mirror of
https://github.com/dobin/RedEdr
synced 2026-08-09 12:30:51 +00:00
1 line
89 KiB
JSON
1 line
89 KiB
JSON
[{"type":"kernel","time":"133737987376815797","callback":"create_process","krn_pid":"5648","pid":"1704","name":"\\Device\\HarddiskVolume2\\Windows\\System32\\notepad.exe","ppid":"5648","parent_name":"\\Device\\HarddiskVolume2\\Windows\\explorer.exe","observe":"1"},{"type":"peb","time":"133737987376972064","id":"1704","parent_pid":"5648","image_path":"C:\\Windows\\system32\\notepad.exe","commandline":"\\C:\\Windows\\system32\\notepad.exe\\ ","working_dir":"C:\\Users\\hacker\\","is_debugged":"0","is_protected_process":"0","is_protected_process_light":"0","image_base":"0x00007FF738840000"},{"type":"loaded_dll","time":"133737987376972064","pid":"1704","dlls":[{"addr":"0x38840000","size":"0x38000","name":"notepad.exe"},{"addr":"0xdebf0000","size":"0x1f8000","name":"ntdll.dll"},{"addr":"0xdeae0000","size":"0xc2000","name":"KERNEL32.DLL"},{"addr":"0xdc330000","size":"0x2fe000","name":"KERNELBASE.dll"},{"addr":"0xdce60000","size":"0x2b000","name":"GDI32.dll"},{"addr":"0xdca90000","size":"0x22000","name":"win32u.dll"},{"addr":"0xdcac0000","size":"0x117000","name":"gdi32full.dll"},{"addr":"0xdc290000","size":"0x9d000","name":"msvcp_win.dll"},{"addr":"0xdc6c0000","size":"0x100000","name":"ucrtbase.dll"},{"addr":"0xdce90000","size":"0x19d000","name":"USER32.dll"},{"addr":"0xdd5d0000","size":"0x353000","name":"combase.dll"},{"addr":"0xdccc0000","size":"0x123000","name":"RPCRT4.dll"},{"addr":"0xdcc10000","size":"0xad000","name":"shcore.dll"},{"addr":"0xddaa0000","size":"0x9e000","name":"msvcrt.dll"},{"addr":"0xc6760000","size":"0x29a000","name":"C:\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.4355_none_60b8b9eb71f62e16\\COMCTL32.dll"},{"addr":"0xdd4b0000","size":"0x2f000","name":"IMM32.DLL"},{"addr":"0xc9ef0000","size":"0x56000","name":"C:\\RedEdr\\RedEdrDll.dll"},{"addr":"0xddeb0000","size":"0xb2000","name":"ADVAPI32.dll"},{"addr":"0xdea40000","size":"0xa0000","name":"sechost.dll"},{"addr":"0xdcbe0000","size":"0x27000","name":"bcrypt.dll"},{"addr":"0xa5db0000","size":"0xe2000","name":"MSVCP140D.dll"},{"addr":"0xde6e0000","size":"0x12b000","name":"ole32.dll"},{"addr":"0xce920000","size":"0x1e4000","name":"dbghelp.dll"},{"addr":"0xd3a90000","size":"0x2b000","name":"VCRUNTIME140D.dll"},{"addr":"0xd7470000","size":"0xf000","name":"VCRUNTIME140_1D.dll"},{"addr":"0x39eb0000","size":"0x222000","name":"ucrtbased.dll"}]},{"type":"dll","func":"hooking_start","pid":"1704","tid":"2524"},{"type":"dll","func":"hooking_finished","pid":"1704","tid":"2524"},{"type":"kernel","time":"133737987376815797","callback":"thread","krn_pid":"5648","pid":"1704","threadid":"2524","create":"1"},{"type":"kernel","time":"133737987376972064","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\notepad.exe"},{"type":"kernel","time":"133737987376972064","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\ntdll.dll"},{"type":"kernel","time":"133737987376972064","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\kernel32.dll"},{"type":"kernel","time":"133737987376972064","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\KernelBase.dll"},{"type":"kernel","time":"133737987376972064","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\gdi32.dll"},{"type":"kernel","time":"133737987376972064","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\win32u.dll"},{"type":"kernel","time":"133737987376972064","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\gdi32full.dll"},{"type":"kernel","time":"133737987376972064","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\msvcp_win.dll"},{"type":"kernel","time":"133737987376972064","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\ucrtbase.dll"},{"type":"kernel","time":"133737987376972064","callback":"thread","krn_pid":"1704","pid":"1704","threadid":"14644","create":"1"},{"type":"kernel","time":"133737987376972064","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\user32.dll"},{"type":"kernel","time":"133737987376972064","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\combase.dll"},{"type":"kernel","time":"133737987376972064","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\rpcrt4.dll"},{"type":"kernel","time":"133737987376972064","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\SHCore.dll"},{"type":"kernel","time":"133737987376972064","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\msvcrt.dll"},{"type":"kernel","time":"133737987376972064","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.4355_none_60b8b9eb71f"},{"type":"kernel","time":"133737987376972064","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\imm32.dll"},{"type":"kernel","time":"133737987376972064","callback":"thread","krn_pid":"1704","pid":"1704","threadid":"11544","create":"1"},{"type":"kernel","time":"133737987376972064","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\RedEdr\\RedEdrDll.dll"},{"type":"kernel","time":"133737987376972064","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\advapi32.dll"},{"type":"kernel","time":"133737987376972064","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\sechost.dll"},{"type":"kernel","time":"133737987376972064","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\bcrypt.dll"},{"type":"kernel","time":"133737987376972064","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\msvcp140d.dll"},{"type":"kernel","time":"133737987376972064","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\ole32.dll"},{"type":"kernel","time":"133737987376972064","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\dbghelp.dll"},{"type":"kernel","time":"133737987376972064","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\vcruntime140d.dll"},{"type":"kernel","time":"133737987376972064","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\vcruntime140_1d.dll"},{"type":"kernel","time":"133737987376972064","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\ucrtbased.dll"},{"type":"kernel","time":"133737987377284560","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\bcryptprimitives.dll"},{"type":"dll","time":"133737987377284560","pid":"1704","tid":"14644","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F07B3C8","size":"8","protect":"0x4","protect_str":"RW-","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEC4419C","page_addr":"00007FFBDEC44000","size":"823296","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEC220F9","page_addr":"00007FFBDEC22000","size":"962560","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC00446","page_addr":"00007FFBDEC00000","size":"1101824","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBCE93892A","page_addr":"00007FFBCE938000","size":"1306624","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"kernel","time":"133737987377284560","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\kernel.appcore.dll"},{"type":"dll","time":"133737987378534600","pid":"1704","tid":"14644","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F07B3C8","size":"4096","protect":"0x2","protect_str":"R--","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEC441ED","page_addr":"00007FFBDEC44000","size":"823296","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEC220F9","page_addr":"00007FFBDEC22000","size":"962560","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC00446","page_addr":"00007FFBDEC00000","size":"1101824","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBCE93892A","page_addr":"00007FFBCE938000","size":"1306624","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"dll","time":"133737987377284560","pid":"1704","tid":"14644","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F07F0B8","size":"400","protect":"0x2","protect_str":"R--","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEBFFEE4","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEBFFAD8","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC04BCF","page_addr":"00007FFBDEC04000","size":"1085440","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEC51243","page_addr":"00007FFBDEC51000","size":"770048","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"dll","time":"133737987378534600","pid":"1704","tid":"14644","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F07F0B8","size":"8","protect":"0x4","protect_str":"RW-","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEBFFFB5","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEBFFAD8","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC04BCF","page_addr":"00007FFBDEC04000","size":"1085440","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEC51243","page_addr":"00007FFBDEC51000","size":"770048","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"dll","time":"133737987378534600","pid":"1704","tid":"14644","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F07F0B8","size":"4096","protect":"0x2","protect_str":"R--","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEBFFFED","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEBFFAD8","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC04BCF","page_addr":"00007FFBDEC04000","size":"1085440","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEC51243","page_addr":"00007FFBDEC51000","size":"770048","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"dll","time":"133737987378690792","pid":"1704","tid":"14644","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F07F0B8","size":"8","protect":"0x4","protect_str":"RW-","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEC00068","page_addr":"00007FFBDEC00000","size":"1101824","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEBFFAD8","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC04BCF","page_addr":"00007FFBDEC04000","size":"1085440","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEC51243","page_addr":"00007FFBDEC51000","size":"770048","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"dll","time":"133737987378847034","pid":"1704","tid":"14644","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F07F0B8","size":"4096","protect":"0x2","protect_str":"R--","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEC0009C","page_addr":"00007FFBDEC00000","size":"1101824","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEBFFAD8","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC04BCF","page_addr":"00007FFBDEC04000","size":"1085440","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEC51243","page_addr":"00007FFBDEC51000","size":"770048","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"dll","time":"133737987378847034","pid":"1704","tid":"14644","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F07F0B0","size":"13600","protect":"0x4","protect_str":"RW-","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEC0354A","page_addr":"00007FFBDEC03000","size":"1089536","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEC02252","page_addr":"00007FFBDEC02000","size":"1093632","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC00921","page_addr":"00007FFBDEC00000","size":"1101824","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEBFFB05","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"dll","time":"133737987378847034","pid":"1704","tid":"14644","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F07F0B0","size":"13600","protect":"0x2","protect_str":"R--","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEC0354A","page_addr":"00007FFBDEC03000","size":"1089536","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEC02296","page_addr":"00007FFBDEC02000","size":"1093632","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC00943","page_addr":"00007FFBDEC00000","size":"1101824","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEBFFB05","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"dll","time":"133737987379159559","pid":"1704","tid":"14644","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F07F100","size":"1344","protect":"0x4","protect_str":"RW-","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEC05082","page_addr":"00007FFBDEC05000","size":"1081344","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEC079D2","page_addr":"00007FFBDEC07000","size":"1073152","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC04C14","page_addr":"00007FFBDEC04000","size":"1085440","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEC51243","page_addr":"00007FFBDEC51000","size":"770048","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"etw","time":"133737987377004979","pid":"1704","thread_id":"2524","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x00000121360F7CA0","ImageSize":"0x00000121360F7CA0","ProcessID":"1704","ImageCheckSum":"265248","TimeDateStamp":"1643917504","DefaultBase":"0x00000121360F84C0","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\notepad.exe"},{"type":"dll","time":"133737987379159559","pid":"1704","tid":"14644","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F07EA28","size":"448","protect":"0x2","protect_str":"R--","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEBFFEE4","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEBFFAD8","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC04BCF","page_addr":"00007FFBDEC04000","size":"1085440","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEC04479","page_addr":"00007FFBDEC04000","size":"1085440","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"dll","time":"133737987379472046","pid":"1704","tid":"14644","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F07EA28","size":"8","protect":"0x4","protect_str":"RW-","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEBFFFB5","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEBFFAD8","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC04BCF","page_addr":"00007FFBDEC04000","size":"1085440","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEC04479","page_addr":"00007FFBDEC04000","size":"1085440","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"dll","time":"133737987379472046","pid":"1704","tid":"14644","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F07EA28","size":"4096","protect":"0x2","protect_str":"R--","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEBFFFED","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEBFFAD8","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC04BCF","page_addr":"00007FFBDEC04000","size":"1085440","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEC04479","page_addr":"00007FFBDEC04000","size":"1085440","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"dll","time":"133737987379940800","pid":"1704","tid":"14644","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F07EA28","size":"8","protect":"0x4","protect_str":"RW-","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEC00068","page_addr":"00007FFBDEC00000","size":"1101824","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEBFFAD8","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC04BCF","page_addr":"00007FFBDEC04000","size":"1085440","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEC04479","page_addr":"00007FFBDEC04000","size":"1085440","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"dll","time":"133737987379940800","pid":"1704","tid":"14644","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F07EA28","size":"4096","protect":"0x2","protect_str":"R--","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEC0009C","page_addr":"00007FFBDEC00000","size":"1101824","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEBFFAD8","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC04BCF","page_addr":"00007FFBDEC04000","size":"1085440","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEC04479","page_addr":"00007FFBDEC04000","size":"1085440","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"dll","time":"133737987379159559","pid":"1704","tid":"11544","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"0000022521EF18E8","size":"5656","protect":"0x2","protect_str":"R--","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEC44518","page_addr":"00007FFBDEC44000","size":"823296","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEC2288A","page_addr":"00007FFBDEC22000","size":"962560","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC50128","page_addr":"00007FFBDEC50000","size":"774144","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEC500D3","page_addr":"00007FFBDEC50000","size":"774144","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"dll","time":"133737987379940800","pid":"1704","tid":"14644","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F07EA20","size":"13600","protect":"0x4","protect_str":"RW-","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEC0354A","page_addr":"00007FFBDEC03000","size":"1089536","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEC02252","page_addr":"00007FFBDEC02000","size":"1093632","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC00921","page_addr":"00007FFBDEC00000","size":"1101824","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEBFFB05","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"dll","time":"133737987380253321","pid":"1704","tid":"14644","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F07EA20","size":"13600","protect":"0x2","protect_str":"R--","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEC0354A","page_addr":"00007FFBDEC03000","size":"1089536","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEC02296","page_addr":"00007FFBDEC02000","size":"1093632","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC00943","page_addr":"00007FFBDEC00000","size":"1101824","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEBFFB05","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"etw","time":"133737987377005179","pid":"1704","thread_id":"2524","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x00000121360F84C0","ImageSize":"0x00000121360F84C0","ProcessID":"1704","ImageCheckSum":"2047181","TimeDateStamp":"1754238027","DefaultBase":"0x00000121360F7D90","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\ntdll.dll"},{"type":"etw","time":"133737987377009890","pid":"1704","thread_id":"2524","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x00000121360F7D90","ImageSize":"0x00000121360F8600","ProcessID":"1704","ImageCheckSum":"809120","TimeDateStamp":"2742881751","DefaultBase":"0x00000121360F8510","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\kernel32.dll"},{"type":"etw","time":"133737987377011212","pid":"1704","thread_id":"2524","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x00000121360F8510","ImageSize":"0x00000121360F8510","ProcessID":"1704","ImageCheckSum":"3204941","TimeDateStamp":"3307363599","DefaultBase":"0x00000121360F84C0","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\KernelBase.dll"},{"type":"etw","time":"133737987377022034","pid":"1704","thread_id":"2524","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x00000121360F8600","ImageSize":"0x00000121360F7DE0","ProcessID":"1704","ImageCheckSum":"218727","TimeDateStamp":"3634633287","DefaultBase":"0x00000121360F8510","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\gdi32.dll"},{"type":"etw","time":"133737987377022656","pid":"1704","thread_id":"2524","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x00000121360F8600","ImageSize":"0x00000121360F8600","ProcessID":"1704","ImageCheckSum":"155400","TimeDateStamp":"3336608826","DefaultBase":"0x00000121360F8600","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\win32u.dll"},{"type":"etw","time":"133737987377023018","pid":"1704","thread_id":"2524","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x00000121360F7DE0","ImageSize":"0x00000121360F7DE0","ProcessID":"1704","ImageCheckSum":"1180473","TimeDateStamp":"576863693","DefaultBase":"0x00000121360F7DE0","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\gdi32full.dll"},{"type":"etw","time":"133737987377023507","pid":"1704","thread_id":"2524","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x00000121360F8FB0","ImageSize":"0x00000121360F98C0","ProcessID":"1704","ImageCheckSum":"659111","TimeDateStamp":"958749903","DefaultBase":"0x00000121360F8FB0","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\msvcp_win.dll"},{"type":"etw","time":"133737987377023941","pid":"1704","thread_id":"2524","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x00000121360F91E0","ImageSize":"0x00000121360F8FB0","ProcessID":"1704","ImageCheckSum":"1076532","TimeDateStamp":"2177850761","DefaultBase":"0x00000121360F93C0","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\ucrtbase.dll"},{"type":"etw","time":"133737987377024494","pid":"1704","thread_id":"2524","event":"StartThread","provider_name":"Microsoft-Windows-Kernel-Process","ProcessID":"1704","ThreadID":"14644","StackBase":"0x00000121360F93C0","StackLimit":"0x00000121360F9370","UserStackBase":"0x00000121360F91E0","UserStackLimit":"0x00000121360F9500","StartAddr":"0x00000121360F95F0","Win32StartAddr":"0x00000121360F99B0","TebBase":"0x00000121360F9870","SubProcessTag":"0"},{"type":"etw","time":"133737987377025005","pid":"1704","thread_id":"2524","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x00000121360F9500","ImageSize":"0x00000121360F9280","ProcessID":"1704","ImageCheckSum":"1745311","TimeDateStamp":"4291603748","DefaultBase":"0x00000121360F99B0","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\user32.dll"},{"type":"etw","time":"133737987377026105","pid":"1704","thread_id":"2524","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x00000121360F9230","ImageSize":"0x00000121360F9500","ProcessID":"1704","ImageCheckSum":"3511252","TimeDateStamp":"3888075817","DefaultBase":"0x00000121360F90F0","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\combase.dll"},{"type":"etw","time":"133737987377026651","pid":"1704","thread_id":"2524","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x00000121360F98C0","ImageSize":"0x00000121360F9500","ProcessID":"1704","ImageCheckSum":"1244603","TimeDateStamp":"2016036219","DefaultBase":"0x00000121360F95F0","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\rpcrt4.dll"},{"type":"etw","time":"133737987377027349","pid":"1704","thread_id":"2524","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x00000121360F9370","ImageSize":"0x00000121360F95F0","ProcessID":"1704","ImageCheckSum":"731810","TimeDateStamp":"2272255898","DefaultBase":"0x00000121360F9730","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\SHCore.dll"},{"type":"etw","time":"133737987377027794","pid":"1704","thread_id":"2524","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x00000121360F91E0","ImageSize":"0x00000121360F94B0","ProcessID":"1704","ImageCheckSum":"681663","TimeDateStamp":"2616593924","DefaultBase":"0x00000121360F9730","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\msvcrt.dll"},{"type":"etw","time":"133737987377034050","pid":"1704","thread_id":"2524","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x00000121360F9460","ImageSize":"0x00000121360F9460","ProcessID":"1704","ImageCheckSum":"2715251","TimeDateStamp":"4145438527","DefaultBase":"0x00000121360F9230","ImageName":"\\Device\\HarddiskVolume2\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.4355_none_60b8b9eb71f62e16\\comctl32.dll"},{"type":"etw","time":"133737987377039649","pid":"1704","thread_id":"2524","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x00000121360F97D0","ImageSize":"0x00000121360F9960","ProcessID":"1704","ImageCheckSum":"244437","TimeDateStamp":"3510600902","DefaultBase":"0x00000121360F9640","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\imm32.dll"},{"type":"etw","time":"133737987377062210","pid":"1704","thread_id":"14644","event":"StartThread","provider_name":"Microsoft-Windows-Kernel-Process","ProcessID":"1704","ThreadID":"11544","StackBase":"0x00000121360F9000","StackLimit":"0x00000121360F9050","UserStackBase":"0x00000121360F9960","UserStackLimit":"0x00000121360F9640","StartAddr":"0x00000121360F99B0","Win32StartAddr":"0x00000121360F9320","TebBase":"0x00000121360F9000","SubProcessTag":"0"},{"type":"etw","time":"133737987377071932","pid":"1704","thread_id":"2524","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x00000121360F8FB0","ImageSize":"0x00000121360F8FB0","ProcessID":"1704","ImageCheckSum":"0","TimeDateStamp":"1729280710","DefaultBase":"0x00000121360F9910","ImageName":"\\Device\\HarddiskVolume2\\RedEdr\\RedEdrDll.dll"},{"type":"etw","time":"133737987377073506","pid":"1704","thread_id":"2524","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x00000121360F9410","ImageSize":"0x00000121360F97D0","ProcessID":"1704","ImageCheckSum":"718102","TimeDateStamp":"55205188","DefaultBase":"0x00000121360F9640","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\advapi32.dll"},{"type":"etw","time":"133737987377074013","pid":"1704","thread_id":"2524","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x00000121360F96E0","ImageSize":"0x00000121360F93C0","ProcessID":"1704","ImageCheckSum":"691703","TimeDateStamp":"944590729","DefaultBase":"0x00000121360F9280","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\sechost.dll"},{"type":"dll","time":"133737987380253321","pid":"1704","tid":"14644","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F07EA70","size":"2328","protect":"0x4","protect_str":"RW-","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEC05082","page_addr":"00007FFBDEC05000","size":"1081344","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEC079D2","page_addr":"00007FFBDEC07000","size":"1073152","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC04C14","page_addr":"00007FFBDEC04000","size":"1085440","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEC04479","page_addr":"00007FFBDEC04000","size":"1085440","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"dll","time":"133737987380565796","pid":"1704","tid":"14644","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"00000225249F6B68","size":"2328","protect":"0x2","protect_str":"R--","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEC44518","page_addr":"00007FFBDEC44000","size":"823296","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEC2288A","page_addr":"00007FFBDEC22000","size":"962560","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC50128","page_addr":"00007FFBDEC50000","size":"774144","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEC500D3","page_addr":"00007FFBDEC50000","size":"774144","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"dll","time":"133737987380565796","pid":"1704","tid":"14644","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"0000022521EF2D18","size":"1344","protect":"0x2","protect_str":"R--","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEC44518","page_addr":"00007FFBDEC44000","size":"823296","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEC2288A","page_addr":"00007FFBDEC22000","size":"962560","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC50128","page_addr":"00007FFBDEC50000","size":"774144","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEC500D3","page_addr":"00007FFBDEC50000","size":"774144","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"dll","time":"133737987380878298","pid":"1704","tid":"14644","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000002252448EE88","size":"640","protect":"0x2","protect_str":"R--","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEC44518","page_addr":"00007FFBDEC44000","size":"823296","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEC2288A","page_addr":"00007FFBDEC22000","size":"962560","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC50128","page_addr":"00007FFBDEC50000","size":"774144","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEC500D3","page_addr":"00007FFBDEC50000","size":"774144","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"dll","time":"133737987380878298","pid":"1704","tid":"14644","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F07F0B8","size":"160","protect":"0x2","protect_str":"R--","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEBFFEE4","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEBFFAD8","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC04BCF","page_addr":"00007FFBDEC04000","size":"1085440","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEC51243","page_addr":"00007FFBDEC51000","size":"770048","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"dll","time":"133737987381190819","pid":"1704","tid":"14644","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F07F0B8","size":"8","protect":"0x4","protect_str":"RW-","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEBFFFB5","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEBFFAD8","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC04BCF","page_addr":"00007FFBDEC04000","size":"1085440","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEC51243","page_addr":"00007FFBDEC51000","size":"770048","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"dll","time":"133737987381190819","pid":"1704","tid":"14644","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F07F0B8","size":"4096","protect":"0x2","protect_str":"R--","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEBFFFED","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEBFFAD8","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC04BCF","page_addr":"00007FFBDEC04000","size":"1085440","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEC51243","page_addr":"00007FFBDEC51000","size":"770048","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"etw","time":"133737987377074497","pid":"1704","thread_id":"2524","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x00000121360F9460","ImageSize":"0x00000121360F97D0","ProcessID":"1704","ImageCheckSum":"199345","TimeDateStamp":"2535700803","DefaultBase":"0x00000121360F9320","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\bcrypt.dll"},{"type":"etw","time":"133737987377077024","pid":"1704","thread_id":"2524","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x00000121360F9960","ImageSize":"0x00000121360F9820","ProcessID":"1704","ImageCheckSum":"929031","TimeDateStamp":"4270244042","DefaultBase":"0x00000121360F97D0","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\msvcp140d.dll"},{"type":"etw","time":"133737987377077521","pid":"1704","thread_id":"2524","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x00000121360F92D0","ImageSize":"0x00000121360F9280","ProcessID":"1704","ImageCheckSum":"1221752","TimeDateStamp":"610785574","DefaultBase":"0x00000121360F9000","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\ole32.dll"},{"type":"etw","time":"133737987377078589","pid":"1704","thread_id":"2524","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x00000121360F96E0","ImageSize":"0x00000121360F90A0","ProcessID":"1704","ImageCheckSum":"1883635","TimeDateStamp":"2592498981","DefaultBase":"0x00000121360F9640","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\dbghelp.dll"},{"type":"etw","time":"133737987377079545","pid":"1704","thread_id":"2524","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x00000121360F9000","ImageSize":"0x00000121360F9820","ProcessID":"1704","ImageCheckSum":"215677","TimeDateStamp":"3390545094","DefaultBase":"0x00000121360F9140","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\vcruntime140d.dll"},{"type":"etw","time":"133737987377080294","pid":"1704","thread_id":"2524","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x00000121360F9550","ImageSize":"0x00000121360F9640","ProcessID":"1704","ImageCheckSum":"124685","TimeDateStamp":"743278547","DefaultBase":"0x00000121360F9000","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\vcruntime140_1d.dll"},{"type":"etw","time":"133737987377082101","pid":"1704","thread_id":"2524","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x00000121360F90A0","ImageSize":"0x00000121360F9870","ProcessID":"1704","ImageCheckSum":"2249853","TimeDateStamp":"3642813796","DefaultBase":"0x00000121360F9910","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\ucrtbased.dll"},{"type":"kernel","time":"133737987377284560","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\uxtheme.dll"},{"type":"kernel","time":"133737987377284560","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\clbcatq.dll"},{"type":"kernel","time":"133737987377284560","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\MrmCoreR.dll"},{"type":"kernel","time":"133737987377284560","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\shell32.dll"},{"type":"kernel","time":"133737987377284560","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\windows.storage.dll"},{"type":"kernel","time":"133737987377284560","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\wldp.dll"},{"type":"kernel","time":"133737987379159559","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\oleaut32.dll"},{"type":"kernel","time":"133737987380878298","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\shlwapi.dll"},{"type":"kernel","time":"133737987380878298","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\msctf.dll"},{"type":"kernel","time":"133737987380878298","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\TextShaping.dll"},{"type":"dll","time":"133737987382753320","pid":"1704","tid":"14644","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F07F0B8","size":"8","protect":"0x4","protect_str":"RW-","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEC00068","page_addr":"00007FFBDEC00000","size":"1101824","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEBFFAD8","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC04BCF","page_addr":"00007FFBDEC04000","size":"1085440","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEC51243","page_addr":"00007FFBDEC51000","size":"770048","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"kernel","time":"133737987380878298","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\efswrt.dll"},{"type":"etw","time":"133737987377296999","pid":"1704","thread_id":"2524","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x0000012136132700","ImageSize":"0x00000121361329D0","ProcessID":"1704","ImageCheckSum":"531569","TimeDateStamp":"3309379821","DefaultBase":"0x0000012136132C00","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\bcryptprimitives.dll"},{"type":"kernel","time":"133737987380878298","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\mpr.dll"},{"type":"kernel","time":"133737987380878298","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\WinTypes.dll"},{"type":"kernel","time":"133737987380878298","callback":"thread","krn_pid":"1704","pid":"1704","threadid":"4756","create":"1"},{"type":"kernel","time":"133737987384472049","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\twinapi.appcore.dll"},{"type":"kernel","time":"133737987384472049","callback":"thread","krn_pid":"1704","pid":"1704","threadid":"3796","create":"1"},{"type":"etw","time":"133737987377302422","pid":"1704","thread_id":"2524","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x0000012136132C00","ImageSize":"0x0000012136132430","ProcessID":"1704","ImageCheckSum":"122143","TimeDateStamp":"1990571354","DefaultBase":"0x0000012136132610","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\kernel.appcore.dll"},{"type":"etw","time":"133737987377312133","pid":"1704","thread_id":"2524","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x0000012136132F20","ImageSize":"0x00000121361330B0","ProcessID":"1704","ImageCheckSum":"652983","TimeDateStamp":"2037838987","DefaultBase":"0x0000012136132840","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\uxtheme.dll"},{"type":"etw","time":"133737987377319817","pid":"1704","thread_id":"2524","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x00000121361329D0","ImageSize":"0x0000012136132CA0","ProcessID":"1704","ImageCheckSum":"736478","TimeDateStamp":"97696835","DefaultBase":"0x0000012136132CF0","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\clbcatq.dll"},{"type":"etw","time":"133737987377323262","pid":"1704","thread_id":"2524","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x00000121361327A0","ImageSize":"0x0000012136132430","ProcessID":"1704","ImageCheckSum":"1076757","TimeDateStamp":"2235875132","DefaultBase":"0x00000121361322F0","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\MrmCoreR.dll"},{"type":"etw","time":"133737987377336205","pid":"1704","thread_id":"2524","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x0000012136133060","ImageSize":"0x00000121361328E0","ProcessID":"1704","ImageCheckSum":"7871264","TimeDateStamp":"3058955310","DefaultBase":"0x00000121361327A0","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\shell32.dll"},{"type":"etw","time":"133737987377341394","pid":"1704","thread_id":"2524","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x0000012136132B60","ImageSize":"0x0000012136132AC0","ProcessID":"1704","ImageCheckSum":"8084351","TimeDateStamp":"392648082","DefaultBase":"0x0000012136132C50","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\windows.storage.dll"},{"type":"dll","time":"133737987382753320","pid":"1704","tid":"14644","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F07F0B8","size":"4096","protect":"0x2","protect_str":"R--","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEC0009C","page_addr":"00007FFBDEC00000","size":"1101824","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEBFFAD8","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC04BCF","page_addr":"00007FFBDEC04000","size":"1085440","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEC51243","page_addr":"00007FFBDEC51000","size":"770048","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"dll","time":"133737987383065817","pid":"1704","tid":"14644","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F07F0B0","size":"13600","protect":"0x4","protect_str":"RW-","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEC0354A","page_addr":"00007FFBDEC03000","size":"1089536","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEC02252","page_addr":"00007FFBDEC02000","size":"1093632","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC00921","page_addr":"00007FFBDEC00000","size":"1101824","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEBFFB05","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"dll","time":"133737987383065817","pid":"1704","tid":"14644","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F07F0B0","size":"13600","protect":"0x2","protect_str":"R--","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEC0354A","page_addr":"00007FFBDEC03000","size":"1089536","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEC02296","page_addr":"00007FFBDEC02000","size":"1093632","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC00943","page_addr":"00007FFBDEC00000","size":"1101824","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEBFFB05","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"dll","time":"133737987383378288","pid":"1704","tid":"14644","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F07F100","size":"1024","protect":"0x4","protect_str":"RW-","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEC05082","page_addr":"00007FFBDEC05000","size":"1081344","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEC079D2","page_addr":"00007FFBDEC07000","size":"1073152","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC04C14","page_addr":"00007FFBDEC04000","size":"1085440","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEC51243","page_addr":"00007FFBDEC51000","size":"770048","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"etw","time":"133737987377344566","pid":"1704","thread_id":"14644","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x0000012136132700","ImageSize":"0x00000121361328E0","ProcessID":"1704","ImageCheckSum":"192391","TimeDateStamp":"946832066","DefaultBase":"0x0000012136132160","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\wldp.dll"},{"type":"kernel","time":"133737987385878346","callback":"thread","krn_pid":"1704","pid":"1704","threadid":"14344","create":"1"},{"type":"kernel","time":"133737987385878346","callback":"thread","krn_pid":"1704","pid":"1704","threadid":"9096","create":"1"},{"type":"kernel","time":"133737987385878346","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\oleacc.dll"},{"type":"dll","time":"133737987383378288","pid":"1704","tid":"14644","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"0000022524E5CDA8","size":"3176","protect":"0x2","protect_str":"R--","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEC44518","page_addr":"00007FFBDEC44000","size":"823296","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEC2288A","page_addr":"00007FFBDEC22000","size":"962560","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC50128","page_addr":"00007FFBDEC50000","size":"774144","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEC500D3","page_addr":"00007FFBDEC50000","size":"774144","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"kernel","time":"133737987385878346","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\TextInputFramework.dll"},{"type":"kernel","time":"133737987385878346","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\CoreMessaging.dll"},{"type":"kernel","time":"133737987385878346","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\CoreUIComponents.dll"},{"type":"kernel","time":"133737987385878346","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\ws2_32.dll"},{"type":"dll","time":"133737987383378288","pid":"1704","tid":"4756","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"0000022524A57458","size":"1024","protect":"0x2","protect_str":"R--","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEC44518","page_addr":"00007FFBDEC44000","size":"823296","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEC2288A","page_addr":"00007FFBDEC22000","size":"962560","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC50128","page_addr":"00007FFBDEC50000","size":"774144","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEC500D3","page_addr":"00007FFBDEC50000","size":"774144","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"dll","time":"133737987384472049","pid":"1704","tid":"3796","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F1FEAF8","size":"88","protect":"0x4","protect_str":"RW-","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEC4419C","page_addr":"00007FFBDEC44000","size":"823296","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEC220F9","page_addr":"00007FFBDEC22000","size":"962560","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC00446","page_addr":"00007FFBDEC00000","size":"1101824","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBD87D6FF2","page_addr":"00007FFBD87D6000","size":"409600","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"dll","time":"133737987385253319","pid":"1704","tid":"3796","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F1FEAF8","size":"4096","protect":"0x2","protect_str":"R--","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEC441ED","page_addr":"00007FFBDEC44000","size":"823296","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEC220F9","page_addr":"00007FFBDEC22000","size":"962560","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC00446","page_addr":"00007FFBDEC00000","size":"1101824","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBD87D6FF2","page_addr":"00007FFBD87D6000","size":"409600","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"dll","time":"133737987385253319","pid":"1704","tid":"3796","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F1FEEC8","size":"136","protect":"0x4","protect_str":"RW-","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEC4419C","page_addr":"00007FFBDEC44000","size":"823296","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEC220F9","page_addr":"00007FFBDEC22000","size":"962560","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC00446","page_addr":"00007FFBDEC00000","size":"1101824","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDD6AC472","page_addr":"00007FFBDD6AC000","size":"1429504","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"dll","time":"133737987385565813","pid":"1704","tid":"3796","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F1FEEC8","size":"4096","protect":"0x2","protect_str":"R--","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEC441ED","page_addr":"00007FFBDEC44000","size":"823296","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEC220F9","page_addr":"00007FFBDEC22000","size":"962560","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC00446","page_addr":"00007FFBDEC00000","size":"1101824","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDD6AC472","page_addr":"00007FFBDD6AC000","size":"1429504","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"dll","time":"133737987385878346","pid":"1704","tid":"4756","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F17F008","size":"496","protect":"0x2","protect_str":"R--","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEBFFEE4","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEBFFAD8","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC04BCF","page_addr":"00007FFBDEC04000","size":"1085440","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEC51243","page_addr":"00007FFBDEC51000","size":"770048","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"kernel","time":"133737987388222078","callback":"image","krn_pid":"1704","pid":"1704","image":"\\Device\\HarddiskVolume2\\Windows\\System32\\ntmarta.dll"},{"type":"dll","time":"133737987386347087","pid":"1704","tid":"4756","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F17F008","size":"8","protect":"0x4","protect_str":"RW-","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEBFFFB5","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEBFFAD8","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC04BCF","page_addr":"00007FFBDEC04000","size":"1085440","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEC51243","page_addr":"00007FFBDEC51000","size":"770048","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"dll","time":"133737987386347087","pid":"1704","tid":"4756","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F17F008","size":"4096","protect":"0x2","protect_str":"R--","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEBFFFED","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEBFFAD8","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC04BCF","page_addr":"00007FFBDEC04000","size":"1085440","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEC51243","page_addr":"00007FFBDEC51000","size":"770048","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"dll","time":"133737987386659587","pid":"1704","tid":"4756","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F17F008","size":"8","protect":"0x4","protect_str":"RW-","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEC00068","page_addr":"00007FFBDEC00000","size":"1101824","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEBFFAD8","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC04BCF","page_addr":"00007FFBDEC04000","size":"1085440","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEC51243","page_addr":"00007FFBDEC51000","size":"770048","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"dll","time":"133737987386815810","pid":"1704","tid":"4756","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F17F008","size":"4096","protect":"0x2","protect_str":"R--","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEC0009C","page_addr":"00007FFBDEC00000","size":"1101824","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEBFFAD8","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC04BCF","page_addr":"00007FFBDEC04000","size":"1085440","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEC51243","page_addr":"00007FFBDEC51000","size":"770048","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"dll","time":"133737987387128306","pid":"1704","tid":"4756","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F17F000","size":"13600","protect":"0x4","protect_str":"RW-","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEC0354A","page_addr":"00007FFBDEC03000","size":"1089536","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEC02252","page_addr":"00007FFBDEC02000","size":"1093632","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC00921","page_addr":"00007FFBDEC00000","size":"1101824","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEBFFB05","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"dll","time":"133737987387128306","pid":"1704","tid":"4756","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F17F000","size":"13600","protect":"0x2","protect_str":"R--","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEC0354A","page_addr":"00007FFBDEC03000","size":"1089536","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEC02296","page_addr":"00007FFBDEC02000","size":"1093632","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC00943","page_addr":"00007FFBDEC00000","size":"1101824","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEBFFB05","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"dll","time":"133737987388065901","pid":"1704","tid":"4756","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F17F050","size":"2368","protect":"0x4","protect_str":"RW-","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEC05082","page_addr":"00007FFBDEC05000","size":"1081344","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEC079D2","page_addr":"00007FFBDEC07000","size":"1073152","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC04C14","page_addr":"00007FFBDEC04000","size":"1085440","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEC51243","page_addr":"00007FFBDEC51000","size":"770048","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"etw","time":"133737987379234643","pid":"1704","thread_id":"14644","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x00000121360F96E0","ImageSize":"0x00000121360F90F0","ProcessID":"1704","ImageCheckSum":"849765","TimeDateStamp":"3559841777","DefaultBase":"0x00000121360F93C0","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\oleaut32.dll"},{"type":"dll","time":"133737987388222078","pid":"1704","tid":"4756","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"0000022524A56C98","size":"1624","protect":"0x2","protect_str":"R--","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEC44518","page_addr":"00007FFBDEC44000","size":"823296","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEC2288A","page_addr":"00007FFBDEC22000","size":"962560","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC50128","page_addr":"00007FFBDEC50000","size":"774144","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEC500D3","page_addr":"00007FFBDEC50000","size":"774144","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"etw","time":"133737987380888397","pid":"1704","thread_id":"2524","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x00000121360F93C0","ImageSize":"0x00000121360F93C0","ProcessID":"1704","ImageCheckSum":"401062","TimeDateStamp":"1783206983","DefaultBase":"0x00000121360F93C0","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\shlwapi.dll"},{"type":"etw","time":"133737987380896341","pid":"1704","thread_id":"2524","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x00000121360F94B0","ImageSize":"0x00000121360F9460","ProcessID":"1704","ImageCheckSum":"1162784","TimeDateStamp":"543326611","DefaultBase":"0x00000121360F9460","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\msctf.dll"},{"type":"etw","time":"133737987380946119","pid":"1704","thread_id":"2524","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x00000121360F9870","ImageSize":"0x00000121360B70F0","ProcessID":"1704","ImageCheckSum":"723665","TimeDateStamp":"2255482695","DefaultBase":"0x00000121360B7A50","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\TextShaping.dll"},{"type":"etw","time":"133737987380961860","pid":"1704","thread_id":"2524","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x00000121360F9410","ImageSize":"0x00000121360F90F0","ProcessID":"1704","ImageCheckSum":"914722","TimeDateStamp":"483081012","DefaultBase":"0x00000121360F9870","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\efswrt.dll"},{"type":"etw","time":"133737987380963002","pid":"1704","thread_id":"14644","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x00000121360F9870","ImageSize":"0x00000121360BD110","ProcessID":"1704","ImageCheckSum":"129330","TimeDateStamp":"931921329","DefaultBase":"0x00000121360BD110","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\mpr.dll"},{"type":"etw","time":"133737987380963412","pid":"1704","thread_id":"2524","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x00000121360F94B0","ImageSize":"0x00000121360F9870","ProcessID":"1704","ImageCheckSum":"1424514","TimeDateStamp":"2716751106","DefaultBase":"0x00000121360F94B0","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\WinTypes.dll"},{"type":"etw","time":"133737987380966001","pid":"1704","thread_id":"11544","event":"StartThread","provider_name":"Microsoft-Windows-Kernel-Process","ProcessID":"1704","ThreadID":"4756","StackBase":"0x00000121360B7910","StackLimit":"0x00000121360B76E0","UserStackBase":"0x00000121360B70F0","UserStackLimit":"0x00000121360B76E0","StartAddr":"0x00000121360B76E0","Win32StartAddr":"0x00000121360B76E0","TebBase":"0x00000121360B7910","SubProcessTag":"0"},{"type":"etw","time":"133737987384526444","pid":"1704","thread_id":"2524","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x00000121360BD110","ImageSize":"0x00000121360BD070","ProcessID":"1704","ImageCheckSum":"2144556","TimeDateStamp":"371345800","DefaultBase":"0x00000121360BD110","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\twinapi.appcore.dll"},{"type":"etw","time":"133737987384530653","pid":"1704","thread_id":"2524","event":"StartThread","provider_name":"Microsoft-Windows-Kernel-Process","ProcessID":"1704","ThreadID":"3796","StackBase":"0x00000121360B8A50","StackLimit":"0x00000121360B8690","UserStackBase":"0x00000121360B8690","UserStackLimit":"0x00000121360B8690","StartAddr":"0x00000121360B8690","Win32StartAddr":"0x00000121360B8690","TebBase":"0x00000121360B8690","SubProcessTag":"0"},{"type":"etw","time":"133737987385879732","pid":"1704","thread_id":"2524","event":"StartThread","provider_name":"Microsoft-Windows-Kernel-Process","ProcessID":"1704","ThreadID":"14344","StackBase":"0x00000121360B8A50","StackLimit":"0x00000121360B03E0","UserStackBase":"0x00000121360B03E0","UserStackLimit":"0x00000121360B03E0","StartAddr":"0x00000121360B03E0","Win32StartAddr":"0x00000121360B03E0","TebBase":"0x00000121360B03E0","SubProcessTag":"0"},{"type":"etw","time":"133737987385886190","pid":"1704","thread_id":"3796","event":"StartThread","provider_name":"Microsoft-Windows-Kernel-Process","ProcessID":"1704","ThreadID":"9096","StackBase":"0x00000121360B70F0","StackLimit":"0x00000121360B70F0","UserStackBase":"0x00000121360B70F0","UserStackLimit":"0x00000121360B70F0","StartAddr":"0x00000121360B70F0","Win32StartAddr":"0x00000121360B70F0","TebBase":"0x00000121360B70F0","SubProcessTag":"0"},{"type":"etw","time":"133737987385928728","pid":"1704","thread_id":"2524","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x00000121360B2C00","ImageSize":"0x00000121360B2C00","ProcessID":"1704","ImageCheckSum":"438444","TimeDateStamp":"4130496952","DefaultBase":"0x00000121360B2C00","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\oleacc.dll"},{"type":"etw","time":"133737987386003188","pid":"1704","thread_id":"2524","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x00000121360F9500","ImageSize":"0x00000121360B03E0","ProcessID":"1704","ImageCheckSum":"1038357","TimeDateStamp":"409007408","DefaultBase":"0x00000121360F9500","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\TextInputFramework.dll"},{"type":"etw","time":"133737987386004880","pid":"1704","thread_id":"2524","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x00000121360F9500","ImageSize":"0x00000121360F9500","ProcessID":"1704","ImageCheckSum":"988081","TimeDateStamp":"1777838427","DefaultBase":"0x00000121360F9500","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\CoreMessaging.dll"},{"type":"etw","time":"133737987386005199","pid":"1704","thread_id":"4756","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x0000012136153D80","ImageSize":"0x0000012136153E70","ProcessID":"1704","ImageCheckSum":"3577987","TimeDateStamp":"240915949","DefaultBase":"0x0000012136152980","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\CoreUIComponents.dll"},{"type":"dll","time":"133737987388222078","pid":"1704","tid":"11544","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F0FF4C8","size":"704","protect":"0x2","protect_str":"R--","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEBFFEE4","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEBFFAD8","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC04BCF","page_addr":"00007FFBDEC04000","size":"1085440","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEC51243","page_addr":"00007FFBDEC51000","size":"770048","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"dll","time":"133737987388690947","pid":"1704","tid":"11544","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F0FF4C8","size":"8","protect":"0x4","protect_str":"RW-","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEBFFFB5","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEBFFAD8","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC04BCF","page_addr":"00007FFBDEC04000","size":"1085440","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEC51243","page_addr":"00007FFBDEC51000","size":"770048","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"dll","time":"133737987389472172","pid":"1704","tid":"11544","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F0FF4C8","size":"4096","protect":"0x2","protect_str":"R--","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEBFFFED","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEBFFAD8","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC04BCF","page_addr":"00007FFBDEC04000","size":"1085440","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEC51243","page_addr":"00007FFBDEC51000","size":"770048","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"etw","time":"133737987386006053","pid":"1704","thread_id":"2524","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x0000012136152D90","ImageSize":"0x0000012136152520","ProcessID":"1704","ImageCheckSum":"489137","TimeDateStamp":"2047685052","DefaultBase":"0x00000121361531A0","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\ws2_32.dll"},{"type":"etw","time":"133737987388317993","pid":"1704","thread_id":"11544","event":"LoadImage","provider_name":"Microsoft-Windows-Kernel-Process","ImageBase":"0x00000121361531A0","ImageSize":"0x0000012136153600","ProcessID":"1704","ImageCheckSum":"197444","TimeDateStamp":"4265087599","DefaultBase":"0x0000012136153600","ImageName":"\\Device\\HarddiskVolume2\\Windows\\System32\\ntmarta.dll"},{"type":"dll","time":"133737987389628340","pid":"1704","tid":"11544","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F0FF4C8","size":"8","protect":"0x4","protect_str":"RW-","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEC00068","page_addr":"00007FFBDEC00000","size":"1101824","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEBFFAD8","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC04BCF","page_addr":"00007FFBDEC04000","size":"1085440","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEC51243","page_addr":"00007FFBDEC51000","size":"770048","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"dll","time":"133737987389940894","pid":"1704","tid":"11544","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F0FF4C8","size":"4096","protect":"0x2","protect_str":"R--","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEC0009C","page_addr":"00007FFBDEC00000","size":"1101824","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEBFFAD8","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC04BCF","page_addr":"00007FFBDEC04000","size":"1085440","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEC51243","page_addr":"00007FFBDEC51000","size":"770048","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"dll","time":"133737987389940894","pid":"1704","tid":"11544","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F0FF4C0","size":"13600","protect":"0x4","protect_str":"RW-","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEC0354A","page_addr":"00007FFBDEC03000","size":"1089536","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEC02252","page_addr":"00007FFBDEC02000","size":"1093632","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC00921","page_addr":"00007FFBDEC00000","size":"1101824","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEBFFB05","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"dll","time":"133737987391503349","pid":"1704","tid":"11544","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F0FF4C0","size":"13600","protect":"0x2","protect_str":"R--","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEC0354A","page_addr":"00007FFBDEC03000","size":"1089536","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEC02296","page_addr":"00007FFBDEC02000","size":"1093632","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC00943","page_addr":"00007FFBDEC00000","size":"1101824","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEBFFB05","page_addr":"00007FFBDEBFF000","size":"1105920","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"dll","time":"133737987391503349","pid":"1704","tid":"11544","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"000000AA3F0FF510","size":"1696","protect":"0x4","protect_str":"RW-","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEC05082","page_addr":"00007FFBDEC05000","size":"1081344","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEC079D2","page_addr":"00007FFBDEC07000","size":"1073152","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC04C14","page_addr":"00007FFBDEC04000","size":"1085440","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEC51243","page_addr":"00007FFBDEC51000","size":"770048","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"dll","time":"133737987391503349","pid":"1704","tid":"4756","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"00000225249E9468","size":"2368","protect":"0x2","protect_str":"R--","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEC44518","page_addr":"00007FFBDEC44000","size":"823296","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEC2288A","page_addr":"00007FFBDEC22000","size":"962560","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC50128","page_addr":"00007FFBDEC50000","size":"774144","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEC500D3","page_addr":"00007FFBDEC50000","size":"774144","state":"0x1000","protect":"0x20","type":"0x1000000"}]},{"type":"dll","time":"133737987391972076","pid":"1704","tid":"11544","func":"ProtectVirtualMemory","pid":"FFFFFFFFFFFFFFFF","base_addr":"0000022525067168","size":"1696","protect":"0x2","protect_str":"R--","callstack":[{"idx":"0","addr":"00007FFBC9F0BB8A","page_addr":"00007FFBC9F0B000","size":"135168","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"1","addr":"00007FFBC9F0C7F4","page_addr":"00007FFBC9F0C000","size":"131072","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"2","addr":"00007FFBDEC44518","page_addr":"00007FFBDEC44000","size":"823296","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"3","addr":"00007FFBDEC2288A","page_addr":"00007FFBDEC22000","size":"962560","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"4","addr":"00007FFBDEC50128","page_addr":"00007FFBDEC50000","size":"774144","state":"0x1000","protect":"0x20","type":"0x1000000"},{"idx":"5","addr":"00007FFBDEC500D3","page_addr":"00007FFBDEC50000","size":"774144","state":"0x1000","protect":"0x20","type":"0x1000000"}]}] |