dobin-RedEdr/Data/dostuff.events.json

[{"callback":"process_create","id":0,"krn_pid":8500,"name":"\\Device\\HarddiskVolume2\\Users\\hacker\\source\\repos\\RedEdr\\x64\\Debug\\RedEdrTester.exe","observe":1,"parent_name":"\\Device\\HarddiskVolume2\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","pid":1208,"ppid":8500,"time":133791868973812041,"trace_id":41,"type":"kernel"},{"callback":"thread_create","create":1,"id":1,"krn_pid":8500,"pid":1208,"threadid":6916,"time":133791868973822044,"trace_id":41,"type":"kernel"},{"callback":"image_load","id":2,"image":"\\Device\\HarddiskVolume2\\Users\\hacker\\source\\repos\\RedEdr\\x64\\Debug\\RedEdrTester.exe","krn_pid":1208,"pid":1208,"time":133791868973822044,"trace_id":41,"type":"kernel"},{"callback":"image_load","id":3,"image":"\\Device\\HarddiskVolume2\\Windows\\System32\\ntdll.dll","krn_pid":1208,"pid":1208,"time":133791868973822044,"trace_id":41,"type":"kernel"},{"callback":"image_load","id":4,"image":"\\Device\\HarddiskVolume2\\Windows\\System32\\kernel32.dll","krn_pid":1208,"pid":1208,"time":133791868973822044,"trace_id":41,"type":"kernel"},{"callback":"image_load","id":5,"image":"\\Device\\HarddiskVolume2\\Windows\\System32\\KernelBase.dll","krn_pid":1208,"pid":1208,"time":133791868973822044,"trace_id":41,"type":"kernel"},{"callback":"image_load","id":6,"image":"\\Device\\HarddiskVolume2\\Windows\\System32\\advapi32.dll","krn_pid":1208,"pid":1208,"time":133791868973842059,"trace_id":41,"type":"kernel"},{"callback":"image_load","id":7,"image":"\\Device\\HarddiskVolume2\\Windows\\System32\\msvcrt.dll","krn_pid":1208,"pid":1208,"time":133791868973842059,"trace_id":41,"type":"kernel"},{"callback":"thread_create","create":1,"id":8,"krn_pid":1208,"pid":1208,"threadid":11092,"time":133791868973842059,"trace_id":41,"type":"kernel"},{"callback":"image_load","id":9,"image":"\\Device\\HarddiskVolume2\\Windows\\System32\\sechost.dll","krn_pid":1208,"pid":1208,"time":133791868973842059,"trace_id":41,"type":"kernel"},{"callback":"image_load","id":10,"image":"\\Device\\HarddiskVolume2\\Windows\\System32\\rpcrt4.dll","krn_pid":1208,"pid":1208,"time":133791868973842059,"trace_id":41,"type":"kernel"},{"callback":"image_load","id":11,"image":"\\Device\\HarddiskVolume2\\Windows\\System32\\bcrypt.dll","krn_pid":1208,"pid":1208,"time":133791868973842059,"trace_id":41,"type":"kernel"},{"callback":"image_load","id":12,"image":"\\Device\\HarddiskVolume2\\Windows\\System32\\msvcp140d.dll","krn_pid":1208,"pid":1208,"time":133791868973842059,"trace_id":41,"type":"kernel"},{"callback":"image_load","id":13,"image":"\\Device\\HarddiskVolume2\\Windows\\System32\\ole32.dll","krn_pid":1208,"pid":1208,"time":133791868973842059,"trace_id":41,"type":"kernel"},{"dlls":[{"addr":140700730916864,"name":"RedEdrTester.exe","size":1630208},{"addr":140722540838912,"name":"ntdll.dll","size":2064384},{"addr":140722507939840,"name":"KERNEL32.DLL","size":794624},{"addr":140722497912832,"name":"KERNELBASE.dll","size":3137536},{"addr":140722518163456,"name":"ADVAPI32.dll","size":724992},{"addr":140722520195072,"name":"msvcrt.dll","size":647168},{"addr":140722529697792,"name":"sechost.dll","size":651264},{"addr":140722510561280,"name":"RPCRT4.dll","size":1191936},{"addr":140722502238208,"name":"bcrypt.dll","size":159744}],"id":14,"pid":1208,"time":133791868973842059,"trace_id":41,"type":"loaded_dll"},{"callback":"image_load","id":15,"image":"\\Device\\HarddiskVolume2\\Windows\\System32\\ucrtbase.dll","krn_pid":1208,"pid":1208,"time":133791868973842059,"trace_id":41,"type":"kernel"},{"commandline":"\"C:\\Users\\hacker\\source\\repos\\RedEdr\\x64\\Debug\\RedEdrTester.exe\" dostuff","id":16,"image_base":140700730916864,"image_path":"C:\\Users\\hacker\\source\\repos\\RedEdr\\x64\\Debug\\RedEdrTester.exe","is_debugged":0,"is_protected_process":0,"is_protected_process_light":0,"parent_pid":-3689348818177875660,"time":133791868973842059,"trace_id":41,"type":"peb","working_dir":"C:\\Users\\hacker\\source\\repos\\RedEdr\\"},{"callback":"image_load","id":17,"image":"\\Device\\HarddiskVolume2\\Windows\\System32\\combase.dll","krn_pid":1208,"pid":1208,"time":133791868973852040,"trace_id":41,"type":"kernel"},{"callback":"image_load","id":18,"image":"\\Device\\HarddiskVolume2\\Windows\\System32\\gdi32.dll","krn_pid":1208,"pid":1208,"time":133791868973852040,"trace_id":41,"type":"kernel"},{"callback":"image_load","id":19,"image":"\\Device\\HarddiskVolume2\\Windows\\System32\\win32u.dll","krn_pid":1208,"pid":1208,"time":133791868973852040,"trace_id":41,"type":"kernel"},{"callback":"image_load","id":20,"image":"\\Device\\HarddiskVolume2\\Windows\\System32\\gdi32full.dll","krn_pid":1208,"pid":1208,"time":133791868973852040,"trace_id":41,"type":"kernel"},{"callback":"image_load","id":21,"image":"\\Device\\HarddiskVolume2\\Windows\\System32\\msvcp_win.dll","krn_pid":1208,"pid":1208,"time":133791868973852040,"trace_id":41,"type":"kernel"},{"callback":"image_load","id":22,"image":"\\Device\\HarddiskVolume2\\Windows\\System32\\user32.dll","krn_pid":1208,"pid":1208,"time":133791868973852040,"trace_id":41,"type":"kernel"},{"callback":"image_load","id":23,"image":"\\Device\\HarddiskVolume2\\Windows\\System32\\vcruntime140d.dll","krn_pid":1208,"pid":1208,"time":133791868973852040,"trace_id":41,"type":"kernel"},{"callback":"image_load","id":24,"image":"\\Device\\HarddiskVolume2\\Windows\\System32\\vcruntime140_1d.dll","krn_pid":1208,"pid":1208,"time":133791868973852040,"trace_id":41,"type":"kernel"},{"callback":"image_load","id":25,"image":"\\Device\\HarddiskVolume2\\Windows\\System32\\ucrtbased.dll","krn_pid":1208,"pid":1208,"time":133791868973852040,"trace_id":41,"type":"kernel"},{"callback":"image_load","id":26,"image":"\\Device\\HarddiskVolume2\\Windows\\System32\\imm32.dll","krn_pid":1208,"pid":1208,"time":133791868973872050,"trace_id":41,"type":"kernel"},{"callback":"image_load","id":27,"image":"\\Device\\HarddiskVolume2\\RedEdr\\RedEdrDll.dll","krn_pid":1208,"pid":1208,"time":133791868973882045,"trace_id":41,"type":"kernel"},{"callback":"image_load","id":28,"image":"\\Device\\HarddiskVolume2\\Windows\\System32\\dbghelp.dll","krn_pid":1208,"pid":1208,"time":133791868973892035,"trace_id":41,"type":"kernel"},{"callback":"thread_create","create":1,"id":29,"krn_pid":1208,"pid":1208,"threadid":3196,"time":133791868973902041,"trace_id":41,"type":"kernel"},{"func":"hooking_start","id":30,"pid":1208,"tid":6916,"trace_id":41,"type":"dll"},{"func":"hooking_finished","id":31,"pid":1208,"tid":6916,"trace_id":41,"type":"dll"},{"addr":2470295011328,"alloc_type":4096,"func":"NtAllocateVirtualMemory","handle":-1,"id":32,"pid":1208,"protect":"RW-","return":0,"size":8192,"size_req":8192,"tid":6916,"time":133791868973902041,"trace_id":41,"type":"dll","zero":0},{"addr":2470295019520,"alloc_type":4096,"func":"NtAllocateVirtualMemory","handle":-1,"id":33,"pid":1208,"protect":"RW-","return":0,"size":4096,"size_req":4096,"tid":6916,"time":133791868973902041,"trace_id":41,"type":"dll","zero":0},{"addr":2470294257664,"alloc_type":12288,"func":"NtAllocateVirtualMemory","handle":-1,"id":34,"pid":1208,"protect":"RW-","return":0,"size":4096,"size_req":3,"tid":6916,"time":133791868979062050,"trace_id":41,"type":"dll","zero":0},{"callback":"image_load","id":35,"image":"\\Device\\HarddiskVolume2\\Windows\\System32\\bcryptprimitives.dll","krn_pid":1208,"pid":1208,"time":133791868979062050,"trace_id":41,"type":"kernel"},{"addr":2470294257664,"callstack":[{"addr":140721970334572,"addr_info":"Unknown","idx":0,"page_addr":140721970331648,"protect":"R-X","size":139264,"state":1662004296,"type":"IMAGE"},{"addr":140721970362881,"addr_info":"Unknown","idx":1,"page_addr":140721970360320,"protect":"R-X","size":110592,"state":1662004296,"type":"IMAGE"},{"addr":140722498356982,"addr_info":"KERNELBASE.dll:.text","idx":2,"page_addr":140722498355200,"protect":"R-X","size":843776,"state":1662004296,"type":"IMAGE"},{"addr":140700732029427,"addr_info":"RedEdrTester.exe:.text","idx":3,"page_addr":140700732026880,"protect":"R-X","size":159744,"state":1662004296,"type":"IMAGE"},{"addr":140700732031462,"addr_info":"RedEdrTester.exe:.text","idx":4,"page_addr":140700732030976,"protect":"R-X","size":155648,"state":1662004296,"type":"IMAGE"},{"addr":140700732110521,"addr_info":"RedEdrTester.exe:.text","idx":5,"page_addr":140700732108800,"protect":"R-X","size":77824,"state":1662004296,"type":"IMAGE"}],"func":"NtProtectVirtualMemory","handle":-1,"id":36,"pid":1208,"protect":"RWX","return":0,"size":4096,"tid":6916,"time":133791868979062050,"trace_id":41,"type":"dll"},{"callback":"thread_create","create":1,"id":37,"krn_pid":1208,"pid":1208,"threadid":5680,"time":133791868979492052,"trace_id":41,"type":"kernel"},{"argument":2470294257664,"callstack":[{"addr":140721970334572,"addr_info":"Unknown","idx":0,"page_addr":140721970331648,"protect":"R-X","size":139264,"state":1662004296,"type":"IMAGE"},{"addr":140721970351516,"addr_info":"Unknown","idx":1,"page_addr":140721970348032,"protect":"R-X","size":122880,"state":1662004296,"type":"IMAGE"},{"addr":140722498157487,"addr_info":"KERNELBASE.dll:.text","idx":2,"page_addr":140722498154496,"protect":"R-X","size":1044480,"state":1662004296,"type":"IMAGE"},{"addr":140722508052765,"addr_info":"KERNEL32.DLL:.text","idx":3,"page_addr":140722508050432,"protect":"R-X","size":421888,"state":1662004296,"type":"IMAGE"},{"addr":140700732029491,"addr_info":"RedEdrTester.exe:.text","idx":4,"page_addr":140700732026880,"protect":"R-X","size":159744,"state":1662004296,"type":"IMAGE"},{"addr":140700732031462,"addr_info":"RedEdrTester.exe:.text","idx":5,"page_addr":140700732030976,"protect":"R-X","size":155648,"state":1662004296,"type":"IMAGE"}],"func":"NtCreateThreadEx","handle":-1,"id":38,"pid":1208,"start_routine":2470294257664,"thread_handle":376,"tid":6916,"time":133791868979492052,"trace_id":41,"type":"dll"},{"desired_access":2031619,"event_type":0,"func":"NtCreateEvent","id":39,"initial_state":0,"pid":1208,"tid":5680,"time":133791868979502041,"trace_id":41,"type":"dll"},{"desired_access":2031619,"event_type":0,"func":"NtCreateEvent","id":40,"initial_state":0,"pid":1208,"tid":5680,"time":133791868979502041,"trace_id":41,"type":"dll"},{"access_mask":983047,"alloc_attributes":134217728,"callstack":[{"addr":140721970334572,"addr_info":"Unknown","idx":0,"page_addr":140721970331648,"protect":"R-X","size":139264,"state":1662004296,"type":"IMAGE"},{"addr":140721970348392,"addr_info":"Unknown","idx":1,"page_addr":140721970348032,"protect":"R-X","size":122880,"state":1662004296,"type":"IMAGE"},{"addr":140722498144289,"addr_info":"KERNELBASE.dll:.text","idx":2,"page_addr":140722498142208,"protect":"R-X","size":1056768,"state":1662004296,"type":"IMAGE"},{"addr":140722498145856,"addr_info":"KERNELBASE.dll:.text","idx":3,"page_addr":140722498142208,"protect":"R-X","size":1056768,"state":1662004296,"type":"IMAGE"},{"addr":140722508405615,"addr_info":"KERNEL32.DLL:.text","idx":4,"page_addr":140722508402688,"protect":"R-X","size":69632,"state":1662004296,"type":"IMAGE"},{"addr":140722508405142,"addr_info":"KERNEL32.DLL:.text","idx":5,"page_addr":140722508402688,"protect":"R-X","size":69632,"state":1662004296,"type":"IMAGE"}],"file_handle":0,"func":"NtCreateSection","id":41,"max_size":686538352688,"page_protection":4,"pid":1208,"section_handle":408,"tid":5680,"time":133791868979502041,"trace_id":41,"type":"dll"},{"alloc_type":0,"base_address":0,"callstack":[{"addr":140721970334572,"addr_info":"Unknown","idx":0,"page_addr":140721970331648,"protect":"R-X","size":139264,"state":1662004296,"type":"IMAGE"},{"addr":140721970358498,"addr_info":"Unknown","idx":1,"page_addr":140721970356224,"protect":"R-X","size":114688,"state":1662004296,"type":"IMAGE"},{"addr":140722498355462,"addr_info":"KERNELBASE.dll:.text","idx":2,"page_addr":140722498355200,"protect":"R-X","size":843776,"state":1662004296,"type":"IMAGE"},{"addr":140722498355166,"addr_info":"KERNELBASE.dll:.text","idx":3,"page_addr":140722498351104,"protect":"R-X","size":847872,"state":1662004296,"type":"IMAGE"},{"addr":140722508405678,"addr_info":"KERNEL32.DLL:.text","idx":4,"page_addr":140722508402688,"protect":"R-X","size":69632,"state":1662004296,"type":"IMAGE"},{"addr":140722508405142,"addr_info":"KERNEL32.DLL:.text","idx":5,"page_addr":140722508402688,"protect":"R-X","size":69632,"state":1662004296,"type":"IMAGE"}],"func":"NtMapViewOfSection","handle":-1,"id":42,"inherit_disposition":1,"pid":1208,"protect":"RW-","section_handle":408,"section_offset":0,"size":0,"tid":5680,"time":133791868979502041,"trace_id":41,"type":"dll","view_size":0,"zero_bits":0},{"addr":2470294519808,"alloc_type":4096,"func":"NtAllocateVirtualMemory","handle":-1,"id":43,"pid":1208,"protect":"RW-","return":0,"size":4096,"size_req":12,"tid":5680,"time":133791868979512065,"trace_id":41,"type":"dll","zero":0},{"DefaultBase":"00007FF771160000","ImageBase":"00007FF771160000","ImageCheckSum":"0","ImageName":"\\Device\\HarddiskVolume2\\Users\\hacker\\source\\repos\\RedEdr\\x64\\Debug\\RedEdrTester.exe","ImageSize":"000000000018E000","ProcessID":"1208","TimeDateStamp":"1734703906","event":"ImageLoadInfo ","id":44,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283801382079,18446735283801378810,18446735283801355267,18446735283801354603,18446735283798965368,18446735283798965216,140722541153392],"thread_id":6916,"time":133791868973826131,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC850F0000","ImageBase":"00007FFC850F0000","ImageCheckSum":"2047181","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\ntdll.dll","ImageSize":"00000000001F8000","ProcessID":"1208","TimeDateStamp":"1754238027","event":"ImageLoadInfo ","id":45,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283801382079,18446735283801378810,18446735283801355528,18446735283801354603,18446735283798965368,18446735283798965216,140722541153392],"thread_id":6916,"time":133791868973826763,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC83190000","ImageBase":"00007FFC83190000","ImageCheckSum":"811940","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\kernel32.dll","ImageSize":"00000000000C2000","ProcessID":"1208","TimeDateStamp":"2273328705","event":"ImageLoadInfo ","id":46,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283801382079,18446735283801378810,18446735283801368557,18446735283801323052,18446735283801319001,18446735283799009541,140722541484532,140722540924226,140722540923562,140722540921977,140722541282029,140722540968753,140722540934116,140722540931828,140722541705166,140722541321707,140722541321331,140722541321246],"thread_id":6916,"time":133791868973830298,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC82800000","ImageBase":"00007FFC82800000","ImageCheckSum":"3204207","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\KernelBase.dll","ImageSize":"00000000002FE000","ProcessID":"1208","TimeDateStamp":"3522100337","event":"ImageLoadInfo ","id":47,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283801382079,18446735283801378810,18446735283801368557,18446735283801323052,18446735283801319001,18446735283799009541,140722541484532,140722540924226,140722540923562,140722540921977,140722540939432,140722540935977,140722540923924,140722540921977,140722541282029,140722540968753,140722540934116,140722540931828,140722541705166,140722541321707,140722541321331,140722541321246],"thread_id":6916,"time":133791868973831893,"trace_id":41,"type":"etw"},{"addr":2470294519808,"free_type":8000,"func":"NtFreeVirtualMemory","handle":-1,"id":48,"pid":1208,"return":0,"size":4096,"size_req":12,"tid":5680,"time":133791868979782053,"trace_id":41,"type":"dll"},{"DefaultBase":"00007FFC83B50000","ImageBase":"00007FFC83B50000","ImageCheckSum":"766771","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\advapi32.dll","ImageSize":"00000000000B1000","ProcessID":"1208","TimeDateStamp":"187986496","event":"ImageLoadInfo ","id":49,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283801382079,18446735283801378810,18446735283801368557,18446735283801323052,18446735283801319001,18446735283799009541,140722541484532,140722540924226,140722540923562,140722540921977,140722540939432,140722540935977,140722541706093,140722541321707,140722541321331,140722541321246],"thread_id":6916,"time":133791868973843604,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC83D40000","ImageBase":"00007FFC83D40000","ImageCheckSum":"681663","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\msvcrt.dll","ImageSize":"000000000009E000","ProcessID":"1208","TimeDateStamp":"2616593924","event":"ImageLoadInfo ","id":50,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283801382079,18446735283801378810,18446735283801368557,18446735283801323052,18446735283801319001,18446735283799009541,140722541484532,140722540924226,140722540923562,140722540921977,140722540939432,140722540935977,140722540923924,140722540921977,140722540939432,140722540935977,140722541706093,140722541321707,140722541321331,140722541321246],"thread_id":6916,"time":133791868973844199,"trace_id":41,"type":"etw"},{"ProcessID":"1208","StackBase":"FFFF8185AAC77000","StackLimit":"FFFF8185AAC71000","StartAddr":"00007FFC8513D110","SubProcessTag":"0","TebBase":"0000009FD88DA000","ThreadID":"11092","UserStackBase":"0000009FD8C00000","UserStackLimit":"0000009FD8BFF000","Win32StartAddr":"00007FFC8513D110","event":"ThreadStartStart ","id":51,"opcode_id":1,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283797242684,18446735283801644436,18446735283801643055,18446735283801540391,18446735283801538352,18446735283801537158,18446735283799009541,18446735283798947552,18446735283801492570,18446735283797779076,18446735283796924337,18446735283796923547,18446735283799009541,140722541495044,140722540915673,140722540915302,140722540901535,140722540936098,140722540923924,140722540921977,140722540939432,140722540935977,140722540923924,140722540921977,140722540939432,140722540935977,140722541706093,140722541321707,140722541321331,140722541321246],"thread_id":6916,"time":133791868973844777,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC84650000","ImageBase":"00007FFC84650000","ImageCheckSum":"673563","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\sechost.dll","ImageSize":"000000000009F000","ProcessID":"1208","TimeDateStamp":"1942365337","event":"ImageLoadInfo ","id":52,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283801382079,18446735283801378810,18446735283801368557,18446735283801323052,18446735283801319001,18446735283799009541,140722541484532,140722540924226,140722540923562,140722540921977,140722540939432,140722540935977,140722540923924,140722540921977,140722540939432,140722540935977,140722541706093,140722541321707,140722541321331,140722541321246],"thread_id":6916,"time":133791868973845122,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC83410000","ImageBase":"00007FFC83410000","ImageCheckSum":"1244603","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\rpcrt4.dll","ImageSize":"0000000000123000","ProcessID":"1208","TimeDateStamp":"2016036219","event":"ImageLoadInfo ","id":53,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283801382079,18446735283801378810,18446735283801368557,18446735283801323052,18446735283801319001,18446735283799009541,140722541484532,140722540924226,140722540923562,140722540921977,140722540939432,140722540935977,140722540923924,140722540921977,140722540939432,140722540935977,140722540923924,140722540921977,140722540939432,140722540935977,140722541706093,140722541321707,140722541321331,140722541321246],"thread_id":6916,"time":133791868973845622,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC82C20000","ImageBase":"00007FFC82C20000","ImageCheckSum":"199345","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\bcrypt.dll","ImageSize":"0000000000027000","ProcessID":"1208","TimeDateStamp":"2535700803","event":"ImageLoadInfo ","id":54,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283801382079,18446735283801378810,18446735283801368557,18446735283801323052,18446735283801319001,18446735283799009541,140722541484532,140722540924226,140722540923562,140722540921977,140722540939432,140722540935977,140722540923924,140722540921977,140722540939432,140722540935977,140722540923924,140722540921977,140722540939432,140722540935977,140722541706093,140722541321707,140722541321331,140722541321246],"thread_id":6916,"time":133791868973846304,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC62B00000","ImageBase":"00007FFC62B00000","ImageCheckSum":"929031","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\msvcp140d.dll","ImageSize":"00000000000E2000","ProcessID":"1208","TimeDateStamp":"4270244042","event":"ImageLoadInfo ","id":55,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283801382079,18446735283801378810,18446735283801368557,18446735283801323052,18446735283801319001,18446735283799009541,140722541484532,140722540924226,140722540923562,140722541236803,140722541235360,140722541232480,140722541232200,140722541706103,140722541321707,140722541321331,140722541321246],"thread_id":6916,"time":133791868973850339,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC848D0000","ImageBase":"00007FFC848D0000","ImageCheckSum":"1221752","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\ole32.dll","ImageSize":"000000000012B000","ProcessID":"1208","TimeDateStamp":"610785574","event":"ImageLoadInfo ","id":56,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283801382079,18446735283801378810,18446735283801368557,18446735283801323052,18446735283801319001,18446735283799009541,140722541484532,140722540924226,140722540923562,140722540921977,140722540939432,140722540935977,140722540923924,140722541236803,140722541235360,140722541232480,140722541232200,140722541706103,140722541321707,140722541321331,140722541321246],"thread_id":6916,"time":133791868973850943,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC82C50000","ImageBase":"00007FFC82C50000","ImageCheckSum":"1076532","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\ucrtbase.dll","ImageSize":"0000000000100000","ProcessID":"1208","TimeDateStamp":"2177850761","event":"ImageLoadInfo ","id":57,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283801382079,18446735283801378810,18446735283801368557,18446735283801323052,18446735283801319001,18446735283799009541,140722541484532,140722540924226,140722540923562,140722540921977,140722540939432,140722540935977,140722540923924,140722540921977,140722540939432,140722540935977,140722540923924,140722541236803,140722541235360,140722541232480,140722541232200,140722541706103,140722541321707,140722541321331,140722541321246],"thread_id":6916,"time":133791868973851508,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC84D50000","ImageBase":"00007FFC84D50000","ImageCheckSum":"3511252","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\combase.dll","ImageSize":"0000000000353000","ProcessID":"1208","TimeDateStamp":"3888075817","event":"ImageLoadInfo ","id":58,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283801382079,18446735283801378810,18446735283801368557,18446735283801323052,18446735283801319001,18446735283799009541,140722541484532,140722540924226,140722540923562,140722540921977,140722540939432,140722540935977,140722540923924,140722540921977,140722540939432,140722540935977,140722540923924,140722541236803,140722541235360,140722541232480,140722541232200,140722541706103,140722541321707,140722541321331,140722541321246],"thread_id":6916,"time":133791868973852214,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC833E0000","ImageBase":"00007FFC833E0000","ImageCheckSum":"218727","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\gdi32.dll","ImageSize":"000000000002B000","ProcessID":"1208","TimeDateStamp":"3634633287","event":"ImageLoadInfo ","id":59,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283801382079,18446735283801378810,18446735283801368557,18446735283801323052,18446735283801319001,18446735283799009541,140722541484532,140722540924226,140722540923562,140722540921977,140722540939432,140722540935977,140722540923924,140722540921977,140722540939432,140722540935977,140722540923924,140722541236803,140722541235360,140722541232480,140722541232200,140722541706103,140722541321707,140722541321331,140722541321246],"thread_id":6916,"time":133791868973852906,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC82FF0000","ImageBase":"00007FFC82FF0000","ImageCheckSum":"137991","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\win32u.dll","ImageSize":"0000000000022000","ProcessID":"1208","TimeDateStamp":"3336608826","event":"ImageLoadInfo ","id":60,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283801382079,18446735283801378810,18446735283801368557,18446735283801323052,18446735283801319001,18446735283799009541,140722541484532,140722540924226,140722540923562,140722540921977,140722540939432,140722540935977,140722540923924,140722540921977,140722540939432,140722540935977,140722540923924,140722540921977,140722540939432,140722540935977,140722540923924,140722541236803,140722541235360,140722541232480,140722541232200,140722541706103,140722541321707,140722541321331,140722541321246],"thread_id":6916,"time":133791868973853419,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC82B00000","ImageBase":"00007FFC82B00000","ImageCheckSum":"1180473","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\gdi32full.dll","ImageSize":"0000000000117000","ProcessID":"1208","TimeDateStamp":"576863693","event":"ImageLoadInfo ","id":61,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283801382079,18446735283801378810,18446735283801368557,18446735283801323052,18446735283801319001,18446735283799009541,140722541484532,140722540924226,140722540923562,140722540921977,140722540939432,140722540935977,140722540923924,140722540921977,140722540939432,140722540935977,140722540923924,140722540921977,140722540939432,140722540935977,140722540923924,140722541236803,140722541235360,140722541232480,140722541232200,140722541706103,140722541321707,140722541321331,140722541321246],"thread_id":6916,"time":133791868973853787,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC83070000","ImageBase":"00007FFC83070000","ImageCheckSum":"659111","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\msvcp_win.dll","ImageSize":"000000000009D000","ProcessID":"1208","TimeDateStamp":"958749903","event":"ImageLoadInfo ","id":62,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283801382079,18446735283801378810,18446735283801368557,18446735283801323052,18446735283801319001,18446735283799009541,140722541484532,140722540924226,140722540923562,140722540921977,140722540939432,140722540935977,140722540923924,140722540921977,140722540939432,140722540935977,140722540923924,140722540921977,140722540939432,140722540935977,140722540923924,140722540921977,140722540939432,140722540935977,140722540923924,140722541236803,140722541235360,140722541232480,140722541232200,140722541706103,140722541321707,140722541321331,140722541321246],"thread_id":6916,"time":133791868973854262,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC84A00000","ImageBase":"00007FFC84A00000","ImageCheckSum":"1745311","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\user32.dll","ImageSize":"000000000019D000","ProcessID":"1208","TimeDateStamp":"4291603748","event":"ImageLoadInfo ","id":63,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283801382079,18446735283801378810,18446735283801368557,18446735283801323052,18446735283801319001,18446735283799009541,140722541484532,140722540924226,140722540923562,140722540921977,140722540939432,140722540935977,140722540923924,140722540921977,140722540939432,140722540935977,140722540923924,140722540921977,140722540939432,140722540935977,140722540923924,140722540921977,140722540939432,140722540935977,140722540923924,140722541236803,140722541235360,140722541232480,140722541232200,140722541706103,140722541321707,140722541321331,140722541321246],"thread_id":6916,"time":133791868973854932,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC77340000","ImageBase":"00007FFC77340000","ImageCheckSum":"215677","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\vcruntime140d.dll","ImageSize":"000000000002B000","ProcessID":"1208","TimeDateStamp":"3390545094","event":"ImageLoadInfo ","id":64,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283801382079,18446735283801378810,18446735283801368557,18446735283801323052,18446735283801319001,18446735283799009541,140722541484532,140722540924226,140722540923562,140722541236803,140722541235360,140722541232480,140722541232200,140722541706103,140722541321707,140722541321331,140722541321246],"thread_id":6916,"time":133791868973856273,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC7DD50000","ImageBase":"00007FFC7DD50000","ImageCheckSum":"124685","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\vcruntime140_1d.dll","ImageSize":"000000000000F000","ProcessID":"1208","TimeDateStamp":"743278547","event":"ImageLoadInfo ","id":65,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283801382079,18446735283801378810,18446735283801368557,18446735283801323052,18446735283801319001,18446735283799009541,140722541484532,140722540924226,140722540923562,140722541236803,140722541235360,140722541232480,140722541232200,140722541706103,140722541321707,140722541321331,140722541321246],"thread_id":6916,"time":133791868973857377,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC628D0000","ImageBase":"00007FFC628D0000","ImageCheckSum":"2249853","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\ucrtbased.dll","ImageSize":"0000000000222000","ProcessID":"1208","TimeDateStamp":"3642813796","event":"ImageLoadInfo ","id":66,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283801382079,18446735283801378810,18446735283801368557,18446735283801323052,18446735283801319001,18446735283799009541,140722541484532,140722540924226,140722540923562,140722541236803,140722541235360,140722541232480,140722541232200,140722541706103,140722541321707,140722541321331,140722541321246],"thread_id":6916,"time":133791868973858416,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC83DE0000","ImageBase":"00007FFC83DE0000","ImageCheckSum":"244437","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\imm32.dll","ImageSize":"000000000002F000","ProcessID":"1208","TimeDateStamp":"3510600902","event":"ImageLoadInfo ","id":67,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283801382079,18446735283801378810,18446735283801368557,18446735283801323052,18446735283801319001,18446735283799009541,140722541484532,140722540924226,140722540923562,140722540921977,140722541282029,140722540968753,140722540934116,140722540931828,140722498119186,140722533672481,140722533664800,140722540943901,140722541286135,140722541285514,140722541285648,140722541285648,140722541285648,140722541706418,140722541321707,140722541321331,140722541321246],"thread_id":6916,"time":133791868973877940,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC630A0000","ImageBase":"00007FFC630A0000","ImageCheckSum":"0","ImageName":"\\Device\\HarddiskVolume2\\RedEdr\\RedEdrDll.dll","ImageSize":"0000000000082000","ProcessID":"1208","TimeDateStamp":"1734697896","event":"ImageLoadInfo ","id":68,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283801382079,18446735283801378810,18446735283801368557,18446735283801323052,18446735283801319001,18446735283799009541,140722541484532,140722540924226,140722540923562,140722541236803,140722541236080,140722541232655,140722540968787,140722540934116,140722540931828,140722498119186,140722498150113,140722541498974,140722541497636,140722541322413,140722541321331,140722541321246],"thread_id":6916,"time":133791868973891869,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC73E50000","ImageBase":"00007FFC73E50000","ImageCheckSum":"1883635","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\dbghelp.dll","ImageSize":"00000000001E4000","ProcessID":"1208","TimeDateStamp":"2592498981","event":"ImageLoadInfo ","id":69,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283801382079,18446735283801378810,18446735283801368557,18446735283801323052,18446735283801319001,18446735283799009541,140722541484532,140722540924226,140722540923562,140722541236803,140722541235360,140722541232480,140722541232200,140722540968797,140722540934116,140722540931828,140722498119186,140722498150113,140722541498974,140722541497636,140722541322413,140722541321331,140722541321246],"thread_id":6916,"time":133791868973894702,"trace_id":41,"type":"etw"},{"ProcessID":"1208","StackBase":"FFFF8185AAC8C000","StackLimit":"FFFF8185AAC86000","StartAddr":"00007FFC8513D110","SubProcessTag":"0","TebBase":"0000009FD88DC000","ThreadID":"3196","UserStackBase":"0000009FD8D00000","UserStackLimit":"0000009FD8CFF000","Win32StartAddr":"00007FFC8513D110","event":"ThreadStartStart ","id":70,"opcode_id":1,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283797242684,18446735283801644436,18446735283801643055,18446735283801540391,18446735283801538352,18446735283801537158,18446735283799009541,18446735283798947552,18446735283801492570,18446735283797779076,18446735283796924337,18446735283796923547,18446735283799009541,140722541495044,140722540915673,140722540970036,140722541246040,140722541156250,140722508034932,140722541153425],"thread_id":11092,"time":133791868973904770,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC82F60000","ImageBase":"00007FFC82F60000","ImageCheckSum":"531569","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\bcryptprimitives.dll","ImageSize":"0000000000082000","ProcessID":"1208","TimeDateStamp":"3309379821","event":"ImageLoadInfo ","id":71,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283801382079,18446735283801378810,18446735283801368557,18446735283801323052,18446735283801319001,18446735283799009541,140722541484532,140721970357133,140722540924226,140722540923562,140722540921977,140722541282029,140722540968753,140722540932416,140722540930798,140722541041959,140722540905542,140722510982114,140722511029553,140722510934949,140722252973064,140722252970041,140722252944910,140721970336136,140721970334552,140721970362881,140722498356982,140700732029427,140700732031462,140700732110521,140700732110174,140700732109854,140700732110670,140722508034932,140722541153425],"thread_id":6916,"time":133791868979064970,"trace_id":41,"type":"etw"},{"ProcessID":"1208","StackBase":"FFFF8185AC7B9000","StackLimit":"FFFF8185AC7B3000","StartAddr":"0000023F29030000","SubProcessTag":"0","TebBase":"0000009FD88DE000","ThreadID":"5680","UserStackBase":"0000009FD8E00000","UserStackLimit":"0000009FD8DFF000","Win32StartAddr":"0000023F29030000","event":"ThreadStartStart ","id":72,"opcode_id":1,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283797242684,18446735283801644436,18446735283801643055,18446735283801540391,18446735283801538352,18446735283801537158,18446735283799009541,140722541489444,140721970350754,140722498157487,140722508052765,140700732029491,140700732031462,140700732110521,140700732110174,140700732109854,140700732110670,140722508034932,140722541153425],"thread_id":6916,"time":133791868979501089,"trace_id":41,"type":"etw"},{"AllocationType":"12288","BaseAddress":"0x0000025BA365C900","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"64","RegionSize":"0x0000025BA365CB30","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"ALLOCVM_LOCAL","id":73,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973909306,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365C540","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"32","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"64","RegionSize":"0x0000025BA365C8B0","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":74,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973909600,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365C4A0","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"32","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"64","RegionSize":"0x0000025BA365CB30","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":75,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973909618,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365C950","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"32","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"64","RegionSize":"0x0000025BA365C5E0","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":76,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973909633,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365C4F0","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"32","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"64","RegionSize":"0x0000025BA365C720","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":77,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973909646,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365C590","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"128","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"64","RegionSize":"0x0000025BA365C630","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":78,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973909659,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365CA40","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"128","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"64","RegionSize":"0x0000025BA365C720","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":79,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973909673,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365C7C0","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"128","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"64","RegionSize":"0x0000025BA365C720","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":80,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973909685,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365C6D0","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"128","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"64","RegionSize":"0x0000025BA365C8B0","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":81,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973909698,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365C7C0","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"32","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"64","RegionSize":"0x0000025BA365C5E0","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":82,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973909711,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365C4F0","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"128","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"64","RegionSize":"0x0000025BA365C630","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":83,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973909724,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365C900","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"128","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"64","RegionSize":"0x0000025BA365CB30","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":84,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973909777,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365CA40","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"128","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"64","RegionSize":"0x0000025BA365C5E0","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":85,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973909790,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365C950","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"128","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"64","RegionSize":"0x0000025BA365CA40","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":86,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973909803,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365C5E0","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"128","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"64","RegionSize":"0x0000025BA365C810","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":87,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973909816,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365C900","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"128","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"64","RegionSize":"0x0000025BA365C630","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":88,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973909828,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365C4F0","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"128","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"64","RegionSize":"0x0000025BA365C540","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":89,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973909840,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365C540","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"128","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"64","RegionSize":"0x0000025BA365C7C0","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":90,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973909853,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365C4F0","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"128","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"64","RegionSize":"0x0000025BA365C4A0","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":91,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973909865,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365CB30","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"128","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"64","RegionSize":"0x0000025BA365C630","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":92,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973909878,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365CB30","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"128","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"64","RegionSize":"0x0000025BA365C590","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":93,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973909891,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365C900","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"128","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"64","RegionSize":"0x0000025BA365C9F0","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":94,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973909914,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365C4F0","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"128","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"64","RegionSize":"0x0000025BA365C4F0","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":95,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973909936,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365CA40","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"64","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"128","RegionSize":"0x0000025BA365C540","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":96,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973910092,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365C8B0","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"64","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"128","RegionSize":"0x0000025BA365C950","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":97,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973910115,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365C9F0","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"64","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"128","RegionSize":"0x0000025BA365C7C0","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":98,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973910127,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365C6D0","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"64","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"128","RegionSize":"0x0000025BA365C950","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":99,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973910139,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365C4F0","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"64","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"128","RegionSize":"0x0000025BA365C5E0","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":100,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973910152,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365CB30","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"64","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"128","RegionSize":"0x0000025BA365C7C0","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":101,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973910166,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365C4F0","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"64","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"128","RegionSize":"0x0000025BA365C4F0","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":102,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973910178,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365C4A0","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"64","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"128","RegionSize":"0x0000025BA365CB30","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":103,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973910192,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365C8B0","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"64","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"128","RegionSize":"0x0000025BA365C630","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":104,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973910204,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365C8B0","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"64","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"128","RegionSize":"0x0000025BA365C4F0","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":105,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973910216,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365C9F0","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"64","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"128","RegionSize":"0x0000025BA365C4F0","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":106,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973910228,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365C4F0","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"64","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"128","RegionSize":"0x0000025BA365C540","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":107,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973910241,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365C720","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"64","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"128","RegionSize":"0x0000025BA365C720","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":108,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973910254,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365C5E0","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"64","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"32","RegionSize":"0x0000025BA365CB30","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":109,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973910267,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365C9A0","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"64","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"128","RegionSize":"0x0000025BA365C8B0","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":110,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973910279,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365CB30","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"64","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"128","RegionSize":"0x0000025BA365C7C0","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":111,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973910292,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365C630","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"64","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"128","RegionSize":"0x0000025BA365C5E0","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":112,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973910304,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365C900","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"64","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"128","RegionSize":"0x0000025BA365C810","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":113,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973910316,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365C9F0","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"64","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"32","RegionSize":"0x0000025BA365C9A0","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":114,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973910328,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365C810","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"64","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"32","RegionSize":"0x0000025BA365C8B0","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":115,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973910344,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365C9A0","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"64","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"32","RegionSize":"0x0000025BA365C900","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":116,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973910355,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365C4A0","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"64","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"32","RegionSize":"0x0000025BA365C950","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":117,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973910372,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365C540","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"64","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"32","RegionSize":"0x0000025BA365C900","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":118,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868973910413,"trace_id":41,"type":"etw"},{"callback":"thread_create","create":0,"id":119,"krn_pid":1208,"pid":1208,"threadid":11092,"time":133791868989812038,"trace_id":41,"type":"kernel"},{"callback":"thread_create","create":0,"id":120,"krn_pid":1208,"pid":1208,"threadid":6916,"time":133791868989812038,"trace_id":41,"type":"kernel"},{"callback":"thread_create","create":0,"id":121,"krn_pid":1208,"pid":1208,"threadid":3196,"time":133791868989812038,"trace_id":41,"type":"kernel"},{"callback":"thread_create","create":0,"id":122,"krn_pid":1208,"pid":1208,"threadid":5680,"time":133791868989812038,"trace_id":41,"type":"kernel"},{"CycleTime":"181056096","ProcessID":"1208","StackBase":"FFFF8185AAC62000","StackLimit":"FFFF8185AAC5C000","StartAddr":"00007FF7711C4616","SubProcessTag":"0","TebBase":"0000009FD88D8000","ThreadID":"6916","UserStackBase":"0000009FD8B00000","UserStackLimit":"0000009FD8AF6000","Win32StartAddr":"00007FF7711C4616","event":"ThreadStopStop ","id":123,"opcode_id":2,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283797242684,18446735283801644436,18446735283801643055,18446735283801352931,18446735283801347736,18446735283796947549,18446735283798949776,18446735283799009711],"thread_id":6916,"time":133791868989812926,"trace_id":41,"type":"etw"},{"CycleTime":"287100","ProcessID":"1208","StackBase":"FFFF8185AAC77000","StackLimit":"FFFF8185AAC71000","StartAddr":"00007FFC8513D110","SubProcessTag":"0","TebBase":"0000009FD88DA000","ThreadID":"11092","UserStackBase":"0000009FD8C00000","UserStackLimit":"0000009FD8BFF000","Win32StartAddr":"00007FFC8513D110","event":"ThreadStopStop ","id":124,"opcode_id":2,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283797242684,18446735283801644436,18446735283801643055,18446735283801352931,18446735283801347736,18446735283796947549,18446735283798949776,18446735283799009711],"thread_id":11092,"time":133791868989812928,"trace_id":41,"type":"etw"},{"CycleTime":"107316","ProcessID":"1208","StackBase":"FFFF8185AAC8C000","StackLimit":"FFFF8185AAC86000","StartAddr":"00007FFC8513D110","SubProcessTag":"0","TebBase":"0000009FD88DC000","ThreadID":"3196","UserStackBase":"0000009FD8D00000","UserStackLimit":"0000009FD8CFF000","Win32StartAddr":"00007FFC8513D110","event":"ThreadStopStop ","id":125,"opcode_id":2,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283797242684,18446735283801644436,18446735283801643055,18446735283801352931,18446735283801347736,18446735283796947549,18446735283798949776,18446735283799009711],"thread_id":3196,"time":133791868989813773,"trace_id":41,"type":"etw"},{"CycleTime":"2887740","ProcessID":"1208","StackBase":"FFFF8185AC7B9000","StackLimit":"FFFF8185AC7B3000","StartAddr":"0000023F29030000","SubProcessTag":"0","TebBase":"0000009FD88DE000","ThreadID":"5680","UserStackBase":"0000009FD8E00000","UserStackLimit":"0000009FD8DF7000","Win32StartAddr":"0000023F29030000","event":"ThreadStopStop ","id":126,"opcode_id":2,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283797242684,18446735283801644436,18446735283801643055,18446735283801352931,18446735283801754190,18446735283799009541],"thread_id":5680,"time":133791868989814117,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FF771160000","ImageBase":"00007FF771160000","ImageCheckSum":"0","ImageName":"\\Device\\HarddiskVolume2\\Users\\hacker\\source\\repos\\RedEdr\\x64\\Debug\\RedEdrTester.exe","ImageSize":"000000000018E000","ProcessID":"1208","TimeDateStamp":"1734703906","event":"ImageUnloadInfo ","id":127,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283797621171,18446735283801386793,18446735283801520226,18446735283800918026,18446735283801353166,18446735283801754190,18446735283799009541],"thread_id":5680,"time":133791868989814755,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC628D0000","ImageBase":"00007FFC628D0000","ImageCheckSum":"2249853","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\ucrtbased.dll","ImageSize":"0000000000222000","ProcessID":"1208","TimeDateStamp":"3642813796","event":"ImageUnloadInfo ","id":128,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283797621171,18446735283801386793,18446735283801520226,18446735283800918026,18446735283801353166,18446735283801754190,18446735283799009541],"thread_id":5680,"time":133791868989814891,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC62B00000","ImageBase":"00007FFC62B00000","ImageCheckSum":"929031","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\msvcp140d.dll","ImageSize":"00000000000E2000","ProcessID":"1208","TimeDateStamp":"4270244042","event":"ImageUnloadInfo ","id":129,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283797621171,18446735283801386793,18446735283801520226,18446735283800918026,18446735283801353166,18446735283801754190,18446735283799009541],"thread_id":5680,"time":133791868989814978,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC630A0000","ImageBase":"00007FFC630A0000","ImageCheckSum":"0","ImageName":"\\Device\\HarddiskVolume2\\RedEdr\\RedEdrDll.dll","ImageSize":"0000000000082000","ProcessID":"1208","TimeDateStamp":"1734697896","event":"ImageUnloadInfo ","id":130,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283797621171,18446735283801386793,18446735283801520226,18446735283800918026,18446735283801353166,18446735283801754190,18446735283799009541],"thread_id":5680,"time":133791868989815067,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC73E50000","ImageBase":"00007FFC73E50000","ImageCheckSum":"1883635","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\dbghelp.dll","ImageSize":"00000000001E4000","ProcessID":"1208","TimeDateStamp":"2592498981","event":"ImageUnloadInfo ","id":131,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283797621171,18446735283801386793,18446735283801520226,18446735283800918026,18446735283801353166,18446735283801754190,18446735283799009541],"thread_id":5680,"time":133791868989815129,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC77340000","ImageBase":"00007FFC77340000","ImageCheckSum":"215677","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\vcruntime140d.dll","ImageSize":"000000000002B000","ProcessID":"1208","TimeDateStamp":"3390545094","event":"ImageUnloadInfo ","id":132,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283797621171,18446735283801386793,18446735283801520226,18446735283800918026,18446735283801353166,18446735283801754190,18446735283799009541],"thread_id":5680,"time":133791868989815203,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC7DD50000","ImageBase":"00007FFC7DD50000","ImageCheckSum":"124685","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\vcruntime140_1d.dll","ImageSize":"000000000000F000","ProcessID":"1208","TimeDateStamp":"743278547","event":"ImageUnloadInfo ","id":133,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283797621171,18446735283801386793,18446735283801520226,18446735283800918026,18446735283801353166,18446735283801754190,18446735283799009541],"thread_id":5680,"time":133791868989815284,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC82800000","ImageBase":"00007FFC82800000","ImageCheckSum":"3204207","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\KernelBase.dll","ImageSize":"00000000002FE000","ProcessID":"1208","TimeDateStamp":"3522100337","event":"ImageUnloadInfo ","id":134,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283797621171,18446735283801386793,18446735283801520226,18446735283800918026,18446735283801353166,18446735283801754190,18446735283799009541],"thread_id":5680,"time":133791868989815348,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC82B00000","ImageBase":"00007FFC82B00000","ImageCheckSum":"1180473","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\gdi32full.dll","ImageSize":"0000000000117000","ProcessID":"1208","TimeDateStamp":"576863693","event":"ImageUnloadInfo ","id":135,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283797621171,18446735283801386793,18446735283801520226,18446735283800918026,18446735283801353166,18446735283801754190,18446735283799009541],"thread_id":5680,"time":133791868989815408,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC82C20000","ImageBase":"00007FFC82C20000","ImageCheckSum":"199345","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\bcrypt.dll","ImageSize":"0000000000027000","ProcessID":"1208","TimeDateStamp":"2535700803","event":"ImageUnloadInfo ","id":136,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283797621171,18446735283801386793,18446735283801520226,18446735283800918026,18446735283801353166,18446735283801754190,18446735283799009541],"thread_id":5680,"time":133791868989815463,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC82C50000","ImageBase":"00007FFC82C50000","ImageCheckSum":"1076532","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\ucrtbase.dll","ImageSize":"0000000000100000","ProcessID":"1208","TimeDateStamp":"2177850761","event":"ImageUnloadInfo ","id":137,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283797621171,18446735283801386793,18446735283801520226,18446735283800918026,18446735283801353166,18446735283801754190,18446735283799009541],"thread_id":5680,"time":133791868989815520,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC82F60000","ImageBase":"00007FFC82F60000","ImageCheckSum":"531569","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\bcryptprimitives.dll","ImageSize":"0000000000082000","ProcessID":"1208","TimeDateStamp":"3309379821","event":"ImageUnloadInfo ","id":138,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283797621171,18446735283801386793,18446735283801520226,18446735283800918026,18446735283801353166,18446735283801754190,18446735283799009541],"thread_id":5680,"time":133791868989815580,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC82FF0000","ImageBase":"00007FFC82FF0000","ImageCheckSum":"137991","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\win32u.dll","ImageSize":"0000000000022000","ProcessID":"1208","TimeDateStamp":"3336608826","event":"ImageUnloadInfo ","id":139,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283797621171,18446735283801386793,18446735283801520226,18446735283800918026,18446735283801353166,18446735283801754190,18446735283799009541],"thread_id":5680,"time":133791868989815638,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC83070000","ImageBase":"00007FFC83070000","ImageCheckSum":"659111","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\msvcp_win.dll","ImageSize":"000000000009D000","ProcessID":"1208","TimeDateStamp":"958749903","event":"ImageUnloadInfo ","id":140,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283797621171,18446735283801386793,18446735283801520226,18446735283800918026,18446735283801353166,18446735283801754190,18446735283799009541],"thread_id":5680,"time":133791868989815696,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC83190000","ImageBase":"00007FFC83190000","ImageCheckSum":"811940","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\kernel32.dll","ImageSize":"00000000000C2000","ProcessID":"1208","TimeDateStamp":"2273328705","event":"ImageUnloadInfo ","id":141,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283797621171,18446735283801386793,18446735283801520226,18446735283800918026,18446735283801353166,18446735283801754190,18446735283799009541],"thread_id":5680,"time":133791868989815751,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC833E0000","ImageBase":"00007FFC833E0000","ImageCheckSum":"218727","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\gdi32.dll","ImageSize":"000000000002B000","ProcessID":"1208","TimeDateStamp":"3634633287","event":"ImageUnloadInfo ","id":142,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283797621171,18446735283801386793,18446735283801520226,18446735283800918026,18446735283801353166,18446735283801754190,18446735283799009541],"thread_id":5680,"time":133791868989815806,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC83410000","ImageBase":"00007FFC83410000","ImageCheckSum":"1244603","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\rpcrt4.dll","ImageSize":"0000000000123000","ProcessID":"1208","TimeDateStamp":"2016036219","event":"ImageUnloadInfo ","id":143,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283797621171,18446735283801386793,18446735283801520226,18446735283800918026,18446735283801353166,18446735283801754190,18446735283799009541],"thread_id":5680,"time":133791868989815860,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC83B50000","ImageBase":"00007FFC83B50000","ImageCheckSum":"766771","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\advapi32.dll","ImageSize":"00000000000B1000","ProcessID":"1208","TimeDateStamp":"187986496","event":"ImageUnloadInfo ","id":144,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283797621171,18446735283801386793,18446735283801520226,18446735283800918026,18446735283801353166,18446735283801754190,18446735283799009541],"thread_id":5680,"time":133791868989815915,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC83D40000","ImageBase":"00007FFC83D40000","ImageCheckSum":"681663","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\msvcrt.dll","ImageSize":"000000000009E000","ProcessID":"1208","TimeDateStamp":"2616593924","event":"ImageUnloadInfo ","id":145,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283797621171,18446735283801386793,18446735283801520226,18446735283800918026,18446735283801353166,18446735283801754190,18446735283799009541],"thread_id":5680,"time":133791868989815968,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC83DE0000","ImageBase":"00007FFC83DE0000","ImageCheckSum":"244437","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\imm32.dll","ImageSize":"000000000002F000","ProcessID":"1208","TimeDateStamp":"3510600902","event":"ImageUnloadInfo ","id":146,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283797621171,18446735283801386793,18446735283801520226,18446735283800918026,18446735283801353166,18446735283801754190,18446735283799009541],"thread_id":5680,"time":133791868989816028,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC84650000","ImageBase":"00007FFC84650000","ImageCheckSum":"673563","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\sechost.dll","ImageSize":"000000000009F000","ProcessID":"1208","TimeDateStamp":"1942365337","event":"ImageUnloadInfo ","id":147,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283797621171,18446735283801386793,18446735283801520226,18446735283800918026,18446735283801353166,18446735283801754190,18446735283799009541],"thread_id":5680,"time":133791868989816082,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC848D0000","ImageBase":"00007FFC848D0000","ImageCheckSum":"1221752","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\ole32.dll","ImageSize":"000000000012B000","ProcessID":"1208","TimeDateStamp":"610785574","event":"ImageUnloadInfo ","id":148,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283797621171,18446735283801386793,18446735283801520226,18446735283800918026,18446735283801353166,18446735283801754190,18446735283799009541],"thread_id":5680,"time":133791868989816147,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC84A00000","ImageBase":"00007FFC84A00000","ImageCheckSum":"1745311","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\user32.dll","ImageSize":"000000000019D000","ProcessID":"1208","TimeDateStamp":"4291603748","event":"ImageUnloadInfo ","id":149,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283797621171,18446735283801386793,18446735283801520226,18446735283800918026,18446735283801353166,18446735283801754190,18446735283799009541],"thread_id":5680,"time":133791868989816201,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC84D50000","ImageBase":"00007FFC84D50000","ImageCheckSum":"3511252","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\combase.dll","ImageSize":"0000000000353000","ProcessID":"1208","TimeDateStamp":"3888075817","event":"ImageUnloadInfo ","id":150,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283797621171,18446735283801386793,18446735283801520226,18446735283800918026,18446735283801353166,18446735283801754190,18446735283799009541],"thread_id":5680,"time":133791868989816259,"trace_id":41,"type":"etw"},{"DefaultBase":"00007FFC850F0000","ImageBase":"00007FFC850F0000","ImageCheckSum":"2047181","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\ntdll.dll","ImageSize":"00000000001F8000","ProcessID":"1208","TimeDateStamp":"1754238027","event":"ImageUnloadInfo ","id":151,"opcode_id":0,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283802249410,18446735283797621171,18446735283801386793,18446735283801520226,18446735283800918026,18446735283801353166,18446735283801754190,18446735283799009541],"thread_id":5680,"time":133791868989816312,"trace_id":41,"type":"etw"},{"CPUCycleCount":"184728780","CommitCharge":"24412160","CommitPeak":"24461312","CreateTime":"133791868973820309","ExitCode":"3221225477","ExitTime":"133791868989814630","HandleCount":"100","HardFaultCount":"0","ImageName":"RedEdrTester.e","ProcessID":"1208","ProcessSequenceNumber":"2314","ReadOperationCount":"9","ReadTransferKiloBytes":"22","TokenElevationType":"3","WriteOperationCount":"45","WriteTransferKiloBytes":"20","event":"ProcessStopStop ","id":152,"opcode_id":2,"pid":1208,"provider_name":"22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716","stack_trace":[18446735283797242684,18446735283801521634,18446735283801520587,18446735283801519924,18446735283800918026,18446735283801353166,18446735283801754190,18446735283799009541],"thread_id":5680,"time":133791868989816369,"trace_id":41,"type":"etw"},{"BaseAddress":"0x0000025BA365CB30","CallingProcessCreateTime":"2024/12/20 17.48.17","CallingProcessId":"1208","CallingProcessProtection":"(Unknown type)","CallingProcessSectionSignatureLevel":"(Unknown type)","CallingProcessSignatureLevel":"(Unknown type)","CallingProcessStartKey":"25332747903961354","CallingThreadCreateTime":"2024/12/20 17.48.17","CallingThreadId":"6916","LastProtectionMask":"4","OriginalProcessCreateTime":"2024/12/20 17.48.17","OriginalProcessId":"1208","OriginalProcessProtection":"(Unknown type)","OriginalProcessSectionSignatureLevel":"(Unknown type)","OriginalProcessSignatureLevel":"(Unknown type)","OriginalProcessStartKey":"25332747903961354","ProtectionMask":"64","RegionSize":"0x0000025BA365C950","TargetProcessCreateTime":"2024/12/20 17.48.17","TargetProcessId":"1208","TargetProcessProtection":"(Unknown type)","TargetProcessSectionSignatureLevel":"(Unknown type)","TargetProcessSignatureLevel":"(Unknown type)","TargetProcessStartKey":"25332747903961354","event":"PROTECTVM_LOCAL","id":153,"pid":1208,"provider_name":"Microsoft-Windows-Threat-Intelligence","thread_id":6916,"time":133791868979063418,"trace_id":41,"type":"etw"}]