Pastein: NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516 ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0

Загрузка данных
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f4510,RegionSize:0x14f9f0,NewProtectWin32:0x4,OldProtect:0x14fa30,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_WRITECOPY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f4000,RegionSize:0x14f9f0,NewProtectWin32:0x8,OldProtect:0x14fa30,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtQueryInformationProcess(ProcessInformationClass:0x24,ProcessInformation:0x14f688,ProcessInformationLength:0x4,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14f578,NewProtectWin32:0x2,OldProtect:0x14f570,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtQueryInformationProcess(ProcessInformationClass:0x24,ProcessInformation:0x7fff007dd230,ProcessInformationLength:0x4,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtQueryInformationProcess(ProcessInformationClass:0x24,ProcessInformation:0x14f518,ProcessInformationLength:0x4,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtQueryInformationProcess(ProcessInformationClass:0x24,ProcessInformation:0x14f570,ProcessInformationLength:0x4,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x400000,RegionSize:0x14f258,FreeType:0x8000,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x10000,RegionSize:0x14f5a8,FreeType:0x8000,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14f578,NewProtectWin32:0x4,OldProtect:0x14f570,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtOpenDirectoryObject(FileName:\KnownDlls,ObjectAttributes:OBJ_CASE_INSENSITIVE,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtOpenDirectoryObject(DirectoryHandle:0x7fff007f1298,DesiredAccess:0x3,ObjectAttributes:\KnownDlls,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14f578,NewProtectWin32:0x2,OldProtect:0x14f570,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14f548,NewProtectWin32:0x4,OldProtect:0x14f540,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14f578,NewProtectWin32:0x2,OldProtect:0x14f570,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14f4d8,NewProtectWin32:0x4,OldProtect:0x14f4d0,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14f4d8,NewProtectWin32:0x2,OldProtect:0x14f4d0,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Users\Jason\Desktop\,FileHandle:0x40,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_TRAVERSE | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE,OpenOptions:FILE_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT,Status:0x0,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtQueryVolumeInformationFile(FileHandle:\Users\Jason\Desktop,IoStatusBlock:0x14f4f8,FsInformation:0x14f4e0,Length:0x8,FsInformationClass:0x4,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff0040a000,RegionSize:0x14f0a0,NewProtectWin32:0x2,OldProtect:0x14f110,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14f098,NewProtectWin32:0x4,OldProtect:0x14f090,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14f098,NewProtectWin32:0x2,OldProtect:0x14f090,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff003d07c0,RegionSize:0x14f0f8,NewProtectWin32:0x4,OldProtect:0x572d68,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b000,RegionSize:0x14ea10,NewProtectWin32:0x2,OldProtect:0x14ea80,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14ea08,NewProtectWin32:0x4,OldProtect:0x14ea00,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14ea08,NewProtectWin32:0x2,OldProtect:0x14ea00,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe4948e8,RegionSize:0x14ea68,NewProtectWin32:0x4,OldProtect:0x573378,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff003d07c0,RegionSize:0x572d50,NewProtectWin32:0x2,OldProtect:0x14efe0,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe4948e8,RegionSize:0x573360,NewProtectWin32:0x2,OldProtect:0x14f0e0,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtCreateSection(SectionHandle:0x14eb40,DesiredAccess:0xf001f,ObjectAttributes:0x0,MaximumSize:0x14eb30,SectionPageProtection:0x4,AllocationAttributes:0x8000000,FileHandle:0x0,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0x8,TokenHandle:0x14ec00,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtOpenDirectoryObject(FileName:\Sessions\1\BaseNamedObjects,ObjectAttributes:OBJ_CASE_INSENSITIVE,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenDirectoryObject(DirectoryHandle:0x14e528,DesiredAccess:0xf,ObjectAttributes:\Sessions\1\BaseNamedObjects,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateMutant(MutantHandle:0x14ec58,DesiredAccess:0x1f0001,ObjectAttributes:Local\SM0:4512:304:WilStaging_02,InitialOwner:0x0,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateSemaphore(SemaphoreHandle:0x14e938,DesiredAccess:0x1f0003,ObjectAttributes:Local\SM0:4512:304:WilStaging_02_p0,InitialCount:0x15d04c,MaximumCount:0x15d04c,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateSemaphore(SemaphoreHandle:0x14e938,DesiredAccess:0x1f0003,ObjectAttributes:Local\SM0:4512:304:WilStaging_02_p0h,InitialCount:0x0,MaximumCount:0x1,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b348,RegionSize:0x14ee50,NewProtectWin32:0x4,OldProtect:0x14ee68,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b000,RegionSize:0x14ee50,NewProtectWin32:0x2,OldProtect:0x14ee68,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b3e0,RegionSize:0x14ee50,NewProtectWin32:0x4,OldProtect:0x14ee68,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b000,RegionSize:0x14ee50,NewProtectWin32:0x2,OldProtect:0x14ee68,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b3a0,RegionSize:0x14ee50,NewProtectWin32:0x4,OldProtect:0x14ee68,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b000,RegionSize:0x14ee50,NewProtectWin32:0x2,OldProtect:0x14ee68,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b408,RegionSize:0x14ee50,NewProtectWin32:0x4,OldProtect:0x14ee68,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b000,RegionSize:0x14ee50,NewProtectWin32:0x2,OldProtect:0x14ee68,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b450,RegionSize:0x14ee50,NewProtectWin32:0x4,OldProtect:0x14ee68,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b000,RegionSize:0x14ee50,NewProtectWin32:0x2,OldProtect:0x14ee68,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b4d0,RegionSize:0x14ee50,NewProtectWin32:0x4,OldProtect:0x14ee68,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b000,RegionSize:0x14ee50,NewProtectWin32:0x2,OldProtect:0x14ee68,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b3c8,RegionSize:0x14ee50,NewProtectWin32:0x4,OldProtect:0x14ee68,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b000,RegionSize:0x14ee50,NewProtectWin32:0x2,OldProtect:0x14ee68,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b468,RegionSize:0x14ee50,NewProtectWin32:0x4,OldProtect:0x14ee68,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b000,RegionSize:0x14ee50,NewProtectWin32:0x2,OldProtect:0x14ee68,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b530,RegionSize:0x14ee50,NewProtectWin32:0x4,OldProtect:0x14ee68,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b000,RegionSize:0x14ee50,NewProtectWin32:0x2,OldProtect:0x14ee68,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b5f0,RegionSize:0x14ee50,NewProtectWin32:0x4,OldProtect:0x14ee68,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b000,RegionSize:0x14ee50,NewProtectWin32:0x2,OldProtect:0x14ee68,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtQueryAttributesFile(FileName:C:\Windows\SYSTEM32\apphelp.dll,ObjectAttributes:OBJ_CASE_INSENSITIVE,CreationTime:1719544790,LastAccessTime:1786262709,LastWriteTime:1719544790,ChangeTime:1719546305,FileAttributes:FILE_ATTRIBUTE_ARCHIVE,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\SYSTEM32\apphelp.dll,FileHandle:0x74,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_DATA | FILE_EXECUTE | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_DELETE,OpenOptions:FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE,Status:0x0,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtCreateSection(SectionHandle:0x14eca8,DesiredAccess:0xd,ObjectAttributes:0x0,MaximumSize:0x0,SectionPageProtection:0x10,AllocationAttributes:0x1000000,FileHandle:\Windows\System32\apphelp.dll,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14eb48,NewProtectWin32:0x4,OldProtect:0x14eb40,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14eb48,NewProtectWin32:0x2,OldProtect:0x14eb40,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefb120cb8,RegionSize:0x14eba8,NewProtectWin32:0x4,OldProtect:0x573038,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefb120cb8,RegionSize:0x573020,NewProtectWin32:0x2,OldProtect:0x14ea90,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14f0b8,NewProtectWin32:0x4,OldProtect:0x14f0b0,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14f0b8,NewProtectWin32:0x2,OldProtect:0x14f0b0,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x8c,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:READ_CONTROL,ShareAccess:FILE_SHARE_READ | FILE_SHARE_DELETE,OpenOptions:empty,Status:0x0,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\SYSTEM32\ntdll.dll,FileHandle:0x8c,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:READ_CONTROL,ShareAccess:FILE_SHARE_READ | FILE_SHARE_DELETE,OpenOptions:empty,Status:0x0,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\System32\KERNEL32.DLL,FileHandle:0x8c,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:READ_CONTROL,ShareAccess:FILE_SHARE_READ | FILE_SHARE_DELETE,OpenOptions:empty,Status:0x0,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\System32\KERNELBASE.dll,FileHandle:0x8c,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:READ_CONTROL,ShareAccess:FILE_SHARE_READ | FILE_SHARE_DELETE,OpenOptions:empty,Status:0x0,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
apphelp.dll->NtCreateFile(FileHandle:0x14eba8,DesiredAccess:0x80100080,ObjectAttributes:\??\C:\Windows\AppPatch\sysmain.sdb,IoStatusBlock:0x14eb50,AllocationSize:0x0,FileAttributes:0x80,ShareAccess:0x5,CreateDisposition:0x1,CreateOptions:0x60,EaBuffer:0x0,EaLength:0x0,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtCreateFile(FileName:C:\Windows\AppPatch\sysmain.sdb,FileHandle:0x8c,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | SYNCHRONIZE | GENERIC_READ,FileAttributes:FILE_ATTRIBUTE_NORMAL,ShareAccess:FILE_SHARE_READ | FILE_SHARE_DELETE,CreateDisposition:FILE_OPEN,CreateOptions:FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE,Status:0x0,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
apphelp.dll->NtQueryInformationFile(FileHandle:\Windows\apppatch\sysmain.sdb,IoStatusBlock:0x14ebe0,FileInformation:0x14ebf0,Length:0x18,FileInformationClass:0x5,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
apphelp.dll->NtQueryInformationFile(FileHandle:\Windows\apppatch\sysmain.sdb,IoStatusBlock:0x14ebc8,FileInformation:0x14ebd8,Length:0x18,FileInformationClass:0x5,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
apphelp.dll->NtCreateSection(SectionHandle:0x14eb80,DesiredAccess:0xf0005,ObjectAttributes:0x14eb98,MaximumSize:0x0,SectionPageProtection:0x2,AllocationAttributes:0x8000000,FileHandle:\Windows\apppatch\sysmain.sdb,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtQueryLicenseValue(Name:TerminalServices-RemoteConnectionManager-AllowAppServerMode,Type:0x14eb50,Buffer:0x14eb40,Length:0x4,ReturnedLength:0x14eb58,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtOpenProcess(DesiredAccess:0x1000,ObjectAttributes:0x14ecf0,ClientID:4512,ClientName:\Device\HarddiskVolume2\Users\Jason\Desktop\CapCutService.exe,PProcessHandle:0x94,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0x8,TokenHandle:0x14ecc0,PProcessHandle:0x94,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
apphelp.dll->NtCreateFile(FileHandle:0x14eb40,DesiredAccess:0x80100080,ObjectAttributes:\??\C:\Users\Jason\Desktop\CapCutService.exe,IoStatusBlock:0x14ea80,AllocationSize:0x0,FileAttributes:0x80,ShareAccess:0x1,CreateDisposition:0x1,CreateOptions:0x60,EaBuffer:0x0,EaLength:0x0,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtCreateFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x98,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | SYNCHRONIZE | GENERIC_READ,FileAttributes:FILE_ATTRIBUTE_NORMAL,ShareAccess:FILE_SHARE_READ,CreateDisposition:FILE_OPEN,CreateOptions:FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE,Status:0x0,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntoskrnl.exe->NtCreateFile(FileHandle:0xffff8289978eee70,DesiredAccess:0x80100080,ObjectAttributes:\SystemRoot\AppPatch\sysmain.sdb,IoStatusBlock:0xffff8289978eedf0,AllocationSize:0x0,FileAttributes:0x80,ShareAccess:0x1,CreateDisposition:0x1,CreateOptions:0x60,EaBuffer:0x0,EaLength:0x0,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtCreateFile(FileName:\SystemRoot\AppPatch\sysmain.sdb,FileHandle:0x80001968,ObjectAttributes:OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | SYNCHRONIZE | GENERIC_READ,FileAttributes:FILE_ATTRIBUTE_NORMAL,ShareAccess:FILE_SHARE_READ,CreateDisposition:FILE_OPEN,CreateOptions:FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE,Status:0x0,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntoskrnl.exe->NtQueryInformationFile(FileHandle:\Windows\apppatch\sysmain.sdb,IoStatusBlock:0xffff8289978eee78,FileInformation:0xffff8289978eee88,Length:0x28,FileInformationClass:0x4,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x80001968,FileName:C:\Windows\apppatch\sysmain.sdb,CreationTime:1719544867,LastAccessTime:1786262709,LastWriteTime:1719544867,ChangeTime:1719545750,FileAttributes:FILE_ATTRIBUTE_ARCHIVE,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntoskrnl.exe->NtQueryInformationFile(FileHandle:\Users\Jason\Desktop\CapCutService.exe,IoStatusBlock:0xffff8289978eeea0,FileInformation:0xffff8289978eef00,Length:0x28,FileInformationClass:0x4,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x800019a0,FileName:C:\Users\Jason\Desktop\CapCutService.exe,CreationTime:1786262696,LastAccessTime:1786262709,LastWriteTime:1786262682,ChangeTime:1786262697,FileAttributes:FILE_ATTRIBUTE_ARCHIVE,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
apphelp.dll->NtCreateFile(FileHandle:0x14eb70,DesiredAccess:0x80100080,ObjectAttributes:\??\C:\Users\Jason\Desktop\CapCutService.exe,IoStatusBlock:0x14eaa0,AllocationSize:0x0,FileAttributes:0x80,ShareAccess:0x1,CreateDisposition:0x1,CreateOptions:0x60,EaBuffer:0x0,EaLength:0x0,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtCreateFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x98,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | SYNCHRONIZE | GENERIC_READ,FileAttributes:FILE_ATTRIBUTE_NORMAL,ShareAccess:FILE_SHARE_READ,CreateDisposition:FILE_OPEN,CreateOptions:FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE,Status:0x0,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntoskrnl.exe->NtQueryInformationFile(FileHandle:\Users\Jason\Desktop\CapCutService.exe,IoStatusBlock:0xffff8289978ef010,FileInformation:0xffff8289978ef070,Length:0x28,FileInformationClass:0x4,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x800019a0,FileName:C:\Users\Jason\Desktop\CapCutService.exe,CreationTime:1786262696,LastAccessTime:1786262709,LastWriteTime:1786262682,ChangeTime:1786262697,FileAttributes:FILE_ATTRIBUTE_ARCHIVE,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenMutant(MutantHandle:0x14eb68,DesiredAccess:0x100000,ObjectAttributes:Local\ShimViewer,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
apphelp.dll->NtUnmapViewOfSection(BaseAddress:0x7ff4fdaa0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
apphelp.dll->NtUnmapViewOfSectionEx(BaseAddress:0x7ff4fdaa0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x1406d0000,RegionSize:0x14f538,NewProtectWin32:0x4,OldProtect:0x14f8c8,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff00252000,RegionSize:0x14ee50,NewProtectWin32:0x2,OldProtect:0x14eec0,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14ee48,NewProtectWin32:0x4,OldProtect:0x14ee40,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14ee48,NewProtectWin32:0x2,OldProtect:0x14ee40,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff0022fd98,RegionSize:0x14eea8,NewProtectWin32:0x4,OldProtect:0x577998,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14e7b8,NewProtectWin32:0x4,OldProtect:0x14e7b0,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14e7b8,NewProtectWin32:0x2,OldProtect:0x14e7b0,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff001a6ee0,RegionSize:0x14e818,NewProtectWin32:0x4,OldProtect:0x577df8,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntoskrnl.exe->NtCreateThreadEx(ThreadHandle:0xffff8289978ef230,DesiredAccess:0x1fffff,ObjectAttributes:0xffff8289978ef248,StartRoutine:0x7fff006bd110,Argument:0x577630,CreateFlags:0x11,ZeroBits:0x0,StackSize:0x1000,MaximumStackSize:0x100000,AttributeList:0xffff8289978ef280,PProcessHandle:0xffffffff800019a0,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntoskrnl.exe->NtCreateThreadEx(ThreadHandle:0xffff82899723f230,DesiredAccess:0x1fffff,ObjectAttributes:0xffff82899723f248,StartRoutine:0x7fff006bd110,Argument:0x577630,CreateFlags:0x11,ZeroBits:0x0,StackSize:0x1000,MaximumStackSize:0x100000,AttributeList:0xffff82899723f280,PProcessHandle:0xffffffff800019a0,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4520
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4520
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff001a6ee0,RegionSize:0x577de0,NewProtectWin32:0x2,OldProtect:0x76fa50,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4520
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffeff4bc000,RegionSize:0x14ee50,NewProtectWin32:0x2,OldProtect:0x14eec0,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14ee48,NewProtectWin32:0x4,OldProtect:0x14ee40,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4520
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff0022fd98,RegionSize:0x577980,NewProtectWin32:0x2,OldProtect:0x76fa50,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4520
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14ee48,NewProtectWin32:0x2,OldProtect:0x14ee40,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffeff36d580,RegionSize:0x14eea8,NewProtectWin32:0x4,OldProtect:0x5797d8,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefdf6a000,RegionSize:0x14e7c0,NewProtectWin32:0x2,OldProtect:0x14e830,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14e7b8,NewProtectWin32:0x4,OldProtect:0x14e7b0,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14e7b8,NewProtectWin32:0x2,OldProtect:0x14e7b0,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefdf26d08,RegionSize:0x14e818,NewProtectWin32:0x4,OldProtect:0x57c9b8,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14e128,NewProtectWin32:0x4,OldProtect:0x14e120,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14e128,NewProtectWin32:0x2,OldProtect:0x14e120,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefde891c8,RegionSize:0x14e188,NewProtectWin32:0x4,OldProtect:0x57d958,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4524
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefde891c8,RegionSize:0x57d940,NewProtectWin32:0x2,OldProtect:0x86fa50,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4524
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4524
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefdf26d08,RegionSize:0x57c9a0,NewProtectWin32:0x2,OldProtect:0x86fa50,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4524
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefea1b000,RegionSize:0x14e7c0,NewProtectWin32:0x2,OldProtect:0x14e830,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14e7b8,NewProtectWin32:0x4,OldProtect:0x14e7b0,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14e7b8,NewProtectWin32:0x2,OldProtect:0x14e7b0,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe9f1c00,RegionSize:0x14e818,NewProtectWin32:0x4,OldProtect:0x57dd28,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14e128,NewProtectWin32:0x4,OldProtect:0x14e120,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14e128,NewProtectWin32:0x2,OldProtect:0x14e120,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefed07000,RegionSize:0x14e130,NewProtectWin32:0x2,OldProtect:0x14e1a0,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14e128,NewProtectWin32:0x4,OldProtect:0x14e120,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14e128,NewProtectWin32:0x2,OldProtect:0x14e120,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefecf02b8,RegionSize:0x14e188,NewProtectWin32:0x4,OldProtect:0x57e768,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe072000,RegionSize:0x14daa0,NewProtectWin32:0x2,OldProtect:0x14db10,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14da98,NewProtectWin32:0x4,OldProtect:0x14da90,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14da98,NewProtectWin32:0x2,OldProtect:0x14da90,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe020eb0,RegionSize:0x14daf8,NewProtectWin32:0x4,OldProtect:0x57ea68,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4520
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe020eb0,RegionSize:0x57ea50,NewProtectWin32:0x2,OldProtect:0x76fa50,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4520
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4520
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefecf02b8,RegionSize:0x57e750,NewProtectWin32:0x2,OldProtect:0x76fa50,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4520
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4520
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe9f1c00,RegionSize:0x57dd10,NewProtectWin32:0x2,OldProtect:0x76fa50,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4520
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4520
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffeff36d580,RegionSize:0x5797c0,NewProtectWin32:0x2,OldProtect:0x76fa50,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4520
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe88c000,RegionSize:0x14ee50,NewProtectWin32:0x2,OldProtect:0x14eec0,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14ee48,NewProtectWin32:0x4,OldProtect:0x14ee40,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14ee48,NewProtectWin32:0x2,OldProtect:0x14ee40,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe85b348,RegionSize:0x14eea8,NewProtectWin32:0x4,OldProtect:0x57ee98,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffeffa7b000,RegionSize:0x14e7c0,NewProtectWin32:0x2,OldProtect:0x14e830,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14e7b8,NewProtectWin32:0x4,OldProtect:0x14e7b0,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14e7b8,NewProtectWin32:0x2,OldProtect:0x14e7b0,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffeffa553d0,RegionSize:0x14e818,NewProtectWin32:0x4,OldProtect:0x57fdf8,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe7cb000,RegionSize:0x14e130,NewProtectWin32:0x2,OldProtect:0x14e1a0,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14e128,NewProtectWin32:0x4,OldProtect:0x14e120,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14e128,NewProtectWin32:0x2,OldProtect:0x14e120,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe79cb00,RegionSize:0x14e188,NewProtectWin32:0x4,OldProtect:0x580138,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4520
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe79cb00,RegionSize:0x580120,NewProtectWin32:0x2,OldProtect:0x76fa50,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4520
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe2a4000,RegionSize:0x14e130,NewProtectWin32:0x2,OldProtect:0x14e1a0,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14e128,NewProtectWin32:0x4,OldProtect:0x14e120,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14e128,NewProtectWin32:0x2,OldProtect:0x14e120,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe29b750,RegionSize:0x14e188,NewProtectWin32:0x4,OldProtect:0x580438,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4520
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe29b750,RegionSize:0x580420,NewProtectWin32:0x2,OldProtect:0x76fa50,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4520
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4520
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffeffa553d0,RegionSize:0x57fde0,NewProtectWin32:0x2,OldProtect:0x76fa50,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4520
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4520
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe85b348,RegionSize:0x57ee80,NewProtectWin32:0x2,OldProtect:0x76fa50,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4520
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffeffff7000,RegionSize:0x14ee50,NewProtectWin32:0x2,OldProtect:0x14eec0,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14ee48,NewProtectWin32:0x4,OldProtect:0x14ee40,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14ee48,NewProtectWin32:0x2,OldProtect:0x14ee40,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefffe5a40,RegionSize:0x14eea8,NewProtectWin32:0x4,OldProtect:0x5815a8,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4524
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefffe5a40,RegionSize:0x581590,NewProtectWin32:0x2,OldProtect:0x86fa50,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4524
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe27a000,RegionSize:0x14ee50,NewProtectWin32:0x2,OldProtect:0x14eec0,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14ee48,NewProtectWin32:0x4,OldProtect:0x14ee40,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14ee48,NewProtectWin32:0x2,OldProtect:0x14ee40,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe23b1a0,RegionSize:0x14eea8,NewProtectWin32:0x4,OldProtect:0x581f98,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4524
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe23b1a0,RegionSize:0x581f80,NewProtectWin32:0x2,OldProtect:0x86fa50,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4524
NtProtectVirtualMemory(NewProtectWin32:PAGE_WRITECOPY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x1406d0000,RegionSize:0x14f8b0,NewProtectWin32:0x8,OldProtect:0x14f420,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\System32\msvcrt.dll,FileHandle:0xa4,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:READ_CONTROL,ShareAccess:FILE_SHARE_READ | FILE_SHARE_DELETE,OpenOptions:empty,Status:0x0,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\System32\SHLWAPI.dll,FileHandle:0xa4,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:READ_CONTROL,ShareAccess:FILE_SHARE_READ | FILE_SHARE_DELETE,OpenOptions:empty,Status:0x0,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\System32\ucrtbase.dll,FileHandle:0xa4,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:READ_CONTROL,ShareAccess:FILE_SHARE_READ | FILE_SHARE_DELETE,OpenOptions:empty,Status:0x0,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\System32\msvcp_win.dll,FileHandle:0xa4,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:READ_CONTROL,ShareAccess:FILE_SHARE_READ | FILE_SHARE_DELETE,OpenOptions:empty,Status:0x0,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\System32\win32u.dll,FileHandle:0xa4,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:READ_CONTROL,ShareAccess:FILE_SHARE_READ | FILE_SHARE_DELETE,OpenOptions:empty,Status:0x0,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\System32\gdi32full.dll,FileHandle:0xa4,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:READ_CONTROL,ShareAccess:FILE_SHARE_READ | FILE_SHARE_DELETE,OpenOptions:empty,Status:0x0,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\System32\GDI32.dll,FileHandle:0xa4,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:READ_CONTROL,ShareAccess:FILE_SHARE_READ | FILE_SHARE_DELETE,OpenOptions:empty,Status:0x0,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\System32\USER32.dll,FileHandle:0xa4,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:READ_CONTROL,ShareAccess:FILE_SHARE_READ | FILE_SHARE_DELETE,OpenOptions:empty,Status:0x0,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\System32\SHELL32.dll,FileHandle:0xa4,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:READ_CONTROL,ShareAccess:FILE_SHARE_READ | FILE_SHARE_DELETE,OpenOptions:empty,Status:0x0,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\System32\RPCRT4.dll,FileHandle:0xa4,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:READ_CONTROL,ShareAccess:FILE_SHARE_READ | FILE_SHARE_DELETE,OpenOptions:empty,Status:0x0,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\System32\bcrypt.dll,FileHandle:0xa4,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:READ_CONTROL,ShareAccess:FILE_SHARE_READ | FILE_SHARE_DELETE,OpenOptions:empty,Status:0x0,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\System32\sechost.dll,FileHandle:0xa4,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:READ_CONTROL,ShareAccess:FILE_SHARE_READ | FILE_SHARE_DELETE,OpenOptions:empty,Status:0x0,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\System32\ADVAPI32.dll,FileHandle:0xa4,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:READ_CONTROL,ShareAccess:FILE_SHARE_READ | FILE_SHARE_DELETE,OpenOptions:empty,Status:0x0,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\System32\WS2_32.dll,FileHandle:0xa4,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:READ_CONTROL,ShareAccess:FILE_SHARE_READ | FILE_SHARE_DELETE,OpenOptions:empty,Status:0x0,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\System32\CRYPT32.dll,FileHandle:0xa4,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:READ_CONTROL,ShareAccess:FILE_SHARE_READ | FILE_SHARE_DELETE,OpenOptions:empty,Status:0x0,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x4d0000,RegionSize:0x14ef38,FreeType:0x8000,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x34,ProcessInformation:0x14f2a0,ProcessInformationLength:0x8,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14eb08,NewProtectWin32:0x4,OldProtect:0x14eb00,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14eb08,NewProtectWin32:0x2,OldProtect:0x14eb00,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtQueryAttributesFile(FileName:C:\Windows\system32\IMM32.DLL,ObjectAttributes:OBJ_CASE_INSENSITIVE,CreationTime:1719544811,LastAccessTime:1786262708,LastWriteTime:1719544811,ChangeTime:1719546166,FileAttributes:FILE_ATTRIBUTE_ARCHIVE,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\system32\IMM32.DLL,FileHandle:0xc4,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_DATA | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_DELETE,OpenOptions:FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE,Status:0x0,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtCreateSection(SectionHandle:0x14e3d0,DesiredAccess:0x4,ObjectAttributes:0x0,MaximumSize:0x0,SectionPageProtection:0x2,AllocationAttributes:0x8000000,FileHandle:\Windows\System32\imm32.dll,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtUnmapViewOfSection(BaseAddress:0x1c0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1c0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff00628000,RegionSize:0x14e3c0,NewProtectWin32:0x2,OldProtect:0x14e430,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14e3b8,NewProtectWin32:0x4,OldProtect:0x14e3b0,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14e3b8,NewProtectWin32:0x2,OldProtect:0x14e3b0,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff0061f1c8,RegionSize:0x14e418,NewProtectWin32:0x4,OldProtect:0x582908,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff0061f1c8,RegionSize:0x5828f0,NewProtectWin32:0x2,OldProtect:0x14e300,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\System32\IMM32.DLL,FileHandle:0xc4,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:READ_CONTROL,ShareAccess:FILE_SHARE_READ | FILE_SHARE_DELETE,OpenOptions:empty,Status:0x0,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x34,ProcessInformation:0x14e280,ProcessInformationLength:0x8,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x34,ProcessInformation:0x14eb60,ProcessInformationLength:0x8,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntoskrnl.exe->NtQueryInformationProcess(ProcessInformationClass:0x4b,ProcessInformation:0xffff8289978eef60,ProcessInformationLength:0x4,ReturnLength:0x0,PProcessHandle:0xffffffff80001968,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntoskrnl.exe->NtQueryInformationProcess(ProcessInformationClass:0x40,ProcessInformation:0xffff8289978eef80,ProcessInformationLength:0x60,ReturnLength:0x0,PProcessHandle:0xffffffff80001968,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntoskrnl.exe->NtFreeVirtualMemory(*BaseAddress:0x1c0000,RegionSize:0xffff8289978ee9e8,FreeType:0x8000,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntoskrnl.exe->NtDuplicateObject(SourceProcessHandle:0xffffffffffffffff,SourceHandle:0xdc,TargetProcessHandle:0xffffffffffffffff,TargetHandle:0xffff8289978eece8,DesiredAccess:0x0,HandleAttributes:0x0,Options:0x2,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefed073c0,RegionSize:0x14e150,NewProtectWin32:0x4,OldProtect:0x14e168,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefed07000,RegionSize:0x14e150,NewProtectWin32:0x2,OldProtect:0x14e168,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefed07048,RegionSize:0x14e120,NewProtectWin32:0x4,OldProtect:0x14e138,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefed07000,RegionSize:0x14e120,NewProtectWin32:0x2,OldProtect:0x14e138,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0xa,TokenHandle:0x14e760,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtDuplicateToken(ExistingTokenHandle:0xe8,DesiredAccess:0xc,ObjectAttributes:0x14e630,EffectiveOnly:0x0,TokenType:0x2,NewTokenHandle:0x14e758,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x34,ProcessInformation:0x14e790,ProcessInformationLength:0x8,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtCreateSemaphore(SemaphoreHandle:0x14f108,DesiredAccess:0x100003,ObjectAttributes:0x0,InitialCount:0x0,MaximumCount:0x7fffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtCreateSemaphore(SemaphoreHandle:0x14f118,DesiredAccess:0x100003,ObjectAttributes:0x0,InitialCount:0x0,MaximumCount:0x7fffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
bcrypt.dll->NtQueryInformationProcess(ProcessInformationClass:0x56,ProcessInformation:0x14eb70,ProcessInformationLength:0xb0,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
bcrypt.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x14eaf0,ProcessInformationLength:0x40,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtCreateSemaphore(SemaphoreHandle:0x14eaa8,DesiredAccess:0x100003,ObjectAttributes:0x0,InitialCount:0x0,MaximumCount:0x7fffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtCreateSemaphore(SemaphoreHandle:0x14eab8,DesiredAccess:0x100003,ObjectAttributes:0x0,InitialCount:0x0,MaximumCount:0x7fffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:\Device\KsecDD,FileHandle:0x10c,ObjectAttributes:Attributes=0,IoStatusBlock:0,DesiredAccess:FILE_READ_DATA | FILE_WRITE_DATA | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_SYNCHRONOUS_IO_NONALERT,Status:0x0,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:TitanHide,FileHandle:0x14f838,ObjectAttributes:Attributes=0,IoStatusBlock:None,DesiredAccess:FILE_READ_ATTRIBUTES | SYNCHRONIZE | GENERIC_WRITE | GENERIC_READ,ShareAccess:empty,OpenOptions:FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE,Status:0xc0000034,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtQueryInformationProcess(ProcessInformationClass:0x7,ProcessInformation:0x14f4d8,ProcessInformationLength:0x8,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtQueryInformationProcess(ProcessInformationClass:0x1e,ProcessInformation:0x14f4d8,ProcessInformationLength:0x8,ReturnLength:0x14f4d8,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtQueryInformationProcess(ProcessInformationClass:0x1e,ProcessInformation:0x14f4d8,ProcessInformationLength:0x8,ReturnLength:0x1,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtQueryInformationProcess(ProcessInformationClass:0x1e,ProcessInformation:0x14f991,ProcessInformationLength:0x8,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtQueryInformationProcess(ProcessInformationClass:0x1e,ProcessInformation:0x14f4d8,ProcessInformationLength:0x0,ReturnLength:0x1,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtCreateDebugObject(DebugObjectHandle:0x14f5b8,DesiredAccess:0x8,ObjectAttributes:0x14f8e8,Flags:0x0,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtQueryObject(Handle:0x15c,ObjectInformationClass:0x2,ObjectInformation:0x0,ObjectInformationLength:0x0,ReturnLength:0x14f518,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtQueryObject(Handle:0x15c,ObjectInformationClass:0x2,ObjectInformation:0x57db70,ObjectInformationLength:0x80,ReturnLength:0x0,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtQueryObject(Handle:0x15c,ObjectInformationClass:0x2,ObjectInformation:0x57db70,ObjectInformationLength:0x80,ReturnLength:0x57db78,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtQueryInformationProcess(ProcessInformationClass:0x7,ProcessInformation:0x14f848,ProcessInformationLength:0x8,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x15c,ObjectAttributes:Attributes=0,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | SYNCHRONIZE | GENERIC_READ,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE,OpenOptions:FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE,Status:0x0,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtCreateSection(SectionHandle:0x14f6f8,DesiredAccess:0x4,ObjectAttributes:0x14f790,MaximumSize:0x0,SectionPageProtection:0x2,AllocationAttributes:0x8000000,FileHandle:\Users\Jason\Desktop\CapCutService.exe,timestamp:1786262710.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtUnmapViewOfSection(BaseAddress:0x2010000,PProcessHandle:0xffffffffffffffff,timestamp:1786262711.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtUnmapViewOfSectionEx(BaseAddress:0x2010000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262711.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_EXECUTE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262711.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x140001000,RegionSize:0x14f7f8,NewProtectWin32:0x40,OldProtect:0x14f638,PProcessHandle:0xffffffffffffffff,timestamp:1786262711.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262711.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x1402ce000,RegionSize:0x14f7f8,NewProtectWin32:0x4,OldProtect:0x14f638,PProcessHandle:0xffffffffffffffff,timestamp:1786262711.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262711.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x1403f1000,RegionSize:0x14f7f8,NewProtectWin32:0x4,OldProtect:0x14f638,PProcessHandle:0xffffffffffffffff,timestamp:1786262711.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262711.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x140419000,RegionSize:0x14f7f8,NewProtectWin32:0x4,OldProtect:0x14f638,PProcessHandle:0xffffffffffffffff,timestamp:1786262711.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_EXECUTE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262711.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x14041b000,RegionSize:0x14f7f8,NewProtectWin32:0x40,OldProtect:0x14f638,PProcessHandle:0xffffffffffffffff,timestamp:1786262711.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262711.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x140452000,RegionSize:0x14f7f8,NewProtectWin32:0x4,OldProtect:0x14f638,PProcessHandle:0xffffffffffffffff,timestamp:1786262711.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x14fc10,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x1c0000,RegionSize:0x14ed68,FreeType:0x8000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->GetCommandLineA(CalledFrom:0x7fff00370150,ReturnValue:0x1,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->GetCommandLineA(CalledFrom:0x14043bc9f,ReturnValue:0x5736b0,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtFreeVirtualMemory(*BaseAddress:0x1d0000,RegionSize:0x14ed28,FreeType:0x8000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtCreateSection(SectionHandle:0x14ee18,DesiredAccess:0xf0007,ObjectAttributes:0x0,MaximumSize:0x14ecd0,SectionPageProtection:0x4,AllocationAttributes:0x8000000,FileHandle:0x0,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtFreeVirtualMemory(*BaseAddress:0x4d0000,RegionSize:0x14ee68,FreeType:0x8000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262717.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenThread(ThreadHandle:0x14eea8,DesiredAccess:0x2,ObjectAttributes:0x14ee50,ClientId:0x14ee40,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenThread(ThreadHandle:0x160,DesiredAccess:0x2,ObjectAttributes:0x14ee50,ClientID:4512,ClientName:\Device\HarddiskVolume2\Users\Jason\Desktop\CapCutService.exe,UniqueThread:4520,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenThread(ThreadHandle:0x14eea8,DesiredAccess:0x2,ObjectAttributes:0x14ee50,ClientId:0x14ee40,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenThread(ThreadHandle:0x164,DesiredAccess:0x2,ObjectAttributes:0x14ee50,ClientID:4512,ClientName:\Device\HarddiskVolume2\Users\Jason\Desktop\CapCutService.exe,UniqueThread:4524,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSuspendThread(ThreadHandle:0x160,PreviousSuspendCount:0x14ef08,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSuspendThread(ThreadHandle:0x164,PreviousSuspendCount:0x14ef08,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x25,ProcessInformation:0x14ec90,ProcessInformationLength:0x40,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtWriteVirtualMemory(BaseAddress:0x7fff00870008,Buffer:0x14ee28,BufferSize:0x5,NumberOfBytesWritten:0x14ece8,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtWriteVirtualMemory(BaseAddress:0x7fff00870015,Buffer:0x14ee28,BufferSize:0x6,NumberOfBytesWritten:0x14ece8,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_EXECUTE_WRITECOPY;0x20000000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff0070d000,RegionSize:0x14ecd8,NewProtectWin32:0x20000080,OldProtect:0x14ecc8,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtWriteVirtualMemory(BaseAddress:0x7fff0070df50,Buffer:0x14ee28,BufferSize:0x5,NumberOfBytesWritten:0x14ece8,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_EXECUTE_READ;0x20000000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff0070d000,RegionSize:0x14ecd8,NewProtectWin32:0x20000020,OldProtect:0x14ecc8,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_EXECUTE_READ,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff00870000,RegionSize:0x14ed70,NewProtectWin32:0x20,OldProtect:0x14ee20,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtWriteVirtualMemory(BaseAddress:0x7fff0088000d,Buffer:0x14ee28,BufferSize:0x5,NumberOfBytesWritten:0x14ece8,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtWriteVirtualMemory(BaseAddress:0x7fff0088001f,Buffer:0x14ee28,BufferSize:0x6,NumberOfBytesWritten:0x14ece8,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_EXECUTE_WRITECOPY;0x20000000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff0073c000,RegionSize:0x14ecd8,NewProtectWin32:0x20000080,OldProtect:0x14ecc8,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtWriteVirtualMemory(BaseAddress:0x7fff0073cab0,Buffer:0x14ee28,BufferSize:0x5,NumberOfBytesWritten:0x14ece8,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_EXECUTE_READ;0x20000000,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff0073c000,RegionSize:0x14ecd8,NewProtectWin32:0x20000020,OldProtect:0x14ecc8,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_EXECUTE_READ,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff00880000,RegionSize:0x14ed70,NewProtectWin32:0x20,OldProtect:0x14ee20,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_EXECUTE_READ,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x140001000,RegionSize:0x14f870,NewProtectWin32:0x20,OldProtect:0x14f628,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x1402ce000,RegionSize:0x14f870,NewProtectWin32:0x2,OldProtect:0x14f628,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x1403f1000,RegionSize:0x14f870,NewProtectWin32:0x2,OldProtect:0x14f628,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x140419000,RegionSize:0x14f870,NewProtectWin32:0x2,OldProtect:0x14f628,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_EXECUTE_READ,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x14041b000,RegionSize:0x14f870,NewProtectWin32:0x20,OldProtect:0x14f628,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x140452000,RegionSize:0x14f870,NewProtectWin32:0x4,OldProtect:0x14f628,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x14041a000,RegionSize:0x14fe60,NewProtectWin32:0x2,OldProtect:0x14fe90,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x14041a000,RegionSize:0x14fde0,NewProtectWin32:0x4,OldProtect:0x14fe40,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x14041a000,RegionSize:0x14fde0,NewProtectWin32:0x2,OldProtect:0x14fe40,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->GetCommandLineA(CalledFrom:0x7fff00370150,ReturnValue:0x1402bcafc,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->GetCommandLineA(CalledFrom:0x1402bcb06,ReturnValue:0x5736b0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x14041a000,RegionSize:0x14f000,NewProtectWin32:0x4,OldProtect:0x14f060,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x14041a000,RegionSize:0x14f000,NewProtectWin32:0x2,OldProtect:0x14f060,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x14041a000,RegionSize:0x14fb00,NewProtectWin32:0x4,OldProtect:0x14fb60,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x14041a000,RegionSize:0x14fb00,NewProtectWin32:0x2,OldProtect:0x14fb60,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->WSAStartup(0x2,0x14fd10,CalledFrom:0x7ffefffaeb10,ReturnValue:0x140001000,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0x8,TokenHandle:0x14f8c0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0x8,TokenHandle:0x14fa30,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x34,ProcessInformation:0x14f9a0,ProcessInformationLength:0x8,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x25,ProcessInformation:0x14fa30,ProcessInformationLength:0x40,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtDuplicateObject(SourceProcessHandle:0xffffffffffffffff,SourceHandle:0xfffffffffffffffe,TargetProcessHandle:0xffffffffffffffff,TargetHandle:0x577d80,DesiredAccess:0x0,HandleAttributes:0x0,Options:0x2,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->WSAStartup(0x2,0x14fd10,CalledFrom:0x140001017,ReturnValue:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateSemaphore(SemaphoreHandle:0x14faf8,DesiredAccess:0x1f0003,ObjectAttributes:0x0,InitialCount:0x0,MaximumCount:0x7fffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateSemaphore(SemaphoreHandle:0x14faf8,DesiredAccess:0x1f0003,ObjectAttributes:0x0,InitialCount:0x0,MaximumCount:0x7fffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateSemaphore(SemaphoreHandle:0x14faf8,DesiredAccess:0x1f0003,ObjectAttributes:0x0,InitialCount:0x0,MaximumCount:0x7fffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateSemaphore(SemaphoreHandle:0x14faf8,DesiredAccess:0x1f0003,ObjectAttributes:0x0,InitialCount:0x0,MaximumCount:0x7fffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateSemaphore(SemaphoreHandle:0x14fb98,DesiredAccess:0x1f0003,ObjectAttributes:0x0,InitialCount:0x0,MaximumCount:0x7fffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateSemaphore(SemaphoreHandle:0x14fb98,DesiredAccess:0x1f0003,ObjectAttributes:0x0,InitialCount:0x0,MaximumCount:0x7fffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateFile(FileHandle:0x14f850,DesiredAccess:0x80100080,ObjectAttributes:\??\D:\openssl-static\ssl\openssl.cnf,IoStatusBlock:0x14f858,AllocationSize:0x0,FileAttributes:0x80,ShareAccess:0x3,CreateDisposition:0x1,CreateOptions:0x60,EaBuffer:0x0,EaLength:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtCreateFile(FileName:D:\openssl-static\ssl\openssl.cnf,FileHandle:0x8,ObjectAttributes:OBJ_INHERIT | OBJ_CASE_INSENSITIVE,IoStatusBlock:None,DesiredAccess:FILE_READ_ATTRIBUTES | SYNCHRONIZE | GENERIC_READ,FileAttributes:FILE_ATTRIBUTE_NORMAL,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE,CreateDisposition:FILE_OPEN,CreateOptions:FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE,Status:0xc0000013,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->WSAStartup(0x2,0x14fd10,CalledFrom:0x7ffefffaeb10,ReturnValue:0x140001060,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->WSAStartup(0x2,0x14fd10,CalledFrom:0x140001077,ReturnValue:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->WSAStartup(0x2,0x14fd10,CalledFrom:0x7ffefffaeb10,ReturnValue:0x1400010c0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->WSAStartup(0x2,0x14fd10,CalledFrom:0x1400010d7,ReturnValue:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->WSAStartup(0x2,0x14fd10,CalledFrom:0x7ffefffaeb10,ReturnValue:0x140001120,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->WSAStartup(0x2,0x14fd10,CalledFrom:0x140001137,ReturnValue:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->WSAStartup(0x2,0x14fd10,CalledFrom:0x7ffefffaeb10,ReturnValue:0x140001180,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->WSAStartup(0x2,0x14fd10,CalledFrom:0x140001197,ReturnValue:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtDuplicateToken(ExistingTokenHandle:0x188,DesiredAccess:0xc,ObjectAttributes:0x14fb58,EffectiveOnly:0x0,TokenType:0x2,NewTokenHandle:0x14fb10,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0x28,TokenHandle:0x14fd90,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffefe84b188,0x82,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x14fc40,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenDirectoryObject(FileName:\RPC Control,ObjectAttributes:Attributes=0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NtOpenDirectoryObject(DirectoryHandle:0x14f1f0,DesiredAccess:0x20001,ObjectAttributes:\RPC Control,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0x8,TokenHandle:0x14f1f8,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x1,ProcessInformation:0x14f118,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x3,ProcessInformation:0x14f150,ProcessInformationLength:0x58,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtDuplicateObject(SourceProcessHandle:0xffffffffffffffff,SourceHandle:0xfffffffffffffffe,TargetProcessHandle:0xffffffffffffffff,TargetHandle:0x57fce8,DesiredAccess:0x0,HandleAttributes:0x0,Options:0x2,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14f590,CalledFrom:0x7ffefe6f0090,ReturnValue:0x58,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14f590,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffefe84b188,0x1f,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x14fca0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14f670,CalledFrom:0x7ffefe6f0090,ReturnValue:0x66,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14f670,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffefe84b188,0x0,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14f680,CalledFrom:0x7ffefe6f0090,ReturnValue:0x14,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14f680,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtAdjustPrivilegesToken(ProcessHandle:396,NewState:[{'SE_SECURITY_PRIVILEGE': 'SE_PRIVILEGE_ENABLED'}],timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtAdjustPrivilegesToken(TokenHandle:0x18c,DisableAllPrivileges:0x0,BufferLength:0x10,PreviousState:0x0,ReturnLength:0x0,SNewState:0x14fd70,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffefe84b188,0x82,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x14fc40,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14f590,CalledFrom:0x7ffefe6f0090,ReturnValue:0x58,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14f590,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffefe84b188,0x1f,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x14fca0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14f670,CalledFrom:0x7ffefe6f0090,ReturnValue:0x70,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14f670,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffefe84b188,0x0,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14f680,CalledFrom:0x7ffefe6f0090,ReturnValue:0x14,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14f680,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtAdjustPrivilegesToken(ProcessHandle:396,NewState:[{'SE_TAKE_OWNERSHIP_PRIVILEGE': 'SE_PRIVILEGE_ENABLED'}],timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtAdjustPrivilegesToken(TokenHandle:0x18c,DisableAllPrivileges:0x0,BufferLength:0x10,PreviousState:0x0,ReturnLength:0x0,SNewState:0x14fd70,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffefe84b188,0x82,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x14fc40,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14f590,CalledFrom:0x7ffefe6f0090,ReturnValue:0x58,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14f590,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffefe84b188,0x1f,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x14fca0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14f670,CalledFrom:0x7ffefe6f0090,ReturnValue:0x62,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14f670,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffefe84b188,0x0,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14f680,CalledFrom:0x7ffefe6f0090,ReturnValue:0x14,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14f680,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtAdjustPrivilegesToken(ProcessHandle:396,NewState:[{'SE_BACKUP_PRIVILEGE': 'SE_PRIVILEGE_ENABLED'}],timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtAdjustPrivilegesToken(TokenHandle:0x18c,DisableAllPrivileges:0x0,BufferLength:0x10,PreviousState:0x0,ReturnLength:0x0,SNewState:0x14fd70,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffefe84b188,0x82,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x14fc40,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14f590,CalledFrom:0x7ffefe6f0090,ReturnValue:0x58,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14f590,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffefe84b188,0x1f,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x14fca0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14f670,CalledFrom:0x7ffefe6f0090,ReturnValue:0x64,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14f670,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffefe84b188,0x0,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14f680,CalledFrom:0x7ffefe6f0090,ReturnValue:0x14,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14f680,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtAdjustPrivilegesToken(ProcessHandle:396,NewState:[{'SE_RESTORE_PRIVILEGE': 'SE_PRIVILEGE_ENABLED'}],timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtAdjustPrivilegesToken(TokenHandle:0x18c,DisableAllPrivileges:0x0,BufferLength:0x10,PreviousState:0x0,ReturnLength:0x0,SNewState:0x14fd70,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtQueryAttributesFile(FileName:C:\Windows\SYSTEM32\ntmarta.dll,ObjectAttributes:OBJ_CASE_INSENSITIVE,CreationTime:1719544803,LastAccessTime:1786262717,LastWriteTime:1719544803,ChangeTime:1719546173,FileAttributes:FILE_ATTRIBUTE_ARCHIVE,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\SYSTEM32\ntmarta.dll,FileHandle:0x18c,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_DATA | FILE_EXECUTE | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_DELETE,OpenOptions:FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtCreateSection(SectionHandle:0x14eee8,DesiredAccess:0xd,ObjectAttributes:0x0,MaximumSize:0x0,SectionPageProtection:0x10,AllocationAttributes:0x1000000,FileHandle:\Windows\System32\ntmarta.dll,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefce50000,RegionSize:0x14ed90,NewProtectWin32:0x2,OldProtect:0x14ee00,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14ed88,NewProtectWin32:0x4,OldProtect:0x14ed80,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14ed88,NewProtectWin32:0x2,OldProtect:0x14ed80,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefce448e0,RegionSize:0x14ede8,NewProtectWin32:0x4,OldProtect:0x58dcf8,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefce448e0,RegionSize:0x58dce0,NewProtectWin32:0x2,OldProtect:0x14eff0,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtCreateSemaphore(SemaphoreHandle:0x14ed58,DesiredAccess:0x100003,ObjectAttributes:0x0,InitialCount:0x0,MaximumCount:0x7fffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtCreateSemaphore(SemaphoreHandle:0x14ed68,DesiredAccess:0x100003,ObjectAttributes:0x0,InitialCount:0x0,MaximumCount:0x7fffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtCreateSemaphore(SemaphoreHandle:0x14ed58,DesiredAccess:0x100003,ObjectAttributes:0x0,InitialCount:0x0,MaximumCount:0x7fffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtCreateSemaphore(SemaphoreHandle:0x14ed68,DesiredAccess:0x100003,ObjectAttributes:0x0,InitialCount:0x0,MaximumCount:0x7fffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtCreateSemaphore(SemaphoreHandle:0x14ed18,DesiredAccess:0x100003,ObjectAttributes:0x0,InitialCount:0x0,MaximumCount:0x7fffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtCreateSemaphore(SemaphoreHandle:0x14ed28,DesiredAccess:0x100003,ObjectAttributes:0x0,InitialCount:0x0,MaximumCount:0x7fffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtCreateSemaphore(SemaphoreHandle:0x14ed18,DesiredAccess:0x100003,ObjectAttributes:0x0,InitialCount:0x0,MaximumCount:0x7fffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtCreateSemaphore(SemaphoreHandle:0x14ed28,DesiredAccess:0x100003,ObjectAttributes:0x0,InitialCount:0x0,MaximumCount:0x7fffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefe88c3c8,RegionSize:0x14f630,NewProtectWin32:0x4,OldProtect:0x14f648,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefe88c000,RegionSize:0x14f630,NewProtectWin32:0x2,OldProtect:0x14f648,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch,FileHandle:0x1dc,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch,IoStatusBlock:0x14fa50,FileInformation:0x14fab0,Length:0x74,FileInformationClass:0x37,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch,FileHandle:0x1dc,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch,IoStatusBlock:0x14fab0,FileInformation:0x14fac0,Length:0x28,FileInformationClass:0x4,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1dc,FileName:C:\Windows\Prefetch,CreationTime:1719534317,LastAccessTime:1786262709,LastWriteTime:1786262709,ChangeTime:1786262709,FileAttributes:FILE_ATTRIBUTE_DIRECTORY | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0xa,TokenHandle:0x14fb48,PProcessHandle:0xffffffffffffffff,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryObject(Handle:0x1dc,ObjectInformationClass:0x1,ObjectInformation:0x14f650,ObjectInformationLength:0x410,ReturnLength:0x14f640,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\,FileHandle:0x1e4,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:READ_CONTROL,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows,IoStatusBlock:0x14f9e0,FileInformation:0x14fa40,Length:0x74,FileInformationClass:0x37,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch,IoStatusBlock:0x14f9e0,FileInformation:0x14fa40,Length:0x74,FileInformationClass:0x37,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\,FileHandle:0x1e4,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_LIST_DIRECTORY | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE,OpenOptions:FILE_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT | FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryVolumeInformationFile(FileHandle:\Windows\Prefetch,IoStatusBlock:0x14f9e0,FsInformation:0x14fa78,Length:0x8,FsInformationClass:0x4,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\7Z2407-X64.EXE-0C9696D4.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\7Z2407-X64.EXE-0C9696D4.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\7Z2407-X64.EXE-0C9696D4.pf,CreationTime:1719571800,LastAccessTime:1748390593,LastWriteTime:1719571800,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\7Z2407-X64.EXE-0C9696D4.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\7ZG.EXE-0F8C4081.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\7ZG.EXE-0F8C4081.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\7ZG.EXE-0F8C4081.pf,CreationTime:1719574088,LastAccessTime:1748390593,LastWriteTime:1720217970,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\7ZG.EXE-0F8C4081.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\ACROBAT.EXE-A488359C.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\ACROBAT.EXE-A488359C.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\ACROBAT.EXE-A488359C.pf,CreationTime:1719572379,LastAccessTime:1748993171,LastWriteTime:1737763755,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\ACROBAT.EXE-A488359C.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\APPLICATIONFRAMEHOST.EXE-CCEEF759.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\APPLICATIONFRAMEHOST.EXE-CCEEF759.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\APPLICATIONFRAMEHOST.EXE-CCEEF759.pf,CreationTime:1719546524,LastAccessTime:1748993171,LastWriteTime:1737068497,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\APPLICATIONFRAMEHOST.EXE-CCEEF759.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\BACKGROUNDTASKHOST.EXE-D61F7B44.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\BACKGROUNDTASKHOST.EXE-D61F7B44.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\BACKGROUNDTASKHOST.EXE-D61F7B44.pf,CreationTime:1719546453,LastAccessTime:1772712060,LastWriteTime:1772712060,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\BACKGROUNDTASKHOST.EXE-D61F7B44.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\cadrespri.7db,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\cadrespri.7db,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\cadrespri.7db,CreationTime:1719537374,LastAccessTime:1772712226,LastWriteTime:1748390605,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\cadrespri.7db,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\CALCULATORAPP.EXE-3747E669.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\CALCULATORAPP.EXE-3747E669.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\CALCULATORAPP.EXE-3747E669.pf,CreationTime:1719956147,LastAccessTime:1748390593,LastWriteTime:1719956382,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\CALCULATORAPP.EXE-3747E669.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\CHROME.EXE-5A1054AF.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\CHROME.EXE-5A1054AF.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\CHROME.EXE-5A1054AF.pf,CreationTime:1719571771,LastAccessTime:1786262707,LastWriteTime:1786262707,ChangeTime:1786262707,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\CHROME.EXE-5A1054AF.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\CHROME.EXE-5A1054B0.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\CHROME.EXE-5A1054B0.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\CHROME.EXE-5A1054B0.pf,CreationTime:1719571773,LastAccessTime:1786262715,LastWriteTime:1786262715,ChangeTime:1786262715,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\CHROME.EXE-5A1054B0.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\CHROME.EXE-5A1054B1.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\CHROME.EXE-5A1054B1.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\CHROME.EXE-5A1054B1.pf,CreationTime:1719609278,LastAccessTime:1786262715,LastWriteTime:1786262715,ChangeTime:1786262715,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\CHROME.EXE-5A1054B1.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\CHROME.EXE-5A1054B2.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\CHROME.EXE-5A1054B2.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\CHROME.EXE-5A1054B2.pf,CreationTime:1719609278,LastAccessTime:1748390594,LastWriteTime:1748377364,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\CHROME.EXE-5A1054B2.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\CHROME.EXE-5A1054B3.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\CHROME.EXE-5A1054B3.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\CHROME.EXE-5A1054B3.pf,CreationTime:1719609276,LastAccessTime:1748390594,LastWriteTime:1748377357,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\CHROME.EXE-5A1054B3.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\CHROME.EXE-5A1054B7.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\CHROME.EXE-5A1054B7.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\CHROME.EXE-5A1054B7.pf,CreationTime:1719571773,LastAccessTime:1786262715,LastWriteTime:1786262715,ChangeTime:1786262715,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\CHROME.EXE-5A1054B7.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\CHROMESETUP.EXE-A1584126.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\CHROMESETUP.EXE-A1584126.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\CHROMESETUP.EXE-A1584126.pf,CreationTime:1719571742,LastAccessTime:1748390594,LastWriteTime:1719571744,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\CHROMESETUP.EXE-A1584126.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\CMD.EXE-4A81B364.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\CMD.EXE-4A81B364.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\CMD.EXE-4A81B364.pf,CreationTime:1719543776,LastAccessTime:1786262708,LastWriteTime:1786262708,ChangeTime:1786262708,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\CMD.EXE-4A81B364.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\CONHOST.EXE-1F3E9D7E.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\CONHOST.EXE-1F3E9D7E.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\CONHOST.EXE-1F3E9D7E.pf,CreationTime:1719534943,LastAccessTime:1786262701,LastWriteTime:1786262701,ChangeTime:1786262701,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\CONHOST.EXE-1F3E9D7E.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\CONSENT.EXE-531BD9EA.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\CONSENT.EXE-531BD9EA.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\CONSENT.EXE-531BD9EA.pf,CreationTime:1719536139,LastAccessTime:1748993171,LastWriteTime:1748993171,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\CONSENT.EXE-531BD9EA.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\CREDENTIALUIBROKER.EXE-2FE21806.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\CREDENTIALUIBROKER.EXE-2FE21806.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\CREDENTIALUIBROKER.EXE-2FE21806.pf,CreationTime:1719535445,LastAccessTime:1748390594,LastWriteTime:1719535445,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\CREDENTIALUIBROKER.EXE-2FE21806.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\CSC.EXE-67679278.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\CSC.EXE-67679278.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\CSC.EXE-67679278.pf,CreationTime:1772712130,LastAccessTime:1772712130,LastWriteTime:1772712130,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\CSC.EXE-67679278.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\CTFMON.EXE-9450846B.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\CTFMON.EXE-9450846B.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\CTFMON.EXE-9450846B.pf,CreationTime:1721771651,LastAccessTime:1748390904,LastWriteTime:1748390904,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\CTFMON.EXE-9450846B.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\CVTRES.EXE-F2B7602E.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\CVTRES.EXE-F2B7602E.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\CVTRES.EXE-F2B7602E.pf,CreationTime:1772712130,LastAccessTime:1772712130,LastWriteTime:1772712130,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\CVTRES.EXE-F2B7602E.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\DLLHOST.EXE-0F564EEF.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\DLLHOST.EXE-0F564EEF.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\DLLHOST.EXE-0F564EEF.pf,CreationTime:1719574350,LastAccessTime:1748390594,LastWriteTime:1719611223,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\DLLHOST.EXE-0F564EEF.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\DLLHOST.EXE-28A8211F.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\DLLHOST.EXE-28A8211F.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\DLLHOST.EXE-28A8211F.pf,CreationTime:1719536157,LastAccessTime:1748993174,LastWriteTime:1748993174,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\DLLHOST.EXE-28A8211F.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\DLLHOST.EXE-504C779A.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\DLLHOST.EXE-504C779A.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\DLLHOST.EXE-504C779A.pf,CreationTime:1719535116,LastAccessTime:1772712146,LastWriteTime:1772712146,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\DLLHOST.EXE-504C779A.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\DLLHOST.EXE-5E46FA0D.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\DLLHOST.EXE-5E46FA0D.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\DLLHOST.EXE-5E46FA0D.pf,CreationTime:1719534699,LastAccessTime:1772712140,LastWriteTime:1772712140,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\DLLHOST.EXE-5E46FA0D.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\DLLHOST.EXE-61F58501.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\DLLHOST.EXE-61F58501.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\DLLHOST.EXE-61F58501.pf,CreationTime:1719534669,LastAccessTime:1772712216,LastWriteTime:1772712216,ChangeTime:1772712216,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\DLLHOST.EXE-61F58501.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\DLLHOST.EXE-B8630D6F.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\DLLHOST.EXE-B8630D6F.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\DLLHOST.EXE-B8630D6F.pf,CreationTime:1719605436,LastAccessTime:1748390594,LastWriteTime:1720216915,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\DLLHOST.EXE-B8630D6F.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\DLLHOST.EXE-F208ED7A.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\DLLHOST.EXE-F208ED7A.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\DLLHOST.EXE-F208ED7A.pf,CreationTime:1719559666,LastAccessTime:1748390594,LastWriteTime:1748389959,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\DLLHOST.EXE-F208ED7A.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\DLLHOST.EXE-FC981FFE.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\DLLHOST.EXE-FC981FFE.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\DLLHOST.EXE-FC981FFE.pf,CreationTime:1719534676,LastAccessTime:1748993169,LastWriteTime:1748993169,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\DLLHOST.EXE-FC981FFE.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\DRVINST.EXE-4CB4314A.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\DRVINST.EXE-4CB4314A.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\DRVINST.EXE-4CB4314A.pf,CreationTime:1748989317,LastAccessTime:1772661935,LastWriteTime:1772661935,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\DRVINST.EXE-4CB4314A.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\dynrespri.7db,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\dynrespri.7db,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\dynrespri.7db,CreationTime:1719537374,LastAccessTime:1772712226,LastWriteTime:1748390589,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\dynrespri.7db,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\EXCEL.EXE-D2B961C3.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\EXCEL.EXE-D2B961C3.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\EXCEL.EXE-D2B961C3.pf,CreationTime:1737763972,LastAccessTime:1748390594,LastWriteTime:1748297593,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\EXCEL.EXE-D2B961C3.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\EXPLORER.EXE-A80E4F97.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\EXPLORER.EXE-A80E4F97.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\EXPLORER.EXE-A80E4F97.pf,CreationTime:1719536139,LastAccessTime:1748390594,LastWriteTime:1737068497,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\EXPLORER.EXE-A80E4F97.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\FIND.EXE-E2237F6D.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\FIND.EXE-E2237F6D.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\FIND.EXE-E2237F6D.pf,CreationTime:1719694979,LastAccessTime:1748390594,LastWriteTime:1748381045,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\FIND.EXE-E2237F6D.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\FINDSTR.EXE-2E9C6FE2.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\FINDSTR.EXE-2E9C6FE2.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\FINDSTR.EXE-2E9C6FE2.pf,CreationTime:1719694978,LastAccessTime:1748390594,LastWriteTime:1748381045,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\FINDSTR.EXE-2E9C6FE2.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\FONDUE.EXE-142C2D15.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\FONDUE.EXE-142C2D15.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\FONDUE.EXE-142C2D15.pf,CreationTime:1719576350,LastAccessTime:1748390594,LastWriteTime:1719576350,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\FONDUE.EXE-142C2D15.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\GAMEBAR.EXE-1CAD104D.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\GAMEBAR.EXE-1CAD104D.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\GAMEBAR.EXE-1CAD104D.pf,CreationTime:1719574321,LastAccessTime:1748390594,LastWriteTime:1719574321,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\GAMEBAR.EXE-1CAD104D.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\IPCONFIG.EXE-912F3D5B.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\IPCONFIG.EXE-912F3D5B.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\IPCONFIG.EXE-912F3D5B.pf,CreationTime:1786262696,LastAccessTime:1786262701,LastWriteTime:1786262701,ChangeTime:1786262701,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\IPCONFIG.EXE-912F3D5B.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\JAVAW.EXE-DB7FBC3B.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\JAVAW.EXE-DB7FBC3B.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\JAVAW.EXE-DB7FBC3B.pf,CreationTime:1719699176,LastAccessTime:1748993170,LastWriteTime:1719954955,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\JAVAW.EXE-DB7FBC3B.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\LOGONUI.EXE-09140401.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\LOGONUI.EXE-09140401.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262718.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\LOGONUI.EXE-09140401.pf,CreationTime:1719534659,LastAccessTime:1772661821,LastWriteTime:1748390950,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\LOGONUI.EXE-09140401.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\MMC.EXE-01A44983.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MMC.EXE-01A44983.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\MMC.EXE-01A44983.pf,CreationTime:1737764068,LastAccessTime:1748390594,LastWriteTime:1737764068,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MMC.EXE-01A44983.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\MMC.EXE-3861CA23.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MMC.EXE-3861CA23.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\MMC.EXE-3861CA23.pf,CreationTime:1721772040,LastAccessTime:1748993180,LastWriteTime:1748993180,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MMC.EXE-3861CA23.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\MMC.EXE-53159585.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MMC.EXE-53159585.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\MMC.EXE-53159585.pf,CreationTime:1719588344,LastAccessTime:1748390594,LastWriteTime:1721771900,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MMC.EXE-53159585.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\MMC.EXE-B0F05220.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MMC.EXE-B0F05220.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\MMC.EXE-B0F05220.pf,CreationTime:1737067915,LastAccessTime:1748390594,LastWriteTime:1737067915,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MMC.EXE-B0F05220.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\MMC.EXE-DA3333FF.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MMC.EXE-DA3333FF.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\MMC.EXE-DA3333FF.pf,CreationTime:1722726635,LastAccessTime:1748390594,LastWriteTime:1722726649,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MMC.EXE-DA3333FF.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\MMC.EXE-E21FB123.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MMC.EXE-E21FB123.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\MMC.EXE-E21FB123.pf,CreationTime:1729547645,LastAccessTime:1748390594,LastWriteTime:1729548001,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MMC.EXE-E21FB123.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\MMC.EXE-E5EE3A89.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MMC.EXE-E5EE3A89.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\MMC.EXE-E5EE3A89.pf,CreationTime:1722726889,LastAccessTime:1748390594,LastWriteTime:1722726889,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MMC.EXE-E5EE3A89.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\MMC.EXE-EF66D102.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MMC.EXE-EF66D102.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\MMC.EXE-EF66D102.pf,CreationTime:1737067985,LastAccessTime:1748390594,LastWriteTime:1737068093,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MMC.EXE-EF66D102.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\MMC.EXE-F39CDED6.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MMC.EXE-F39CDED6.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\MMC.EXE-F39CDED6.pf,CreationTime:1719572691,LastAccessTime:1748390844,LastWriteTime:1748390844,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MMC.EXE-F39CDED6.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\MMC.EXE-F5DC4F82.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MMC.EXE-F5DC4F82.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\MMC.EXE-F5DC4F82.pf,CreationTime:1727124180,LastAccessTime:1748390594,LastWriteTime:1735083429,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MMC.EXE-F5DC4F82.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\MODE.COM-DB34C082.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MODE.COM-DB34C082.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\MODE.COM-DB34C082.pf,CreationTime:1748381047,LastAccessTime:1748390594,LastWriteTime:1748381620,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MODE.COM-DB34C082.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\MOUSOCOREWORKER.EXE-681A8FEE.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MOUSOCOREWORKER.EXE-681A8FEE.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\MOUSOCOREWORKER.EXE-681A8FEE.pf,CreationTime:1719534717,LastAccessTime:1772661912,LastWriteTime:1772661912,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MOUSOCOREWORKER.EXE-681A8FEE.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\MRT.EXE-851529F7.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MRT.EXE-851529F7.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\MRT.EXE-851529F7.pf,CreationTime:1748390761,LastAccessTime:1748390761,LastWriteTime:1748390761,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MRT.EXE-851529F7.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\MSCONFIG.EXE-3A52734E.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MSCONFIG.EXE-3A52734E.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\MSCONFIG.EXE-3A52734E.pf,CreationTime:1719572874,LastAccessTime:1748390594,LastWriteTime:1719654573,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MSCONFIG.EXE-3A52734E.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\MSCORSVW.EXE-57D17DAF.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MSCORSVW.EXE-57D17DAF.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\MSCORSVW.EXE-57D17DAF.pf,CreationTime:1748391073,LastAccessTime:1748993141,LastWriteTime:1748993141,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MSCORSVW.EXE-57D17DAF.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\MSCORSVW.EXE-C3C515BD.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MSCORSVW.EXE-C3C515BD.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\MSCORSVW.EXE-C3C515BD.pf,CreationTime:1748993144,LastAccessTime:1748993281,LastWriteTime:1748993281,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MSCORSVW.EXE-C3C515BD.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\MSEDGE.EXE-78F14B85.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MSEDGE.EXE-78F14B85.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\MSEDGE.EXE-78F14B85.pf,CreationTime:1719535945,LastAccessTime:1772661821,LastWriteTime:1748384476,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MSEDGE.EXE-78F14B85.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\MSEDGE.EXE-78F14B86.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MSEDGE.EXE-78F14B86.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\MSEDGE.EXE-78F14B86.pf,CreationTime:1719536201,LastAccessTime:1748390594,LastWriteTime:1748384480,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MSEDGE.EXE-78F14B86.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\MSEDGE.EXE-78F14B87.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MSEDGE.EXE-78F14B87.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\MSEDGE.EXE-78F14B87.pf,CreationTime:1719535945,LastAccessTime:1748390594,LastWriteTime:1748384480,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MSEDGE.EXE-78F14B87.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\MSEDGE.EXE-78F14B88.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MSEDGE.EXE-78F14B88.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\MSEDGE.EXE-78F14B88.pf,CreationTime:1719955873,LastAccessTime:1748390595,LastWriteTime:1748384480,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MSEDGE.EXE-78F14B88.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\MSEDGE.EXE-78F14B89.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MSEDGE.EXE-78F14B89.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\MSEDGE.EXE-78F14B89.pf,CreationTime:1719536199,LastAccessTime:1748390595,LastWriteTime:1748384480,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MSEDGE.EXE-78F14B89.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\MSEDGE.EXE-78F14B8D.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MSEDGE.EXE-78F14B8D.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\MSEDGE.EXE-78F14B8D.pf,CreationTime:1719536200,LastAccessTime:1748390596,LastWriteTime:1748384480,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MSEDGE.EXE-78F14B8D.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\MSIEXEC.EXE-A2D55CB6.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MSIEXEC.EXE-A2D55CB6.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\MSIEXEC.EXE-A2D55CB6.pf,CreationTime:1719543780,LastAccessTime:1772661849,LastWriteTime:1772661849,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MSIEXEC.EXE-A2D55CB6.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\MSIEXEC.EXE-E09A077A.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MSIEXEC.EXE-E09A077A.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\MSIEXEC.EXE-E09A077A.pf,CreationTime:1719559823,LastAccessTime:1748390599,LastWriteTime:1748381078,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\MSIEXEC.EXE-E09A077A.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\NGEN.EXE-EC3F9239.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\NGEN.EXE-EC3F9239.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\NGEN.EXE-EC3F9239.pf,CreationTime:1748989317,LastAccessTime:1748989788,LastWriteTime:1748989788,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\NGEN.EXE-EC3F9239.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\NGENTASK.EXE-4F8BD802.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\NGENTASK.EXE-4F8BD802.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\NGENTASK.EXE-4F8BD802.pf,CreationTime:1748391072,LastAccessTime:1748391072,LastWriteTime:1748391072,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\NGENTASK.EXE-4F8BD802.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\NGENTASK.EXE-BB7F7010.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\NGENTASK.EXE-BB7F7010.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\NGENTASK.EXE-BB7F7010.pf,CreationTime:1748391072,LastAccessTime:1748391072,LastWriteTime:1748391072,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\NGENTASK.EXE-BB7F7010.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\NOTEPAD.EXE-D8414F97.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\NOTEPAD.EXE-D8414F97.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\NOTEPAD.EXE-D8414F97.pf,CreationTime:1737765019,LastAccessTime:1748390601,LastWriteTime:1737765019,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\NOTEPAD.EXE-D8414F97.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\OFFICEC2RCLIENT.EXE-51F51E1B.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\OFFICEC2RCLIENT.EXE-51F51E1B.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\OFFICEC2RCLIENT.EXE-51F51E1B.pf,CreationTime:1719559695,LastAccessTime:1748390602,LastWriteTime:1719559695,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\OFFICEC2RCLIENT.EXE-51F51E1B.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\OFFICECLICKTORUN.EXE-9BB5F0C3.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\OFFICECLICKTORUN.EXE-9BB5F0C3.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\OFFICECLICKTORUN.EXE-9BB5F0C3.pf,CreationTime:1719559686,LastAccessTime:1748390604,LastWriteTime:1737764025,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\OFFICECLICKTORUN.EXE-9BB5F0C3.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\ONEDRIVE.EXE-1C4641AC.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\ONEDRIVE.EXE-1C4641AC.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\ONEDRIVE.EXE-1C4641AC.pf,CreationTime:1719536233,LastAccessTime:1748390604,LastWriteTime:1719546468,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\ONEDRIVE.EXE-1C4641AC.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\ONENOTE.EXE-E8EF945E.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\ONENOTE.EXE-E8EF945E.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\ONENOTE.EXE-E8EF945E.pf,CreationTime:1737764297,LastAccessTime:1748390604,LastWriteTime:1737764297,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\ONENOTE.EXE-E8EF945E.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\ONENOTEM.EXE-5356802F.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\ONENOTEM.EXE-5356802F.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\ONENOTEM.EXE-5356802F.pf,CreationTime:1737764304,LastAccessTime:1772712216,LastWriteTime:1772712216,ChangeTime:1772712216,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\ONENOTEM.EXE-5356802F.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\OPENWITH.EXE-5C93E816.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\OPENWITH.EXE-5C93E816.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\OPENWITH.EXE-5C93E816.pf,CreationTime:1719572470,LastAccessTime:1748390605,LastWriteTime:1719572470,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\OPENWITH.EXE-5C93E816.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\OPTIONALFEATURES.EXE-27133C71.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\OPTIONALFEATURES.EXE-27133C71.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\OPTIONALFEATURES.EXE-27133C71.pf,CreationTime:1719576352,LastAccessTime:1748390605,LastWriteTime:1719576352,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\OPTIONALFEATURES.EXE-27133C71.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\OSK.EXE-3E832AF1.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\OSK.EXE-3E832AF1.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\OSK.EXE-3E832AF1.pf,CreationTime:1720218734,LastAccessTime:1748390605,LastWriteTime:1720218734,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\OSK.EXE-3E832AF1.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\OUTLOOK.EXE-F1C71227.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\OUTLOOK.EXE-F1C71227.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\OUTLOOK.EXE-F1C71227.pf,CreationTime:1737764276,LastAccessTime:1748390969,LastWriteTime:1748380723,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\OUTLOOK.EXE-F1C71227.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\PfPre_3faaf478.mkd,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\PfPre_3faaf478.mkd,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\PfPre_3faaf478.mkd,CreationTime:1719534649,LastAccessTime:1719534649,LastWriteTime:1719534649,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\PfPre_3faaf478.mkd,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\PfPre_3fabba55.mkd,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\PfPre_3fabba55.mkd,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\PfPre_3fabba55.mkd,CreationTime:1719535846,LastAccessTime:1772712215,LastWriteTime:1719535846,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\PfPre_3fabba55.mkd,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\PICKERHOST.EXE-B8A68B3C.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\PICKERHOST.EXE-B8A68B3C.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\PICKERHOST.EXE-B8A68B3C.pf,CreationTime:1719605198,LastAccessTime:1748390605,LastWriteTime:1719605198,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\PICKERHOST.EXE-B8A68B3C.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\PING.EXE-7E94E73E.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\PING.EXE-7E94E73E.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\PING.EXE-7E94E73E.pf,CreationTime:1786262709,LastAccessTime:1786262709,LastWriteTime:1786262709,ChangeTime:1786262709,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\PING.EXE-7E94E73E.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\POWERSHELL.EXE-920BBA2A.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\POWERSHELL.EXE-920BBA2A.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\POWERSHELL.EXE-920BBA2A.pf,CreationTime:1719956058,LastAccessTime:1748390605,LastWriteTime:1748381047,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\POWERSHELL.EXE-920BBA2A.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\PYTHON-3.13.3-AMD64.EXE-0F29DCFF.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\PYTHON-3.13.3-AMD64.EXE-0F29DCFF.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\PYTHON-3.13.3-AMD64.EXE-0F29DCFF.pf,CreationTime:1748377398,LastAccessTime:1748390605,LastWriteTime:1748377398,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\PYTHON-3.13.3-AMD64.EXE-0F29DCFF.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\PYTHON-3.13.3-AMD64.EXE-A339C4FB.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\PYTHON-3.13.3-AMD64.EXE-A339C4FB.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\PYTHON-3.13.3-AMD64.EXE-A339C4FB.pf,CreationTime:1748381028,LastAccessTime:1748390605,LastWriteTime:1748381028,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\PYTHON-3.13.3-AMD64.EXE-A339C4FB.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\READER_UK_INSTALL.EXE-E37609DB.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\READER_UK_INSTALL.EXE-E37609DB.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\READER_UK_INSTALL.EXE-E37609DB.pf,CreationTime:1719571830,LastAccessTime:1748390605,LastWriteTime:1719571833,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\READER_UK_INSTALL.EXE-E37609DB.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\ReadyBoot,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\ReadyBoot,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\ReadyBoot,CreationTime:1719534317,LastAccessTime:1772712216,LastWriteTime:1772712060,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_DIRECTORY,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\ReadyBoot,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\ReadyBoot\,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_LIST_DIRECTORY | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE,OpenOptions:FILE_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT | FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryVolumeInformationFile(FileHandle:\Windows\Prefetch\ReadyBoot,IoStatusBlock:0x14f940,FsInformation:0x14f9d8,Length:0x8,FsInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x5b7a50,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\ReadyBoot,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\ReadyBoot\,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_LIST_DIRECTORY | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE,OpenOptions:FILE_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT | FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryVolumeInformationFile(FileHandle:\Windows\Prefetch\ReadyBoot,IoStatusBlock:0x14f940,FsInformation:0x14f9d8,Length:0x8,FsInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\REG.EXE-E7E8BD26.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\REG.EXE-E7E8BD26.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\REG.EXE-E7E8BD26.pf,CreationTime:1719574307,LastAccessTime:1748390605,LastWriteTime:1748381045,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\REG.EXE-E7E8BD26.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\REGEDIT.EXE-90FEEA06.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\REGEDIT.EXE-90FEEA06.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\REGEDIT.EXE-90FEEA06.pf,CreationTime:1719574347,LastAccessTime:1772661821,LastWriteTime:1748390800,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\REGEDIT.EXE-90FEEA06.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\ResPriHMStaticDb.ebd,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\ResPriHMStaticDb.ebd,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\ResPriHMStaticDb.ebd,CreationTime:1719534401,LastAccessTime:1772712226,LastWriteTime:1719534401,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\ResPriHMStaticDb.ebd,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\RUNDLL32.EXE-215FAEB9.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\RUNDLL32.EXE-215FAEB9.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\RUNDLL32.EXE-215FAEB9.pf,CreationTime:1720554973,LastAccessTime:1748390605,LastWriteTime:1720554973,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\RUNDLL32.EXE-215FAEB9.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\RUNDLL32.EXE-29388D79.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\RUNDLL32.EXE-29388D79.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\RUNDLL32.EXE-29388D79.pf,CreationTime:1719605151,LastAccessTime:1748390605,LastWriteTime:1719605151,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\RUNDLL32.EXE-29388D79.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\RUNDLL32.EXE-318626CB.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\RUNDLL32.EXE-318626CB.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\RUNDLL32.EXE-318626CB.pf,CreationTime:1772661938,LastAccessTime:1772661938,LastWriteTime:1772661938,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\RUNDLL32.EXE-318626CB.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\RUNDLL32.EXE-3D0EC884.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\RUNDLL32.EXE-3D0EC884.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\RUNDLL32.EXE-3D0EC884.pf,CreationTime:1772661935,LastAccessTime:1772661935,LastWriteTime:1772661935,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\RUNDLL32.EXE-3D0EC884.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\RUNDLL32.EXE-8119462B.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\RUNDLL32.EXE-8119462B.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\RUNDLL32.EXE-8119462B.pf,CreationTime:1772661937,LastAccessTime:1772661937,LastWriteTime:1772661937,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\RUNDLL32.EXE-8119462B.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\RUNDLL32.EXE-90B5D9EF.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\RUNDLL32.EXE-90B5D9EF.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\RUNDLL32.EXE-90B5D9EF.pf,CreationTime:1786262699,LastAccessTime:1786262699,LastWriteTime:1786262699,ChangeTime:1786262699,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\RUNDLL32.EXE-90B5D9EF.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\RUNDLL32.EXE-964E2543.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\RUNDLL32.EXE-964E2543.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\RUNDLL32.EXE-964E2543.pf,CreationTime:1772661842,LastAccessTime:1772661842,LastWriteTime:1772661842,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\RUNDLL32.EXE-964E2543.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\RUNDLL32.EXE-9902CA0A.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\RUNDLL32.EXE-9902CA0A.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\RUNDLL32.EXE-9902CA0A.pf,CreationTime:1772661843,LastAccessTime:1772661843,LastWriteTime:1772661843,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\RUNDLL32.EXE-9902CA0A.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\RUNDLL32.EXE-9FA6D811.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\RUNDLL32.EXE-9FA6D811.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\RUNDLL32.EXE-9FA6D811.pf,CreationTime:1772661931,LastAccessTime:1772661931,LastWriteTime:1772661931,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\RUNDLL32.EXE-9FA6D811.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\RUNDLL32.EXE-BA7A4020.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\RUNDLL32.EXE-BA7A4020.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\RUNDLL32.EXE-BA7A4020.pf,CreationTime:1772661934,LastAccessTime:1772661934,LastWriteTime:1772661934,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\RUNDLL32.EXE-BA7A4020.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\RUNDLL32.EXE-CF0EC82C.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\RUNDLL32.EXE-CF0EC82C.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\RUNDLL32.EXE-CF0EC82C.pf,CreationTime:1719559654,LastAccessTime:1772661835,LastWriteTime:1772661835,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\RUNDLL32.EXE-CF0EC82C.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\RUNDLL32.EXE-D1221375.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\RUNDLL32.EXE-D1221375.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\RUNDLL32.EXE-D1221375.pf,CreationTime:1720554978,LastAccessTime:1748390605,LastWriteTime:1720554978,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\RUNDLL32.EXE-D1221375.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\RUNDLL32.EXE-D1BD4E6E.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\RUNDLL32.EXE-D1BD4E6E.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\RUNDLL32.EXE-D1BD4E6E.pf,CreationTime:1737068145,LastAccessTime:1748390605,LastWriteTime:1737068500,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\RUNDLL32.EXE-D1BD4E6E.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\RUNDLL32.EXE-D5932106.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\RUNDLL32.EXE-D5932106.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\RUNDLL32.EXE-D5932106.pf,CreationTime:1772661842,LastAccessTime:1772661842,LastWriteTime:1772661842,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\RUNDLL32.EXE-D5932106.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\RUNONCE.EXE-0E293DD6.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\RUNONCE.EXE-0E293DD6.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\RUNONCE.EXE-0E293DD6.pf,CreationTime:1719573974,LastAccessTime:1772712216,LastWriteTime:1772712216,ChangeTime:1772712216,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\RUNONCE.EXE-0E293DD6.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\RUNTIMEBROKER.EXE-72C0C855.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\RUNTIMEBROKER.EXE-72C0C855.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\RUNTIMEBROKER.EXE-72C0C855.pf,CreationTime:1719535955,LastAccessTime:1772712216,LastWriteTime:1772712216,ChangeTime:1772712216,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\RUNTIMEBROKER.EXE-72C0C855.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\RUNTIMEBROKER.EXE-C2227512.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\RUNTIMEBROKER.EXE-C2227512.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\RUNTIMEBROKER.EXE-C2227512.pf,CreationTime:1719546575,LastAccessTime:1748390605,LastWriteTime:1748380708,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\RUNTIMEBROKER.EXE-C2227512.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\RUNTIMEBROKER.EXE-DB4509BC.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\RUNTIMEBROKER.EXE-DB4509BC.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\RUNTIMEBROKER.EXE-DB4509BC.pf,CreationTime:1719546450,LastAccessTime:1772712216,LastWriteTime:1772712216,ChangeTime:1772712216,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\RUNTIMEBROKER.EXE-DB4509BC.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\RUNTIMEBROKER.EXE-EAE31032.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\RUNTIMEBROKER.EXE-EAE31032.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\RUNTIMEBROKER.EXE-EAE31032.pf,CreationTime:1719546453,LastAccessTime:1772712216,LastWriteTime:1772712216,ChangeTime:1772712216,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\RUNTIMEBROKER.EXE-EAE31032.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\SC.EXE-945D79AE.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SC.EXE-945D79AE.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\SC.EXE-945D79AE.pf,CreationTime:1748381045,LastAccessTime:1748390605,LastWriteTime:1748381077,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SC.EXE-945D79AE.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\SCHTASKS.EXE-AD598958.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SCHTASKS.EXE-AD598958.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\SCHTASKS.EXE-AD598958.pf,CreationTime:1748390592,LastAccessTime:1748390605,LastWriteTime:1748390593,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SCHTASKS.EXE-AD598958.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\SEARCHAPP.EXE-357B871E.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SEARCHAPP.EXE-357B871E.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\SEARCHAPP.EXE-357B871E.pf,CreationTime:1719546448,LastAccessTime:1772712216,LastWriteTime:1772712216,ChangeTime:1772712216,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SEARCHAPP.EXE-357B871E.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\SEARCHAPP.EXE-B7BDD349.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SEARCHAPP.EXE-B7BDD349.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\SEARCHAPP.EXE-B7BDD349.pf,CreationTime:1719696625,LastAccessTime:1748390605,LastWriteTime:1722727032,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SEARCHAPP.EXE-B7BDD349.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\SEARCHAPP.EXE-C0170CFD.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SEARCHAPP.EXE-C0170CFD.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\SEARCHAPP.EXE-C0170CFD.pf,CreationTime:1719535881,LastAccessTime:1748390605,LastWriteTime:1719535881,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SEARCHAPP.EXE-C0170CFD.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\SECHEALTHUI.EXE-46CD6C01.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SECHEALTHUI.EXE-46CD6C01.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\SECHEALTHUI.EXE-46CD6C01.pf,CreationTime:1719605208,LastAccessTime:1748390605,LastWriteTime:1719605208,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SECHEALTHUI.EXE-46CD6C01.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\SETUP.EXE-98F8EDA0.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SETUP.EXE-98F8EDA0.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\SETUP.EXE-98F8EDA0.pf,CreationTime:1719572140,LastAccessTime:1748390605,LastWriteTime:1719572140,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SETUP.EXE-98F8EDA0.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\SETUP.EXE-E589C2EE.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SETUP.EXE-E589C2EE.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\SETUP.EXE-E589C2EE.pf,CreationTime:1719559667,LastAccessTime:1748390605,LastWriteTime:1719559667,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SETUP.EXE-E589C2EE.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\SETUP32.EXE-A90B6D0F.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SETUP32.EXE-A90B6D0F.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\SETUP32.EXE-A90B6D0F.pf,CreationTime:1719559677,LastAccessTime:1748390605,LastWriteTime:1719559680,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SETUP32.EXE-A90B6D0F.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\SFC.EXE-8103D384.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SFC.EXE-8103D384.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\SFC.EXE-8103D384.pf,CreationTime:1719954615,LastAccessTime:1748390605,LastWriteTime:1748389968,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SFC.EXE-8103D384.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\SGRMBROKER.EXE-0CA31CC6.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SGRMBROKER.EXE-0CA31CC6.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\SGRMBROKER.EXE-0CA31CC6.pf,CreationTime:1719534700,LastAccessTime:1772661911,LastWriteTime:1772661911,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SGRMBROKER.EXE-0CA31CC6.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\SHELLEXPERIENCEHOST.EXE-E5B36B6A.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SHELLEXPERIENCEHOST.EXE-E5B36B6A.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\SHELLEXPERIENCEHOST.EXE-E5B36B6A.pf,CreationTime:1719559935,LastAccessTime:1786262707,LastWriteTime:1786262707,ChangeTime:1786262707,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SHELLEXPERIENCEHOST.EXE-E5B36B6A.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\SHELLEXPERIENCEHOST.EXE-EF3EE583.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SHELLEXPERIENCEHOST.EXE-EF3EE583.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\SHELLEXPERIENCEHOST.EXE-EF3EE583.pf,CreationTime:1719535945,LastAccessTime:1748390605,LastWriteTime:1719535945,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SHELLEXPERIENCEHOST.EXE-EF3EE583.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\SHUTDOWN.EXE-E7D5C9CC.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SHUTDOWN.EXE-E7D5C9CC.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\SHUTDOWN.EXE-E7D5C9CC.pf,CreationTime:1772712146,LastAccessTime:1772712146,LastWriteTime:1772712146,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SHUTDOWN.EXE-E7D5C9CC.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\SIHCLIENT.EXE-A872A8BF.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SIHCLIENT.EXE-A872A8BF.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\SIHCLIENT.EXE-A872A8BF.pf,CreationTime:1719694411,LastAccessTime:1748989317,LastWriteTime:1748989317,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SIHCLIENT.EXE-A872A8BF.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\SIHOST.EXE-2C4C53BA.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SIHOST.EXE-2C4C53BA.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\SIHOST.EXE-2C4C53BA.pf,CreationTime:1719534659,LastAccessTime:1748390605,LastWriteTime:1719589716,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SIHOST.EXE-2C4C53BA.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\SLUI.EXE-724E99D9.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SLUI.EXE-724E99D9.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\SLUI.EXE-724E99D9.pf,CreationTime:1737763071,LastAccessTime:1772661822,LastWriteTime:1772661822,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SLUI.EXE-724E99D9.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\SMARTSCREEN.EXE-9B5E4173.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SMARTSCREEN.EXE-9B5E4173.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\SMARTSCREEN.EXE-9B5E4173.pf,CreationTime:1748390799,LastAccessTime:1772712216,LastWriteTime:1772712216,ChangeTime:1772712216,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SMARTSCREEN.EXE-9B5E4173.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\SPPEXTCOMOBJ.EXE-BB03B3D6.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SPPEXTCOMOBJ.EXE-BB03B3D6.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\SPPEXTCOMOBJ.EXE-BB03B3D6.pf,CreationTime:1748989317,LastAccessTime:1748989317,LastWriteTime:1748989317,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SPPEXTCOMOBJ.EXE-BB03B3D6.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\SPPSVC.EXE-B0F8131B.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SPPSVC.EXE-B0F8131B.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\SPPSVC.EXE-B0F8131B.pf,CreationTime:1719535112,LastAccessTime:1748390605,LastWriteTime:1748390034,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SPPSVC.EXE-B0F8131B.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\STARTMENUEXPERIENCEHOST.EXE-1A6157D8.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\STARTMENUEXPERIENCEHOST.EXE-1A6157D8.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\STARTMENUEXPERIENCEHOST.EXE-1A6157D8.pf,CreationTime:1719546450,LastAccessTime:1772712216,LastWriteTime:1772712216,ChangeTime:1772712216,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\STARTMENUEXPERIENCEHOST.EXE-1A6157D8.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\STARTMENUEXPERIENCEHOST.EXE-D80E778C.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\STARTMENUEXPERIENCEHOST.EXE-D80E778C.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\STARTMENUEXPERIENCEHOST.EXE-D80E778C.pf,CreationTime:1719535879,LastAccessTime:1748390605,LastWriteTime:1719535879,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\STARTMENUEXPERIENCEHOST.EXE-D80E778C.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\SVCHOST.EXE-109E4311.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SVCHOST.EXE-109E4311.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\SVCHOST.EXE-109E4311.pf,CreationTime:1719609821,LastAccessTime:1772661917,LastWriteTime:1772661917,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SVCHOST.EXE-109E4311.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\SVCHOST.EXE-4BA0E729.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SVCHOST.EXE-4BA0E729.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\SVCHOST.EXE-4BA0E729.pf,CreationTime:1719534694,LastAccessTime:1772712146,LastWriteTime:1772712146,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SVCHOST.EXE-4BA0E729.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\SVCHOST.EXE-63699C7D.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SVCHOST.EXE-63699C7D.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\SVCHOST.EXE-63699C7D.pf,CreationTime:1719655077,LastAccessTime:1772661912,LastWriteTime:1772661912,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SVCHOST.EXE-63699C7D.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\SVCHOST.EXE-6FEFCF11.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SVCHOST.EXE-6FEFCF11.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\SVCHOST.EXE-6FEFCF11.pf,CreationTime:1748390625,LastAccessTime:1748390625,LastWriteTime:1748390625,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SVCHOST.EXE-6FEFCF11.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\SVCHOST.EXE-7CFEDEA3.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SVCHOST.EXE-7CFEDEA3.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\SVCHOST.EXE-7CFEDEA3.pf,CreationTime:1786262707,LastAccessTime:1786262707,LastWriteTime:1786262707,ChangeTime:1786262707,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SVCHOST.EXE-7CFEDEA3.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\SVCHOST.EXE-8F1093D6.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SVCHOST.EXE-8F1093D6.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\SVCHOST.EXE-8F1093D6.pf,CreationTime:1719609339,LastAccessTime:1786262714,LastWriteTime:1786262714,ChangeTime:1786262714,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SVCHOST.EXE-8F1093D6.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\SYSTEMINFO.EXE-A98925A5.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SYSTEMINFO.EXE-A98925A5.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\SYSTEMINFO.EXE-A98925A5.pf,CreationTime:1772712135,LastAccessTime:1772712135,LastWriteTime:1772712135,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SYSTEMINFO.EXE-A98925A5.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\SYSTEMPROPERTIESADVANCED.EXE-68C7C4F0.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SYSTEMPROPERTIESADVANCED.EXE-68C7C4F0.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\SYSTEMPROPERTIESADVANCED.EXE-68C7C4F0.pf,CreationTime:1748390917,LastAccessTime:1748390917,LastWriteTime:1748390917,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SYSTEMPROPERTIESADVANCED.EXE-68C7C4F0.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\SYSTEMSETTINGS.EXE-01D72268.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SYSTEMSETTINGS.EXE-01D72268.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\SYSTEMSETTINGS.EXE-01D72268.pf,CreationTime:1719536162,LastAccessTime:1748390605,LastWriteTime:1737068497,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\SYSTEMSETTINGS.EXE-01D72268.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\TASKHOSTW.EXE-3E0B74C8.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\TASKHOSTW.EXE-3E0B74C8.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\TASKHOSTW.EXE-3E0B74C8.pf,CreationTime:1719534659,LastAccessTime:1748993018,LastWriteTime:1748993018,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\TASKHOSTW.EXE-3E0B74C8.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\TASKMGR.EXE-5F5F473D.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\TASKMGR.EXE-5F5F473D.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\TASKMGR.EXE-5F5F473D.pf,CreationTime:1719572882,LastAccessTime:1772661955,LastWriteTime:1737765523,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\TASKMGR.EXE-5F5F473D.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\TEXTINPUTHOST.EXE-95832A05.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\TEXTINPUTHOST.EXE-95832A05.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\TEXTINPUTHOST.EXE-95832A05.pf,CreationTime:1719535186,LastAccessTime:1748390605,LastWriteTime:1719536157,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\TEXTINPUTHOST.EXE-95832A05.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\TEXTINPUTHOST.EXE-DD18FAE5.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\TEXTINPUTHOST.EXE-DD18FAE5.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\TEXTINPUTHOST.EXE-DD18FAE5.pf,CreationTime:1719559264,LastAccessTime:1748390910,LastWriteTime:1748390910,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\TEXTINPUTHOST.EXE-DD18FAE5.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\TIWORKER.EXE-76D77F81.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\TIWORKER.EXE-76D77F81.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\TIWORKER.EXE-76D77F81.pf,CreationTime:1719543817,LastAccessTime:1772661822,LastWriteTime:1772661822,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\TIWORKER.EXE-76D77F81.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\TRUSTEDINSTALLER.EXE-3CC531E5.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\TRUSTEDINSTALLER.EXE-3CC531E5.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\TRUSTEDINSTALLER.EXE-3CC531E5.pf,CreationTime:1719534709,LastAccessTime:1772661822,LastWriteTime:1772661822,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\TRUSTEDINSTALLER.EXE-3CC531E5.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\UPDATER.EXE-FE69FB79.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\UPDATER.EXE-FE69FB79.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\UPDATER.EXE-FE69FB79.pf,CreationTime:1719571745,LastAccessTime:1748390605,LastWriteTime:1719571745,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\UPDATER.EXE-FE69FB79.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\USERACCOUNTCONTROLSETTINGS.EX-1B2F66BE.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\USERACCOUNTCONTROLSETTINGS.EX-1B2F66BE.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\USERACCOUNTCONTROLSETTINGS.EX-1B2F66BE.pf,CreationTime:1719574345,LastAccessTime:1748390605,LastWriteTime:1719611218,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\USERACCOUNTCONTROLSETTINGS.EX-1B2F66BE.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\USEROOBEBROKER.EXE-D2992F42.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\USEROOBEBROKER.EXE-D2992F42.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\USEROOBEBROKER.EXE-D2992F42.pf,CreationTime:1719535675,LastAccessTime:1786262712,LastWriteTime:1786262712,ChangeTime:1786262712,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\USEROOBEBROKER.EXE-D2992F42.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\VC_REDIST.X64 (1).EXE-F52FACEC.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\VC_REDIST.X64 (1).EXE-F52FACEC.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\VC_REDIST.X64 (1).EXE-F52FACEC.pf,CreationTime:1719744867,LastAccessTime:1748390605,LastWriteTime:1719744867,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\VC_REDIST.X64 (1).EXE-F52FACEC.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\VC_REDIST.X64.EXE-A59F04C2.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\VC_REDIST.X64.EXE-A59F04C2.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\VC_REDIST.X64.EXE-A59F04C2.pf,CreationTime:1719744870,LastAccessTime:1748390605,LastWriteTime:1719744870,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\VC_REDIST.X64.EXE-A59F04C2.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\VC_REDIST.X64.EXE-C6C3D84A.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\VC_REDIST.X64.EXE-C6C3D84A.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\VC_REDIST.X64.EXE-C6C3D84A.pf,CreationTime:1719744529,LastAccessTime:1748390605,LastWriteTime:1719744529,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\VC_REDIST.X64.EXE-C6C3D84A.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\VC_REDIST.X64.EXE-D3A3C549.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\VC_REDIST.X64.EXE-D3A3C549.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\VC_REDIST.X64.EXE-D3A3C549.pf,CreationTime:1719744862,LastAccessTime:1748390605,LastWriteTime:1719744862,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\VC_REDIST.X64.EXE-D3A3C549.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\VC_REDIST.X64.EXE-FB5A475D.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\VC_REDIST.X64.EXE-FB5A475D.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\VC_REDIST.X64.EXE-FB5A475D.pf,CreationTime:1719744529,LastAccessTime:1748390605,LastWriteTime:1719744529,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\VC_REDIST.X64.EXE-FB5A475D.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\VC_REDIST.X86.EXE-359368D2.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\VC_REDIST.X86.EXE-359368D2.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\VC_REDIST.X86.EXE-359368D2.pf,CreationTime:1719744881,LastAccessTime:1748390605,LastWriteTime:1719744881,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\VC_REDIST.X86.EXE-359368D2.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\VC_REDIST.X86.EXE-B8542FCE.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\VC_REDIST.X86.EXE-B8542FCE.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\VC_REDIST.X86.EXE-B8542FCE.pf,CreationTime:1719744881,LastAccessTime:1748390605,LastWriteTime:1719744881,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\VC_REDIST.X86.EXE-B8542FCE.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\VISUAL C++ V56.EXE-3A979829.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\VISUAL C++ V56.EXE-3A979829.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\VISUAL C++ V56.EXE-3A979829.pf,CreationTime:1719744293,LastAccessTime:1748390605,LastWriteTime:1719744293,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\VISUAL C++ V56.EXE-3A979829.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\VISUALCPPREDIST_AIO_X86_X64.E-FDF55623.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\VISUALCPPREDIST_AIO_X86_X64.E-FDF55623.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\VISUALCPPREDIST_AIO_X86_X64.E-FDF55623.pf,CreationTime:1719694975,LastAccessTime:1748390605,LastWriteTime:1719694975,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\VISUALCPPREDIST_AIO_X86_X64.E-FDF55623.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\VSSVC.EXE-B8AFC319.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\VSSVC.EXE-B8AFC319.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\VSSVC.EXE-B8AFC319.pf,CreationTime:1786262705,LastAccessTime:1786262705,LastWriteTime:1786262705,ChangeTime:1786262705,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\VSSVC.EXE-B8AFC319.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\WAASMEDICAGENT.EXE-ED0D7511.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\WAASMEDICAGENT.EXE-ED0D7511.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\WAASMEDICAGENT.EXE-ED0D7511.pf,CreationTime:1748989317,LastAccessTime:1748989317,LastWriteTime:1748989317,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\WAASMEDICAGENT.EXE-ED0D7511.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\WINDOWS-KB890830-X64-V5.133.E-6D80CDB1.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\WINDOWS-KB890830-X64-V5.133.E-6D80CDB1.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\WINDOWS-KB890830-X64-V5.133.E-6D80CDB1.pf,CreationTime:1748390705,LastAccessTime:1748390705,LastWriteTime:1748390705,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\WINDOWS-KB890830-X64-V5.133.E-6D80CDB1.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\WINWORD.EXE-A29E96D8.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\WINWORD.EXE-A29E96D8.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\WINWORD.EXE-A29E96D8.pf,CreationTime:1719960120,LastAccessTime:1748390969,LastWriteTime:1748381118,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\WINWORD.EXE-A29E96D8.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\WLRMDR.EXE-C2B47318.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\WLRMDR.EXE-C2B47318.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\WLRMDR.EXE-C2B47318.pf,CreationTime:1719534680,LastAccessTime:1772712216,LastWriteTime:1772712216,ChangeTime:1772712216,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\WLRMDR.EXE-C2B47318.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\WMIADAP.EXE-F8DFDFA2.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\WMIADAP.EXE-F8DFDFA2.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\WMIADAP.EXE-F8DFDFA2.pf,CreationTime:1719534813,LastAccessTime:1748993129,LastWriteTime:1748993129,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\WMIADAP.EXE-F8DFDFA2.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\WMIAPSRV.EXE-29F35ED0.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\WMIAPSRV.EXE-29F35ED0.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\WMIAPSRV.EXE-29F35ED0.pf,CreationTime:1748390958,LastAccessTime:1748390958,LastWriteTime:1748390958,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\WMIAPSRV.EXE-29F35ED0.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\WMIC.EXE-A7D06383.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\WMIC.EXE-A7D06383.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\WMIC.EXE-A7D06383.pf,CreationTime:1719694979,LastAccessTime:1748390605,LastWriteTime:1748381092,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\WMIC.EXE-A7D06383.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\WMIPRVSE.EXE-1628051C.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\WMIPRVSE.EXE-1628051C.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\WMIPRVSE.EXE-1628051C.pf,CreationTime:1719534659,LastAccessTime:1772661917,LastWriteTime:1772661917,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\WMIPRVSE.EXE-1628051C.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\WUAUCLT.EXE-70318591.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\WUAUCLT.EXE-70318591.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\WUAUCLT.EXE-70318591.pf,CreationTime:1720216210,LastAccessTime:1748993142,LastWriteTime:1748993142,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\WUAUCLT.EXE-70318591.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\WWAHOST.EXE-3FD45057.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\WWAHOST.EXE-3FD45057.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\WWAHOST.EXE-3FD45057.pf,CreationTime:1719534669,LastAccessTime:1748390605,LastWriteTime:1719534669,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\WWAHOST.EXE-3FD45057.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\XCOPY.EXE-41E6513F.pf,FileHandle:0x1e8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\XCOPY.EXE-41E6513F.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1e8,FileName:C:\Windows\Prefetch\XCOPY.EXE-41E6513F.pf,CreationTime:1786262697,LastAccessTime:1786262697,LastWriteTime:1786262697,ChangeTime:1786262697,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\XCOPY.EXE-41E6513F.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1e8,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\Prefetch\XENBUS_MONITOR_9_1_100_59.EXE-7C90EC65.pf,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | READ_CONTROL | WRITE_DAC,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntmarta.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\XENBUS_MONITOR_9_1_100_59.EXE-7C90EC65.pf,IoStatusBlock:0x14fa10,FileInformation:0x14fa20,Length:0x28,FileInformationClass:0x4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x1ec,FileName:C:\Windows\Prefetch\XENBUS_MONITOR_9_1_100_59.EXE-7C90EC65.pf,CreationTime:1772661943,LastAccessTime:1772661943,LastWriteTime:1772661943,ChangeTime:1772712175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_NOT_CONTENT_INDEXED,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Windows\Prefetch\XENBUS_MONITOR_9_1_100_59.EXE-7C90EC65.pf,IoStatusBlock:0x14f940,FileInformation:0x14f9a0,Length:0x74,FileInformationClass:0x37,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1ec,SecurityInformation:0x4,SSecurityDescriptor:0x57fdd0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x5c5000,RegionSize:0x14f540,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x5bc000,RegionSize:0x14f540,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtSetSecurityObject(Handle:0x1dc,SecurityInformation:0x4,SSecurityDescriptor:0x5b7c90,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->CreateThread(0x0,0x0,0x14004c7e0,0x0,0x0,0x0,0x0,0x0,CalledFrom:0x7fff0036b8b0,ReturnValue:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateThreadEx(ThreadHandle:0x14f808,DesiredAccess:0x1fffff,ObjectAttributes:0x0,StartRoutine:0x14004c7e0,Argument:0x0,CreateFlags:0x0,ZeroBits:0x0,StackSize:0x0,MaximumStackSize:0x0,AttributeList:0x14f930,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->CreateThread(0x0,0x0,0x14004c7e0,0x0,0x0,0x0,0x0,0x0,CalledFrom:0x14002d336,ReturnValue:0x1dc,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffeffdc0000,RegionSize:0x14db80,NewProtectWin32:0x2,OldProtect:0x14dbf0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14db78,NewProtectWin32:0x4,OldProtect:0x14db70,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14db78,NewProtectWin32:0x2,OldProtect:0x14db70,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffeffd0c2e8,RegionSize:0x14dbd8,NewProtectWin32:0x4,OldProtect:0x58dcf8,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffeffd0c2e8,RegionSize:0x58dce0,NewProtectWin32:0x2,OldProtect:0x14dbc0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryFullAttributesFile(FileName:C:\Windows\Prefetch,ObjectAttributes:OBJ_CASE_INSENSITIVE,CreationTime:1719534317,LastAccessTime:1786262718,LastWriteTime:1786262709,ChangeTime:1786262718,FileAttributes:FILE_ATTRIBUTE_INTEGRITY_STREAM | FILE_ATTRIBUTE_NO_SCRUB_DATA,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5056
NtOpenFile(FileName:C:\Windows\Prefetch\,FileHandle:0x24c,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_LIST_DIRECTORY | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT | FILE_OPEN_FOR_BACKUP_INTENT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5056
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffeff4bdd30,RegionSize:0x14e200,NewProtectWin32:0x4,OldProtect:0x14e218,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffeff4bd000,RegionSize:0x14e200,NewProtectWin32:0x2,OldProtect:0x14e218,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryAttributesFile(FileName:C:\Windows\system32\rpcss.dll,ObjectAttributes:OBJ_CASE_INSENSITIVE,CreationTime:1719544802,LastAccessTime:1786262718,LastWriteTime:1719544802,ChangeTime:1719546131,FileAttributes:FILE_ATTRIBUTE_ARCHIVE,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\system32\rpcss.dll,FileHandle:0x24c,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_DATA | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_DELETE,OpenOptions:FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtCreateSection(SectionHandle:0x14df50,DesiredAccess:0x4,ObjectAttributes:0x0,MaximumSize:0x0,SectionPageProtection:0x2,AllocationAttributes:0x8000000,FileHandle:\Windows\System32\rpcss.dll,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtUnmapViewOfSection(BaseAddress:0x2110000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtUnmapViewOfSectionEx(BaseAddress:0x2110000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryAttributesFile(FileName:C:\Windows\SYSTEM32\kernel.appcore.dll,ObjectAttributes:OBJ_CASE_INSENSITIVE,CreationTime:1719544760,LastAccessTime:1786262718,LastWriteTime:1719544760,ChangeTime:1719546175,FileAttributes:FILE_ATTRIBUTE_ARCHIVE,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\SYSTEM32\kernel.appcore.dll,FileHandle:0x254,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_DATA | FILE_EXECUTE | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_DELETE,OpenOptions:FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtCreateSection(SectionHandle:0x14d558,DesiredAccess:0xd,ObjectAttributes:0x0,MaximumSize:0x0,SectionPageProtection:0x10,AllocationAttributes:0x1000000,FileHandle:\Windows\System32\kernel.appcore.dll,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefbbdf000,RegionSize:0x14d400,NewProtectWin32:0x2,OldProtect:0x14d470,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14d3f8,NewProtectWin32:0x4,OldProtect:0x14d3f0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14d3f8,NewProtectWin32:0x2,OldProtect:0x14d3f0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefbbd5590,RegionSize:0x14d458,NewProtectWin32:0x4,OldProtect:0x5be9b8,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefbbd5590,RegionSize:0x5be9a0,NewProtectWin32:0x2,OldProtect:0x14d660,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffeffdc0468,RegionSize:0x14dca0,NewProtectWin32:0x4,OldProtect:0x14dcb8,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffeffdc0000,RegionSize:0x14dca0,NewProtectWin32:0x2,OldProtect:0x14dcb8,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14d648,NewProtectWin32:0x4,OldProtect:0x14d640,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14d648,NewProtectWin32:0x2,OldProtect:0x14d640,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefe0f72f8,RegionSize:0x14d6a8,NewProtectWin32:0x4,OldProtect:0x5beb68,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefe0f72f8,RegionSize:0x5beb50,NewProtectWin32:0x2,OldProtect:0x14d690,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
bcryptprimitives.dll->NtQueryInformationProcess(ProcessInformationClass:0x56,ProcessInformation:0x14d4e0,ProcessInformationLength:0xb0,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
bcryptprimitives.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x14d460,ProcessInformationLength:0x40,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:\Device\CNG,FileHandle:0x264,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:0,DesiredAccess:FILE_READ_DATA | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_SYNCHRONOUS_IO_NONALERT,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefe7cb1a8,RegionSize:0x14dcd0,NewProtectWin32:0x4,OldProtect:0x14dce8,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefe7cb000,RegionSize:0x14dcd0,NewProtectWin32:0x2,OldProtect:0x14dce8,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffeffdc0570,RegionSize:0x14dd80,NewProtectWin32:0x4,OldProtect:0x14dd98,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffeffdc0000,RegionSize:0x14dd80,NewProtectWin32:0x2,OldProtect:0x14dd98,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
user32.dll->CreateWindowExW(0x0,"","O",0x88000000,0x1480000000,0x7ffe80000000,0x80000000,0x80000000,0xfffffffffffffffd,0x0,0x7ffeffa90000,0x0,CalledFrom:0x7ffefe967150,ReturnValue:0x80000000,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryAttributesFile(FileName:C:\Windows\system32\uxtheme.dll,ObjectAttributes:OBJ_CASE_INSENSITIVE,CreationTime:1719544864,LastAccessTime:1786262718,LastWriteTime:1719544864,ChangeTime:1719546430,FileAttributes:FILE_ATTRIBUTE_ARCHIVE,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\system32\uxtheme.dll,FileHandle:0x260,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_DATA | FILE_EXECUTE | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_DELETE,OpenOptions:FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtCreateSection(SectionHandle:0x14d638,DesiredAccess:0xd,ObjectAttributes:0x0,MaximumSize:0x0,SectionPageProtection:0x10,AllocationAttributes:0x1000000,FileHandle:\Windows\System32\uxtheme.dll,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefb78a000,RegionSize:0x14d4e0,NewProtectWin32:0x2,OldProtect:0x14d550,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14d4d8,NewProtectWin32:0x4,OldProtect:0x14d4d0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14d4d8,NewProtectWin32:0x2,OldProtect:0x14d4d0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefb7561a8,RegionSize:0x14d538,NewProtectWin32:0x4,OldProtect:0x5bd308,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefb7561a8,RegionSize:0x5bd2f0,NewProtectWin32:0x2,OldProtect:0x14d420,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x4d0000,RegionSize:0x14d2a8,FreeType:0x8000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
combase.dll->CreateWindowExW(0x0,"","O",0x88000000,0x1480000000,0x7ffe80000000,0x80000000,0x80000000,0xfffffffffffffffd,0x0,0x7ffeffa90000,0x0,CalledFrom:0x7ffeffb61cc7,ReturnValue:0x501c4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryAttributesFile(FileName:C:\Windows\SYSTEM32\windows.storage.dll,ObjectAttributes:OBJ_CASE_INSENSITIVE,CreationTime:1719544759,LastAccessTime:1786262705,LastWriteTime:1719544760,ChangeTime:1719546184,FileAttributes:FILE_ATTRIBUTE_ARCHIVE,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\SYSTEM32\windows.storage.dll,FileHandle:0x270,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_DATA | FILE_EXECUTE | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_DELETE,OpenOptions:FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtCreateSection(SectionHandle:0x14dab8,DesiredAccess:0xd,ObjectAttributes:0x0,MaximumSize:0x0,SectionPageProtection:0x10,AllocationAttributes:0x1000000,FileHandle:\Windows\System32\windows.storage.dll,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefc547000,RegionSize:0x14d960,NewProtectWin32:0x2,OldProtect:0x14d9d0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14d958,NewProtectWin32:0x4,OldProtect:0x14d950,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14d958,NewProtectWin32:0x2,OldProtect:0x14d950,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefc3e3630,RegionSize:0x14d9b8,NewProtectWin32:0x4,OldProtect:0x5ca488,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryAttributesFile(FileName:C:\Users\Jason\Desktop\Wldp.dll,ObjectAttributes:OBJ_CASE_INSENSITIVE,Status:0xc0000034,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryAttributesFile(FileName:C:\Windows\SYSTEM32\Wldp.dll,ObjectAttributes:OBJ_CASE_INSENSITIVE,CreationTime:1719544801,LastAccessTime:1786262717,LastWriteTime:1719544801,ChangeTime:1719546184,FileAttributes:FILE_ATTRIBUTE_ARCHIVE,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\SYSTEM32\Wldp.dll,FileHandle:0x274,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_DATA | FILE_EXECUTE | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_DELETE,OpenOptions:FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtCreateSection(SectionHandle:0x14d9a8,DesiredAccess:0xd,ObjectAttributes:0x0,MaximumSize:0x0,SectionPageProtection:0x10,AllocationAttributes:0x1000000,FileHandle:\Windows\System32\wldp.dll,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefd6aa000,RegionSize:0x14d850,NewProtectWin32:0x2,OldProtect:0x14d8c0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14d848,NewProtectWin32:0x4,OldProtect:0x14d840,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14d848,NewProtectWin32:0x2,OldProtect:0x14d840,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefd69a720,RegionSize:0x14d8a8,NewProtectWin32:0x4,OldProtect:0x5ca838,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefe958000,RegionSize:0x14d1c0,NewProtectWin32:0x2,OldProtect:0x14d230,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14d1b8,NewProtectWin32:0x4,OldProtect:0x14d1b0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14d1b8,NewProtectWin32:0x2,OldProtect:0x14d1b0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefe931d40,RegionSize:0x14d218,NewProtectWin32:0x4,OldProtect:0x5caa08,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefc3e3630,RegionSize:0x5ca470,NewProtectWin32:0x2,OldProtect:0x14dbc0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefe931d40,RegionSize:0x5ca9f0,NewProtectWin32:0x2,OldProtect:0x14dbc0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefd69a720,RegionSize:0x5ca820,NewProtectWin32:0x2,OldProtect:0x14dbc0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryAttributesFile(FileName:C:\Windows\SYSTEM32\ole32.dll,ObjectAttributes:OBJ_CASE_INSENSITIVE,CreationTime:1719544795,LastAccessTime:1786262718,LastWriteTime:1719544795,ChangeTime:1719546167,FileAttributes:FILE_ATTRIBUTE_ARCHIVE,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\SYSTEM32\ole32.dll,FileHandle:0x274,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_DATA | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_DELETE,OpenOptions:FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtCreateSection(SectionHandle:0x14d4b0,DesiredAccess:0x4,ObjectAttributes:0x0,MaximumSize:0x0,SectionPageProtection:0x2,AllocationAttributes:0x8000000,FileHandle:\Windows\System32\ole32.dll,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtUnmapViewOfSection(BaseAddress:0x2110000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtUnmapViewOfSectionEx(BaseAddress:0x2110000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefc547c78,RegionSize:0x14d2f0,NewProtectWin32:0x4,OldProtect:0x14d308,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefc547000,RegionSize:0x14d2f0,NewProtectWin32:0x2,OldProtect:0x14d308,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffeff4be590,RegionSize:0x14e200,NewProtectWin32:0x4,OldProtect:0x14e218,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffeff4be000,RegionSize:0x14e200,NewProtectWin32:0x2,OldProtect:0x14e218,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefc547a88,RegionSize:0x14e160,NewProtectWin32:0x4,OldProtect:0x14e178,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefc547000,RegionSize:0x14e160,NewProtectWin32:0x2,OldProtect:0x14e178,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefc548140,RegionSize:0x14dc30,NewProtectWin32:0x4,OldProtect:0x14dc48,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefc548000,RegionSize:0x14dc30,NewProtectWin32:0x2,OldProtect:0x14dc48,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff004b7000,RegionSize:0x14d570,NewProtectWin32:0x2,OldProtect:0x14d5e0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14d568,NewProtectWin32:0x4,OldProtect:0x14d560,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14d568,NewProtectWin32:0x2,OldProtect:0x14d560,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff00492dd0,RegionSize:0x14d5c8,NewProtectWin32:0x4,OldProtect:0x5c0b58,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff00492dd0,RegionSize:0x5c0b40,NewProtectWin32:0x2,OldProtect:0x14d5b0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff00252318,RegionSize:0x14dbf0,NewProtectWin32:0x4,OldProtect:0x14dc08,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff00252000,RegionSize:0x14dbf0,NewProtectWin32:0x2,OldProtect:0x14dc08,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff002526e8,RegionSize:0x14d980,NewProtectWin32:0x4,OldProtect:0x14d998,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff00252000,RegionSize:0x14d980,NewProtectWin32:0x2,OldProtect:0x14d998,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefc5476e8,RegionSize:0x14dc30,NewProtectWin32:0x4,OldProtect:0x14dc48,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefc547000,RegionSize:0x14dc30,NewProtectWin32:0x2,OldProtect:0x14dc48,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateMutant(MutantHandle:0x14ddc8,DesiredAccess:0x1f0001,ObjectAttributes:Local\SM0:4512:304:WilStaging_02,InitialOwner:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateMutant(MutantHandle:0x14df18,DesiredAccess:0x1f0001,ObjectAttributes:Local\SM0:4512:120:WilError_03,InitialOwner:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateSemaphore(SemaphoreHandle:0x14dc48,DesiredAccess:0x1f0003,ObjectAttributes:Local\SM0:4512:120:WilError_03_p0,InitialCount:0x172a88,MaximumCount:0x172a88,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateSemaphore(SemaphoreHandle:0x14dc48,DesiredAccess:0x1f0003,ObjectAttributes:Local\SM0:4512:120:WilError_03_p0h,InitialCount:0x0,MaximumCount:0x1,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateFile(FileHandle:0x14dc50,DesiredAccess:0x80100080,ObjectAttributes:\??\C:\Windows\Globalization\Sorting\sortdefault.nls,IoStatusBlock:0x14dc58,AllocationSize:0x0,FileAttributes:0x80,ShareAccess:0x1,CreateDisposition:0x1,CreateOptions:0x60,EaBuffer:0x0,EaLength:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtCreateFile(FileName:C:\Windows\Globalization\Sorting\sortdefault.nls,FileHandle:0x2bc,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | SYNCHRONIZE | GENERIC_READ,FileAttributes:FILE_ATTRIBUTE_NORMAL,ShareAccess:FILE_SHARE_READ,CreateDisposition:FILE_OPEN,CreateOptions:FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateSection(SectionHandle:0x14dce0,DesiredAccess:0xf0005,ObjectAttributes:0x0,MaximumSize:0x0,SectionPageProtection:0x2,AllocationAttributes:0x8000000,FileHandle:\Windows\Globalization\Sorting\SortDefault.nls,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefc547250,RegionSize:0x14d720,NewProtectWin32:0x4,OldProtect:0x14d738,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefc547000,RegionSize:0x14d720,NewProtectWin32:0x2,OldProtect:0x14d738,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x2b,ProcessInformation:0x5c1b10,ProcessInformationLength:0x218,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:\Device\MountPointManager,FileHandle:0x8000149c,ObjectAttributes:OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,IoStatusBlock:0,DesiredAccess:FILE_READ_ATTRIBUTES,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE,OpenOptions:FILE_NON_DIRECTORY_FILE,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:\Device\HarddiskVolume2,FileHandle:0x8000149c,ObjectAttributes:OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,IoStatusBlock:0,DesiredAccess:FILE_READ_ATTRIBUTES,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE,OpenOptions:FILE_NON_DIRECTORY_FILE,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:\Device\HarddiskVolume2,FileHandle:0x8000149c,ObjectAttributes:OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,IoStatusBlock:0,DesiredAccess:FILE_READ_ATTRIBUTES,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE,OpenOptions:FILE_NON_DIRECTORY_FILE,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefc547f10,RegionSize:0x14e130,NewProtectWin32:0x4,OldProtect:0x14e148,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefc547000,RegionSize:0x14e130,NewProtectWin32:0x2,OldProtect:0x14e148,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff004b7030,RegionSize:0x14d920,NewProtectWin32:0x4,OldProtect:0x14d938,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff004b7000,RegionSize:0x14d920,NewProtectWin32:0x2,OldProtect:0x14d938,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefc547f70,RegionSize:0x14dc60,NewProtectWin32:0x4,OldProtect:0x14dc78,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefc547000,RegionSize:0x14dc60,NewProtectWin32:0x2,OldProtect:0x14dc78,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefc547fc8,RegionSize:0x14dc60,NewProtectWin32:0x4,OldProtect:0x14dc78,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefc547000,RegionSize:0x14dc60,NewProtectWin32:0x2,OldProtect:0x14dc78,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
windows.storage.dll->NtOpenProcessToken(DesiredAccess:0x8,TokenHandle:0x14d428,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateMutant(MutantHandle:0x14ca38,DesiredAccess:0x1f0001,ObjectAttributes:Local\SM0:4512:304:WilStaging_02,InitialOwner:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0x8,TokenHandle:0x14ce90,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefeba4000,RegionSize:0x14c130,NewProtectWin32:0x2,OldProtect:0x14c1a0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14c128,NewProtectWin32:0x4,OldProtect:0x14c120,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14c128,NewProtectWin32:0x2,OldProtect:0x14c120,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefeb78dd8,RegionSize:0x14c188,NewProtectWin32:0x4,OldProtect:0x5bbba8,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefeb78dd8,RegionSize:0x5bbb90,NewProtectWin32:0x2,OldProtect:0x14c170,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffeffdc02b8,RegionSize:0x14c7b0,NewProtectWin32:0x4,OldProtect:0x14c7c8,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffeffdc0000,RegionSize:0x14c7b0,NewProtectWin32:0x2,OldProtect:0x14c7c8,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
clbcatq.dll->NtQueryInformationProcess(ProcessInformationClass:0x1a,ProcessInformation:0x14ce80,ProcessInformationLength:0x8,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0x8,TokenHandle:0x14b780,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryAttributesFile(FileName:C:\Users\Jason\Desktop\PROPSYS.dll,ObjectAttributes:OBJ_CASE_INSENSITIVE,Status:0xc0000034,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryAttributesFile(FileName:C:\Windows\SYSTEM32\PROPSYS.dll,ObjectAttributes:OBJ_CASE_INSENSITIVE,CreationTime:1719544760,LastAccessTime:1786262705,LastWriteTime:1719544760,ChangeTime:1719546268,FileAttributes:FILE_ATTRIBUTE_ARCHIVE,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\SYSTEM32\PROPSYS.dll,FileHandle:0x2ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_DATA | FILE_EXECUTE | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_DELETE,OpenOptions:FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtCreateSection(SectionHandle:0x14cba8,DesiredAccess:0xd,ObjectAttributes:0x0,MaximumSize:0x0,SectionPageProtection:0x10,AllocationAttributes:0x1000000,FileHandle:\Windows\System32\propsys.dll,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffef949f000,RegionSize:0x14ca50,NewProtectWin32:0x2,OldProtect:0x14cac0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14ca48,NewProtectWin32:0x4,OldProtect:0x14ca40,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14ca48,NewProtectWin32:0x2,OldProtect:0x14ca40,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffef946cb20,RegionSize:0x14caa8,NewProtectWin32:0x4,OldProtect:0x5c0d18,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffef946cb20,RegionSize:0x5c0d00,NewProtectWin32:0x2,OldProtect:0x14cd80,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtQueryLicenseValue(Name:TerminalServices-RemoteConnectionManager-AllowAppServerMode,Type:0x14c580,Buffer:0x14c570,Length:0x4,ReturnedLength:0x14c588,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefc5472f0,RegionSize:0x14d3c0,NewProtectWin32:0x4,OldProtect:0x14d3d8,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefc547000,RegionSize:0x14d3c0,NewProtectWin32:0x2,OldProtect:0x14d3d8,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffef949f010,RegionSize:0x14d340,NewProtectWin32:0x4,OldProtect:0x14d358,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffef949f000,RegionSize:0x14d340,NewProtectWin32:0x2,OldProtect:0x14d358,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff00252120,RegionSize:0x14d240,NewProtectWin32:0x4,OldProtect:0x14d258,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff00252000,RegionSize:0x14d240,NewProtectWin32:0x2,OldProtect:0x14d258,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefe958000,RegionSize:0x14d1d0,NewProtectWin32:0x4,OldProtect:0x14d1e8,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefe958000,RegionSize:0x14d1d0,NewProtectWin32:0x2,OldProtect:0x14d1e8,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffef949f230,RegionSize:0x14d330,NewProtectWin32:0x4,OldProtect:0x14d348,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffef949f000,RegionSize:0x14d330,NewProtectWin32:0x2,OldProtect:0x14d348,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0x8,TokenHandle:0x14bab8,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefc547d38,RegionSize:0x14b320,NewProtectWin32:0x4,OldProtect:0x14b338,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefc547000,RegionSize:0x14b320,NewProtectWin32:0x2,OldProtect:0x14b338,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0x8,TokenHandle:0x1499b8,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefc547eb0,RegionSize:0x149210,NewProtectWin32:0x4,OldProtect:0x149228,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefc547000,RegionSize:0x149210,NewProtectWin32:0x2,OldProtect:0x149228,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryAttributesFile(FileName:C:\Users\Jason\Desktop\profapi.dll,ObjectAttributes:OBJ_CASE_INSENSITIVE,Status:0xc0000034,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtQueryAttributesFile(FileName:C:\Windows\SYSTEM32\profapi.dll,ObjectAttributes:OBJ_CASE_INSENSITIVE,CreationTime:1719544808,LastAccessTime:1786262718,LastWriteTime:1719544808,ChangeTime:1719546172,FileAttributes:FILE_ATTRIBUTE_ARCHIVE,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\SYSTEM32\profapi.dll,FileHandle:0x300,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_DATA | FILE_EXECUTE | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_DELETE,OpenOptions:FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE,Status:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtCreateSection(SectionHandle:0x148a48,DesiredAccess:0xd,ObjectAttributes:0x0,MaximumSize:0x0,SectionPageProtection:0x10,AllocationAttributes:0x1000000,FileHandle:\Windows\System32\profapi.dll,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefdc81000,RegionSize:0x1488f0,NewProtectWin32:0x2,OldProtect:0x148960,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x1488e8,NewProtectWin32:0x4,OldProtect:0x1488e0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x1488e8,NewProtectWin32:0x2,OldProtect:0x1488e0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefdc76218,RegionSize:0x148948,NewProtectWin32:0x4,OldProtect:0x5c0998,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefdc76218,RegionSize:0x5c0980,NewProtectWin32:0x2,OldProtect:0x148c20,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefc548f68,RegionSize:0x149260,NewProtectWin32:0x4,OldProtect:0x149278,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefc548000,RegionSize:0x149260,NewProtectWin32:0x2,OldProtect:0x149278,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffeff4bd5c0,RegionSize:0x14e200,NewProtectWin32:0x4,OldProtect:0x14e218,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffeff4bd000,RegionSize:0x14e200,NewProtectWin32:0x2,OldProtect:0x14e218,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefecc1000,RegionSize:0x14d9a0,NewProtectWin32:0x2,OldProtect:0x14da10,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14d998,NewProtectWin32:0x4,OldProtect:0x14d990,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14d998,NewProtectWin32:0x2,OldProtect:0x14d990,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefec851b0,RegionSize:0x14d9f8,NewProtectWin32:0x4,OldProtect:0x5cfb88,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefec851b0,RegionSize:0x5cfb70,NewProtectWin32:0x2,OldProtect:0x14d9e0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefecc10e8,RegionSize:0x14d0b0,NewProtectWin32:0x4,OldProtect:0x14d0c8,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefecc1000,RegionSize:0x14d0b0,NewProtectWin32:0x2,OldProtect:0x14d0c8,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x25,ProcessInformation:0x14d710,ProcessInformationLength:0x40,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x25,ProcessInformation:0x14d710,ProcessInformationLength:0x40,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffeffdc02e0,RegionSize:0x14e020,NewProtectWin32:0x4,OldProtect:0x14e038,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffeffdc0000,RegionSize:0x14e020,NewProtectWin32:0x2,OldProtect:0x14e038,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffeffdc0048,RegionSize:0x14e0a0,NewProtectWin32:0x4,OldProtect:0x14e0b8,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffeffdc0000,RegionSize:0x14e0a0,NewProtectWin32:0x2,OldProtect:0x14e0b8,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
user32.dll->CreateWindowExW(0x0,"","O",0x88000000,0x1480000000,0x7ffe80000000,0x80000000,0x80000000,0xfffffffffffffffd,0x0,0x7ffeffa90000,0x0,CalledFrom:0x7ffefe967150,ReturnValue:0x80000000,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
combase.dll->CreateWindowExW(0x0,"","O",0x88000000,0x1480000000,0x7ffe80000000,0x80000000,0x80000000,0xfffffffffffffffd,0x0,0x7ffeffa90000,0x0,CalledFrom:0x7ffeffb61cc7,ReturnValue:0x601c4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefc5480c0,RegionSize:0x14d8b0,NewProtectWin32:0x4,OldProtect:0x14d8c8,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefc548000,RegionSize:0x14d8b0,NewProtectWin32:0x2,OldProtect:0x14d8c8,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateMutant(MutantHandle:0x14d608,DesiredAccess:0x1f0001,ObjectAttributes:Local\SM0:4512:304:WilStaging_02,InitialOwner:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0x8,TokenHandle:0x14da58,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefc547d08,RegionSize:0x14ce20,NewProtectWin32:0x4,OldProtect:0x14ce38,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefc547000,RegionSize:0x14ce20,NewProtectWin32:0x2,OldProtect:0x14ce38,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
user32.dll->CreateWindowExW(0x0,"","O",0x88000000,0x1480000000,0x7ffe80000000,0x80000000,0x80000000,0xfffffffffffffffd,0x0,0x7ffeffa90000,0x0,CalledFrom:0x7ffefe967150,ReturnValue:0x80000000,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
combase.dll->CreateWindowExW(0x0,"","O",0x88000000,0x1480000000,0x7ffe80000000,0x80000000,0x80000000,0xfffffffffffffffd,0x0,0x7ffeffa90000,0x0,CalledFrom:0x7ffeffb61cc7,ReturnValue:0x701c4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
windows.storage.dll->NtOpenProcessToken(DesiredAccess:0x8,TokenHandle:0x14d428,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0x8,TokenHandle:0x14ce90,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
clbcatq.dll->NtQueryInformationProcess(ProcessInformationClass:0x1a,ProcessInformation:0x14ce80,ProcessInformationLength:0x8,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
user32.dll->CreateWindowExW(0x0,"","O",0x88000000,0x1480000000,0x7ffe80000000,0x80000000,0x80000000,0xfffffffffffffffd,0x0,0x7ffeffa90000,0x0,CalledFrom:0x7ffefe967150,ReturnValue:0x80000000,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
combase.dll->CreateWindowExW(0x0,"","O",0x88000000,0x1480000000,0x7ffe80000000,0x80000000,0x80000000,0xfffffffffffffffd,0x0,0x7ffeffa90000,0x0,CalledFrom:0x7ffeffb61cc7,ReturnValue:0x801c4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
user32.dll->CreateWindowExW(0x0,"","O",0x88000000,0x1480000000,0x7ffe80000000,0x80000000,0x80000000,0xfffffffffffffffd,0x0,0x7ffeffa90000,0x0,CalledFrom:0x7ffefe967150,ReturnValue:0x80000000,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
combase.dll->CreateWindowExW(0x0,"","O",0x88000000,0x1480000000,0x7ffe80000000,0x80000000,0x80000000,0xfffffffffffffffd,0x0,0x7ffeffa90000,0x0,CalledFrom:0x7ffeffb61cc7,ReturnValue:0x901c4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
windows.storage.dll->NtOpenProcessToken(DesiredAccess:0x8,TokenHandle:0x14d428,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0x8,TokenHandle:0x14ce90,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
clbcatq.dll->NtQueryInformationProcess(ProcessInformationClass:0x1a,ProcessInformation:0x14ce80,ProcessInformationLength:0x8,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
user32.dll->CreateWindowExW(0x0,"","O",0x88000000,0x1480000000,0x7ffe80000000,0x80000000,0x80000000,0xfffffffffffffffd,0x0,0x7ffeffa90000,0x0,CalledFrom:0x7ffefe967150,ReturnValue:0x80000000,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
combase.dll->CreateWindowExW(0x0,"","O",0x88000000,0x1480000000,0x7ffe80000000,0x80000000,0x80000000,0xfffffffffffffffd,0x0,0x7ffeffa90000,0x0,CalledFrom:0x7ffeffb61cc7,ReturnValue:0xa01c4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
windows.storage.dll->NtOpenProcessToken(DesiredAccess:0x8,TokenHandle:0x14d428,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0x8,TokenHandle:0x14ce90,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
clbcatq.dll->NtQueryInformationProcess(ProcessInformationClass:0x1a,ProcessInformation:0x14ce80,ProcessInformationLength:0x8,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0x28,TokenHandle:0x14fe10,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffefe84b188,0x82,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x14fc90,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14f5e0,CalledFrom:0x7ffefe6f0090,ReturnValue:0x58,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14f5e0,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffefe84b188,0x1f,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x14fcf0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14f6c0,CalledFrom:0x7ffefe6f0090,ReturnValue:0x60,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14f6c0,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffefe84b188,0x0,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14f6d0,CalledFrom:0x7ffefe6f0090,ReturnValue:0x14,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14f6d0,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtAdjustPrivilegesToken(ProcessHandle:492,NewState:[{'SE_DEBUG_PRIVILEGE': 'SE_PRIVILEGE_ENABLED'}],timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtAdjustPrivilegesToken(TokenHandle:0x1ec,DisableAllPrivileges:0x0,BufferLength:0x0,PreviousState:0x0,ReturnLength:0x0,SNewState:0x14fe40,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtQueryInformationProcess(ProcessInformationClass:0x7,ProcessInformation:0x14fd98,ProcessInformationLength:0x8,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtQueryInformationProcess(ProcessInformationClass:0x1e,ProcessInformation:0x14fda0,ProcessInformationLength:0x8,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtQueryInformationProcess(ProcessInformationClass:0x1f,ProcessInformation:0x14fd90,ProcessInformationLength:0x4,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtCreateSection(SectionHandle:0x14f500,DesiredAccess:0xf001f,ObjectAttributes:0x0,MaximumSize:0x14f520,SectionPageProtection:0x4,AllocationAttributes:0x4000000,FileHandle:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtCreateSection(SectionHandle:0x14f678,DesiredAccess:0xf0007,ObjectAttributes:0x0,MaximumSize:0x14f530,SectionPageProtection:0x4,AllocationAttributes:0x8000000,FileHandle:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtUnmapViewOfSection(BaseAddress:0x2450000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtUnmapViewOfSectionEx(BaseAddress:0x2450000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->CreateThread(0x0,0x0,0x1402a562c,0x5cec30,0x0,0x14f700,0x5726b0,0x140051800,CalledFrom:0x7fff0036b8b0,ReturnValue:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateThreadEx(ThreadHandle:0x14f128,DesiredAccess:0x1fffff,ObjectAttributes:0x0,StartRoutine:0x1402a562c,Argument:0x5cec30,CreateFlags:0x0,ZeroBits:0x0,StackSize:0x0,MaximumStackSize:0x0,AttributeList:0x14f250,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->CreateThread(0x0,0x0,0x1402a562c,0x5cec30,0x0,0x14f700,0x5726b0,0x140051800,CalledFrom:0x1402a57d2,ReturnValue:0x1e4,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
advapi32.dll->OpenSCManagerW("","",0xf003f,CalledFrom:0x7ffefe7f7a10,ReturnValue:0x1,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
sechost.dll->OpenSCManagerW("","",0xf003f,CalledFrom:0x7ffeff9e83e0,ReturnValue:0x1,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa57da2,CalledFrom:0x7ffefe6b1010,ReturnValue:0x14f698,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa57da2,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f648,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa57da2,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
advapi32.dll->OpenServiceW(0x5ce9c0,"DPS",0x24,CalledFrom:0x7ffefe7f7c30,ReturnValue:0x5ce9c0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
sechost.dll->OpenServiceW(0x5ce9c0,"DPS",0x24,CalledFrom:0x7ffeff9e8360,ReturnValue:0x5ce9c0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa57034,CalledFrom:0x7ffefe6b1010,ReturnValue:0x14f708,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa57034,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f698,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa57034,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
advapi32.dll->ControlService(0x5ce9f0,0x1,0x14f7b8,CalledFrom:0x7ffefe811a80,ReturnValue:0x1,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
sechost.dll->ControlService(0x5ce9f0,0x1,0x14f7b8,CalledFrom:0x7ffeff9ee940,ReturnValue:0x1,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56c3e,CalledFrom:0x7ffefe6b1010,ReturnValue:0x1,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56c3e,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f698,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56c3e,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x1,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x14041a000,RegionSize:0x254fe50,NewProtectWin32:0x4,OldProtect:0x254feb0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x14041a000,RegionSize:0x254fe50,NewProtectWin32:0x2,OldProtect:0x254feb0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
CapCutService.exe->NtQueryInformationProcess(ProcessInformationClass:0x7,ProcessInformation:0x254f8f0,ProcessInformationLength:0x8,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
CapCutService.exe->NtQueryInformationProcess(ProcessInformationClass:0x1e,ProcessInformation:0x254f978,ProcessInformationLength:0x8,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
CapCutService.exe->NtQueryInformationProcess(ProcessInformationClass:0x1f,ProcessInformation:0x254fed8,ProcessInformationLength:0x4,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
ntdll.dll->NtCreateSection(SectionHandle:0x254f630,DesiredAccess:0xf001f,ObjectAttributes:0x0,MaximumSize:0x254f650,SectionPageProtection:0x4,AllocationAttributes:0x4000000,FileHandle:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtCreateSection(SectionHandle:0x254f7a8,DesiredAccess:0xf0007,ObjectAttributes:0x0,MaximumSize:0x254f660,SectionPageProtection:0x4,AllocationAttributes:0x8000000,FileHandle:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
ntdll.dll->NtUnmapViewOfSection(BaseAddress:0x2550000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
ntdll.dll->NtUnmapViewOfSectionEx(BaseAddress:0x2550000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:5100
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262719.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262720.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262720.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262720.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262720.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262720.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262720.0) // CapCutService.exe PID:4512 TID:4516
NtQueryFullAttributesFile(FileName:C:\Windows\Prefetch,ObjectAttributes:OBJ_CASE_INSENSITIVE,CreationTime:1719534317,LastAccessTime:1786262718,LastWriteTime:1786262709,ChangeTime:1786262718,FileAttributes:FILE_ATTRIBUTE_INTEGRITY_STREAM | FILE_ATTRIBUTE_NO_SCRUB_DATA,timestamp:1786262720.0) // CapCutService.exe PID:4512 TID:5056
NtOpenFile(FileName:C:\Windows\Prefetch\,FileHandle:0x318,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_LIST_DIRECTORY | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT | FILE_OPEN_FOR_BACKUP_INTENT,Status:0x0,timestamp:1786262720.0) // CapCutService.exe PID:4512 TID:5056
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262720.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262720.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262720.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262720.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262720.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262720.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262720.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262720.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262720.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262720.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262720.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262720.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262720.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262720.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262720.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262720.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262720.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262720.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262721.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262721.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262721.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262721.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262721.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262721.0) // CapCutService.exe PID:4512 TID:4516
NtQueryFullAttributesFile(FileName:C:\Windows\Prefetch,ObjectAttributes:OBJ_CASE_INSENSITIVE,CreationTime:1719534317,LastAccessTime:1786262719,LastWriteTime:1786262709,ChangeTime:1786262718,FileAttributes:FILE_ATTRIBUTE_INTEGRITY_STREAM | FILE_ATTRIBUTE_NO_SCRUB_DATA,timestamp:1786262721.0) // CapCutService.exe PID:4512 TID:5056
NtOpenFile(FileName:C:\Windows\Prefetch\,FileHandle:0x31c,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_LIST_DIRECTORY | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT | FILE_OPEN_FOR_BACKUP_INTENT,Status:0x0,timestamp:1786262721.0) // CapCutService.exe PID:4512 TID:5056
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262721.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262721.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262721.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262721.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262721.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262721.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262721.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262721.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262721.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262721.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262721.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262721.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262721.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262721.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262721.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:4516
NtQueryFullAttributesFile(FileName:C:\Windows\Prefetch,ObjectAttributes:OBJ_CASE_INSENSITIVE,CreationTime:1719534317,LastAccessTime:1786262720,LastWriteTime:1786262709,ChangeTime:1786262718,FileAttributes:FILE_ATTRIBUTE_INTEGRITY_STREAM | FILE_ATTRIBUTE_NO_SCRUB_DATA,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5056
NtOpenFile(FileName:C:\Windows\Prefetch\,FileHandle:0x318,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_LIST_DIRECTORY | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT | FILE_OPEN_FOR_BACKUP_INTENT,Status:0x0,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5056
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtQueryInformationProcess(ProcessInformationClass:0x7,ProcessInformation:0x254f8f0,ProcessInformationLength:0x8,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
CapCutService.exe->NtQueryInformationProcess(ProcessInformationClass:0x1e,ProcessInformation:0x254f978,ProcessInformationLength:0x8,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
CapCutService.exe->NtQueryInformationProcess(ProcessInformationClass:0x1f,ProcessInformation:0x254fed8,ProcessInformationLength:0x4,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
ntdll.dll->NtCreateSection(SectionHandle:0x254f630,DesiredAccess:0xf001f,ObjectAttributes:0x0,MaximumSize:0x254f650,SectionPageProtection:0x4,AllocationAttributes:0x4000000,FileHandle:0x0,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtCreateSection(SectionHandle:0x254f7a8,DesiredAccess:0xf0007,ObjectAttributes:0x0,MaximumSize:0x254f660,SectionPageProtection:0x4,AllocationAttributes:0x8000000,FileHandle:0x0,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
ntdll.dll->NtUnmapViewOfSection(BaseAddress:0x2550000,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
ntdll.dll->NtUnmapViewOfSectionEx(BaseAddress:0x2550000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:5100
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262722.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262723.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262723.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262723.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262723.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262723.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262723.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262723.0) // CapCutService.exe PID:4512 TID:4516
NtQueryFullAttributesFile(FileName:C:\Windows\Prefetch,ObjectAttributes:OBJ_CASE_INSENSITIVE,CreationTime:1719534317,LastAccessTime:1786262721,LastWriteTime:1786262709,ChangeTime:1786262718,FileAttributes:FILE_ATTRIBUTE_INTEGRITY_STREAM | FILE_ATTRIBUTE_NO_SCRUB_DATA,timestamp:1786262723.0) // CapCutService.exe PID:4512 TID:5056
NtOpenFile(FileName:C:\Windows\Prefetch\,FileHandle:0x318,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_LIST_DIRECTORY | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT | FILE_OPEN_FOR_BACKUP_INTENT,Status:0x0,timestamp:1786262723.0) // CapCutService.exe PID:4512 TID:5056
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262723.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262723.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262723.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262723.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262723.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262723.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262723.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262723.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262723.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262723.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262723.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262723.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262724.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262724.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262724.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262724.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262724.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262724.0) // CapCutService.exe PID:4512 TID:4516
NtQueryFullAttributesFile(FileName:C:\Windows\Prefetch,ObjectAttributes:OBJ_CASE_INSENSITIVE,CreationTime:1719534317,LastAccessTime:1786262722,LastWriteTime:1786262709,ChangeTime:1786262718,FileAttributes:FILE_ATTRIBUTE_INTEGRITY_STREAM | FILE_ATTRIBUTE_NO_SCRUB_DATA,timestamp:1786262724.0) // CapCutService.exe PID:4512 TID:5056
NtOpenFile(FileName:C:\Windows\Prefetch\,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_LIST_DIRECTORY | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT | FILE_OPEN_FOR_BACKUP_INTENT,Status:0x0,timestamp:1786262724.0) // CapCutService.exe PID:4512 TID:5056
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262724.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262724.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262724.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262724.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262724.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262724.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262724.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262724.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262724.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262724.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262724.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262724.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262724.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262724.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262724.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262724.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262724.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262724.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:4516
NtQueryFullAttributesFile(FileName:C:\Windows\Prefetch,ObjectAttributes:OBJ_CASE_INSENSITIVE,CreationTime:1719534317,LastAccessTime:1786262723,LastWriteTime:1786262709,ChangeTime:1786262718,FileAttributes:FILE_ATTRIBUTE_INTEGRITY_STREAM | FILE_ATTRIBUTE_NO_SCRUB_DATA,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5056
NtOpenFile(FileName:C:\Windows\Prefetch\,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_LIST_DIRECTORY | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT | FILE_OPEN_FOR_BACKUP_INTENT,Status:0x0,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5056
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtQueryInformationProcess(ProcessInformationClass:0x7,ProcessInformation:0x254f8f0,ProcessInformationLength:0x8,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
CapCutService.exe->NtQueryInformationProcess(ProcessInformationClass:0x1e,ProcessInformation:0x254f978,ProcessInformationLength:0x8,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
CapCutService.exe->NtQueryInformationProcess(ProcessInformationClass:0x1f,ProcessInformation:0x254fed8,ProcessInformationLength:0x4,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
ntdll.dll->NtCreateSection(SectionHandle:0x254f630,DesiredAccess:0xf001f,ObjectAttributes:0x0,MaximumSize:0x254f650,SectionPageProtection:0x4,AllocationAttributes:0x4000000,FileHandle:0x0,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtCreateSection(SectionHandle:0x254f7a8,DesiredAccess:0xf0007,ObjectAttributes:0x0,MaximumSize:0x254f660,SectionPageProtection:0x4,AllocationAttributes:0x8000000,FileHandle:0x0,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
ntdll.dll->NtUnmapViewOfSection(BaseAddress:0x2550000,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
ntdll.dll->NtUnmapViewOfSectionEx(BaseAddress:0x2550000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:5100
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262725.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtQueryFullAttributesFile(FileName:C:\Windows\Prefetch,ObjectAttributes:OBJ_CASE_INSENSITIVE,CreationTime:1719534317,LastAccessTime:1786262724,LastWriteTime:1786262709,ChangeTime:1786262718,FileAttributes:FILE_ATTRIBUTE_INTEGRITY_STREAM | FILE_ATTRIBUTE_NO_SCRUB_DATA,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:5056
NtOpenFile(FileName:C:\Windows\Prefetch\,FileHandle:0x2c8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_LIST_DIRECTORY | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT | FILE_OPEN_FOR_BACKUP_INTENT,Status:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:5056
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56d56,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56c12,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56c12,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56c12,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56c12,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56c12,CalledFrom:0x7ffefe6b1040,ReturnValue:0x14f6a8,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56c12,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtQueryAttributesFile(FileName:C:\Users\Jason\Desktop\CRYPTSP.dll,ObjectAttributes:OBJ_CASE_INSENSITIVE,Status:0xc0000034,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtQueryAttributesFile(FileName:C:\Windows\SYSTEM32\CRYPTSP.dll,ObjectAttributes:OBJ_CASE_INSENSITIVE,CreationTime:1719544802,LastAccessTime:1786262720,LastWriteTime:1719544802,ChangeTime:1719546186,FileAttributes:FILE_ATTRIBUTE_ARCHIVE,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\SYSTEM32\CRYPTSP.dll,FileHandle:0x314,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_DATA | FILE_EXECUTE | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_DELETE,OpenOptions:FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE,Status:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtCreateSection(SectionHandle:0x14dbc8,DesiredAccess:0xd,ObjectAttributes:0x0,MaximumSize:0x0,SectionPageProtection:0x10,AllocationAttributes:0x1000000,FileHandle:\Windows\System32\cryptsp.dll,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefd5f5000,RegionSize:0x14da70,NewProtectWin32:0x2,OldProtect:0x14dae0,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14da68,NewProtectWin32:0x4,OldProtect:0x14da60,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14da68,NewProtectWin32:0x2,OldProtect:0x14da60,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefd5ed920,RegionSize:0x14dac8,NewProtectWin32:0x4,OldProtect:0x5c0c38,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefd5ed920,RegionSize:0x5c0c20,NewProtectWin32:0x2,OldProtect:0x14dda0,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefe88c040,RegionSize:0x14e3e0,NewProtectWin32:0x4,OldProtect:0x14e3f8,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefe88c000,RegionSize:0x14e3e0,NewProtectWin32:0x2,OldProtect:0x14e3f8,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtQueryAttributesFile(FileName:C:\Windows\system32\rsaenh.dll,ObjectAttributes:OBJ_CASE_INSENSITIVE,CreationTime:1719544803,LastAccessTime:1786262723,LastWriteTime:1719544803,ChangeTime:1719546005,FileAttributes:FILE_ATTRIBUTE_ARCHIVE,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\system32\rsaenh.dll,FileHandle:0x2cc,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_DATA | FILE_EXECUTE | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_DELETE,OpenOptions:FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE,Status:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtCreateSection(SectionHandle:0x14e2a8,DesiredAccess:0xd,ObjectAttributes:0x0,MaximumSize:0x0,SectionPageProtection:0x10,AllocationAttributes:0x1000000,FileHandle:\Windows\System32\rsaenh.dll,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefcd2e000,RegionSize:0x14e150,NewProtectWin32:0x2,OldProtect:0x14e1c0,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14e148,NewProtectWin32:0x4,OldProtect:0x14e140,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14e148,NewProtectWin32:0x2,OldProtect:0x14e140,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefcd24430,RegionSize:0x14e1a8,NewProtectWin32:0x4,OldProtect:0x627ca8,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefcd24430,RegionSize:0x627c90,NewProtectWin32:0x2,OldProtect:0x14e090,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0xc,TokenHandle:0x14e410,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0x8,TokenHandle:0x14e410,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtQueryAttributesFile(FileName:C:\Users\Jason\Desktop\CRYPTBASE.dll,ObjectAttributes:OBJ_CASE_INSENSITIVE,Status:0xc0000034,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtQueryAttributesFile(FileName:C:\Windows\SYSTEM32\CRYPTBASE.dll,ObjectAttributes:OBJ_CASE_INSENSITIVE,CreationTime:1719544808,LastAccessTime:1786262723,LastWriteTime:1719544808,ChangeTime:1719546185,FileAttributes:FILE_ATTRIBUTE_ARCHIVE,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\SYSTEM32\CRYPTBASE.dll,FileHandle:0x300,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_DATA | FILE_EXECUTE | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_DELETE,OpenOptions:FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE,Status:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtCreateSection(SectionHandle:0x14d478,DesiredAccess:0xd,ObjectAttributes:0x0,MaximumSize:0x0,SectionPageProtection:0x10,AllocationAttributes:0x1000000,FileHandle:\Windows\System32\cryptbase.dll,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefd5d9000,RegionSize:0x14d320,NewProtectWin32:0x2,OldProtect:0x14d390,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14d318,NewProtectWin32:0x4,OldProtect:0x14d310,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14d318,NewProtectWin32:0x2,OldProtect:0x14d310,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefd5d4128,RegionSize:0x14d378,NewProtectWin32:0x4,OldProtect:0x5f7428,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefd5d4128,RegionSize:0x5f7410,NewProtectWin32:0x2,OldProtect:0x14d650,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:\Device\KsecDD,FileHandle:0x300,ObjectAttributes:Attributes=0,IoStatusBlock:0,DesiredAccess:FILE_READ_DATA | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_SYNCHRONOUS_IO_NONALERT,Status:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefcd2e018,RegionSize:0x14dc90,NewProtectWin32:0x4,OldProtect:0x14dca8,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefcd2e000,RegionSize:0x14dc90,NewProtectWin32:0x2,OldProtect:0x14dca8,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefd5d9050,RegionSize:0x14dc60,NewProtectWin32:0x4,OldProtect:0x14dc78,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefd5d9000,RegionSize:0x14dc60,NewProtectWin32:0x2,OldProtect:0x14dc78,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->getaddrinfo(0x14f228,0x14e7e0,0x14e800,0x14e868,CalledFrom:0x7ffefffa3710,ReturnValue:0x14e7e0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->GetAddrInfoW(0x624f70,0x62e8d0,0x14e740,0x14e868,CalledFrom:0x7ffefffa5b20,ReturnValue:0x62e8d0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->socket(0x2,0x2,0x0,CalledFrom:0x7ffefffa55f0,ReturnValue:0x7ffefffa2d30,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->WSASocketW(0x2,0x2,0x0,0x0,0x7ffe00000000,0x7ffe00000001,CalledFrom:0x7ffefffa56b0,ReturnValue:0x577d70,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtQueryAttributesFile(FileName:C:\Windows\system32\mswsock.dll,ObjectAttributes:OBJ_CASE_INSENSITIVE,CreationTime:1719544797,LastAccessTime:1786262724,LastWriteTime:1719544797,ChangeTime:1719546174,FileAttributes:FILE_ATTRIBUTE_ARCHIVE,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\system32\mswsock.dll,FileHandle:0x310,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_DATA | FILE_EXECUTE | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_DELETE,OpenOptions:FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE,Status:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtCreateSection(SectionHandle:0x14d5d8,DesiredAccess:0xd,ObjectAttributes:0x0,MaximumSize:0x0,SectionPageProtection:0x10,AllocationAttributes:0x1000000,FileHandle:\Windows\System32\mswsock.dll,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefd447000,RegionSize:0x14d480,NewProtectWin32:0x2,OldProtect:0x14d4f0,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14d478,NewProtectWin32:0x4,OldProtect:0x14d470,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14d478,NewProtectWin32:0x2,OldProtect:0x14d470,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefd434240,RegionSize:0x14d4d8,NewProtectWin32:0x4,OldProtect:0x629408,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefd434240,RegionSize:0x6293f0,NewProtectWin32:0x2,OldProtect:0x14d3c0,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0x8,TokenHandle:0x14df40,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
mswsock.dll->NtCreateFile(FileHandle:0x14dfe0,DesiredAccess:0xc0140000,ObjectAttributes:\Device\Afd\Endpoint,IoStatusBlock:0x14e020,AllocationSize:0x0,FileAttributes:0x0,ShareAccess:0x3,CreateDisposition:0x3,CreateOptions:0x0,EaBuffer:0x14e070,EaLength:0x39,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtCreateFile(FileName:\Device\Afd\Endpoint,FileHandle:0x1ec,ObjectAttributes:OBJ_INHERIT | OBJ_CASE_INSENSITIVE,IoStatusBlock:0,DesiredAccess:WRITE_DAC | SYNCHRONIZE | GENERIC_WRITE | GENERIC_READ,FileAttributes:empty,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE,CreateDisposition:FILE_OPEN | FILE_CREATE | FILE_OPEN_IF,CreateOptions:empty,Status:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->WSASocketW(0x2,0x2,0x0,0x0,0x7ffe00000000,0x7ffe00000001,CalledFrom:0x7ffefffa565e,ReturnValue:0x1ec,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->closesocket(0x1ec,CalledFrom:0x7ffefffa5000,ReturnValue:0x1ec,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->closesocket(0x1ec,CalledFrom:0x7ffefffa2d5a,ReturnValue:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->socket(0x17,0x2,0x0,CalledFrom:0x7ffefffa55f0,ReturnValue:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->WSASocketW(0x17,0x2,0x0,0x0,0x7ffe00000000,0x7ffe00000001,CalledFrom:0x7ffefffa56b0,ReturnValue:0x577d70,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
mswsock.dll->NtCreateFile(FileHandle:0x14dfe0,DesiredAccess:0xc0140000,ObjectAttributes:\Device\Afd\Endpoint,IoStatusBlock:0x14e020,AllocationSize:0x0,FileAttributes:0x0,ShareAccess:0x3,CreateDisposition:0x3,CreateOptions:0x0,EaBuffer:0x14e070,EaLength:0x39,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtCreateFile(FileName:\Device\Afd\Endpoint,FileHandle:0x1ec,ObjectAttributes:OBJ_INHERIT | OBJ_CASE_INSENSITIVE,IoStatusBlock:0,DesiredAccess:WRITE_DAC | SYNCHRONIZE | GENERIC_WRITE | GENERIC_READ,FileAttributes:empty,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE,CreateDisposition:FILE_OPEN | FILE_CREATE | FILE_OPEN_IF,CreateOptions:empty,Status:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->WSASocketW(0x17,0x2,0x0,0x0,0x7ffe00000000,0x7ffe00000001,CalledFrom:0x7ffefffa565e,ReturnValue:0x1ec,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->closesocket(0x1ec,CalledFrom:0x7ffefffa5000,ReturnValue:0x1ec,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->closesocket(0x1ec,CalledFrom:0x7ffefffa2d81,ReturnValue:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtQueryAttributesFile(FileName:C:\Windows\SYSTEM32\DNSAPI.dll,ObjectAttributes:OBJ_CASE_INSENSITIVE,CreationTime:1719544797,LastAccessTime:1786262724,LastWriteTime:1719544797,ChangeTime:1719546173,FileAttributes:FILE_ATTRIBUTE_ARCHIVE,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\SYSTEM32\DNSAPI.dll,FileHandle:0x1ec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_DATA | FILE_EXECUTE | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_DELETE,OpenOptions:FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE,Status:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtCreateSection(SectionHandle:0x14c478,DesiredAccess:0xd,ObjectAttributes:0x0,MaximumSize:0x0,SectionPageProtection:0x10,AllocationAttributes:0x1000000,FileHandle:\Windows\System32\dnsapi.dll,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefd1bf000,RegionSize:0x14c320,NewProtectWin32:0x2,OldProtect:0x14c390,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14c318,NewProtectWin32:0x4,OldProtect:0x14c310,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14c318,NewProtectWin32:0x2,OldProtect:0x14c310,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefd19ab50,RegionSize:0x14c378,NewProtectWin32:0x4,OldProtect:0x63bf98,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefd19ab50,RegionSize:0x63bf80,NewProtectWin32:0x2,OldProtect:0x14c650,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtQueryAttributesFile(FileName:C:\Windows\SYSTEM32\IPHLPAPI.DLL,ObjectAttributes:OBJ_CASE_INSENSITIVE,CreationTime:1719544797,LastAccessTime:1786262724,LastWriteTime:1719544797,ChangeTime:1719546173,FileAttributes:FILE_ATTRIBUTE_ARCHIVE,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\SYSTEM32\IPHLPAPI.DLL,FileHandle:0x328,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_DATA | FILE_EXECUTE | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_DELETE,OpenOptions:FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE,Status:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtCreateSection(SectionHandle:0x14b538,DesiredAccess:0xd,ObjectAttributes:0x0,MaximumSize:0x0,SectionPageProtection:0x10,AllocationAttributes:0x1000000,FileHandle:\Windows\System32\IPHLPAPI.DLL,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefd0f8000,RegionSize:0x14b3e0,NewProtectWin32:0x2,OldProtect:0x14b450,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14b3d8,NewProtectWin32:0x4,OldProtect:0x14b3d0,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14b3d8,NewProtectWin32:0x2,OldProtect:0x14b3d0,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefd0ea340,RegionSize:0x14b438,NewProtectWin32:0x4,OldProtect:0x5f6f78,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefd0ea340,RegionSize:0x5f6f60,NewProtectWin32:0x2,OldProtect:0x14b710,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefd1bf010,RegionSize:0x14bd50,NewProtectWin32:0x4,OldProtect:0x14bd68,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefd1bf000,RegionSize:0x14bd50,NewProtectWin32:0x2,OldProtect:0x14bd68,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14b5e8,NewProtectWin32:0x4,OldProtect:0x14b5e0,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14b5e8,NewProtectWin32:0x2,OldProtect:0x14b5e0,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff001d3128,RegionSize:0x14b648,NewProtectWin32:0x4,OldProtect:0x63c158,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff001d3128,RegionSize:0x63c140,NewProtectWin32:0x2,OldProtect:0x14b630,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefd0f8058,RegionSize:0x14bc70,NewProtectWin32:0x4,OldProtect:0x14bc88,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefd0f8000,RegionSize:0x14bc70,NewProtectWin32:0x2,OldProtect:0x14bc88,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateFile(FileHandle:0x14c170,DesiredAccess:0x100080,ObjectAttributes:\??\Nsi,IoStatusBlock:0x14c178,AllocationSize:0x0,FileAttributes:0x0,ShareAccess:0x3,CreateDisposition:0x1,CreateOptions:0x40,EaBuffer:0x0,EaLength:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtCreateFile(FileName:Nsi,FileHandle:0x32c,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:0,DesiredAccess:FILE_READ_ATTRIBUTES | SYNCHRONIZE,FileAttributes:empty,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE,CreateDisposition:FILE_OPEN,CreateOptions:FILE_NON_DIRECTORY_FILE,Status:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
dnsapi.dll->NtQueryLicenseValue(Name:Kernel-ProductInfo,Type:0x14c470,Buffer:0x14c460,Length:0x4,ReturnedLength:0x14c468,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefd447000,RegionSize:0x14cc90,NewProtectWin32:0x4,OldProtect:0x14cca8,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefd447000,RegionSize:0x14cc90,NewProtectWin32:0x2,OldProtect:0x14cca8,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtQueryLicenseValue(Name:TerminalServices-RemoteConnectionManager-AllowAppServerMode,Type:0x14d000,Buffer:0x14cff0,Length:0x4,ReturnedLength:0x14d008,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtCreateKey(Key:\REGISTRY\MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters,ValueName:None,Value:None,RegOptions:empty,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateKey(KeyHandle:0x14c818,DesiredAccess:0x20019,ObjectAttributes:\System\CurrentControlSet\Services\Tcpip\Parameters,TitleIndex:0x0,Class:Class,CreateOptions:0x0,Disposition:0x14c918,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtCreateKey(Key:\REGISTRY\MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters,ValueName:None,Value:None,RegOptions:empty,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateKey(KeyHandle:0x14c5f8,DesiredAccess:0x20019,ObjectAttributes:\System\CurrentControlSet\Services\Tcpip\Parameters,TitleIndex:0x0,Class:Class,CreateOptions:0x0,Disposition:0x14c6f8,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtCreateKey(Key:\REGISTRY\MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters,ValueName:None,Value:None,RegOptions:empty,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateKey(KeyHandle:0x14c768,DesiredAccess:0x20019,ObjectAttributes:\System\CurrentControlSet\Services\Tcpip\Parameters,TitleIndex:0x0,Class:Class,CreateOptions:0x0,Disposition:0x14c868,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
dnsapi.dll->DnsQueryEx(0x14d340,0x14d300,0x0,CalledFrom:0x7ffefd10bc30,ReturnValue:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
mswsock.dll->DnsQueryEx(0x14d340,0x14d300,0x0,CalledFrom:0x7ffefd3eb163,ReturnValue:0x57,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0x8,TokenHandle:0x14d600,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtQueryAttributesFile(FileName:C:\Windows\System32\rasadhlp.dll,ObjectAttributes:OBJ_CASE_INSENSITIVE,CreationTime:1719544857,LastAccessTime:1786262724,LastWriteTime:1719544857,ChangeTime:1719546186,FileAttributes:FILE_ATTRIBUTE_ARCHIVE,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\System32\rasadhlp.dll,FileHandle:0x33c,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_DATA | FILE_EXECUTE | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_DELETE,OpenOptions:FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE,Status:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtCreateSection(SectionHandle:0x14d238,DesiredAccess:0xd,ObjectAttributes:0x0,MaximumSize:0x0,SectionPageProtection:0x10,AllocationAttributes:0x1000000,FileHandle:\Windows\System32\rasadhlp.dll,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffef79f7000,RegionSize:0x14d0e0,NewProtectWin32:0x2,OldProtect:0x14d150,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14d0d8,NewProtectWin32:0x4,OldProtect:0x14d0d0,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14d0d8,NewProtectWin32:0x2,OldProtect:0x14d0d0,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffef79f3128,RegionSize:0x14d138,NewProtectWin32:0x4,OldProtect:0x5bff18,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffef79f3128,RegionSize:0x5bff00,NewProtectWin32:0x2,OldProtect:0x14d020,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
rasadhlp.dll->NtCreateFile(FileHandle:0x14ce70,DesiredAccess:0x3,ObjectAttributes:\Device\RasAcd,IoStatusBlock:0x14ce78,AllocationSize:0x0,FileAttributes:0x80,ShareAccess:0x3,CreateDisposition:0x3,CreateOptions:0x0,EaBuffer:0x0,EaLength:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtCreateFile(FileName:\Device\RasAcd,FileHandle:0x1,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:None,DesiredAccess:FILE_READ_DATA | FILE_WRITE_DATA,FileAttributes:FILE_ATTRIBUTE_NORMAL,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE,CreateDisposition:FILE_OPEN | FILE_CREATE | FILE_OPEN_IF,CreateOptions:empty,Status:0xc0000034,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
dnsapi.dll->DnsQueryEx(0x14d340,0x14d300,0x0,CalledFrom:0x7ffefd10bc30,ReturnValue:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtCreateKey(Key:\REGISTRY\MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters,ValueName:None,Value:None,RegOptions:empty,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateKey(KeyHandle:0x14bfb8,DesiredAccess:0x20019,ObjectAttributes:\System\CurrentControlSet\Services\Tcpip\Parameters,TitleIndex:0x0,Class:Class,CreateOptions:0x0,Disposition:0x14c0b8,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtCreateKey(Key:\REGISTRY\MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters,ValueName:None,Value:None,RegOptions:empty,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateKey(KeyHandle:0x14bb98,DesiredAccess:0x20019,ObjectAttributes:\System\CurrentControlSet\Services\Tcpip\Parameters,TitleIndex:0x0,Class:Class,CreateOptions:0x0,Disposition:0x14bc98,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtCreateKey(Key:\REGISTRY\MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters,ValueName:None,Value:None,RegOptions:empty,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateKey(KeyHandle:0x14bd08,DesiredAccess:0x20019,ObjectAttributes:\System\CurrentControlSet\Services\Tcpip\Parameters,TitleIndex:0x0,Class:Class,CreateOptions:0x0,Disposition:0x14be08,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtCreateKey(Key:\REGISTRY\MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters,ValueName:None,Value:None,RegOptions:empty,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateKey(KeyHandle:0x14bdb8,DesiredAccess:0x20019,ObjectAttributes:\System\CurrentControlSet\Services\Tcpip\Parameters,TitleIndex:0x0,Class:Class,CreateOptions:0x0,Disposition:0x14beb8,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefd1bf0c0,RegionSize:0x14bc60,NewProtectWin32:0x4,OldProtect:0x14bc78,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefd1bf000,RegionSize:0x14bc60,NewProtectWin32:0x2,OldProtect:0x14bc78,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtOpenDirectoryObject(FileName:\RPC Control,ObjectAttributes:Attributes=0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NtOpenDirectoryObject(DirectoryHandle:0x14c160,DesiredAccess:0x20001,ObjectAttributes:\RPC Control,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0x8,TokenHandle:0x14c168,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtOpenDirectoryObject(FileName:\RPC Control,ObjectAttributes:Attributes=0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NtOpenDirectoryObject(DirectoryHandle:0x14bfc0,DesiredAccess:0x20001,ObjectAttributes:\RPC Control,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0x8,TokenHandle:0x14bfc8,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffefd193090,0x4,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14bf80,CalledFrom:0x7ffefe6f0090,ReturnValue:0x58,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14bf80,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtQueryAttributesFile(FileName:C:\Windows\System32\fwpuclnt.dll,ObjectAttributes:OBJ_CASE_INSENSITIVE,CreationTime:1719544762,LastAccessTime:1786262724,LastWriteTime:1719544762,ChangeTime:1719546186,FileAttributes:FILE_ATTRIBUTE_ARCHIVE,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\System32\fwpuclnt.dll,FileHandle:0x338,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_DATA | FILE_EXECUTE | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_DELETE,OpenOptions:FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE,Status:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtCreateSection(SectionHandle:0x14d348,DesiredAccess:0xd,ObjectAttributes:0x0,MaximumSize:0x0,SectionPageProtection:0x10,AllocationAttributes:0x1000000,FileHandle:\Windows\System32\FWPUCLNT.DLL,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffef81db000,RegionSize:0x14d1f0,NewProtectWin32:0x2,OldProtect:0x14d260,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14d1e8,NewProtectWin32:0x4,OldProtect:0x14d1e0,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14d1e8,NewProtectWin32:0x2,OldProtect:0x14d1e0,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffef81b8190,RegionSize:0x14d248,NewProtectWin32:0x4,OldProtect:0x5c0688,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffef81b8190,RegionSize:0x5c0670,NewProtectWin32:0x2,OldProtect:0x14d130,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateSemaphore(SemaphoreHandle:0x14d138,DesiredAccess:0x1f0003,ObjectAttributes:0x0,InitialCount:0x0,MaximumCount:0x1,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0x8,TokenHandle:0x14d510,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffefe791c80,0x7,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x62e9f0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14c7c0,CalledFrom:0x7ffefe6f0090,ReturnValue:0x94,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14c7c0,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffef81a7000,0x2,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x63fae8,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14cd20,CalledFrom:0x7ffefe6f0090,ReturnValue:0xf0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14cd20,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffef81a7000,0x4,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x624d00,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14cf20,CalledFrom:0x7ffefe6f0090,ReturnValue:0x18,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14cf20,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffef81a7000,0x3,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14cf20,CalledFrom:0x7ffefe6f0090,ReturnValue:0x14,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14cf20,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->socket(0x17,0x2,0x0,CalledFrom:0x7ffefffa55f0,ReturnValue:0x624fd0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->WSASocketW(0x17,0x2,0x0,0x0,0x0,0x1,CalledFrom:0x7ffefffa56b0,ReturnValue:0x577d70,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
mswsock.dll->NtCreateFile(FileHandle:0x14e0a0,DesiredAccess:0xc0140000,ObjectAttributes:\Device\Afd\Endpoint,IoStatusBlock:0x14e0e0,AllocationSize:0x0,FileAttributes:0x0,ShareAccess:0x3,CreateDisposition:0x3,CreateOptions:0x0,EaBuffer:0x14e130,EaLength:0x39,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtCreateFile(FileName:\Device\Afd\Endpoint,FileHandle:0x354,ObjectAttributes:OBJ_INHERIT | OBJ_CASE_INSENSITIVE,IoStatusBlock:0,DesiredAccess:WRITE_DAC | SYNCHRONIZE | GENERIC_WRITE | GENERIC_READ,FileAttributes:empty,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE,CreateDisposition:FILE_OPEN | FILE_CREATE | FILE_OPEN_IF,CreateOptions:empty,Status:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->WSASocketW(0x17,0x2,0x0,0x0,0x0,0x1,CalledFrom:0x7ffefffa565e,ReturnValue:0x354,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->closesocket(0x354,CalledFrom:0x7ffefffa5000,ReturnValue:0x14e4b8,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->closesocket(0x354,CalledFrom:0x7ffefffa4f8a,ReturnValue:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->WSASocketW(0x2,0x1,0x0,0x0,0x0,0x81,CalledFrom:0x7ffefffa56b0,ReturnValue:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
mswsock.dll->NtCreateFile(FileHandle:0x14e4b0,DesiredAccess:0xc0140000,ObjectAttributes:\Device\Afd\Endpoint,IoStatusBlock:0x14e4f0,AllocationSize:0x0,FileAttributes:0x0,ShareAccess:0x3,CreateDisposition:0x3,CreateOptions:0x0,EaBuffer:0x14e540,EaLength:0x39,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtCreateFile(FileName:\Device\Afd\Endpoint,FileHandle:0x354,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:0,DesiredAccess:WRITE_DAC | SYNCHRONIZE | GENERIC_WRITE | GENERIC_READ,FileAttributes:empty,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE,CreateDisposition:FILE_OPEN | FILE_CREATE | FILE_OPEN_IF,CreateOptions:empty,Status:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->WSASocketW(0x2,0x1,0x0,0x0,0x0,0x81,CalledFrom:0x140015900,ReturnValue:0x354,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->ioctlsocket(0x354,0x8004667e,0x14e790,CalledFrom:0x7ffefffa51e0,ReturnValue:0x354,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->ioctlsocket(0x354,0x8004667e,0x14e790,CalledFrom:0x1400041bc,ReturnValue:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->connect(0x354,0x62e730,0x10,CalledFrom:0x7ffefffb1a50,ReturnValue:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
mswsock.dll->NtCreateFile(FileHandle:0x14ddb8,DesiredAccess:0xc0100000,ObjectAttributes:\Device\Afd\AsyncConnectHlp,IoStatusBlock:0x14dd40,AllocationSize:0x0,FileAttributes:0x0,ShareAccess:0x3,CreateDisposition:0x3,CreateOptions:0x0,EaBuffer:0x0,EaLength:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtCreateFile(FileName:\Device\Afd\AsyncConnectHlp,FileHandle:0x358,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:0,DesiredAccess:SYNCHRONIZE | GENERIC_WRITE | GENERIC_READ,FileAttributes:empty,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE,CreateDisposition:FILE_OPEN | FILE_CREATE | FILE_OPEN_IF,CreateOptions:empty,Status:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->CreateThread(0x0,0x0,0x7ffefd3e1010,0x63d5a0,0x0,0x14ddb0,0x0,0x7ffefd3e2c52,CalledFrom:0x7fff0036b8b0,ReturnValue:0x14ddb0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateThreadEx(ThreadHandle:0x14d7e8,DesiredAccess:0x1fffff,ObjectAttributes:0x0,StartRoutine:0x7ffefd3e1010,Argument:0x63d5a0,CreateFlags:0x0,ZeroBits:0x0,StackSize:0x0,MaximumStackSize:0x0,AttributeList:0x14d910,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
mswsock.dll->CreateThread(0x0,0x0,0x7ffefd3e1010,0x63d5a0,0x0,0x14ddb0,0x0,0x7ffefd3e2c52,CalledFrom:0x7ffefd3ed345,ReturnValue:0x364,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
TcpCreateAndConnectTcbRateLimitComplete(Owner:\Device\HarddiskVolume2\Users\Jason\Desktop\CapCutService.exe,OwnerId:0,OwnerPID:4512,OwnerPPID:4496,Protocol:TCPv4,LocalIp:127.0.0.1,LocalPort:49727,RemoteIp:130.193.50.201,RemotePort:443,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14e130,0x14e340,0x14e550,0x14e7a8,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14e7a8,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14e130,0x14e340,0x14e550,0x14e7a8,CalledFrom:0x140004338,ReturnValue:0x1,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->ioctlsocket(0x354,0x8004667e,0x14e790,CalledFrom:0x7ffefffa51e0,ReturnValue:0x14ee50,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->ioctlsocket(0x354,0x8004667e,0x14e790,CalledFrom:0x140004404,ReturnValue:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->setsockopt(0x354,0xffff,0x1006,0x14e790,0x4,CalledFrom:0x7ffefffb10a0,ReturnValue:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->setsockopt(0x354,0xffff,0x1006,0x14e790,0x4,CalledFrom:0x140004460,ReturnValue:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->setsockopt(0x354,0xffff,0x1005,0x14e790,0x4,CalledFrom:0x7ffefffb10a0,ReturnValue:0x14e9a0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->setsockopt(0x354,0xffff,0x1005,0x14e790,0x4,CalledFrom:0x1400044ad,ReturnValue:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->FreeAddrInfoW(0x632490,CalledFrom:0x7ffefffb29f0,ReturnValue:0x14ee01,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->FreeAddrInfoW(0x632490,CalledFrom:0x140015a5b,ReturnValue:0x1,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->ioctlsocket(0x354,0x8004667e,0x14ea90,CalledFrom:0x7ffefffa51e0,ReturnValue:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->ioctlsocket(0x354,0x8004667e,0x14ea90,CalledFrom:0x140010011,ReturnValue:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
ntoskrnl.exe->NtCreateThreadEx(ThreadHandle:0xffff8289978ef1b0,DesiredAccess:0x1fffff,ObjectAttributes:0xffff8289978ef1c8,StartRoutine:0x7fff006bd110,Argument:0x646a70,CreateFlags:0x1,ZeroBits:0x0,StackSize:0x1000,MaximumStackSize:0x100000,AttributeList:0xffff8289978ef200,PProcessHandle:0xffffffff80000728,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefe27a430,RegionSize:0x14de30,NewProtectWin32:0x4,OldProtect:0x14de48,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefe27a000,RegionSize:0x14de30,NewProtectWin32:0x2,OldProtect:0x14de48,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtDuplicateToken(ExistingTokenHandle:0x38c,DesiredAccess:0x4,ObjectAttributes:0x14e4a0,EffectiveOnly:0x0,TokenType:0x2,NewTokenHandle:0x14e490,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtDuplicateToken(ExistingTokenHandle:0x38c,DesiredAccess:0x4,ObjectAttributes:0x14e320,EffectiveOnly:0x0,TokenType:0x2,NewTokenHandle:0x14e310,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtDuplicateToken(ExistingTokenHandle:0x38c,DesiredAccess:0x4,ObjectAttributes:0x14e1e0,EffectiveOnly:0x0,TokenType:0x2,NewTokenHandle:0x14e1d0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0x8,TokenHandle:0x14e050,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtDuplicateToken(ExistingTokenHandle:0x390,DesiredAccess:0x4,ObjectAttributes:0x14e1e0,EffectiveOnly:0x0,TokenType:0x2,NewTokenHandle:0x14e1d0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0x8,TokenHandle:0x14e050,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtCreateKey(Key:\REGISTRY\USER\S-1-5-21-1088755839-2761040374-1703837236-1001\Software\Microsoft\SystemCertificates\ROOT,ValueName:None,Value:None,RegOptions:empty,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateKey(KeyHandle:0x14ddb8,DesiredAccess:0x3001f,ObjectAttributes:\Software\Microsoft\SystemCertificates\ROOT,TitleIndex:0x0,Class:0x14e228,CreateOptions:0x0,Disposition:0x14deb8,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtDuplicateToken(ExistingTokenHandle:0x394,DesiredAccess:0x4,ObjectAttributes:0x14e0a0,EffectiveOnly:0x0,TokenType:0x2,NewTokenHandle:0x14e090,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0x8,TokenHandle:0x14df50,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtCreateKey(Key:\REGISTRY\USER\S-1-5-21-1088755839-2761040374-1703837236-1001\Software\Microsoft\SystemCertificates\ROOT,ValueName:None,Value:None,RegOptions:empty,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateKey(KeyHandle:0x14db68,DesiredAccess:0x3001f,ObjectAttributes:\Software\Microsoft\SystemCertificates\ROOT,TitleIndex:0x0,Class:0x14dfd8,CreateOptions:0x0,Disposition:0x14dc68,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0x8,TokenHandle:0x14df00,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtCreateKey(Key:\REGISTRY\USER\S-1-5-21-1088755839-2761040374-1703837236-1001\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\Certificates,ValueName:None,Value:None,RegOptions:empty,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateKey(KeyHandle:0x14daa8,DesiredAccess:0x3001f,ObjectAttributes:\Certificates,TitleIndex:0x0,Class:0x14df18,CreateOptions:0x0,Disposition:0x14dba8,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
crypt32.dll->NtQueryObject(Handle:0x39c,ObjectInformationClass:0x0,ObjectInformation:0x14e058,ObjectInformationLength:0x38,ReturnLength:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtCreateKey(Key:\REGISTRY\USER\S-1-5-21-1088755839-2761040374-1703837236-1001\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLs,ValueName:None,Value:None,RegOptions:empty,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateKey(KeyHandle:0x14daa8,DesiredAccess:0x3001f,ObjectAttributes:\CRLs,TitleIndex:0x0,Class:0x14df18,CreateOptions:0x0,Disposition:0x14dba8,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtCreateKey(Key:\REGISTRY\USER\S-1-5-21-1088755839-2761040374-1703837236-1001\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLs,ValueName:None,Value:None,RegOptions:empty,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateKey(KeyHandle:0x14daa8,DesiredAccess:0x3001f,ObjectAttributes:\CTLs,TitleIndex:0x0,Class:0x14df18,CreateOptions:0x0,Disposition:0x14dba8,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0x8,TokenHandle:0x14de90,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefe27a558,RegionSize:0x14d8c0,NewProtectWin32:0x4,OldProtect:0x14d8d8,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefe27a000,RegionSize:0x14d8c0,NewProtectWin32:0x2,OldProtect:0x14d8d8,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtQueryAttributesFile(FileName:C:\Users\Jason\Desktop\MSASN1.dll,ObjectAttributes:OBJ_CASE_INSENSITIVE,Status:0xc0000034,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtQueryAttributesFile(FileName:C:\Windows\SYSTEM32\MSASN1.dll,ObjectAttributes:OBJ_CASE_INSENSITIVE,CreationTime:1719544802,LastAccessTime:1786262725,LastWriteTime:1719544802,ChangeTime:1719546181,FileAttributes:FILE_ATTRIBUTE_ARCHIVE,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\SYSTEM32\MSASN1.dll,FileHandle:0x3a0,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_DATA | FILE_EXECUTE | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_DELETE,OpenOptions:FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE,Status:0x0,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtCreateSection(SectionHandle:0x14c848,DesiredAccess:0xd,ObjectAttributes:0x0,MaximumSize:0x0,SectionPageProtection:0x10,AllocationAttributes:0x1000000,FileHandle:\Windows\System32\msasn1.dll,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14c6e8,NewProtectWin32:0x4,OldProtect:0x14c6e0,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14c6e8,NewProtectWin32:0x2,OldProtect:0x14c6e0,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefd81a128,RegionSize:0x14c748,NewProtectWin32:0x4,OldProtect:0x63bb38,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefd81a128,RegionSize:0x63bb20,NewProtectWin32:0x2,OldProtect:0x14ca20,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefe27a108,RegionSize:0x14d060,NewProtectWin32:0x4,OldProtect:0x14d078,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefe27a000,RegionSize:0x14d060,NewProtectWin32:0x2,OldProtect:0x14d078,PProcessHandle:0xffffffffffffffff,timestamp:1786262726.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtDuplicateToken(ExistingTokenHandle:0x394,DesiredAccess:0x4,ObjectAttributes:0x14e0a0,EffectiveOnly:0x0,TokenType:0x2,NewTokenHandle:0x14e090,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0x8,TokenHandle:0x14df50,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->send(0x354,0x650c10,0x611,0x0,CalledFrom:0x7ffefffa2320,ReturnValue:0x286000,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->send(0x354,0x650c10,0x611,0x0,CalledFrom:0x1400db546,ReturnValue:0x611,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14e580,0x0,0x0,0x14e7a8,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14e7a8,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14e580,0x0,0x0,0x14e7a8,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->send(0x354,0x650c10,0x174,0x0,CalledFrom:0x7ffefffa2320,ReturnValue:0x286000,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->send(0x354,0x650c10,0x174,0x0,CalledFrom:0x1400db546,ReturnValue:0x174,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14e580,0x0,0x0,0x14e7a8,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14e7a8,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14e580,0x0,0x0,0x14e7a8,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->send(0x354,0x650c10,0x4a,0x0,CalledFrom:0x7ffefffa2320,ReturnValue:0x286000,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->send(0x354,0x650c10,0x4a,0x0,CalledFrom:0x1400db546,ReturnValue:0x4a,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->ioctlsocket(0x354,0x8004667e,0x14ea90,CalledFrom:0x7ffefffa51e0,ReturnValue:0x0,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->ioctlsocket(0x354,0x8004667e,0x14ea90,CalledFrom:0x14001009a,ReturnValue:0x0,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x0,0x14d890,0x0,0x14dab0,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14dab0,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x0,0x14d890,0x0,0x14dab0,CalledFrom:0x14000f5cf,ReturnValue:0x1,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->send(0x354,0x278a173,0x95,0x0,CalledFrom:0x7ffefffa2320,ReturnValue:0x286000,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->send(0x354,0x278a173,0x95,0x0,CalledFrom:0x1400db546,ReturnValue:0x95,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x14041a000,RegionSize:0x14d700,NewProtectWin32:0x4,OldProtect:0x14d760,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
NtQueryFullAttributesFile(FileName:C:\Windows\Prefetch,ObjectAttributes:OBJ_CASE_INSENSITIVE,CreationTime:1719534317,LastAccessTime:1786262725,LastWriteTime:1786262709,ChangeTime:1786262718,FileAttributes:FILE_ATTRIBUTE_INTEGRITY_STREAM | FILE_ATTRIBUTE_NO_SCRUB_DATA,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:5056
NtOpenFile(FileName:C:\Windows\Prefetch\,FileHandle:0x398,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_LIST_DIRECTORY | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT | FILE_OPEN_FOR_BACKUP_INTENT,Status:0x0,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:5056
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x14041a000,RegionSize:0x14d700,NewProtectWin32:0x2,OldProtect:0x14d760,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x14041a000,RegionSize:0x14d700,NewProtectWin32:0x4,OldProtect:0x14d760,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x14041a000,RegionSize:0x14d700,NewProtectWin32:0x2,OldProtect:0x14d760,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x14041a000,RegionSize:0x14d700,NewProtectWin32:0x4,OldProtect:0x14d760,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x14041a000,RegionSize:0x14d700,NewProtectWin32:0x2,OldProtect:0x14d760,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x14041a000,RegionSize:0x14d700,NewProtectWin32:0x4,OldProtect:0x14d760,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x14041a000,RegionSize:0x14d700,NewProtectWin32:0x2,OldProtect:0x14d760,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x14041a000,RegionSize:0x14d700,NewProtectWin32:0x4,OldProtect:0x14d760,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x14041a000,RegionSize:0x14d700,NewProtectWin32:0x2,OldProtect:0x14d760,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x14041a000,RegionSize:0x14d700,NewProtectWin32:0x4,OldProtect:0x14d760,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x14041a000,RegionSize:0x14d700,NewProtectWin32:0x2,OldProtect:0x14d760,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x14041a000,RegionSize:0x14d700,NewProtectWin32:0x4,OldProtect:0x14d760,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x14041a000,RegionSize:0x14d700,NewProtectWin32:0x2,OldProtect:0x14d760,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x14041a000,RegionSize:0x14d700,NewProtectWin32:0x4,OldProtect:0x14d760,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x14041a000,RegionSize:0x14d700,NewProtectWin32:0x2,OldProtect:0x14d760,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x14041a000,RegionSize:0x14d700,NewProtectWin32:0x4,OldProtect:0x14d760,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x14041a000,RegionSize:0x14d700,NewProtectWin32:0x2,OldProtect:0x14d760,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14d030,0x0,0x0,0x14d258,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14d258,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14d030,0x0,0x0,0x14d258,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14d030,0x0,0x0,0x14d258,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14d258,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14d030,0x0,0x0,0x14d258,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14d030,0x0,0x0,0x14d258,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14d258,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14d030,0x0,0x0,0x14d258,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14b958,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14b958,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14b958,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14b958,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14b958,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14b958,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14b958,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14b958,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14b958,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14b958,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14b958,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14b958,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->send(0x354,0x278a173,0x18,0x0,CalledFrom:0x7ffefffa2320,ReturnValue:0x286000,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->send(0x354,0x278a173,0x18,0x0,CalledFrom:0x1400db546,ReturnValue:0x18,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x27bc000,RegionSize:0x14d750,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x277d000,RegionSize:0x14d750,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x2797000,RegionSize:0x14d750,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->shutdown(0x354,0x2,CalledFrom:0x7ffefffb1cc0,ReturnValue:0x0,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->shutdown(0x354,0x2,CalledFrom:0x14000f249,ReturnValue:0x0,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->closesocket(0x354,CalledFrom:0x7ffefffa5000,ReturnValue:0x0,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->closesocket(0x354,CalledFrom:0x14000f259,ReturnValue:0x0,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x2797000,RegionSize:0x14ed20,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x2789000,RegionSize:0x14ed20,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x643000,RegionSize:0x14ed20,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x2779000,RegionSize:0x14ed20,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x652000,RegionSize:0x14ed20,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->getaddrinfo(0x14f228,0x14e7e0,0x14e800,0x14e868,CalledFrom:0x7ffefffa3710,ReturnValue:0x14e7e0,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->GetAddrInfoW(0x2769490,0x27602c0,0x14e740,0x14e868,CalledFrom:0x7ffefffa5b20,ReturnValue:0x27602c0,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
dnsapi.dll->DnsQueryEx(0x14d340,0x14d300,0x0,CalledFrom:0x7ffefd10bc30,ReturnValue:0x0,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
mswsock.dll->DnsQueryEx(0x14d340,0x14d300,0x0,CalledFrom:0x7ffefd3eb163,ReturnValue:0x57,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
rasadhlp.dll->NtCreateFile(FileHandle:0x14ce70,DesiredAccess:0x3,ObjectAttributes:\Device\RasAcd,IoStatusBlock:0x14ce78,AllocationSize:0x0,FileAttributes:0x80,ShareAccess:0x3,CreateDisposition:0x3,CreateOptions:0x0,EaBuffer:0x0,EaLength:0x0,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
NtCreateFile(FileName:\Device\RasAcd,FileHandle:0x40000000,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:None,DesiredAccess:FILE_READ_DATA | FILE_WRITE_DATA,FileAttributes:FILE_ATTRIBUTE_NORMAL,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE,CreateDisposition:FILE_OPEN | FILE_CREATE | FILE_OPEN_IF,CreateOptions:empty,Status:0xc0000034,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
dnsapi.dll->DnsQueryEx(0x14d340,0x14d300,0x0,CalledFrom:0x7ffefd10bc30,ReturnValue:0x0,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffefd193090,0x4,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x0,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14bf80,CalledFrom:0x7ffefe6f0090,ReturnValue:0x58,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14bf80,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->socket(0x17,0x2,0x0,CalledFrom:0x7ffefffa55f0,ReturnValue:0x27691c0,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->WSASocketW(0x17,0x2,0x0,0x0,0x0,0x1,CalledFrom:0x7ffefffa56b0,ReturnValue:0x577d70,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
mswsock.dll->NtCreateFile(FileHandle:0x14e0a0,DesiredAccess:0xc0140000,ObjectAttributes:\Device\Afd\Endpoint,IoStatusBlock:0x14e0e0,AllocationSize:0x0,FileAttributes:0x0,ShareAccess:0x3,CreateDisposition:0x3,CreateOptions:0x0,EaBuffer:0x14e130,EaLength:0x39,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
NtCreateFile(FileName:\Device\Afd\Endpoint,FileHandle:0x354,ObjectAttributes:OBJ_INHERIT | OBJ_CASE_INSENSITIVE,IoStatusBlock:0,DesiredAccess:WRITE_DAC | SYNCHRONIZE | GENERIC_WRITE | GENERIC_READ,FileAttributes:empty,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE,CreateDisposition:FILE_OPEN | FILE_CREATE | FILE_OPEN_IF,CreateOptions:empty,Status:0x0,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->WSASocketW(0x17,0x2,0x0,0x0,0x0,0x1,CalledFrom:0x7ffefffa565e,ReturnValue:0x354,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->closesocket(0x354,CalledFrom:0x7ffefffa5000,ReturnValue:0x14e4b8,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->closesocket(0x354,CalledFrom:0x7ffefffa4f8a,ReturnValue:0x0,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->WSASocketW(0x2,0x1,0x0,0x0,0x0,0x100000081,CalledFrom:0x7ffefffa56b0,ReturnValue:0x0,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
mswsock.dll->NtCreateFile(FileHandle:0x14e4b0,DesiredAccess:0xc0140000,ObjectAttributes:\Device\Afd\Endpoint,IoStatusBlock:0x14e4f0,AllocationSize:0x0,FileAttributes:0x0,ShareAccess:0x3,CreateDisposition:0x3,CreateOptions:0x0,EaBuffer:0x14e540,EaLength:0x39,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
NtCreateFile(FileName:\Device\Afd\Endpoint,FileHandle:0x354,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:0,DesiredAccess:WRITE_DAC | SYNCHRONIZE | GENERIC_WRITE | GENERIC_READ,FileAttributes:empty,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE,CreateDisposition:FILE_OPEN | FILE_CREATE | FILE_OPEN_IF,CreateOptions:empty,Status:0x0,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->WSASocketW(0x2,0x1,0x0,0x0,0x0,0x100000081,CalledFrom:0x140015900,ReturnValue:0x354,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->ioctlsocket(0x354,0x8004667e,0x14e790,CalledFrom:0x7ffefffa51e0,ReturnValue:0x354,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->ioctlsocket(0x354,0x8004667e,0x14e790,CalledFrom:0x1400041bc,ReturnValue:0x0,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->connect(0x354,0x2760d60,0x10,CalledFrom:0x7ffefffb1a50,ReturnValue:0x0,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
TcpCreateAndConnectTcbRateLimitComplete(Owner:\Device\HarddiskVolume2\Users\Jason\Desktop\CapCutService.exe,OwnerId:0,OwnerPID:4512,OwnerPPID:4496,Protocol:TCPv4,LocalIp:127.0.0.1,LocalPort:49728,RemoteIp:138.124.104.59,RemotePort:443,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->connect(0x354,0x2760d60,0x10,CalledFrom:0x1400041cd,ReturnValue:0xffffffff,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14e130,0x14e340,0x14e550,0x14e7a8,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14e7a8,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14e130,0x14e340,0x14e550,0x14e7a8,CalledFrom:0x140004338,ReturnValue:0x1,timestamp:1786262727.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->ioctlsocket(0x354,0x8004667e,0x14e790,CalledFrom:0x7ffefffa51e0,ReturnValue:0x14ee50,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->ioctlsocket(0x354,0x8004667e,0x14e790,CalledFrom:0x140004404,ReturnValue:0x0,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->setsockopt(0x354,0xffff,0x1006,0x14e790,0x4,CalledFrom:0x7ffefffb10a0,ReturnValue:0x0,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->setsockopt(0x354,0xffff,0x1006,0x14e790,0x4,CalledFrom:0x140004460,ReturnValue:0x0,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->setsockopt(0x354,0xffff,0x1005,0x14e790,0x4,CalledFrom:0x7ffefffb10a0,ReturnValue:0x14e9a0,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->setsockopt(0x354,0xffff,0x1005,0x14e790,0x4,CalledFrom:0x1400044ad,ReturnValue:0x0,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->FreeAddrInfoW(0x632ad0,CalledFrom:0x7ffefffb29f0,ReturnValue:0x14ee01,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->FreeAddrInfoW(0x632ad0,CalledFrom:0x140015a5b,ReturnValue:0x1,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->ioctlsocket(0x354,0x8004667e,0x14ea90,CalledFrom:0x7ffefffa51e0,ReturnValue:0x0,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->ioctlsocket(0x354,0x8004667e,0x14ea90,CalledFrom:0x140010011,ReturnValue:0x0,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtDuplicateToken(ExistingTokenHandle:0x390,DesiredAccess:0x4,ObjectAttributes:0x14e4a0,EffectiveOnly:0x0,TokenType:0x2,NewTokenHandle:0x14e490,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtDuplicateToken(ExistingTokenHandle:0x390,DesiredAccess:0x4,ObjectAttributes:0x14e320,EffectiveOnly:0x0,TokenType:0x2,NewTokenHandle:0x14e310,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtDuplicateToken(ExistingTokenHandle:0x390,DesiredAccess:0x4,ObjectAttributes:0x14e1e0,EffectiveOnly:0x0,TokenType:0x2,NewTokenHandle:0x14e1d0,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0x8,TokenHandle:0x14e050,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtDuplicateToken(ExistingTokenHandle:0x390,DesiredAccess:0x4,ObjectAttributes:0x14e1e0,EffectiveOnly:0x0,TokenType:0x2,NewTokenHandle:0x14e1d0,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0x8,TokenHandle:0x14e050,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:4516
NtCreateKey(Key:\REGISTRY\USER\S-1-5-21-1088755839-2761040374-1703837236-1001\Software\Microsoft\SystemCertificates\ROOT,ValueName:None,Value:None,RegOptions:empty,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateKey(KeyHandle:0x14ddb8,DesiredAccess:0x3001f,ObjectAttributes:\Software\Microsoft\SystemCertificates\ROOT,TitleIndex:0x0,Class:0x14e228,CreateOptions:0x0,Disposition:0x14deb8,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtDuplicateToken(ExistingTokenHandle:0x39c,DesiredAccess:0x4,ObjectAttributes:0x14e0a0,EffectiveOnly:0x0,TokenType:0x2,NewTokenHandle:0x14e090,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0x8,TokenHandle:0x14df50,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:4516
NtCreateKey(Key:\REGISTRY\USER\S-1-5-21-1088755839-2761040374-1703837236-1001\Software\Microsoft\SystemCertificates\ROOT,ValueName:None,Value:None,RegOptions:empty,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateKey(KeyHandle:0x14db68,DesiredAccess:0x3001f,ObjectAttributes:\Software\Microsoft\SystemCertificates\ROOT,TitleIndex:0x0,Class:0x14dfd8,CreateOptions:0x0,Disposition:0x14dc68,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0x8,TokenHandle:0x14df00,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:4516
NtCreateKey(Key:\REGISTRY\USER\S-1-5-21-1088755839-2761040374-1703837236-1001\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\Certificates,ValueName:None,Value:None,RegOptions:empty,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateKey(KeyHandle:0x14daa8,DesiredAccess:0x3001f,ObjectAttributes:\Certificates,TitleIndex:0x0,Class:0x14df18,CreateOptions:0x0,Disposition:0x14dba8,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:4516
crypt32.dll->NtQueryObject(Handle:0x3a4,ObjectInformationClass:0x0,ObjectInformation:0x14e058,ObjectInformationLength:0x38,ReturnLength:0x0,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:4516
NtCreateKey(Key:\REGISTRY\USER\S-1-5-21-1088755839-2761040374-1703837236-1001\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLs,ValueName:None,Value:None,RegOptions:empty,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateKey(KeyHandle:0x14daa8,DesiredAccess:0x3001f,ObjectAttributes:\CRLs,TitleIndex:0x0,Class:0x14df18,CreateOptions:0x0,Disposition:0x14dba8,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:4516
NtCreateKey(Key:\REGISTRY\USER\S-1-5-21-1088755839-2761040374-1703837236-1001\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLs,ValueName:None,Value:None,RegOptions:empty,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateKey(KeyHandle:0x14daa8,DesiredAccess:0x3001f,ObjectAttributes:\CTLs,TitleIndex:0x0,Class:0x14df18,CreateOptions:0x0,Disposition:0x14dba8,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0x8,TokenHandle:0x14de90,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtDuplicateToken(ExistingTokenHandle:0x39c,DesiredAccess:0x4,ObjectAttributes:0x14e0a0,EffectiveOnly:0x0,TokenType:0x2,NewTokenHandle:0x14e090,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0x8,TokenHandle:0x14df50,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->send(0x354,0x279a4d0,0x612,0x0,CalledFrom:0x7ffefffa2320,ReturnValue:0x286000,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->send(0x354,0x279a4d0,0x612,0x0,CalledFrom:0x1400db546,ReturnValue:0x612,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14e580,0x0,0x0,0x14e7a8,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14e7a8,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:4516
NtQueryFullAttributesFile(FileName:C:\Windows\Prefetch,ObjectAttributes:OBJ_CASE_INSENSITIVE,CreationTime:1719534317,LastAccessTime:1786262726,LastWriteTime:1786262709,ChangeTime:1786262718,FileAttributes:FILE_ATTRIBUTE_INTEGRITY_STREAM | FILE_ATTRIBUTE_NO_SCRUB_DATA,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5056
NtOpenFile(FileName:C:\Windows\Prefetch\,FileHandle:0x3b4,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_LIST_DIRECTORY | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT | FILE_OPEN_FOR_BACKUP_INTENT,Status:0x0,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5056
CapCutService.exe->NtQueryInformationProcess(ProcessInformationClass:0x7,ProcessInformation:0x254f8f0,ProcessInformationLength:0x8,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
CapCutService.exe->NtQueryInformationProcess(ProcessInformationClass:0x1e,ProcessInformation:0x254f978,ProcessInformationLength:0x8,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
CapCutService.exe->NtQueryInformationProcess(ProcessInformationClass:0x1f,ProcessInformation:0x254fed8,ProcessInformationLength:0x4,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
ntdll.dll->NtCreateSection(SectionHandle:0x254f630,DesiredAccess:0xf001f,ObjectAttributes:0x0,MaximumSize:0x254f650,SectionPageProtection:0x4,AllocationAttributes:0x4000000,FileHandle:0x0,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtCreateSection(SectionHandle:0x254f7a8,DesiredAccess:0xf0007,ObjectAttributes:0x0,MaximumSize:0x254f660,SectionPageProtection:0x4,AllocationAttributes:0x8000000,FileHandle:0x0,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
ntdll.dll->NtUnmapViewOfSection(BaseAddress:0x2850000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
ntdll.dll->NtUnmapViewOfSectionEx(BaseAddress:0x2850000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:5100
CapCutService.exe->select(0x355,0x14e580,0x0,0x0,0x14e7a8,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->send(0x354,0x279a4d0,0x175,0x0,CalledFrom:0x7ffefffa2320,ReturnValue:0x286000,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->send(0x354,0x279a4d0,0x175,0x0,CalledFrom:0x1400db546,ReturnValue:0x175,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14e580,0x0,0x0,0x14e7a8,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14e7a8,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14e580,0x0,0x0,0x14e7a8,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262728.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->send(0x354,0x279a4d0,0x4a,0x0,CalledFrom:0x7ffefffa2320,ReturnValue:0x286000,timestamp:1786262729.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->send(0x354,0x279a4d0,0x4a,0x0,CalledFrom:0x1400db546,ReturnValue:0x4a,timestamp:1786262729.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->ioctlsocket(0x354,0x8004667e,0x14ea90,CalledFrom:0x7ffefffa51e0,ReturnValue:0x0,timestamp:1786262729.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->ioctlsocket(0x354,0x8004667e,0x14ea90,CalledFrom:0x14001009a,ReturnValue:0x0,timestamp:1786262729.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x0,0x14d890,0x0,0x14dab0,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14dab0,timestamp:1786262729.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x0,0x14d890,0x0,0x14dab0,CalledFrom:0x14000f5cf,ReturnValue:0x1,timestamp:1786262729.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->send(0x354,0x27a6453,0x96,0x0,CalledFrom:0x7ffefffa2320,ReturnValue:0x286000,timestamp:1786262729.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->send(0x354,0x27a6453,0x96,0x0,CalledFrom:0x1400db546,ReturnValue:0x96,timestamp:1786262729.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14d030,0x0,0x0,0x14d258,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14d258,timestamp:1786262729.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14d030,0x0,0x0,0x14d258,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262729.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14d030,0x0,0x0,0x14d258,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14d258,timestamp:1786262729.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14d030,0x0,0x0,0x14d258,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262729.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14d030,0x0,0x0,0x14d258,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14d258,timestamp:1786262729.0) // CapCutService.exe PID:4512 TID:4516
NtQueryFullAttributesFile(FileName:C:\Windows\Prefetch,ObjectAttributes:OBJ_CASE_INSENSITIVE,CreationTime:1719534317,LastAccessTime:1786262727,LastWriteTime:1786262709,ChangeTime:1786262718,FileAttributes:FILE_ATTRIBUTE_INTEGRITY_STREAM | FILE_ATTRIBUTE_NO_SCRUB_DATA,timestamp:1786262729.0) // CapCutService.exe PID:4512 TID:5056
NtOpenFile(FileName:C:\Windows\Prefetch\,FileHandle:0x3b4,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_LIST_DIRECTORY | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT | FILE_OPEN_FOR_BACKUP_INTENT,Status:0x0,timestamp:1786262729.0) // CapCutService.exe PID:4512 TID:5056
CapCutService.exe->select(0x355,0x14d030,0x0,0x0,0x14d258,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262729.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14b958,timestamp:1786262729.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262729.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14b958,timestamp:1786262729.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262729.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14b958,timestamp:1786262729.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262729.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14b958,timestamp:1786262729.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262729.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14b958,timestamp:1786262729.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262729.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14b958,timestamp:1786262729.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262729.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14b958,timestamp:1786262729.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262729.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14b958,timestamp:1786262729.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262729.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14b958,timestamp:1786262729.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262729.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14b958,timestamp:1786262729.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14b958,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14b958,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14b958,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14b958,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14b958,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14b958,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14b958,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14b958,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14b958,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14b958,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14b958,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14b958,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14b958,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14b730,0x0,0x0,0x14b958,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->send(0x354,0x27a6453,0x18,0x0,CalledFrom:0x7ffefffa2320,ReturnValue:0x286000,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->send(0x354,0x27a6453,0x18,0x0,CalledFrom:0x1400db546,ReturnValue:0x18,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->shutdown(0x354,0x2,CalledFrom:0x7ffefffb1cc0,ReturnValue:0x0,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->shutdown(0x354,0x2,CalledFrom:0x14000f249,ReturnValue:0x0,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->closesocket(0x354,CalledFrom:0x7ffefffa5000,ReturnValue:0x0,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->closesocket(0x354,CalledFrom:0x14000f259,ReturnValue:0x0,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x27b3000,RegionSize:0x14ed20,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x277c000,RegionSize:0x14ed20,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x2789000,RegionSize:0x14ed20,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x27a7000,RegionSize:0x14ed20,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x2759000,RegionSize:0x14ed20,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x2778000,RegionSize:0x14ed20,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x27a7000,RegionSize:0x14ec30,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x2771000,RegionSize:0x14ec30,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x636000,RegionSize:0x14ec30,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x2778000,RegionSize:0x14ec30,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->getaddrinfo(0x14f248,0x14e620,0x14e640,0x14e6a8,CalledFrom:0x7ffefffa3710,ReturnValue:0x14e620,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->GetAddrInfoW(0x2769a00,0x2750b10,0x14e580,0x14e6a8,CalledFrom:0x7ffefffa5b20,ReturnValue:0x2750b10,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
dnsapi.dll->DnsQueryEx(0x14d180,0x14d140,0x0,CalledFrom:0x7ffefd10bc30,ReturnValue:0x0,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
mswsock.dll->DnsQueryEx(0x14d180,0x14d140,0x0,CalledFrom:0x7ffefd3eb163,ReturnValue:0x57,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
rasadhlp.dll->NtCreateFile(FileHandle:0x14ccb0,DesiredAccess:0x3,ObjectAttributes:\Device\RasAcd,IoStatusBlock:0x14ccb8,AllocationSize:0x0,FileAttributes:0x80,ShareAccess:0x3,CreateDisposition:0x3,CreateOptions:0x0,EaBuffer:0x0,EaLength:0x0,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
NtCreateFile(FileName:\Device\RasAcd,FileHandle:0x2757650,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:None,DesiredAccess:FILE_READ_DATA | FILE_WRITE_DATA,FileAttributes:FILE_ATTRIBUTE_NORMAL,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE,CreateDisposition:FILE_OPEN | FILE_CREATE | FILE_OPEN_IF,CreateOptions:empty,Status:0xc0000034,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
dnsapi.dll->DnsQueryEx(0x14d180,0x14d140,0x0,CalledFrom:0x7ffefd10bc30,ReturnValue:0x0,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffefd193090,0x4,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x0,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14bdc0,CalledFrom:0x7ffefe6f0090,ReturnValue:0x58,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14bdc0,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->socket(0x17,0x2,0x0,CalledFrom:0x7ffefffa55f0,ReturnValue:0x2769d00,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->WSASocketW(0x17,0x2,0x0,0x0,0x0,0x1,CalledFrom:0x7ffefffa56b0,ReturnValue:0x577d70,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
mswsock.dll->NtCreateFile(FileHandle:0x14dee0,DesiredAccess:0xc0140000,ObjectAttributes:\Device\Afd\Endpoint,IoStatusBlock:0x14df20,AllocationSize:0x0,FileAttributes:0x0,ShareAccess:0x3,CreateDisposition:0x3,CreateOptions:0x0,EaBuffer:0x14df70,EaLength:0x39,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
NtCreateFile(FileName:\Device\Afd\Endpoint,FileHandle:0x354,ObjectAttributes:OBJ_INHERIT | OBJ_CASE_INSENSITIVE,IoStatusBlock:0,DesiredAccess:WRITE_DAC | SYNCHRONIZE | GENERIC_WRITE | GENERIC_READ,FileAttributes:empty,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE,CreateDisposition:FILE_OPEN | FILE_CREATE | FILE_OPEN_IF,CreateOptions:empty,Status:0x0,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->WSASocketW(0x17,0x2,0x0,0x0,0x0,0x1,CalledFrom:0x7ffefffa565e,ReturnValue:0x354,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->closesocket(0x354,CalledFrom:0x7ffefffa5000,ReturnValue:0x14e2f8,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->closesocket(0x354,CalledFrom:0x7ffefffa4f8a,ReturnValue:0x0,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->WSASocketW(0x2,0x1,0x0,0x0,0x0,0x100000081,CalledFrom:0x7ffefffa56b0,ReturnValue:0x0,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
mswsock.dll->NtCreateFile(FileHandle:0x14e2f0,DesiredAccess:0xc0140000,ObjectAttributes:\Device\Afd\Endpoint,IoStatusBlock:0x14e330,AllocationSize:0x0,FileAttributes:0x0,ShareAccess:0x3,CreateDisposition:0x3,CreateOptions:0x0,EaBuffer:0x14e380,EaLength:0x39,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
NtCreateFile(FileName:\Device\Afd\Endpoint,FileHandle:0x354,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:0,DesiredAccess:WRITE_DAC | SYNCHRONIZE | GENERIC_WRITE | GENERIC_READ,FileAttributes:empty,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE,CreateDisposition:FILE_OPEN | FILE_CREATE | FILE_OPEN_IF,CreateOptions:empty,Status:0x0,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->WSASocketW(0x2,0x1,0x0,0x0,0x0,0x100000081,CalledFrom:0x140015900,ReturnValue:0x354,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->ioctlsocket(0x354,0x8004667e,0x14e5d0,CalledFrom:0x7ffefffa51e0,ReturnValue:0x354,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->ioctlsocket(0x354,0x8004667e,0x14e5d0,CalledFrom:0x1400041bc,ReturnValue:0x0,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->connect(0x354,0x2750b70,0x10,CalledFrom:0x7ffefffb1a50,ReturnValue:0x0,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
TcpCreateAndConnectTcbRateLimitComplete(Owner:\Device\HarddiskVolume2\Users\Jason\Desktop\CapCutService.exe,OwnerId:0,OwnerPID:4512,OwnerPPID:4496,Protocol:TCPv4,LocalIp:127.0.0.1,LocalPort:49731,RemoteIp:130.193.50.201,RemotePort:443,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->connect(0x354,0x2750b70,0x10,CalledFrom:0x1400041cd,ReturnValue:0xffffffff,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14df70,0x14e180,0x14e390,0x14e5e8,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14e5e8,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14df70,0x14e180,0x14e390,0x14e5e8,CalledFrom:0x140004338,ReturnValue:0x1,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->ioctlsocket(0x354,0x8004667e,0x14e5d0,CalledFrom:0x7ffefffa51e0,ReturnValue:0x14ed70,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->ioctlsocket(0x354,0x8004667e,0x14e5d0,CalledFrom:0x140004404,ReturnValue:0x0,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->setsockopt(0x354,0xffff,0x1006,0x14e5d0,0x4,CalledFrom:0x7ffefffb10a0,ReturnValue:0x0,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->setsockopt(0x354,0xffff,0x1006,0x14e5d0,0x4,CalledFrom:0x140004460,ReturnValue:0x0,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->setsockopt(0x354,0xffff,0x1005,0x14e5d0,0x4,CalledFrom:0x7ffefffb10a0,ReturnValue:0x14e7e0,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->setsockopt(0x354,0xffff,0x1005,0x14e5d0,0x4,CalledFrom:0x1400044ad,ReturnValue:0x0,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->FreeAddrInfoW(0x2763690,CalledFrom:0x7ffefffb29f0,ReturnValue:0x14ed01,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->FreeAddrInfoW(0x2763690,CalledFrom:0x140015a5b,ReturnValue:0x1,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->ioctlsocket(0x354,0x8004667e,0x14e8d0,CalledFrom:0x7ffefffa51e0,ReturnValue:0x0,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->ioctlsocket(0x354,0x8004667e,0x14e8d0,CalledFrom:0x140010011,ReturnValue:0x0,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtDuplicateToken(ExistingTokenHandle:0x390,DesiredAccess:0x4,ObjectAttributes:0x14e2e0,EffectiveOnly:0x0,TokenType:0x2,NewTokenHandle:0x14e2d0,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtDuplicateToken(ExistingTokenHandle:0x390,DesiredAccess:0x4,ObjectAttributes:0x14e160,EffectiveOnly:0x0,TokenType:0x2,NewTokenHandle:0x14e150,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtDuplicateToken(ExistingTokenHandle:0x390,DesiredAccess:0x4,ObjectAttributes:0x14e020,EffectiveOnly:0x0,TokenType:0x2,NewTokenHandle:0x14e010,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0x8,TokenHandle:0x14de90,PProcessHandle:0xffffffffffffffff,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtDuplicateToken(ExistingTokenHandle:0x390,DesiredAccess:0x4,ObjectAttributes:0x14e020,EffectiveOnly:0x0,TokenType:0x2,NewTokenHandle:0x14e010,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0x8,TokenHandle:0x14de90,PProcessHandle:0xffffffffffffffff,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
NtCreateKey(Key:\REGISTRY\USER\S-1-5-21-1088755839-2761040374-1703837236-1001\Software\Microsoft\SystemCertificates\ROOT,ValueName:None,Value:None,RegOptions:empty,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateKey(KeyHandle:0x14dbf8,DesiredAccess:0x3001f,ObjectAttributes:\Software\Microsoft\SystemCertificates\ROOT,TitleIndex:0x0,Class:0x14e068,CreateOptions:0x0,Disposition:0x14dcf8,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtDuplicateToken(ExistingTokenHandle:0x3a0,DesiredAccess:0x4,ObjectAttributes:0x14dee0,EffectiveOnly:0x0,TokenType:0x2,NewTokenHandle:0x14ded0,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0x8,TokenHandle:0x14dd90,PProcessHandle:0xffffffffffffffff,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
NtCreateKey(Key:\REGISTRY\USER\S-1-5-21-1088755839-2761040374-1703837236-1001\Software\Microsoft\SystemCertificates\ROOT,ValueName:None,Value:None,RegOptions:empty,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateKey(KeyHandle:0x14d9a8,DesiredAccess:0x3001f,ObjectAttributes:\Software\Microsoft\SystemCertificates\ROOT,TitleIndex:0x0,Class:0x14de18,CreateOptions:0x0,Disposition:0x14daa8,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0x8,TokenHandle:0x14dd40,PProcessHandle:0xffffffffffffffff,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
NtCreateKey(Key:\REGISTRY\USER\S-1-5-21-1088755839-2761040374-1703837236-1001\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\Certificates,ValueName:None,Value:None,RegOptions:empty,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateKey(KeyHandle:0x14d8e8,DesiredAccess:0x3001f,ObjectAttributes:\Certificates,TitleIndex:0x0,Class:0x14dd58,CreateOptions:0x0,Disposition:0x14d9e8,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
crypt32.dll->NtQueryObject(Handle:0x3ac,ObjectInformationClass:0x0,ObjectInformation:0x14de98,ObjectInformationLength:0x38,ReturnLength:0x0,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
NtCreateKey(Key:\REGISTRY\USER\S-1-5-21-1088755839-2761040374-1703837236-1001\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLs,ValueName:None,Value:None,RegOptions:empty,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateKey(KeyHandle:0x14d8e8,DesiredAccess:0x3001f,ObjectAttributes:\CRLs,TitleIndex:0x0,Class:0x14dd58,CreateOptions:0x0,Disposition:0x14d9e8,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
NtCreateKey(Key:\REGISTRY\USER\S-1-5-21-1088755839-2761040374-1703837236-1001\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLs,ValueName:None,Value:None,RegOptions:empty,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateKey(KeyHandle:0x14d8e8,DesiredAccess:0x3001f,ObjectAttributes:\CTLs,TitleIndex:0x0,Class:0x14dd58,CreateOptions:0x0,Disposition:0x14d9e8,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0x8,TokenHandle:0x14dcd0,PProcessHandle:0xffffffffffffffff,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtDuplicateToken(ExistingTokenHandle:0x3a0,DesiredAccess:0x4,ObjectAttributes:0x14dee0,EffectiveOnly:0x0,TokenType:0x2,NewTokenHandle:0x14ded0,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0x8,TokenHandle:0x14dd90,PProcessHandle:0xffffffffffffffff,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->send(0x354,0x27974a0,0x611,0x0,CalledFrom:0x7ffefffa2320,ReturnValue:0x286000,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->send(0x354,0x27974a0,0x611,0x0,CalledFrom:0x1400db546,ReturnValue:0x611,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14e3c0,0x0,0x0,0x14e5e8,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14e5e8,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:4516
NtQueryFullAttributesFile(FileName:C:\Windows\Prefetch,ObjectAttributes:OBJ_CASE_INSENSITIVE,CreationTime:1719534317,LastAccessTime:1786262728,LastWriteTime:1786262709,ChangeTime:1786262718,FileAttributes:FILE_ATTRIBUTE_INTEGRITY_STREAM | FILE_ATTRIBUTE_NO_SCRUB_DATA,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:5056
NtOpenFile(FileName:C:\Windows\Prefetch\,FileHandle:0x3b4,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_LIST_DIRECTORY | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT | FILE_OPEN_FOR_BACKUP_INTENT,Status:0x0,timestamp:1786262730.0) // CapCutService.exe PID:4512 TID:5056
CapCutService.exe->select(0x355,0x14e3c0,0x0,0x0,0x14e5e8,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->send(0x354,0x27974a0,0x174,0x0,CalledFrom:0x7ffefffa2320,ReturnValue:0x286000,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->send(0x354,0x27974a0,0x174,0x0,CalledFrom:0x1400db546,ReturnValue:0x174,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14e3c0,0x0,0x0,0x14e5e8,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14e5e8,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14e3c0,0x0,0x0,0x14e5e8,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->send(0x354,0x27974a0,0x4a,0x0,CalledFrom:0x7ffefffa2320,ReturnValue:0x286000,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->send(0x354,0x27974a0,0x4a,0x0,CalledFrom:0x1400db546,ReturnValue:0x4a,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->ioctlsocket(0x354,0x8004667e,0x14e8d0,CalledFrom:0x7ffefffa51e0,ReturnValue:0x0,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->ioctlsocket(0x354,0x8004667e,0x14e8d0,CalledFrom:0x14001009a,ReturnValue:0x0,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x0,0x14d6d0,0x0,0x14d8f0,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14d8f0,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x0,0x14d6d0,0x0,0x14d8f0,CalledFrom:0x14000f5cf,ReturnValue:0x1,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->send(0x354,0x27a6453,0xc1,0x0,CalledFrom:0x7ffefffa2320,ReturnValue:0x286000,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->send(0x354,0x27a6453,0xc1,0x0,CalledFrom:0x1400db546,ReturnValue:0xc1,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x0,0x14d6d0,0x0,0x14d8f0,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14d8f0,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x0,0x14d6d0,0x0,0x14d8f0,CalledFrom:0x14000f5cf,ReturnValue:0x1,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->send(0x354,0x27a6453,0x29,0x0,CalledFrom:0x7ffefffa2320,ReturnValue:0x286000,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->send(0x354,0x27a6453,0x29,0x0,CalledFrom:0x1400db546,ReturnValue:0x29,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14ce70,0x0,0x0,0x14d098,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14d098,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14ce70,0x0,0x0,0x14d098,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14ce70,0x0,0x0,0x14d098,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14d098,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14ce70,0x0,0x0,0x14d098,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14ce70,0x0,0x0,0x14d098,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14d098,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtQueryFullAttributesFile(FileName:C:\Windows\Prefetch,ObjectAttributes:OBJ_CASE_INSENSITIVE,CreationTime:1719534317,LastAccessTime:1786262729,LastWriteTime:1786262709,ChangeTime:1786262718,FileAttributes:FILE_ATTRIBUTE_INTEGRITY_STREAM | FILE_ATTRIBUTE_NO_SCRUB_DATA,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:5056
NtOpenFile(FileName:C:\Windows\Prefetch\,FileHandle:0x3b8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_LIST_DIRECTORY | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT | FILE_OPEN_FOR_BACKUP_INTENT,Status:0x0,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:5056
CapCutService.exe->select(0x355,0x14ce70,0x0,0x0,0x14d098,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->send(0x354,0x27a6453,0x18,0x0,CalledFrom:0x7ffefffa2320,ReturnValue:0x286000,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->send(0x354,0x27a6453,0x18,0x0,CalledFrom:0x1400db546,ReturnValue:0x18,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->shutdown(0x354,0x2,CalledFrom:0x7ffefffb1cc0,ReturnValue:0x0,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->shutdown(0x354,0x2,CalledFrom:0x14000f249,ReturnValue:0x0,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->closesocket(0x354,CalledFrom:0x7ffefffa5000,ReturnValue:0x0,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->closesocket(0x354,CalledFrom:0x14000f259,ReturnValue:0x0,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x27af000,RegionSize:0x14ea30,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x277c000,RegionSize:0x14ea30,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x2771000,RegionSize:0x14ea30,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x27a7000,RegionSize:0x14ea30,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x656000,RegionSize:0x14ea30,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x278c000,RegionSize:0x14ea30,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x2776000,RegionSize:0x14ea30,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x645000,RegionSize:0x14ea30,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateFile(FileHandle:0x14e430,DesiredAccess:0x80100080,ObjectAttributes:\??\C:\Users\Jason\Desktop\CapCutService.exe,IoStatusBlock:0x14e438,AllocationSize:0x0,FileAttributes:0x0,ShareAccess:0x3,CreateDisposition:0x1,CreateOptions:0x60,EaBuffer:0x0,EaLength:0x0,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtCreateFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | SYNCHRONIZE | GENERIC_READ,FileAttributes:empty,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE,CreateDisposition:FILE_OPEN,CreateOptions:FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE,Status:0x0,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Users\Jason\Desktop\CapCutService.exe,IoStatusBlock:0x14e540,FileInformation:0x14e550,Length:0x18,FileInformationClass:0x5,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtQueryAttributesFile(FileName:C:\Users\Jason\Desktop\tbs.dll,ObjectAttributes:OBJ_CASE_INSENSITIVE,Status:0xc0000034,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtQueryAttributesFile(FileName:C:\Windows\SYSTEM32\tbs.dll,ObjectAttributes:OBJ_CASE_INSENSITIVE,CreationTime:1719544701,LastAccessTime:1786262717,LastWriteTime:1719544701,ChangeTime:1719546194,FileAttributes:FILE_ATTRIBUTE_ARCHIVE,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\SYSTEM32\tbs.dll,FileHandle:0x354,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_DATA | FILE_EXECUTE | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_DELETE,OpenOptions:FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE,Status:0x0,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtCreateSection(SectionHandle:0x14cf28,DesiredAccess:0xd,ObjectAttributes:0x0,MaximumSize:0x0,SectionPageProtection:0x10,AllocationAttributes:0x1000000,FileHandle:\Windows\System32\tbs.dll,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14cdc8,NewProtectWin32:0x4,OldProtect:0x14cdc0,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14cdc8,NewProtectWin32:0x2,OldProtect:0x14cdc0,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffeee4b1178,RegionSize:0x14ce28,NewProtectWin32:0x4,OldProtect:0x276f898,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff001f7000,RegionSize:0x14c740,NewProtectWin32:0x2,OldProtect:0x14c7b0,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14c738,NewProtectWin32:0x4,OldProtect:0x14c730,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14c738,NewProtectWin32:0x2,OldProtect:0x14c730,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff001ec4f8,RegionSize:0x14c798,NewProtectWin32:0x4,OldProtect:0x5f6f78,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffeee4b1178,RegionSize:0x276f880,NewProtectWin32:0x2,OldProtect:0x14cd10,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff001ec4f8,RegionSize:0x5f6f60,NewProtectWin32:0x2,OldProtect:0x14d100,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtQueryLicenseValue(Name:TerminalServices-RemoteConnectionManager-AllowAppServerMode,Type:0x14cdf0,Buffer:0x14cde0,Length:0x4,ReturnedLength:0x14cdf8,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
tbs.dll->NtCreateFile(FileHandle:0x14d5a0,DesiredAccess:0xc0000000,ObjectAttributes:\??\TPM,IoStatusBlock:0x14d5e8,AllocationSize:0x0,FileAttributes:0x0,ShareAccess:0x1,CreateDisposition:0x1,CreateOptions:0x0,EaBuffer:0x0,EaLength:0x0,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtCreateFile(FileName:TPM,FileHandle:0x0,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:None,DesiredAccess:GENERIC_WRITE | GENERIC_READ,FileAttributes:empty,ShareAccess:FILE_SHARE_READ,CreateDisposition:FILE_OPEN,CreateOptions:empty,Status:0xc0000034,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14d418,NewProtectWin32:0x4,OldProtect:0x14d410,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14d418,NewProtectWin32:0x2,OldProtect:0x14d410,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtUnmapViewOfSection(BaseAddress:0x7fff001e0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtUnmapViewOfSectionEx(BaseAddress:0x7fff001e0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14d4e8,NewProtectWin32:0x4,OldProtect:0x14d4e0,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14d4e8,NewProtectWin32:0x2,OldProtect:0x14d4e0,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtUnmapViewOfSection(BaseAddress:0x7ffeee4a0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtUnmapViewOfSectionEx(BaseAddress:0x7ffeee4a0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateFile(FileHandle:0x14e060,DesiredAccess:0x100080,ObjectAttributes:\??\PhysicalDrive0,IoStatusBlock:0x14e068,AllocationSize:0x0,FileAttributes:0x0,ShareAccess:0x3,CreateDisposition:0x1,CreateOptions:0x60,EaBuffer:0x0,EaLength:0x0,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtCreateFile(FileName:PhysicalDrive0,FileHandle:0x354,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:0,DesiredAccess:FILE_READ_ATTRIBUTES | SYNCHRONIZE,FileAttributes:empty,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE,CreateDisposition:FILE_OPEN,CreateOptions:FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE,Status:0x0,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->GetSystemFirmwareTable(0x52534d42,0x0,0x0,0x0,CalledFrom:0x7fff00387b80,ReturnValue:0x14e628,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->GetSystemFirmwareTable(0x52534d42,0x0,0x0,0x0,CalledFrom:0x1400380eb,ReturnValue:0x0,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->GetSystemFirmwareTable(0x52534d42,0x0,0x0,0x0,CalledFrom:0x7fff00387b80,ReturnValue:0x14e7c8,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->GetSystemFirmwareTable(0x52534d42,0x0,0x0,0x0,CalledFrom:0x1400380eb,ReturnValue:0x0,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateFile(FileHandle:0x14e200,DesiredAccess:0x100080,ObjectAttributes:\??\PhysicalDrive0,IoStatusBlock:0x14e208,AllocationSize:0x0,FileAttributes:0x0,ShareAccess:0x3,CreateDisposition:0x1,CreateOptions:0x60,EaBuffer:0x0,EaLength:0x0,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtCreateFile(FileName:PhysicalDrive0,FileHandle:0x354,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:0,DesiredAccess:FILE_READ_ATTRIBUTES | SYNCHRONIZE,FileAttributes:empty,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE,CreateDisposition:FILE_OPEN,CreateOptions:FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE,Status:0x0,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtQueryAttributesFile(FileName:C:\Users\Jason\Desktop\tbs.dll,ObjectAttributes:OBJ_CASE_INSENSITIVE,Status:0xc0000034,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtQueryAttributesFile(FileName:C:\Windows\SYSTEM32\tbs.dll,ObjectAttributes:OBJ_CASE_INSENSITIVE,CreationTime:1719544701,LastAccessTime:1786262730,LastWriteTime:1719544701,ChangeTime:1719546194,FileAttributes:FILE_ATTRIBUTE_ARCHIVE,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtOpenFile(FileName:C:\Windows\SYSTEM32\tbs.dll,FileHandle:0x354,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_DATA | FILE_EXECUTE | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_DELETE,OpenOptions:FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE,Status:0x0,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtCreateSection(SectionHandle:0x14d0c8,DesiredAccess:0xd,ObjectAttributes:0x0,MaximumSize:0x0,SectionPageProtection:0x10,AllocationAttributes:0x1000000,FileHandle:\Windows\System32\tbs.dll,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14cf68,NewProtectWin32:0x4,OldProtect:0x14cf60,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14cf68,NewProtectWin32:0x2,OldProtect:0x14cf60,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffeee4b1178,RegionSize:0x14cfc8,NewProtectWin32:0x4,OldProtect:0x276e558,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff001f7000,RegionSize:0x14c8e0,NewProtectWin32:0x2,OldProtect:0x14c950,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14c8d8,NewProtectWin32:0x4,OldProtect:0x14c8d0,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14c8d8,NewProtectWin32:0x2,OldProtect:0x14c8d0,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff001ec4f8,RegionSize:0x14c938,NewProtectWin32:0x4,OldProtect:0x5f6f78,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffeee4b1178,RegionSize:0x276e540,NewProtectWin32:0x2,OldProtect:0x14ceb0,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff001ec4f8,RegionSize:0x5f6f60,NewProtectWin32:0x2,OldProtect:0x14d2a0,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtQueryLicenseValue(Name:TerminalServices-RemoteConnectionManager-AllowAppServerMode,Type:0x14cf90,Buffer:0x14cf80,Length:0x4,ReturnedLength:0x14cf98,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
tbs.dll->NtCreateFile(FileHandle:0x14d740,DesiredAccess:0xc0000000,ObjectAttributes:\??\TPM,IoStatusBlock:0x14d788,AllocationSize:0x0,FileAttributes:0x0,ShareAccess:0x1,CreateDisposition:0x1,CreateOptions:0x0,EaBuffer:0x0,EaLength:0x0,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtCreateFile(FileName:TPM,FileHandle:0x0,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:None,DesiredAccess:GENERIC_WRITE | GENERIC_READ,FileAttributes:empty,ShareAccess:FILE_SHARE_READ,CreateDisposition:FILE_OPEN,CreateOptions:empty,Status:0xc0000034,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14d5b8,NewProtectWin32:0x4,OldProtect:0x14d5b0,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14d5b8,NewProtectWin32:0x2,OldProtect:0x14d5b0,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtUnmapViewOfSection(BaseAddress:0x7fff001e0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtUnmapViewOfSectionEx(BaseAddress:0x7fff001e0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14d688,NewProtectWin32:0x4,OldProtect:0x14d680,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x14d688,NewProtectWin32:0x2,OldProtect:0x14d680,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtUnmapViewOfSection(BaseAddress:0x7ffeee4a0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtUnmapViewOfSectionEx(BaseAddress:0x7ffeee4a0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtCreateFile(FileHandle:0x14e4b0,DesiredAccess:0x80100080,ObjectAttributes:\??\C:\Users\Jason\Desktop\CapCutService.exe,IoStatusBlock:0x14e4b8,AllocationSize:0x0,FileAttributes:0x0,ShareAccess:0x3,CreateDisposition:0x1,CreateOptions:0x60,EaBuffer:0x0,EaLength:0x0,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtCreateFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | SYNCHRONIZE | GENERIC_READ,FileAttributes:empty,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE,CreateDisposition:FILE_OPEN,CreateOptions:FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE,Status:0x0,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtQueryInformationFile(FileHandle:\Users\Jason\Desktop\CapCutService.exe,IoStatusBlock:0x14e5c0,FileInformation:0x14e5d0,Length:0x18,FileInformationClass:0x5,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x2850000,RegionSize:0x14e250,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x2e1a000,RegionSize:0x14e208,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
NtReadFile(FileName:C:\Users\Jason\Desktop\CapCutService.exe,FileHandle:0x354,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x2850000,RegionSize:0x14e370,FreeType:0x8000,PProcessHandle:0xffffffffffffffff,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->getaddrinfo(0x14e418,0x14d5e0,0x14d600,0x14d668,CalledFrom:0x7ffefffa3710,ReturnValue:0x14d5e0,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->GetAddrInfoW(0x2769190,0x62f310,0x14d540,0x14d668,CalledFrom:0x7ffefffa5b20,ReturnValue:0x62f310,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
dnsapi.dll->DnsQueryEx(0x14c140,0x14c100,0x0,CalledFrom:0x7ffefd10bc30,ReturnValue:0x0,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
mswsock.dll->DnsQueryEx(0x14c140,0x14c100,0x0,CalledFrom:0x7ffefd3eb163,ReturnValue:0x57,timestamp:1786262731.0) // CapCutService.exe PID:4512 TID:4516
rasadhlp.dll->NtCreateFile(FileHandle:0x14bc70,DesiredAccess:0x3,ObjectAttributes:\Device\RasAcd,IoStatusBlock:0x14bc78,AllocationSize:0x0,FileAttributes:0x80,ShareAccess:0x3,CreateDisposition:0x3,CreateOptions:0x0,EaBuffer:0x0,EaLength:0x0,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
NtCreateFile(FileName:\Device\RasAcd,FileHandle:0x14bdec,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:None,DesiredAccess:FILE_READ_DATA | FILE_WRITE_DATA,FileAttributes:FILE_ATTRIBUTE_NORMAL,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE,CreateDisposition:FILE_OPEN | FILE_CREATE | FILE_OPEN_IF,CreateOptions:empty,Status:0xc0000034,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtQueryInformationProcess(ProcessInformationClass:0x7,ProcessInformation:0x254f8f0,ProcessInformationLength:0x8,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
CapCutService.exe->NtQueryInformationProcess(ProcessInformationClass:0x1e,ProcessInformation:0x254f978,ProcessInformationLength:0x8,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
CapCutService.exe->NtQueryInformationProcess(ProcessInformationClass:0x1f,ProcessInformation:0x254fed8,ProcessInformationLength:0x4,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
dnsapi.dll->DnsQueryEx(0x14c140,0x14c100,0x0,CalledFrom:0x7ffefd10bc30,ReturnValue:0x0,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtCreateSection(SectionHandle:0x254f630,DesiredAccess:0xf001f,ObjectAttributes:0x0,MaximumSize:0x254f650,SectionPageProtection:0x4,AllocationAttributes:0x4000000,FileHandle:0x0,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
rpcrt4.dll->NdrClientCall3(0x7ffefd193090,0x4,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x0,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14ad80,CalledFrom:0x7ffefe6f0090,ReturnValue:0x58,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14ad80,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->socket(0x17,0x2,0x0,CalledFrom:0x7ffefffa55f0,ReturnValue:0x2769b50,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->WSASocketW(0x17,0x2,0x0,0x0,0x0,0x1,CalledFrom:0x7ffefffa56b0,ReturnValue:0x577d70,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
mswsock.dll->NtCreateFile(FileHandle:0x14cea0,DesiredAccess:0xc0140000,ObjectAttributes:\Device\Afd\Endpoint,IoStatusBlock:0x14cee0,AllocationSize:0x0,FileAttributes:0x0,ShareAccess:0x3,CreateDisposition:0x3,CreateOptions:0x0,EaBuffer:0x14cf30,EaLength:0x39,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
NtCreateFile(FileName:\Device\Afd\Endpoint,FileHandle:0x354,ObjectAttributes:OBJ_INHERIT | OBJ_CASE_INSENSITIVE,IoStatusBlock:0,DesiredAccess:WRITE_DAC | SYNCHRONIZE | GENERIC_WRITE | GENERIC_READ,FileAttributes:empty,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE,CreateDisposition:FILE_OPEN | FILE_CREATE | FILE_OPEN_IF,CreateOptions:empty,Status:0x0,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->WSASocketW(0x17,0x2,0x0,0x0,0x0,0x1,CalledFrom:0x7ffefffa565e,ReturnValue:0x354,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->closesocket(0x354,CalledFrom:0x7ffefffa5000,ReturnValue:0x14d2b8,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->closesocket(0x354,CalledFrom:0x7ffefffa4f8a,ReturnValue:0x0,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->WSASocketW(0x2,0x1,0x0,0x0,0x0,0x100000081,CalledFrom:0x7ffefffa56b0,ReturnValue:0x0,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
mswsock.dll->NtCreateFile(FileHandle:0x14d2b0,DesiredAccess:0xc0140000,ObjectAttributes:\Device\Afd\Endpoint,IoStatusBlock:0x14d2f0,AllocationSize:0x0,FileAttributes:0x0,ShareAccess:0x3,CreateDisposition:0x3,CreateOptions:0x0,EaBuffer:0x14d340,EaLength:0x39,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
NtCreateFile(FileName:\Device\Afd\Endpoint,FileHandle:0x354,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:0,DesiredAccess:WRITE_DAC | SYNCHRONIZE | GENERIC_WRITE | GENERIC_READ,FileAttributes:empty,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE,CreateDisposition:FILE_OPEN | FILE_CREATE | FILE_OPEN_IF,CreateOptions:empty,Status:0x0,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->WSASocketW(0x2,0x1,0x0,0x0,0x0,0x100000081,CalledFrom:0x140015900,ReturnValue:0x354,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->ioctlsocket(0x354,0x8004667e,0x14d590,CalledFrom:0x7ffefffa51e0,ReturnValue:0x354,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->ioctlsocket(0x354,0x8004667e,0x14d590,CalledFrom:0x1400041bc,ReturnValue:0x0,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->connect(0x354,0x62f4f0,0x10,CalledFrom:0x7ffefffb1a50,ReturnValue:0x0,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
TcpCreateAndConnectTcbRateLimitComplete(Owner:\Device\HarddiskVolume2\Users\Jason\Desktop\CapCutService.exe,OwnerId:0,OwnerPID:4512,OwnerPPID:4496,Protocol:TCPv4,LocalIp:127.0.0.1,LocalPort:49736,RemoteIp:130.193.50.201,RemotePort:443,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->connect(0x354,0x62f4f0,0x10,CalledFrom:0x1400041cd,ReturnValue:0xffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14cf30,0x14d140,0x14d350,0x14d5a8,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14d5a8,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtCreateSection(SectionHandle:0x254f7a8,DesiredAccess:0xf0007,ObjectAttributes:0x0,MaximumSize:0x254f660,SectionPageProtection:0x4,AllocationAttributes:0x8000000,FileHandle:0x0,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
ntdll.dll->NtUnmapViewOfSection(BaseAddress:0x2850000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
ntdll.dll->NtUnmapViewOfSectionEx(BaseAddress:0x2850000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
CapCutService.exe->select(0x355,0x14cf30,0x14d140,0x14d350,0x14d5a8,CalledFrom:0x140004338,ReturnValue:0x1,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
ws2_32.dll->ioctlsocket(0x354,0x8004667e,0x14d590,CalledFrom:0x7ffefffa51e0,ReturnValue:0x14dd30,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->ioctlsocket(0x354,0x8004667e,0x14d590,CalledFrom:0x140004404,ReturnValue:0x0,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->setsockopt(0x354,0xffff,0x1006,0x14d590,0x4,CalledFrom:0x7ffefffb10a0,ReturnValue:0x0,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->setsockopt(0x354,0xffff,0x1006,0x14d590,0x4,CalledFrom:0x140004460,ReturnValue:0x0,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->setsockopt(0x354,0xffff,0x1005,0x14d590,0x4,CalledFrom:0x7ffefffb10a0,ReturnValue:0x14d7a0,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->setsockopt(0x354,0xffff,0x1005,0x14d590,0x4,CalledFrom:0x1400044ad,ReturnValue:0x0,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->FreeAddrInfoW(0x632e90,CalledFrom:0x7ffefffb29f0,ReturnValue:0x14dd01,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->FreeAddrInfoW(0x632e90,CalledFrom:0x140015a5b,ReturnValue:0x1,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->ioctlsocket(0x354,0x8004667e,0x14d890,CalledFrom:0x7ffefffa51e0,ReturnValue:0x0,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->ioctlsocket(0x354,0x8004667e,0x14d890,CalledFrom:0x140010011,ReturnValue:0x0,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->send(0x354,0x2796490,0x611,0x0,CalledFrom:0x7ffefffa2320,ReturnValue:0x286000,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->send(0x354,0x2796490,0x611,0x0,CalledFrom:0x1400db546,ReturnValue:0x611,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14d380,0x0,0x0,0x14d5a8,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14d5a8,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5100
NtQueryFullAttributesFile(FileName:C:\Windows\Prefetch,ObjectAttributes:OBJ_CASE_INSENSITIVE,CreationTime:1719534317,LastAccessTime:1786262730,LastWriteTime:1786262709,ChangeTime:1786262718,FileAttributes:FILE_ATTRIBUTE_INTEGRITY_STREAM | FILE_ATTRIBUTE_NO_SCRUB_DATA,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5056
NtOpenFile(FileName:C:\Windows\Prefetch\,FileHandle:0x3b8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_LIST_DIRECTORY | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT | FILE_OPEN_FOR_BACKUP_INTENT,Status:0x0,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:5056
CapCutService.exe->select(0x355,0x14d380,0x0,0x0,0x14d5a8,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->send(0x354,0x2796490,0x174,0x0,CalledFrom:0x7ffefffa2320,ReturnValue:0x286000,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->send(0x354,0x2796490,0x174,0x0,CalledFrom:0x1400db546,ReturnValue:0x174,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14d380,0x0,0x0,0x14d5a8,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14d5a8,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14d380,0x0,0x0,0x14d5a8,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->send(0x354,0x2796490,0x4a,0x0,CalledFrom:0x7ffefffa2320,ReturnValue:0x286000,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->send(0x354,0x2796490,0x4a,0x0,CalledFrom:0x1400db546,ReturnValue:0x4a,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->ioctlsocket(0x354,0x8004667e,0x14d890,CalledFrom:0x7ffefffa51e0,ReturnValue:0x0,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->ioctlsocket(0x354,0x8004667e,0x14d890,CalledFrom:0x14001009a,ReturnValue:0x0,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x0,0x14c690,0x0,0x14c8b0,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14c8b0,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x0,0x14c690,0x0,0x14c8b0,CalledFrom:0x14000f5cf,ReturnValue:0x1,timestamp:1786262732.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->send(0x354,0x27a6453,0x12f,0x0,CalledFrom:0x7ffefffa2320,ReturnValue:0x286000,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->send(0x354,0x27a6453,0x12f,0x0,CalledFrom:0x1400db546,ReturnValue:0x12f,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x0,0x14c690,0x0,0x14c8b0,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14c8b0,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x0,0x14c690,0x0,0x14c8b0,CalledFrom:0x14000f5cf,ReturnValue:0x1,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->send(0x354,0x27a6453,0x1dd,0x0,CalledFrom:0x7ffefffa2320,ReturnValue:0x286000,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->send(0x354,0x27a6453,0x1dd,0x0,CalledFrom:0x1400db546,ReturnValue:0x1dd,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14be30,0x0,0x0,0x14c058,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14c058,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14be30,0x0,0x0,0x14c058,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14be30,0x0,0x0,0x14c058,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14c058,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14be30,0x0,0x0,0x14c058,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14be30,0x0,0x0,0x14c058,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14c058,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14be30,0x0,0x0,0x14c058,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->send(0x354,0x27a6453,0x18,0x0,CalledFrom:0x7ffefffa2320,ReturnValue:0x286000,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->send(0x354,0x27a6453,0x18,0x0,CalledFrom:0x1400db546,ReturnValue:0x18,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->shutdown(0x354,0x2,CalledFrom:0x7ffefffb1cc0,ReturnValue:0x0,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->shutdown(0x354,0x2,CalledFrom:0x14000f249,ReturnValue:0x0,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->closesocket(0x354,CalledFrom:0x7ffefffa5000,ReturnValue:0x0,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->closesocket(0x354,CalledFrom:0x14000f259,ReturnValue:0x0,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->getaddrinfo(0x14e418,0x14d5e0,0x14d600,0x14d668,CalledFrom:0x7ffefffa3710,ReturnValue:0x14d5e0,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->GetAddrInfoW(0x27695b0,0x62f810,0x14d540,0x14d668,CalledFrom:0x7ffefffa5b20,ReturnValue:0x62f810,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
dnsapi.dll->DnsQueryEx(0x14c140,0x14c100,0x0,CalledFrom:0x7ffefd10bc30,ReturnValue:0x0,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
mswsock.dll->DnsQueryEx(0x14c140,0x14c100,0x0,CalledFrom:0x7ffefd3eb163,ReturnValue:0x57,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
rasadhlp.dll->NtCreateFile(FileHandle:0x14bc70,DesiredAccess:0x3,ObjectAttributes:\Device\RasAcd,IoStatusBlock:0x14bc78,AllocationSize:0x0,FileAttributes:0x80,ShareAccess:0x3,CreateDisposition:0x3,CreateOptions:0x0,EaBuffer:0x0,EaLength:0x0,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
NtCreateFile(FileName:\Device\RasAcd,FileHandle:0x40000000,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:None,DesiredAccess:FILE_READ_DATA | FILE_WRITE_DATA,FileAttributes:FILE_ATTRIBUTE_NORMAL,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE,CreateDisposition:FILE_OPEN | FILE_CREATE | FILE_OPEN_IF,CreateOptions:empty,Status:0xc0000034,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
dnsapi.dll->DnsQueryEx(0x14c140,0x14c100,0x0,CalledFrom:0x7ffefd10bc30,ReturnValue:0x0,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffefd193090,0x4,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x0,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14ad80,CalledFrom:0x7ffefe6f0090,ReturnValue:0x58,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14ad80,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->socket(0x17,0x2,0x0,CalledFrom:0x7ffefffa55f0,ReturnValue:0x2769bb0,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->WSASocketW(0x17,0x2,0x0,0x0,0x0,0x1,CalledFrom:0x7ffefffa56b0,ReturnValue:0x577d70,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
mswsock.dll->NtCreateFile(FileHandle:0x14cea0,DesiredAccess:0xc0140000,ObjectAttributes:\Device\Afd\Endpoint,IoStatusBlock:0x14cee0,AllocationSize:0x0,FileAttributes:0x0,ShareAccess:0x3,CreateDisposition:0x3,CreateOptions:0x0,EaBuffer:0x14cf30,EaLength:0x39,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
NtCreateFile(FileName:\Device\Afd\Endpoint,FileHandle:0x354,ObjectAttributes:OBJ_INHERIT | OBJ_CASE_INSENSITIVE,IoStatusBlock:0,DesiredAccess:WRITE_DAC | SYNCHRONIZE | GENERIC_WRITE | GENERIC_READ,FileAttributes:empty,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE,CreateDisposition:FILE_OPEN | FILE_CREATE | FILE_OPEN_IF,CreateOptions:empty,Status:0x0,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->WSASocketW(0x17,0x2,0x0,0x0,0x0,0x1,CalledFrom:0x7ffefffa565e,ReturnValue:0x354,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->closesocket(0x354,CalledFrom:0x7ffefffa5000,ReturnValue:0x14d2b8,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->closesocket(0x354,CalledFrom:0x7ffefffa4f8a,ReturnValue:0x0,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->WSASocketW(0x2,0x1,0x0,0x0,0x0,0x100000081,CalledFrom:0x7ffefffa56b0,ReturnValue:0x0,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
mswsock.dll->NtCreateFile(FileHandle:0x14d2b0,DesiredAccess:0xc0140000,ObjectAttributes:\Device\Afd\Endpoint,IoStatusBlock:0x14d2f0,AllocationSize:0x0,FileAttributes:0x0,ShareAccess:0x3,CreateDisposition:0x3,CreateOptions:0x0,EaBuffer:0x14d340,EaLength:0x39,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
NtCreateFile(FileName:\Device\Afd\Endpoint,FileHandle:0x354,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:0,DesiredAccess:WRITE_DAC | SYNCHRONIZE | GENERIC_WRITE | GENERIC_READ,FileAttributes:empty,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE,CreateDisposition:FILE_OPEN | FILE_CREATE | FILE_OPEN_IF,CreateOptions:empty,Status:0x0,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->WSASocketW(0x2,0x1,0x0,0x0,0x0,0x100000081,CalledFrom:0x140015900,ReturnValue:0x354,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->ioctlsocket(0x354,0x8004667e,0x14d590,CalledFrom:0x7ffefffa51e0,ReturnValue:0x354,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->ioctlsocket(0x354,0x8004667e,0x14d590,CalledFrom:0x1400041bc,ReturnValue:0x0,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->connect(0x354,0x62f870,0x10,CalledFrom:0x7ffefffb1a50,ReturnValue:0x0,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
TcpCreateAndConnectTcbRateLimitComplete(Owner:\Device\HarddiskVolume2\Users\Jason\Desktop\CapCutService.exe,OwnerId:0,OwnerPID:4512,OwnerPPID:4496,Protocol:TCPv4,LocalIp:127.0.0.1,LocalPort:49739,RemoteIp:130.193.50.201,RemotePort:443,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->connect(0x354,0x62f870,0x10,CalledFrom:0x1400041cd,ReturnValue:0xffffffff,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14cf30,0x14d140,0x14d350,0x14d5a8,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14d5a8,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14cf30,0x14d140,0x14d350,0x14d5a8,CalledFrom:0x140004338,ReturnValue:0x1,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->ioctlsocket(0x354,0x8004667e,0x14d590,CalledFrom:0x7ffefffa51e0,ReturnValue:0x14dd30,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->ioctlsocket(0x354,0x8004667e,0x14d590,CalledFrom:0x140004404,ReturnValue:0x0,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->setsockopt(0x354,0xffff,0x1006,0x14d590,0x4,CalledFrom:0x7ffefffb10a0,ReturnValue:0x0,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->setsockopt(0x354,0xffff,0x1006,0x14d590,0x4,CalledFrom:0x140004460,ReturnValue:0x0,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->setsockopt(0x354,0xffff,0x1005,0x14d590,0x4,CalledFrom:0x7ffefffb10a0,ReturnValue:0x14d7a0,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->setsockopt(0x354,0xffff,0x1005,0x14d590,0x4,CalledFrom:0x1400044ad,ReturnValue:0x0,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->FreeAddrInfoW(0x2763890,CalledFrom:0x7ffefffb29f0,ReturnValue:0x14dd01,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->FreeAddrInfoW(0x2763890,CalledFrom:0x140015a5b,ReturnValue:0x1,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->ioctlsocket(0x354,0x8004667e,0x14d890,CalledFrom:0x7ffefffa51e0,ReturnValue:0x0,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->ioctlsocket(0x354,0x8004667e,0x14d890,CalledFrom:0x140010011,ReturnValue:0x0,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->send(0x354,0x279c4f0,0x611,0x0,CalledFrom:0x7ffefffa2320,ReturnValue:0x286000,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->send(0x354,0x279c4f0,0x611,0x0,CalledFrom:0x1400db546,ReturnValue:0x611,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
NtQueryFullAttributesFile(FileName:C:\Windows\Prefetch,ObjectAttributes:OBJ_CASE_INSENSITIVE,CreationTime:1719534317,LastAccessTime:1786262731,LastWriteTime:1786262709,ChangeTime:1786262718,FileAttributes:FILE_ATTRIBUTE_INTEGRITY_STREAM | FILE_ATTRIBUTE_NO_SCRUB_DATA,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:5056
NtOpenFile(FileName:C:\Windows\Prefetch\,FileHandle:0x3b8,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_LIST_DIRECTORY | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,OpenOptions:FILE_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT | FILE_OPEN_FOR_BACKUP_INTENT,Status:0x0,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:5056
ws2_32.dll->select(0x355,0x14d380,0x0,0x0,0x14d5a8,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14d5a8,timestamp:1786262733.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14d380,0x0,0x0,0x14d5a8,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->send(0x354,0x279c4f0,0x174,0x0,CalledFrom:0x7ffefffa2320,ReturnValue:0x286000,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->send(0x354,0x279c4f0,0x174,0x0,CalledFrom:0x1400db546,ReturnValue:0x174,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14d380,0x0,0x0,0x14d5a8,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14d5a8,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14d380,0x0,0x0,0x14d5a8,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->send(0x354,0x279c4f0,0x4a,0x0,CalledFrom:0x7ffefffa2320,ReturnValue:0x286000,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->send(0x354,0x279c4f0,0x4a,0x0,CalledFrom:0x1400db546,ReturnValue:0x4a,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->ioctlsocket(0x354,0x8004667e,0x14d890,CalledFrom:0x7ffefffa51e0,ReturnValue:0x0,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->ioctlsocket(0x354,0x8004667e,0x14d890,CalledFrom:0x14001009a,ReturnValue:0x0,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x0,0x14c690,0x0,0x14c8b0,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14c8b0,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x0,0x14c690,0x0,0x14c8b0,CalledFrom:0x14000f5cf,ReturnValue:0x1,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->send(0x354,0x27a6453,0x12a,0x0,CalledFrom:0x7ffefffa2320,ReturnValue:0x286000,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->send(0x354,0x27a6453,0x12a,0x0,CalledFrom:0x1400db546,ReturnValue:0x12a,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x0,0x14c690,0x0,0x14c8b0,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14c8b0,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x0,0x14c690,0x0,0x14c8b0,CalledFrom:0x14000f5cf,ReturnValue:0x1,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->send(0x354,0x27a6453,0x1bc,0x0,CalledFrom:0x7ffefffa2320,ReturnValue:0x286000,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->send(0x354,0x27a6453,0x1bc,0x0,CalledFrom:0x1400db546,ReturnValue:0x1bc,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14be30,0x0,0x0,0x14c058,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14c058,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14be30,0x0,0x0,0x14c058,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14be30,0x0,0x0,0x14c058,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14c058,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14be30,0x0,0x0,0x14c058,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14be30,0x0,0x0,0x14c058,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14c058,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:4516
advapi32.dll->OpenSCManagerW("","",0x1,CalledFrom:0x7ffefe7f7a10,ReturnValue:0x0,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
sechost.dll->OpenSCManagerW("","",0x1,CalledFrom:0x7ffeff9e83e0,ReturnValue:0x0,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtDuplicateObject(SourceProcessHandle:0xffffffffffffffff,SourceHandle:0xfffffffffffffffe,TargetProcessHandle:0xffffffffffffffff,TargetHandle:0x5f6ef8,DesiredAccess:0x0,HandleAttributes:0x0,Options:0x2,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa57da2,CalledFrom:0x7ffefe6b1010,ReturnValue:0x210fb08,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa57da2,CalledFrom:0x7ffefe6b1040,ReturnValue:0x210fab8,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa57da2,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
advapi32.dll->OpenServiceW(0x276a870,"PcaSvc",0x4,CalledFrom:0x7ffefe7f7c30,ReturnValue:0x276a870,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
sechost.dll->OpenServiceW(0x276a870,"PcaSvc",0x4,CalledFrom:0x7ffeff9e8360,ReturnValue:0x276a870,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa57034,CalledFrom:0x7ffefe6b1010,ReturnValue:0x210fb78,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa57034,CalledFrom:0x7ffefe6b1040,ReturnValue:0x210fb08,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa57034,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa576ac,CalledFrom:0x7ffefe6b1010,ReturnValue:0x210fec0,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa576ac,CalledFrom:0x7ffefe6b1040,ReturnValue:0x210faf8,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa576ac,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56c12,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56c12,CalledFrom:0x7ffefe6b1040,ReturnValue:0x210fb18,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56c12,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
rpcrt4.dll->NdrClientCall2(0x7ffeffa490a0,0x7ffeffa56c12,CalledFrom:0x7ffefe6b1010,ReturnValue:0x0,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56c12,CalledFrom:0x7ffefe6b1040,ReturnValue:0x210fb18,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
rpcrt4.dll->NdrpClientCall2(0x7ffeffa490a0,0x7ffeffa56c12,CalledFrom:0x7ffefe6b102f,ReturnValue:0x0,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x27af000,RegionSize:0x210b4d0,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x2771000,RegionSize:0x210b4d0,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x277c000,RegionSize:0x210b4d0,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:4,ClientName:System,PProcessHandle:0x1a5f8,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:92,ClientName:Registry,PProcessHandle:0x1a5f8,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:356,ClientName:\Device\HarddiskVolume2\Windows\System32\smss.exe,PProcessHandle:0x1a5f8,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:452,ClientName:\Device\HarddiskVolume2\Windows\System32\csrss.exe,PProcessHandle:0x1a5f8,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:532,ClientName:\Device\HarddiskVolume2\Windows\System32\wininit.exe,PProcessHandle:0x1a5f8,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:540,ClientName:\Device\HarddiskVolume2\Windows\System32\csrss.exe,PProcessHandle:0x1a5f8,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:624,ClientName:\Device\HarddiskVolume2\Windows\System32\winlogon.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:688,ClientName:\Device\HarddiskVolume2\Windows\System32\services.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:708,ClientName:\Device\HarddiskVolume2\Windows\System32\lsass.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:808,ClientName:\Device\HarddiskVolume2\Windows\System32\svchost.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:824,ClientName:\Device\HarddiskVolume2\Windows\System32\fontdrvhost.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:832,ClientName:\Device\HarddiskVolume2\Windows\System32\fontdrvhost.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:928,ClientName:\Device\HarddiskVolume2\Windows\System32\svchost.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:64,ClientName:\Device\HarddiskVolume2\Windows\System32\svchost.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:476,ClientName:\Device\HarddiskVolume2\Windows\System32\svchost.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:448,ClientName:\Device\HarddiskVolume2\Windows\System32\dwm.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:784,ClientName:\Device\HarddiskVolume2\Windows\System32\svchost.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:1108,ClientName:\Device\HarddiskVolume2\Windows\System32\svchost.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:1124,ClientName:\Device\HarddiskVolume2\Windows\System32\svchost.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:1244,ClientName:\Device\HarddiskVolume2\Windows\System32\svchost.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:1296,ClientName:\Device\HarddiskVolume2\Windows\System32\svchost.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:1308,ClientName:\Device\HarddiskVolume2\Windows\System32\svchost.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:1328,ClientName:\Device\HarddiskVolume2\Windows\System32\svchost.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:1444,ClientName:\Device\HarddiskVolume2\Windows\System32\svchost.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:1768,ClientName:\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:1788,ClientName:\Device\HarddiskVolume2\Windows\System32\xenbus_monitor_9_1_100_59.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:1924,ClientName:\Device\HarddiskVolume2\Windows\System32\svchost.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:2256,ClientName:\Device\HarddiskVolume2\Windows\System32\svchost.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:2376,ClientName:\Device\HarddiskVolume2\Windows\System32\sihost.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:2408,ClientName:\Device\HarddiskVolume2\Windows\System32\svchost.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:2580,ClientName:\Device\HarddiskVolume2\Windows\explorer.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:2736,ClientName:\Device\HarddiskVolume2\Windows\System32\svchost.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:2916,ClientName:\Device\HarddiskVolume2\Windows\System32\dllhost.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:3000,ClientName:\Device\HarddiskVolume2\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:3068,ClientName:\Device\HarddiskVolume2\Windows\System32\RuntimeBroker.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:576,ClientName:\Device\HarddiskVolume2\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:3084,ClientName:\Device\HarddiskVolume2\Windows\System32\RuntimeBroker.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:3504,ClientName:\Device\HarddiskVolume2\Windows\System32\RuntimeBroker.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:3580,ClientName:\Device\HarddiskVolume2\Windows\System32\dllhost.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:3676,ClientName:\Device\HarddiskVolume2\Windows\System32\smartscreen.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:3720,ClientName:\Device\HarddiskVolume2\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:3940,ClientName:\Device\HarddiskVolume2\Windows\System32\VSSVC.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:1508,ClientName:\Device\HarddiskVolume2\Windows\System32\svchost.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:2724,ClientName:\Device\HarddiskVolume2\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:2576,ClientName:\Device\HarddiskVolume2\Windows\System32\RuntimeBroker.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:1304,ClientName:\Device\HarddiskVolume2\Windows\System32\oobe\UserOOBEBroker.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:376,ClientName:\Device\HarddiskVolume2\Windows\System32\svchost.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:4512,ClientName:\Device\HarddiskVolume2\Users\Jason\Desktop\CapCutService.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:4556,ClientName:\Device\HarddiskVolume2\Windows\System32\wbem\WmiPrvSE.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:4784,ClientName:\Device\HarddiskVolume2\Windows\System32\SgrmBroker.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:4832,ClientName:\Device\HarddiskVolume2\Windows\System32\sppsvc.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:4888,ClientName:\Device\HarddiskVolume2\Windows\System32\MoUsoCoreWorker.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:4928,ClientName:\Device\HarddiskVolume2\Windows\System32\svchost.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:4980,ClientName:\Device\HarddiskVolume2\Windows\System32\svchost.exe,PProcessHandle:0x3c4,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:4232,ClientName:\Device\HarddiskVolume2\Windows\System32\SppExtComObj.Exe,PProcessHandle:0x3b8,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x210b778,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0x3b8,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210b890,ClientID:4696,ClientName:\Device\HarddiskVolume2\Windows\System32\svchost.exe,PProcessHandle:0x3b8,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
NtOpenProcess(DesiredAccess:0x410,ObjectAttributes:0x210fa10,ClientID:2580,ClientName:\Device\HarddiskVolume2\Windows\explorer.exe,PProcessHandle:0x3b8,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
KernelBase.dll->NtQueryInformationProcess(ProcessInformationClass:0x25,ProcessInformation:0x210f970,ProcessInformationLength:0x40,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x2850000,RegionSize:0x210f670,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x295f000,RegionSize:0x210f628,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262734.0) // CapCutService.exe PID:4512 TID:5056
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x2adf000,RegionSize:0x210f628,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5056
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x2850000,RegionSize:0x210f790,FreeType:0x8000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5056
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x2ae0000,RegionSize:0x210f670,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5056
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x32ce000,RegionSize:0x210f628,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5056
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x2960000,RegionSize:0x210f790,FreeType:0x8000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5056
CapCutService.exe->select(0x355,0x14be30,0x0,0x0,0x14c058,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtQueryInformationProcess(ProcessInformationClass:0x7,ProcessInformation:0x254f8f0,ProcessInformationLength:0x8,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
CapCutService.exe->NtQueryInformationProcess(ProcessInformationClass:0x1e,ProcessInformation:0x254f978,ProcessInformationLength:0x8,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
CapCutService.exe->NtQueryInformationProcess(ProcessInformationClass:0x1f,ProcessInformation:0x254fed8,ProcessInformationLength:0x4,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
ntdll.dll->NtCreateSection(SectionHandle:0x254f630,DesiredAccess:0xf001f,ObjectAttributes:0x0,MaximumSize:0x254f650,SectionPageProtection:0x4,AllocationAttributes:0x4000000,FileHandle:0x0,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtCreateSection(SectionHandle:0x254f7a8,DesiredAccess:0xf0007,ObjectAttributes:0x0,MaximumSize:0x254f660,SectionPageProtection:0x4,AllocationAttributes:0x8000000,FileHandle:0x0,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
ntdll.dll->NtUnmapViewOfSection(BaseAddress:0x32d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
ntdll.dll->NtUnmapViewOfSectionEx(BaseAddress:0x32d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:5100
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262735.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x2851000,RegionSize:0x14a380,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262736.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x36d0000,RegionSize:0x14a340,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x3853000,RegionSize:0x14a2f8,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x32d1000,RegionSize:0x14a380,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262737.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x3860000,RegionSize:0x14a340,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x3aa7000,RegionSize:0x14a2f8,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x36d0000,RegionSize:0x14a460,FreeType:0x8000,PProcessHandle:0xffffffffffffffff,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262738.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x3ab0000,RegionSize:0x14a340,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x3e13000,RegionSize:0x14a2f8,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x3860000,RegionSize:0x14a460,FreeType:0x8000,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtQueryInformationProcess(ProcessInformationClass:0x7,ProcessInformation:0x254f8f0,ProcessInformationLength:0x8,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
CapCutService.exe->NtQueryInformationProcess(ProcessInformationClass:0x1e,ProcessInformation:0x254f978,ProcessInformationLength:0x8,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
CapCutService.exe->NtQueryInformationProcess(ProcessInformationClass:0x1f,ProcessInformation:0x254fed8,ProcessInformationLength:0x4,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
ntdll.dll->NtCreateSection(SectionHandle:0x254f630,DesiredAccess:0xf001f,ObjectAttributes:0x0,MaximumSize:0x254f650,SectionPageProtection:0x4,AllocationAttributes:0x4000000,FileHandle:0x0,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtCreateSection(SectionHandle:0x254f7a8,DesiredAccess:0xf0007,ObjectAttributes:0x0,MaximumSize:0x254f660,SectionPageProtection:0x4,AllocationAttributes:0x8000000,FileHandle:0x0,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
ntdll.dll->NtUnmapViewOfSection(BaseAddress:0x3e20000,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
ntdll.dll->NtUnmapViewOfSectionEx(BaseAddress:0x3e20000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:5100
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262739.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:5100
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262740.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x3e20000,RegionSize:0x14a340,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x4333000,RegionSize:0x14a2f8,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x3ab0000,RegionSize:0x14a460,FreeType:0x8000,PProcessHandle:0xffffffffffffffff,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262741.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262742.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262743.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x4340000,RegionSize:0x14a340,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x4ad9000,RegionSize:0x14a2f8,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x3e20000,RegionSize:0x14a460,FreeType:0x8000,PProcessHandle:0xffffffffffffffff,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262744.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262745.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtQueryInformationProcess(ProcessInformationClass:0x7,ProcessInformation:0x254f8f0,ProcessInformationLength:0x8,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
CapCutService.exe->NtQueryInformationProcess(ProcessInformationClass:0x1e,ProcessInformation:0x254f978,ProcessInformationLength:0x8,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
CapCutService.exe->NtQueryInformationProcess(ProcessInformationClass:0x1f,ProcessInformation:0x254fed8,ProcessInformationLength:0x4,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
ntdll.dll->NtCreateSection(SectionHandle:0x254f630,DesiredAccess:0xf001f,ObjectAttributes:0x0,MaximumSize:0x254f650,SectionPageProtection:0x4,AllocationAttributes:0x4000000,FileHandle:0x0,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtCreateSection(SectionHandle:0x254f7a8,DesiredAccess:0xf0007,ObjectAttributes:0x0,MaximumSize:0x254f660,SectionPageProtection:0x4,AllocationAttributes:0x8000000,FileHandle:0x0,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
ntdll.dll->NtUnmapViewOfSection(BaseAddress:0x36d0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
ntdll.dll->NtUnmapViewOfSectionEx(BaseAddress:0x36d0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262746.0) // CapCutService.exe PID:4512 TID:5100
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262747.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x36d0000,RegionSize:0x14a340,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x4234000,RegionSize:0x14a2f8,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x4340000,RegionSize:0x14a460,FreeType:0x8000,PProcessHandle:0xffffffffffffffff,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262748.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262749.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x7ffefffb15c0,ReturnValue:0x14a758,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->select(0x355,0x14a530,0x0,0x0,0x14a758,CalledFrom:0x140003e90,ReturnValue:0x1,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->send(0x354,0x27a6453,0x18,0x0,CalledFrom:0x7ffefffa2320,ReturnValue:0x286000,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->send(0x354,0x27a6453,0x18,0x0,CalledFrom:0x1400db546,ReturnValue:0x18,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x27af000,RegionSize:0x14c520,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x2771000,RegionSize:0x14c520,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x277c000,RegionSize:0x14c520,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x636000,RegionSize:0x14c520,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x27a7000,RegionSize:0x14c520,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x656000,RegionSize:0x14c520,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->shutdown(0x354,0x2,CalledFrom:0x7ffefffb1cc0,ReturnValue:0x0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->shutdown(0x354,0x2,CalledFrom:0x14000f249,ReturnValue:0x0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ws2_32.dll->closesocket(0x354,CalledFrom:0x7ffefffa5000,ReturnValue:0x0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->closesocket(0x354,CalledFrom:0x14000f259,ReturnValue:0x0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x4340000,RegionSize:0x14dcd0,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x4c1c000,RegionSize:0x14dc88,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x36d0000,RegionSize:0x14ddf0,FreeType:0x8000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x36d0000,RegionSize:0x14e400,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x3fae000,RegionSize:0x14e3b8,FreeType:0x4000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x4340000,RegionSize:0x14e620,FreeType:0x8000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0xa,TokenHandle:0x14ede0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffefe84b188,0x82,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x14e990,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14e2e0,CalledFrom:0x7ffefe6f0090,ReturnValue:0x58,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14e2e0,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffefe84b188,0x1f,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x14e9f0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14e3c0,CalledFrom:0x7ffefe6f0090,ReturnValue:0x5c,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14e3c0,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffefe84b188,0x0,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14e3d0,CalledFrom:0x7ffefe6f0090,ReturnValue:0x14,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14e3d0,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtQueryInformationProcess(ProcessInformationClass:0x7,ProcessInformation:0x254f8f0,ProcessInformationLength:0x8,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
CapCutService.exe->NtQueryInformationProcess(ProcessInformationClass:0x1e,ProcessInformation:0x254f978,ProcessInformationLength:0x8,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
CapCutService.exe->NtQueryInformationProcess(ProcessInformationClass:0x1f,ProcessInformation:0x254fed8,ProcessInformationLength:0x4,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
ntdll.dll->NtCreateSection(SectionHandle:0x254f630,DesiredAccess:0xf001f,ObjectAttributes:0x0,MaximumSize:0x254f650,SectionPageProtection:0x4,AllocationAttributes:0x4000000,FileHandle:0x0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtFreeVirtualMemory(*BaseAddress:0x1f0000,RegionSize:0x14e928,FreeType:0x8000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtCreateSection(SectionHandle:0x254f7a8,DesiredAccess:0xf0007,ObjectAttributes:0x0,MaximumSize:0x254f660,SectionPageProtection:0x4,AllocationAttributes:0x8000000,FileHandle:0x0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
ntdll.dll->NtUnmapViewOfSection(BaseAddress:0x4340000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtCreateSection(SectionHandle:0x14ea18,DesiredAccess:0xf0007,ObjectAttributes:0x0,MaximumSize:0x14e8d0,SectionPageProtection:0x4,AllocationAttributes:0x8000000,FileHandle:0x0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtUnmapViewOfSectionEx(BaseAddress:0x4340000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x500000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x500000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtFreeVirtualMemory(*BaseAddress:0x4e0000,RegionSize:0x14ea68,FreeType:0x8000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtDuplicateObject(SourceProcessHandle:0xffffffffffffffff,SourceHandle:0xfffffffffffffffe,TargetProcessHandle:0xffffffffffffffff,TargetHandle:0x5f7df8,DesiredAccess:0x0,HandleAttributes:0x0,Options:0x2,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:2500
ntoskrnl.exe->NtCreateThreadEx(ThreadHandle:0xffff8289961321b0,DesiredAccess:0x1fffff,ObjectAttributes:0xffff8289961321c8,StartRoutine:0x7fff006bd110,Argument:0x5b8e70,CreateFlags:0x1,ZeroBits:0x0,StackSize:0x0,MaximumStackSize:0x0,AttributeList:0xffff828996132200,PProcessHandle:0xffffffff80001d88,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:2500
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5100
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x2ae0000,RegionSize:0x210f7c0,FreeType:0x8000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:5056
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSection(BaseAddress:0x1f0000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtUnmapViewOfSectionEx(BaseAddress:0x1f0000,Flags:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
NtOpenProcess(DesiredAccess:0x1000,ObjectAttributes:0x14ea50,ClientID:624,ClientName:\Device\HarddiskVolume2\Windows\System32\winlogon.exe,PProcessHandle:0x3b8,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0xa,TokenHandle:0x14eac0,PProcessHandle:0x3b8,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtDuplicateToken(ExistingTokenHandle:0x3b0,DesiredAccess:0x4,ObjectAttributes:0x14ea20,EffectiveOnly:0x0,TokenType:0x2,NewTokenHandle:0x14ede8,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtDuplicateToken(ExistingTokenHandle:0x354,DesiredAccess:0xab,ObjectAttributes:0x14ed00,EffectiveOnly:0x0,TokenType:0x1,NewTokenHandle:0x14edd0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffefe84b188,0x82,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x14ec70,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14e5c0,CalledFrom:0x7ffefe6f0090,ReturnValue:0x58,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14e5c0,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffefe84b188,0x1f,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x14ecd0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14e6a0,CalledFrom:0x7ffefe6f0090,ReturnValue:0x62,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14e6a0,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffefe84b188,0x0,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14e6b0,CalledFrom:0x7ffefe6f0090,ReturnValue:0x14,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14e6b0,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
NtAdjustPrivilegesToken(ProcessHandle:912,NewState:[{'SE_BACKUP_PRIVILEGE': 'SE_PRIVILEGE_ENABLED'}],timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtAdjustPrivilegesToken(TokenHandle:0x390,DisableAllPrivileges:0x0,BufferLength:0x10,PreviousState:0x0,ReturnLength:0x0,SNewState:0x14edf0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffefe84b188,0x82,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x14ec70,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14e5c0,CalledFrom:0x7ffefe6f0090,ReturnValue:0x58,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14e5c0,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffefe84b188,0x1f,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x14ecd0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14e6a0,CalledFrom:0x7ffefe6f0090,ReturnValue:0x64,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14e6a0,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffefe84b188,0x0,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14e6b0,CalledFrom:0x7ffefe6f0090,ReturnValue:0x14,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14e6b0,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
NtAdjustPrivilegesToken(ProcessHandle:912,NewState:[{'SE_RESTORE_PRIVILEGE': 'SE_PRIVILEGE_ENABLED'}],timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtAdjustPrivilegesToken(TokenHandle:0x390,DisableAllPrivileges:0x0,BufferLength:0x10,PreviousState:0x0,ReturnLength:0x0,SNewState:0x14edf0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffefe84b188,0x82,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x14ec70,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14e5c0,CalledFrom:0x7ffefe6f0090,ReturnValue:0x58,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14e5c0,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffefe84b188,0x1f,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x14ecd0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14e6a0,CalledFrom:0x7ffefe6f0090,ReturnValue:0x6e,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14e6a0,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffefe84b188,0x0,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14e6b0,CalledFrom:0x7ffefe6f0090,ReturnValue:0x14,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14e6b0,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
NtAdjustPrivilegesToken(ProcessHandle:912,NewState:[{'SE_MANAGE_VOLUME_PRIVILEGE': 'SE_PRIVILEGE_ENABLED'}],timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtAdjustPrivilegesToken(TokenHandle:0x390,DisableAllPrivileges:0x0,BufferLength:0x10,PreviousState:0x0,ReturnLength:0x0,SNewState:0x14edf0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffefe84b188,0x82,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x14ec70,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14e5c0,CalledFrom:0x7ffefe6f0090,ReturnValue:0x58,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14e5c0,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffefe84b188,0x1f,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x14ecd0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14e6a0,CalledFrom:0x7ffefe6f0090,ReturnValue:0x66,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14e6a0,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffefe84b188,0x0,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14e6b0,CalledFrom:0x7ffefe6f0090,ReturnValue:0x14,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14e6b0,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
NtAdjustPrivilegesToken(ProcessHandle:912,NewState:[{'SE_SECURITY_PRIVILEGE': 'SE_PRIVILEGE_ENABLED'}],timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtAdjustPrivilegesToken(TokenHandle:0x390,DisableAllPrivileges:0x0,BufferLength:0x10,PreviousState:0x0,ReturnLength:0x0,SNewState:0x14edf0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffefe84b188,0x82,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x14ec70,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14e5c0,CalledFrom:0x7ffefe6f0090,ReturnValue:0x58,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14e5c0,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffefe84b188,0x1f,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x14ecd0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14e6a0,CalledFrom:0x7ffefe6f0090,ReturnValue:0x70,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14e6a0,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffefe84b188,0x0,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14e6b0,CalledFrom:0x7ffefe6f0090,ReturnValue:0x14,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14e6b0,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
NtAdjustPrivilegesToken(ProcessHandle:912,NewState:[{'SE_TAKE_OWNERSHIP_PRIVILEGE': 'SE_PRIVILEGE_ENABLED'}],timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtAdjustPrivilegesToken(TokenHandle:0x390,DisableAllPrivileges:0x0,BufferLength:0x10,PreviousState:0x0,ReturnLength:0x0,SNewState:0x14edf0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffefe84b188,0x82,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x14ec70,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14e5c0,CalledFrom:0x7ffefe6f0090,ReturnValue:0x58,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14e5c0,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffefe84b188,0x1f,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x14ecd0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14e6a0,CalledFrom:0x7ffefe6f0090,ReturnValue:0x60,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14e6a0,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->NdrClientCall3(0x7ffefe84b188,0x0,0x0,CalledFrom:0x7ffefe78db80,ReturnValue:0x0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14e6b0,CalledFrom:0x7ffefe6f0090,ReturnValue:0x14,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
rpcrt4.dll->I_RpcSendReceive(0x14e6b0,CalledFrom:0x7ffefe7296a6,ReturnValue:0x0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
NtAdjustPrivilegesToken(ProcessHandle:912,NewState:[{'SE_DEBUG_PRIVILEGE': 'SE_PRIVILEGE_ENABLED'}],timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtAdjustPrivilegesToken(TokenHandle:0x390,DisableAllPrivileges:0x0,BufferLength:0x10,PreviousState:0x0,ReturnLength:0x0,SNewState:0x14edf0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b010,RegionSize:0x14d010,NewProtectWin32:0x4,OldProtect:0x14d028,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
CapCutService.exe->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b000,RegionSize:0x14d010,NewProtectWin32:0x2,OldProtect:0x14d028,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ntoskrnl.exe->NtDuplicateToken(ExistingTokenHandle:0xffffffff80001070,DesiredAccess:0x2c,ObjectAttributes:0xffff8289978ee420,EffectiveOnly:0x0,TokenType:0x2,NewTokenHandle:0xffff8289978ee410,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
NtAdjustPrivilegesToken(ProcessHandle:2147488232,NewState:[{'SE_ASSIGNPRIMARYTOKEN_PRIVILEGE': 'SE_PRIVILEGE_ENABLED'}],timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ntoskrnl.exe->NtAdjustPrivilegesToken(TokenHandle:0xffffffff800011e8,DisableAllPrivileges:0x0,BufferLength:0x400,PreviousState:0xffff960d7ef07b84,ReturnLength:0xffff8289978ee520,SNewState:0xffff960d7ef07f88,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ntoskrnl.exe->NtDuplicateToken(ExistingTokenHandle:0xffffffff80001070,DesiredAccess:0x8,ObjectAttributes:0xffff8289978ee1d8,EffectiveOnly:0x0,TokenType:0x2,NewTokenHandle:0xffff8289978ee1a8,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ntoskrnl.exe->NtQueryInformationProcess(ProcessInformationClass:0x4b,ProcessInformation:0xffffa808264fc128,ProcessInformationLength:0x4,ReturnLength:0x0,PProcessHandle:0xffffffff800011e8,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ntoskrnl.exe->NtQueryInformationProcess(ProcessInformationClass:0x3d,ProcessInformation:0xffffa808264fc168,ProcessInformationLength:0x1,ReturnLength:0x0,PProcessHandle:0xffffffff800011e8,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ntoskrnl.exe->NtQueryInformationProcess(ProcessInformationClass:0x1b,ProcessInformation:0x0,ProcessInformationLength:0x0,ReturnLength:0xffff8289978ee420,PProcessHandle:0xffffffff800011e8,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ntoskrnl.exe->NtQueryInformationProcess(ProcessInformationClass:0x1b,ProcessInformation:0xffffa80827791580,ProcessInformationLength:0x7a,ReturnLength:0xffff8289978ee420,PProcessHandle:0xffffffff800011e8,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ntoskrnl.exe->NtQueryInformationProcess(ProcessInformationClass:0x51,ProcessInformation:0xffff8289978ee3c0,ProcessInformationLength:0x30,ReturnLength:0x0,PProcessHandle:0xffffffff800011e8,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
NtCreateUserProcess(Status:0x0,NewProcessHandle:0x3a8,NewPid:4156,NewThreadHandle:0x354,NewTid:4136,CommandLine:\"C:\Windows\System32\dllhost.exe\" /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F},ImagePathName:C:\Windows\System32\dllhost.exe,DllPath:empty,CWD:C:\Users\Jason\Desktop\,Bitness:64,timestamp:1786262750.0,CMD:['\\"C:\\Windows\\System32\\dllhost.exe\\"', '/Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}']) // CapCutService.exe PID:4512 TID:4516
ntoskrnl.exe->NtCreateFile(FileHandle:0xffff8289978eee70,DesiredAccess:0x80100080,ObjectAttributes:\SystemRoot\AppPatch\sysmain.sdb,IoStatusBlock:0xffff8289978eedf0,AllocationSize:0x0,FileAttributes:0x80,ShareAccess:0x1,CreateDisposition:0x1,CreateOptions:0x60,EaBuffer:0x0,EaLength:0x0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
NtCreateFile(FileName:\SystemRoot\AppPatch\sysmain.sdb,FileHandle:0x80001e88,ObjectAttributes:OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,IoStatusBlock:1,DesiredAccess:FILE_READ_ATTRIBUTES | SYNCHRONIZE | GENERIC_READ,FileAttributes:FILE_ATTRIBUTE_NORMAL,ShareAccess:FILE_SHARE_READ,CreateDisposition:FILE_OPEN,CreateOptions:FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE,Status:0x0,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ntoskrnl.exe->NtQueryInformationFile(FileHandle:\Windows\apppatch\sysmain.sdb,IoStatusBlock:0xffff8289978eee78,FileInformation:0xffff8289978eee88,Length:0x28,FileInformationClass:0x4,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x80001e88,FileName:C:\Windows\apppatch\sysmain.sdb,CreationTime:1719544867,LastAccessTime:1786262732,LastWriteTime:1719544867,ChangeTime:1719545750,FileAttributes:FILE_ATTRIBUTE_ARCHIVE,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ntoskrnl.exe->NtQueryInformationFile(FileHandle:\Windows\System32\dllhost.exe,IoStatusBlock:0xffff8289978eeea0,FileInformation:0xffff8289978eef00,Length:0x28,FileInformationClass:0x4,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
NtQueryInformationFile(Operation:FileBasicInformation,FileHandle:0x80001888,FileName:C:\Windows\System32\dllhost.exe,CreationTime:1719544802,LastAccessTime:1786262718,LastWriteTime:1719544802,ChangeTime:1719590011,FileAttributes:FILE_ATTRIBUTE_ARCHIVE,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtQueryInformationProcess(ProcessInformationClass:0x0,ProcessInformation:0x14d660,ProcessInformationLength:0x40,ReturnLength:0x0,PProcessHandle:0x3a8,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
kernel32.dll->NtQueryVolumeInformationFile(FileHandle:\Windows\System32\dllhost.exe,IoStatusBlock:0x14d400,FsInformation:0x14d430,Length:0x8,FsInformationClass:0x4,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
ntdll.dll->NtQueryLicenseValue(Name:Kernel-OneCore-DeviceFamilyID,Type:0x14d318,Buffer:0x14d310,Length:0x4,ReturnedLength:0x14d360,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtWriteVirtualMemory(BaseAddress:0x18d27000000,Buffer:0x652c20,BufferSize:0x11c0,NumberOfBytesWritten:0x0,PProcessHandle:0x3a8,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
KernelBase.dll->NtWriteVirtualMemory(BaseAddress:0x7edc3162d8,Buffer:0x14da40,BufferSize:0x8,NumberOfBytesWritten:0x0,PProcessHandle:0x3a8,timestamp:1786262750.0) // CapCutService.exe PID:4512 TID:4516
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f4510,RegionSize:0x7edc13f470,NewProtectWin32:0x4,OldProtect:0x7edc13f4b0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_WRITECOPY,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f4000,RegionSize:0x7edc13f470,NewProtectWin32:0x8,OldProtect:0x7edc13f4b0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtQueryInformationProcess(ProcessInformationClass:0x24,ProcessInformation:0x7edc13f108,ProcessInformationLength:0x4,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x7edc13eff8,NewProtectWin32:0x2,OldProtect:0x7edc13eff0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtQueryInformationProcess(ProcessInformationClass:0x24,ProcessInformation:0x7fff007dd230,ProcessInformationLength:0x4,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtQueryInformationProcess(ProcessInformationClass:0x24,ProcessInformation:0x7edc13ef98,ProcessInformationLength:0x4,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtQueryInformationProcess(ProcessInformationClass:0x24,ProcessInformation:0x7edc13eff0,ProcessInformationLength:0x4,ReturnLength:0x0,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x18d27010000,RegionSize:0x7edc13ecd8,FreeType:0x8000,PProcessHandle:0xffffffffffffffff,timestamp:1786262750.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtFreeVirtualMemory(*BaseAddress:0x18d26fb0000,RegionSize:0x7edc13f028,FreeType:0x8000,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x7edc13eff8,NewProtectWin32:0x4,OldProtect:0x7edc13eff0,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtOpenDirectoryObject(FileName:\KnownDlls,ObjectAttributes:OBJ_CASE_INSENSITIVE,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtOpenDirectoryObject(DirectoryHandle:0x7fff007f1298,DesiredAccess:0x3,ObjectAttributes:\KnownDlls,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x7edc13eff8,NewProtectWin32:0x2,OldProtect:0x7edc13eff0,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f11e0,RegionSize:0x7edc13ef60,NewProtectWin32:0x4,OldProtect:0x7edc13efd0,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x7edc13ef60,NewProtectWin32:0x2,OldProtect:0x7edc13efd0,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f5000,RegionSize:0x7edc13ef60,NewProtectWin32:0x4,OldProtect:0x7edc13efd0,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f5000,RegionSize:0x7edc13ef60,NewProtectWin32:0x2,OldProtect:0x7edc13efd0,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x7edc13efc8,NewProtectWin32:0x4,OldProtect:0x7edc13efc0,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x7edc13eff8,NewProtectWin32:0x2,OldProtect:0x7edc13eff0,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ff7303c3300,RegionSize:0x7edc13ef60,NewProtectWin32:0x4,OldProtect:0x7edc13efd0,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ff7303c3000,RegionSize:0x7edc13ef60,NewProtectWin32:0x2,OldProtect:0x7edc13efd0,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ff7303c3308,RegionSize:0x7edc13ef60,NewProtectWin32:0x4,OldProtect:0x7edc13efd0,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ff7303c3000,RegionSize:0x7edc13ef60,NewProtectWin32:0x2,OldProtect:0x7edc13efd0,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x7edc13ef58,NewProtectWin32:0x4,OldProtect:0x7edc13ef50,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x7edc13ef58,NewProtectWin32:0x2,OldProtect:0x7edc13ef50,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtOpenFile(FileName:C:\Users\Jason\Desktop\,FileHandle:0x40,ObjectAttributes:OBJ_CASE_INSENSITIVE,IoStatusBlock:1,DesiredAccess:FILE_TRAVERSE | SYNCHRONIZE,ShareAccess:FILE_SHARE_READ | FILE_SHARE_WRITE,OpenOptions:FILE_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT,Status:0x0,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtQueryVolumeInformationFile(FileHandle:\Users\Jason\Desktop,IoStatusBlock:0x7edc13ef78,FsInformation:0x7edc13ef60,Length:0x8,FsInformationClass:0x4,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff0040a000,RegionSize:0x7edc13eb20,NewProtectWin32:0x2,OldProtect:0x7edc13eb90,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff003d3230,RegionSize:0x7edc13eb20,NewProtectWin32:0x4,OldProtect:0x7edc13eb90,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff003d3000,RegionSize:0x7edc13eb20,NewProtectWin32:0x2,OldProtect:0x7edc13eb90,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff003d3238,RegionSize:0x7edc13eb20,NewProtectWin32:0x4,OldProtect:0x7edc13eb90,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff003d3000,RegionSize:0x7edc13eb20,NewProtectWin32:0x2,OldProtect:0x7edc13eb90,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x7edc13eb18,NewProtectWin32:0x4,OldProtect:0x7edc13eb10,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x7edc13eb18,NewProtectWin32:0x2,OldProtect:0x7edc13eb10,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff003d07c0,RegionSize:0x7edc13eb78,NewProtectWin32:0x4,OldProtect:0x18d27082e58,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b000,RegionSize:0x7edc13e490,NewProtectWin32:0x2,OldProtect:0x7edc13e500,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe495f70,RegionSize:0x7edc13e490,NewProtectWin32:0x4,OldProtect:0x7edc13e500,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe495000,RegionSize:0x7edc13e490,NewProtectWin32:0x2,OldProtect:0x7edc13e500,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe495f78,RegionSize:0x7edc13e490,NewProtectWin32:0x4,OldProtect:0x7edc13e500,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe495000,RegionSize:0x7edc13e490,NewProtectWin32:0x2,OldProtect:0x7edc13e500,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x7edc13e488,NewProtectWin32:0x4,OldProtect:0x7edc13e480,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x7edc13e488,NewProtectWin32:0x2,OldProtect:0x7edc13e480,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe4948e8,RegionSize:0x7edc13e4e8,NewProtectWin32:0x4,OldProtect:0x18d27083468,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff003d07c0,RegionSize:0x18d27082e40,NewProtectWin32:0x2,OldProtect:0x7edc13ea60,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe4948e8,RegionSize:0x18d27083450,NewProtectWin32:0x2,OldProtect:0x7edc13eb60,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtCreateSection(SectionHandle:0x7edc13e5c0,DesiredAccess:0xf001f,ObjectAttributes:0x0,MaximumSize:0x7edc13e5b0,SectionPageProtection:0x4,AllocationAttributes:0x8000000,FileHandle:0x0,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
KernelBase.dll->NtOpenProcessToken(DesiredAccess:0x8,TokenHandle:0x7edc13e680,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtOpenDirectoryObject(FileName:\Sessions\1\BaseNamedObjects,ObjectAttributes:OBJ_CASE_INSENSITIVE,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
KernelBase.dll->NtOpenDirectoryObject(DirectoryHandle:0x7edc13dfa8,DesiredAccess:0xf,ObjectAttributes:\Sessions\1\BaseNamedObjects,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
KernelBase.dll->NtCreateMutant(MutantHandle:0x7edc13e6d8,DesiredAccess:0x1f0001,ObjectAttributes:Local\SM0:4156:304:WilStaging_02,InitialOwner:0x0,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
KernelBase.dll->NtCreateSemaphore(SemaphoreHandle:0x7edc13e3b8,DesiredAccess:0x1f0003,ObjectAttributes:Local\SM0:4156:304:WilStaging_02_p0,InitialCount:0x49c210b0,MaximumCount:0x49c210b0,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
KernelBase.dll->NtCreateSemaphore(SemaphoreHandle:0x7edc13e3b8,DesiredAccess:0x1f0003,ObjectAttributes:Local\SM0:4156:304:WilStaging_02_p0h,InitialCount:0xc6,MaximumCount:0xc6,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b348,RegionSize:0x7edc13e8d0,NewProtectWin32:0x4,OldProtect:0x7edc13e8e8,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b000,RegionSize:0x7edc13e8d0,NewProtectWin32:0x2,OldProtect:0x7edc13e8e8,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b3e0,RegionSize:0x7edc13e8d0,NewProtectWin32:0x4,OldProtect:0x7edc13e8e8,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b000,RegionSize:0x7edc13e8d0,NewProtectWin32:0x2,OldProtect:0x7edc13e8e8,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b3a0,RegionSize:0x7edc13e8d0,NewProtectWin32:0x4,OldProtect:0x7edc13e8e8,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b000,RegionSize:0x7edc13e8d0,NewProtectWin32:0x2,OldProtect:0x7edc13e8e8,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b408,RegionSize:0x7edc13e8d0,NewProtectWin32:0x4,OldProtect:0x7edc13e8e8,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b000,RegionSize:0x7edc13e8d0,NewProtectWin32:0x2,OldProtect:0x7edc13e8e8,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b450,RegionSize:0x7edc13e8d0,NewProtectWin32:0x4,OldProtect:0x7edc13e8e8,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b000,RegionSize:0x7edc13e8d0,NewProtectWin32:0x2,OldProtect:0x7edc13e8e8,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b4d0,RegionSize:0x7edc13e8d0,NewProtectWin32:0x4,OldProtect:0x7edc13e8e8,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b000,RegionSize:0x7edc13e8d0,NewProtectWin32:0x2,OldProtect:0x7edc13e8e8,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b3c8,RegionSize:0x7edc13e8d0,NewProtectWin32:0x4,OldProtect:0x7edc13e8e8,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b000,RegionSize:0x7edc13e8d0,NewProtectWin32:0x2,OldProtect:0x7edc13e8e8,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b468,RegionSize:0x7edc13e8d0,NewProtectWin32:0x4,OldProtect:0x7edc13e8e8,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b000,RegionSize:0x7edc13e8d0,NewProtectWin32:0x2,OldProtect:0x7edc13e8e8,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b530,RegionSize:0x7edc13e8d0,NewProtectWin32:0x4,OldProtect:0x7edc13e8e8,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b000,RegionSize:0x7edc13e8d0,NewProtectWin32:0x2,OldProtect:0x7edc13e8e8,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b5f0,RegionSize:0x7edc13e8d0,NewProtectWin32:0x4,OldProtect:0x7edc13e8e8,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefe57b000,RegionSize:0x7edc13e8d0,NewProtectWin32:0x2,OldProtect:0x7edc13e8e8,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ff7303c3128,RegionSize:0x7edc13efb8,NewProtectWin32:0x4,OldProtect:0x7edc13f348,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefde896c8,RegionSize:0x7edc13e8d0,NewProtectWin32:0x4,OldProtect:0x7edc13e940,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefde89000,RegionSize:0x7edc13e8d0,NewProtectWin32:0x2,OldProtect:0x7edc13e940,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefde896d0,RegionSize:0x7edc13e8d0,NewProtectWin32:0x4,OldProtect:0x7edc13e940,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefde89000,RegionSize:0x7edc13e8d0,NewProtectWin32:0x2,OldProtect:0x7edc13e940,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x7edc13e8c8,NewProtectWin32:0x4,OldProtect:0x7edc13e8c0,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7fff007f1000,RegionSize:0x7edc13e8c8,NewProtectWin32:0x2,OldProtect:0x7edc13e8c0,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffefde891c8,RegionSize:0x7edc13e928,NewProtectWin32:0x4,OldProtect:0x18d27084948,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntoskrnl.exe->NtCreateThreadEx(ThreadHandle:0xffff828997897230,DesiredAccess:0x1fffff,ObjectAttributes:0xffff828997897248,StartRoutine:0x7fff006bd110,Argument:0x18d270830a0,CreateFlags:0x11,ZeroBits:0x0,StackSize:0x8000,MaximumStackSize:0x100000,AttributeList:0xffff828997897280,PProcessHandle:0xffffffff8000191c,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffeffdc0000,RegionSize:0x7edc13e8d0,NewProtectWin32:0x2,OldProtect:0x7edc13e940,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffeffd0d560,RegionSize:0x7edc13e8d0,NewProtectWin32:0x4,OldProtect:0x7edc13e940,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READONLY,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->NtProtectVirtualMemory(*BaseAddress:0x7ffeffd0d000,RegionSize:0x7edc13e8d0,NewProtectWin32:0x2,OldProtect:0x7edc13e940,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
NtProtectVirtualMemory(NewProtectWin32:PAGE_READWRITE,PProcessHandle:0xffffffffffffffff,timestamp:1786262751.0) // dllhost.exe PID:4156 TID:4136
ntdll.dll->
Больше возможностей при регистрации:
