{
  "event": "syscall",
  "pid": 4252,
  "ppid": 4100,
  "uid": 1000,
  "comm": "loader",
  "syscall": "memfd_create",
  "args": [0, 0, 0],
  "text": "payload"
}