diff --git a/EDRi/dumps/Defender-vs-Injector-standard-events-All.csv b/EDRi/dumps/Defender-vs-Injector-standard-events-All.csv index 561d378..07ea32f 100644 --- a/EDRi/dumps/Defender-vs-Injector-standard-events-All.csv +++ b/EDRi/dumps/Defender-vs-Injector-standard-events-All.csv @@ -1,1640 +1,1663 @@ -timestamp_sys,timestamp_etw,src_type,provider_name,event_id,task_info,process_id,thread_id,ppid,pid,targetpid,targettid,message,filepath,cachename,result,vname,name,sigseq,sigsha,commandline,firstparam,secondparam,timestamp_ns,stackbase,stacklimit,startaddr,subprocesstag,tebbase,threadid,userstackbase,userstacklimit,win32startaddr,cycletime,defaultbase,imagebase,imagechecksum,imagesize,timedatestamp,commitcharge,commitpeak,cpucyclecount,createtime,exitcode,exittime,handlecount,hardfaultcount,processsequencenumber,readoperationcount,readtransferkilobytes,tokenelevationtype,writeoperationcount,writetransferkilobytes,flags,mandatorylabel,packagefullname,packagerelativeappid,parentprocessid,parentprocesssequencenumber,processtokenelevationtype,processtokeniselevated,securitymitigations,sessionid"2025-11-19 19:51:16.343730900Z","2025-11-19 19:51:16.3437374Z","myETW","EDRi-Provider",4242,"EDRiTask","12472 EDRi.exe",,,,,,"++ EDRi START MARKER ++",,,,,,,,,,,1763581876343737400,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.5865091Z","2025-11-19 19:51:16.5865091Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8972 VBoxTray.exe",9020,,," 8972 VBoxTray.exe",,,,,,,,,,,,,1763581876586509100,18446633084041842688,18446633084041818112,140700131109808,0,471284228096,9164,471286677504,471286673408,140700131109808,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.5868139Z","2025-11-19 19:51:16.5868139Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8972 VBoxTray.exe",9164,,," 8972 VBoxTray.exe",,,,,,,,,,,,,1763581876586813900,18446633084041842688,18446633084041818112,140700131109808,0,471284228096,9164,471286677504,471286669312,140700131109808,428122,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.6931597Z","2025-11-19 19:51:16.6931597Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"11648 RuntimeBroker.exe",,,,,,,,,,,,,1763581876693159700,18446633084041842688,18446633084041818112,140712899206080,0,503394820096,3896,503397220352,503397171200,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.6933880Z","2025-11-19 19:51:16.6933880Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11648 RuntimeBroker.exe",3896,,,"11648 RuntimeBroker.exe",,,,,,,,,,,,,1763581876693388000,18446633084040663040,18446633084040638464,140712899206080,0,503394828288,8592,503397744640,503397695488,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.7247840Z","2025-11-19 19:51:16.7247840Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 5664 OpenConsole.exe",,,,,,,,,,,,,1763581876724784000,18446633084041900032,18446633084041875456,140712899206080,0,304352927744,12896,304354426880,304354422784,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9633043Z","2025-11-19 19:51:16.9633043Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13120 ",540,,,"13120 ",,,,,,,,,,,,,1763581876963304300,18446633084052176896,18446633084052152320,140712865112144,0,619234459648,540,619238653952,619238604800,140712865112144,934326,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9633044Z","2025-11-19 19:51:16.9633044Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13120 ",8284,,,"13120 ",,,,,,,,,,,,,1763581876963304400,18446633084051488768,18446633084051464192,140712899206080,0,619236544512,8284,619238129664,619238080512,140712899206080,46624563,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9633055Z","2025-11-19 19:51:16.9633055Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13120 ",12604,,,"13120 ",,,,,,,,,,,,,1763581876963305500,18446633084053524480,18446633084053499904,140712899206080,0,619234476032,12604,619237605376,619237556224,140712899206080,736670,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9633063Z","2025-11-19 19:51:16.9633063Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13120 ",14864,,,"13120 ",,,,,,,,,,,,,1763581876963306300,18446633084043333632,18446633084043309056,140712899206080,0,619236519936,14864,619234000896,619233951744,140712899206080,3646014,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9633083Z","2025-11-19 19:51:16.9633083Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13120 ",15068,,,"13120 ",,,,,,,,,,,,,1763581876963308300,18446633084036870144,18446633084036845568,140699399787184,0,619236216832,15068,619233476608,619233427456,140699399787184,56130748,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9633298Z","2025-11-19 19:51:16.9633298Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13120 ",13920,,,"13120 ",,,,,,,,,,,,,1763581876963329800,18446633084041756672,18446633084041732096,140712865112144,0,619236282368,13920,619240226816,619240177664,140712865112144,120178560,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9634505Z","2025-11-19 19:51:16.9634505Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13120 ",1692,,,"13120 ",,,,,,,,,,,,,1763581876963450500,18446633084024516608,18446633084024492032,140712899206080,0,619234467840,1692,619237081088,619237031936,140712899206080,1102179,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9639407Z","2025-11-19 19:51:16.9639407Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5184 explorer.exe",3712,,," 5184 explorer.exe",,,,,,,,,,,,,1763581876963940700,18446633084022595584,18446633084022571008,140712891292720,0,15220736,3712,467664896,467607552,140712891292720,5481847,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9643705Z","2025-11-19 19:51:16.9643705Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\RuntimeBroker.exe",,,,,,,,,,1763581876964370500,,,,,,,,,,,140699399749632,140699399749632,148437,126976,1175682367,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9643839Z","2025-11-19 19:51:16.9643839Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\twinui.dll",,,,,,,,,,1763581876964383900,,,,,,,,,,,140712339046400,140712339046400,5239409,5242880,279122806,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9643947Z","2025-11-19 19:51:16.9643947Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\gamemode.dll",,,,,,,,,,1763581876964394700,,,,,,,,,,,140712543387648,140712543387648,164324,114688,328629043,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9644123Z","2025-11-19 19:51:16.9644123Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\OneCoreCommonProxyStub.dll",,,,,,,,,,1763581876964412300,,,,,,,,,,,140712570257408,140712570257408,903222,823296,2010952444,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9644228Z","2025-11-19 19:51:16.9644228Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\iertutil.dll",,,,,,,,,,1763581876964422800,,,,,,,,,,,140712642805760,140712642805760,2984761,2904064,3815768453,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9644303Z","2025-11-19 19:51:16.9644303Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\srvcli.dll",,,,,,,,,,1763581876964430300,,,,,,,,,,,140712668954624,140712668954624,181029,167936,239922031,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9644395Z","2025-11-19 19:51:16.9644395Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,1763581876964439500,,,,,,,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9644486Z","2025-11-19 19:51:16.9644486Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\mscms.dll",,,,,,,,,,1763581876964448600,,,,,,,,,,,140712711880704,140712711880704,859508,786432,1878966387,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9644575Z","2025-11-19 19:51:16.9644575Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\OneCoreUAPCommonProxyStub.dll",,,,,,,,,,1763581876964457500,,,,,,,,,,,140712713977856,140712713977856,6740758,6615040,2011948997,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9644704Z","2025-11-19 19:51:16.9644704Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\propsys.dll",,,,,,,,,,1763581876964470400,,,,,,,,,,,140712761491456,140712761491456,1123662,1060864,3228732737,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9644816Z","2025-11-19 19:51:16.9644816Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581876964481600,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9644903Z","2025-11-19 19:51:16.9644903Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\uxtheme.dll",,,,,,,,,,1763581876964490300,,,,,,,,,,,140712802254848,140712802254848,696534,696320,1695798817,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9644978Z","2025-11-19 19:51:16.9644978Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\DXCore.dll",,,,,,,,,,1763581876964497800,,,,,,,,,,,140712805400576,140712805400576,331386,274432,2354081039,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9645067Z","2025-11-19 19:51:16.9645067Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\windows.storage.dll",,,,,,,,,,1763581876964506700,,,,,,,,,,,140712812412928,140712812412928,8877403,8769536,3667346596,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9645155Z","2025-11-19 19:51:16.9645155Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\netutils.dll",,,,,,,,,,1763581876964515500,,,,,,,,,,,140712825847808,140712825847808,80696,53248,865845000,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9645240Z","2025-11-19 19:51:16.9645240Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,1763581876964524000,,,,,,,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9645389Z","2025-11-19 19:51:16.9645389Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\ntmarta.dll",,,,,,,,,,1763581876964538900,,,,,,,,,,,140712831811584,140712831811584,265798,221184,3598506564,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9645469Z","2025-11-19 19:51:16.9645469Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\cfgmgr32.dll",,,,,,,,,,1763581876964546900,,,,,,,,,,,140712845049856,140712845049856,385808,356352,1737777300,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9645550Z","2025-11-19 19:51:16.9645550Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\umpdc.dll",,,,,,,,,,1763581876964555000,,,,,,,,,,,140712848064512,140712848064512,98535,81920,1714427184,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9645619Z","2025-11-19 19:51:16.9645619Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\powrprof.dll",,,,,,,,,,1763581876964561900,,,,,,,,,,,140712848195584,140712848195584,457799,385024,2858637235,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9645780Z","2025-11-19 19:51:16.9645780Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\bcrypt.dll",,,,,,,,,,1763581876964578000,,,,,,,,,,,140712848654336,140712848654336,206048,172032,2893678010,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9645934Z","2025-11-19 19:51:16.9645934Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\profapi.dll",,,,,,,,,,1763581876964593400,,,,,,,,,,,140712848850944,140712848850944,229548,167936,2447194521,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9646033Z","2025-11-19 19:51:16.9646033Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,1763581876964603300,,,,,,,,,,,140712851341312,140712851341312,1524912,1486848,1404855129,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9646112Z","2025-11-19 19:51:16.9646112Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,1763581876964611200,,,,,,,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9646188Z","2025-11-19 19:51:16.9646188Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581876964618800,,,,,,,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9646256Z","2025-11-19 19:51:16.9646256Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,1763581876964625600,,,,,,,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9646348Z","2025-11-19 19:51:16.9646348Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581876964634800,,,,,,,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9646423Z","2025-11-19 19:51:16.9646423Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581876964642300,,,,,,,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9646544Z","2025-11-19 19:51:16.9646544Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,1763581876964654400,,,,,,,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9646638Z","2025-11-19 19:51:16.9646638Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581876964663800,,,,,,,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9646705Z","2025-11-19 19:51:16.9646705Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\combase.dll",,,,,,,,,,1763581876964670500,,,,,,,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9646777Z","2025-11-19 19:51:16.9646777Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\shlwapi.dll",,,,,,,,,,1763581876964677700,,,,,,,,,,,140712868839424,140712868839424,479562,421888,2142510382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9646845Z","2025-11-19 19:51:16.9646845Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,1763581876964684500,,,,,,,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9646922Z","2025-11-19 19:51:16.9646922Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581876964692200,,,,,,,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9647006Z","2025-11-19 19:51:16.9647006Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\ole32.dll",,,,,,,,,,1763581876964700600,,,,,,,,,,,140712878473216,140712878473216,1689904,1667072,1018821057,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9647082Z","2025-11-19 19:51:16.9647082Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,1763581876964708200,,,,,,,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9647221Z","2025-11-19 19:51:16.9647221Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581876964722100,,,,,,,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9647286Z","2025-11-19 19:51:16.9647286Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,1763581876964728600,,,,,,,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9647366Z","2025-11-19 19:51:16.9647366Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,1763581876964736600,,,,,,,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9647436Z","2025-11-19 19:51:16.9647436Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,1763581876964743600,,,,,,,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9647507Z","2025-11-19 19:51:16.9647507Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\user32.dll",,,,,,,,,,1763581876964750700,,,,,,,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9647590Z","2025-11-19 19:51:16.9647590Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,1763581876964759000,,,,,,,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9647664Z","2025-11-19 19:51:16.9647664Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581876964766400,,,,,,,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9647802Z","2025-11-19 19:51:16.9647802Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581876964780200,,,,,,,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9647881Z","2025-11-19 19:51:16.9647881Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581876964788100,,,,,,,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9648012Z","2025-11-19 19:51:16.9648012Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop ","13120 ",1692,,,"13120 ",,,"RuntimeBroker.",,,,,,,,,,1763581876964801200,,,,,,,,,,,,,,,,3215360,3645440,424320572,134080539436056425,0,134080554769450943,264,0,2861,12,26,3,4,12,,,,,,,,,, -"2025-11-19 19:51:16.9791067Z","2025-11-19 19:51:16.9791067Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1416 ApplicationFrameHost.exe",11516,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,1763581876979106700,18446633084046409728,18446633084046385152,140712891292720,0,199841775616,11516,199843905536,199843897344,140712891292720,31722890,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9793344Z","2025-11-19 19:51:16.9793344Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4340 sihost.exe",13900,,," 4340 sihost.exe",,,,,,,,,,,,,1763581876979334400,18446633084023111680,18446633084023087104,140712891292720,0,645640536064,13900,645647040512,645647028224,140712891292720,5391318,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9950931Z","2025-11-19 19:51:16.9950931Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4340 sihost.exe",13260,,," 4340 sihost.exe",,,,,,,,,,,,,1763581876995093100,18446633084011245568,18446633084011220992,140712891292720,0,645640544256,13260,645647564800,645647548416,140712891292720,3404229,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9951060Z","2025-11-19 19:51:16.9951060Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1416 ApplicationFrameHost.exe",13876,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,1763581876995106000,18446633084045979648,18446633084045955072,140712891292720,0,199841767424,13876,199842332672,199842316288,140712891292720,181487517,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.0111136Z","2025-11-19 19:51:17.0111136Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1416 ApplicationFrameHost.exe",9424,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,1763581877011113600,18446633083987144704,18446633083987120128,140712891292720,0,199841759232,9424,199839318016,199839297536,140712891292720,65582250,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.0430380Z","2025-11-19 19:51:17.0430380Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5992 svchost.exe",13196,,," 5992 svchost.exe",,,,,,,,,,,,,1763581877043038000,18446633084053237760,18446633084053213184,140712899206080,0,477737390080,13196,477738565632,477738532864,140712899206080,8061896,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.0430460Z","2025-11-19 19:51:17.0430460Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5992 svchost.exe",13756,,," 5992 svchost.exe",,,,,,,,,,,,,1763581877043046100,18446633084028424192,18446633084028399616,140712899206080,0,477737398272,13756,477739089920,477739057152,140712899206080,6557245,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.2863561Z","2025-11-19 19:51:17.2863561Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","15184 SearchProtocolHost.exe",4084,,,"15184 SearchProtocolHost.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,1763581877286356100,,,,,,,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.2875043Z","2025-11-19 19:51:17.2875043Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","15184 SearchProtocolHost.exe",4084,,,"15184 SearchProtocolHost.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,1763581877287504300,,,,,,,,,,,140712869888000,140712869888000,7769948,7675904,2341846616,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.2923207Z","2025-11-19 19:51:17.2923207Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6500 SearchHost.exe",14484,,," 6500 SearchHost.exe",,,,,,,,,,,,,1763581877292320700,18446633084058714112,18446633084058689536,140712449945792,0,1050565754880,14484,1050568294400,1050568228864,140712449945792,1580469,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.2923407Z","2025-11-19 19:51:17.2923407Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","15184 SearchProtocolHost.exe",4084,,,"15184 SearchProtocolHost.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,1763581877292340700,,,,,,,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.2924784Z","2025-11-19 19:51:17.2924784Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6500 SearchHost.exe",14300,,," 6500 SearchHost.exe",,,,,,,,,,,,,1763581877292478500,18446633084041756672,18446633084041732096,140712449945792,0,1050565763072,11380,1050568294400,1050568228864,140712449945792,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.2931419Z","2025-11-19 19:51:17.2931419Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","15184 SearchProtocolHost.exe",4084,,,"15184 SearchProtocolHost.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,1763581877293141900,,,,,,,,,,,140712869888000,140712869888000,7769948,7675904,2341846616,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.2967529Z","2025-11-19 19:51:17.2967529Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6500 SearchHost.exe",11380,,," 6500 SearchHost.exe",,,,,,,,,,,,,1763581877296752900,18446633084041756672,18446633084041732096,140712449945792,0,1050565763072,11380,1050568294400,1050568228864,140712449945792,1074644,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.2968507Z","2025-11-19 19:51:17.2968507Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6500 SearchHost.exe",14300,,," 6500 SearchHost.exe",,,,,,,,,,,,,1763581877296850700,18446633084041756672,18446633084041732096,140712449945792,0,1050565771264,14416,1050568294400,1050568228864,140712449945792,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.287575200Z","2025-11-19 19:51:17.3448096Z","myETW","EDRi-Provider",4242,"EDRiTask","12472 EDRi.exe",,,,,,"++ EDRi START MARKER ++",,,,,,,,,,,1763581877344809600,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.5841062Z","2025-11-19 19:51:17.5841062Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9920 ServiceHub.IntellicodeModelService.exe",5860,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,1763581877584106200,18446633084005670912,18446633084005646336,140711612509856,0,46014308352,5860,46012694528,46012678144,140711612509856,774012,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.197740800Z","2025-11-19 19:51:18.3561017Z","myETW","EDRi-Provider",4242,"EDRiTask","12472 EDRi.exe",,,,,,"Before decrypting the attack exe from C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\attacks\Injector-standard.exe.enc",,,,,,,,,,,1763581878356101700,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.199912800Z","2025-11-19 19:51:18.3585127Z","myETW","EDRi-Provider",4242,"EDRiTask","12472 EDRi.exe",,,,,,"After decrypting the attack exe",,,,,,,,,,,1763581878358512700,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.3963495Z","2025-11-19 19:51:18.3963495Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3504 svchost.exe",12864,,," 3504 svchost.exe",,,,,,,,,,,,,1763581878396349500,18446633083987144704,18446633083987120128,140712899206080,38,949314420736,8740,949313404928,949313372160,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.4026822Z","2025-11-19 19:51:18.4026822Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3564 MsMpEng.exe",8704,,," 3564 MsMpEng.exe",,,,,,,,,,,,,1763581878402682200,18446633084043333632,18446633084043309056,140712865112144,247,273686036480,12944,273705598976,273705533440,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.4034668Z","2025-11-19 19:51:18.4034668Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1776 svchost.exe",2748,,," 1776 svchost.exe",,,,,,,,,,,,,1763581878403466800,18446633084042158080,18446633084042133504,140712899206080,122,699936538624,1248,699937587200,699937554432,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.4082367Z","2025-11-19 19:51:18.4082367Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2376 svchost.exe",2640,,," 2376 svchost.exe",,,,,,,,,,,,,1763581878408236700,18446633084042186752,18446633084042162176,140712899206080,248,36400259072,2884,36401315840,36401283072,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.4099234Z","2025-11-19 19:51:18.4099234Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2932 svchost.exe",5072,,," 2932 svchost.exe",,,,,,,,,,,,,1763581878409923400,18446633084045979648,18446633084045955072,140712899206080,49,212461367296,14528,212459651072,212459585536,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.4324897Z","2025-11-19 19:51:18.4324897Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3504 svchost.exe",12864,,," 3504 svchost.exe",,,,,,,,,,,,,1763581878432489700,18446633084042100736,18446633084042076160,140712678802768,38,949314428928,6532,949316747264,949316714496,140712678802768,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.7511985Z","2025-11-19 19:51:18.7511985Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1520 powershell.exe",4168,,," 1520 powershell.exe",,,,,,,,,,,,,1763581878751198500,18446633084042129408,18446633084042104832,140712899206080,0,931706306560,6084,931710107648,931710099456,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.7512011Z","2025-11-19 19:51:18.7512011Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8916 SecurityHealthService.exe",8952,,," 8916 SecurityHealthService.exe",,,,,,,,,,,,,1763581878751201100,18446633084042330112,18446633084042305536,140712899206080,167,33812795392,13648,33815003136,33814994944,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.0792892Z","2025-11-19 19:51:19.0792892Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 872 wininit.exe",5580,,," 872 wininit.exe",,,,,,,,,,,,,1763581879079289300,18446633084040691712,18446633084040667136,140712899206080,0,97764474880,5580,97765556224,97765498880,140712899206080,268944,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.108607600Z","2025-11-19 19:51:19.3681762Z","myETW","EDRi-Provider",4242,"EDRiTask","12472 EDRi.exe",,,,,,"Before starting the attack exe",,,,,,,,,,,1763581879368176200,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.3794628Z","2025-11-19 19:51:19.3794628Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8448 OneDrive.exe",8496,,," 8448 OneDrive.exe",,,,,,,,,,,,,1763581879379462800,18446633084042072064,18446633084042047488,140712859481984,0,70345129984,12656,70351060992,70351056896,140712859481984,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.3795497Z","2025-11-19 19:51:19.3795497Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8448 OneDrive.exe",8496,,," 8448 OneDrive.exe",,,,,,,,,,,,,1763581879379549700,18446633084040691712,18446633084040667136,140712859481984,0,70345138176,4244,70353158144,70353154048,140712859481984,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.5582180Z","2025-11-19 19:51:19.5582180Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1564 svchost.exe",320,,," 1564 svchost.exe",,,,,,,,,,,,,1763581879558218000,18446633083995705344,18446633083995680768,140712899206080,0,86741528576,320,86739845120,86739812352,140712899206080,348156,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.5582222Z","2025-11-19 19:51:19.5582222Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1676 svchost.exe",14356,,," 1676 svchost.exe",,,,,,,,,,,,,1763581879558222300,18446633084007567360,18446633084007542784,140712899206080,0,289651163136,14356,289649328128,289649295360,140712899206080,294971,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.5582251Z","2025-11-19 19:51:19.5582251Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1388 svchost.exe",7708,,," 1388 svchost.exe",,,,,,,,,,,,,1763581879558225100,18446633083995619328,18446633083995594752,140712899206080,0,867845017600,7708,867846062080,867846029312,140712899206080,442079,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.5582269Z","2025-11-19 19:51:19.5582269Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1796 svchost.exe",13672,,," 1796 svchost.exe",,,,,,,,,,,,,1763581879558226900,18446633084043304960,18446633084043280384,140712899206080,0,708991610880,13672,708990205952,708990173184,140712899206080,218022,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.5582272Z","2025-11-19 19:51:19.5582272Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1660 svchost.exe",10848,,," 1660 svchost.exe",,,,,,,,,,,,,1763581879558227200,18446633084006277120,18446633084006252544,140712899206080,0,265906405376,10848,265905373184,265905340416,140712899206080,567308,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.5582306Z","2025-11-19 19:51:19.5582306Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1580 svchost.exe",11172,,," 1580 svchost.exe",,,,,,,,,,,,,1763581879558230600,18446633083995676672,18446633083995652096,140712899206080,0,966821433344,11172,966823247872,966823215104,140712899206080,442078,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.6057562Z","2025-11-19 19:51:19.6057562Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13112 TimelineExplorer.exe",3660,,,"13112 TimelineExplorer.exe",,,,,,,,,,,,,1763581879605756200,18446633083995676672,18446633083995652096,140710065285584,0,1007263309824,6596,1007268921344,1007268917248,140710065285584,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.6062469Z","2025-11-19 19:51:19.6062469Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13112 TimelineExplorer.exe",6596,,,"13112 TimelineExplorer.exe",,,,,,,,,,,,,1763581879606246900,18446633083995705344,18446633083995680768,140710065285584,0,1007263318016,13176,1007270494208,1007270490112,140710065285584,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.6854481Z","2025-11-19 19:51:19.6854481Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2244 svchost.exe",10872,,," 2244 svchost.exe",,,,,,,,,,,,,1763581879685448100,18446633084007510016,18446633084007485440,140712899206080,0,927664201728,10872,927665225728,927665192960,140712899206080,271962,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.7168967Z","2025-11-19 19:51:19.7168967Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2384 svchost.exe",11224,,," 2384 svchost.exe",,,,,,,,,,,,,1763581879716896700,18446633084007280640,18446633084007256064,140712899206080,0,928822128640,11224,928820035584,928820002816,140712899206080,284409,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.7681200Z","2025-11-19 19:51:19.7681200Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3564 MsMpEng.exe",15092,,," 3564 MsMpEng.exe",,,,,,,,,,,,,1763581879768120000,18446633084007280640,18446633084007256064,140712850417280,247,273686044672,13280,273711366144,273711345664,140712850417280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.7962656Z","2025-11-19 19:51:19.7962656Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2572 svchost.exe",12492,,," 2572 svchost.exe",,,,,,,,,,,,,1763581879796265600,18446633083989929984,18446633083989905408,140712899206080,0,140318752768,12492,140317556736,140317523968,140712899206080,58596122,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.7962861Z","2025-11-19 19:51:19.7962861Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2580 svchost.exe",1592,,," 2580 svchost.exe",,,,,,,,,,,,,1763581879796286100,18446633084006535168,18446633084006510592,140712899206080,0,139709349888,1592,139707613184,139707580416,140712899206080,432271,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.8593797Z","2025-11-19 19:51:19.8593797Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2688 svchost.exe",15088,,," 2688 svchost.exe",,,,,,,,,,,,,1763581879859379700,18446633084017565696,18446633084017541120,140712899206080,0,461861052416,15088,461859520512,461859487744,140712899206080,3639602,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.8593858Z","2025-11-19 19:51:19.8593858Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2824 svchost.exe",14692,,," 2824 svchost.exe",,,,,,,,,,,,,1763581879859385800,18446633084007337984,18446633084007313408,140712899206080,0,912958394368,14692,912960520192,912960487424,140712899206080,190109,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.8593878Z","2025-11-19 19:51:19.8593878Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2924 svchost.exe",15280,,," 2924 svchost.exe",,,,,,,,,,,,,1763581879859387800,18446633084053037056,18446633084053012480,140712899206080,0,22795169792,15280,22796566528,22796533760,140712899206080,320242,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.9394117Z","2025-11-19 19:51:19.9394117Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2724 svchost.exe",13784,,," 2724 svchost.exe",,,,,,,,,,,,,1763581879939411700,18446633084007624704,18446633084007600128,140712899206080,0,89489293312,13784,89490718720,89490685952,140712899206080,388516,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.9713021Z","2025-11-19 19:51:19.9713021Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3316 svchost.exe",15048,,," 3316 svchost.exe",,,,,,,,,,,,,1763581879971302100,18446633084007768064,18446633084007743488,140712899206080,0,725981220864,15048,725982642176,725982609408,140712899206080,116932,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.9713034Z","2025-11-19 19:51:19.9713034Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3256 svchost.exe",14068,,," 3256 svchost.exe",,,,,,,,,,,,,1763581879971303400,18446633084007653376,18446633084007628800,140712899206080,0,435930497024,14068,433793794048,433793761280,140712899206080,313453,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.9713095Z","2025-11-19 19:51:19.9713095Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3456 svchost.exe",11540,,," 3456 svchost.exe",,,,,,,,,,,,,1763581879971309500,18446633084007858176,18446633084007833600,140712899206080,0,94398496768,11540,94400151552,94400118784,140712899206080,179170,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.9713146Z","2025-11-19 19:51:19.9713146Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3000 svchost.exe",11392,,," 3000 svchost.exe",,,,,,,,,,,,,1763581879971314600,18446633084019789824,18446633084019765248,140712899206080,0,1014020698112,11392,1014021750784,1014021718016,140712899206080,198407,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.9713249Z","2025-11-19 19:51:19.9713249Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3532 svchost.exe",8628,,," 3532 svchost.exe",,,,,,,,,,,,,1763581879971324900,18446633083996078080,18446633083996053504,140712899206080,0,761505017856,8628,761506299904,761506267136,140712899206080,396438,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.0667475Z","2025-11-19 19:51:20.0667475Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3608 svchost.exe",13932,,," 3608 svchost.exe",,,,,,,,,,,,,1763581880066747500,18446633084007944192,18446633084007919616,140712899206080,0,310404599808,13932,310406807552,310406774784,140712899206080,237636,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.0667560Z","2025-11-19 19:51:20.0667560Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3740 svchost.exe",11332,,," 3740 svchost.exe",,,,,,,,,,,,,1763581880066756000,18446633083981160448,18446633083981135872,140712899206080,0,100414373888,11332,100416356352,100416323584,140712899206080,504693,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.0827302Z","2025-11-19 19:51:20.0827302Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 872 wininit.exe",,,,,,,,,,,,,1763581880082730200,18446633083981160448,18446633083981135872,140712899206080,0,97764483072,1924,97765556224,97765498880,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.2250627Z","2025-11-19 19:51:20.2250627Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4192 svchost.exe",7568,,," 4192 svchost.exe",,,,,,,,,,,,,1763581880225062700,18446633083979362304,18446633083979337728,140712899206080,0,330479362048,7568,330476748800,330476716032,140712899206080,297987,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.5099571Z","2025-11-19 19:51:20.5099571Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","12740 svchost.exe",14676,,,"12740 svchost.exe",,,,,,,,,,,,,1763581880509957100,18446633084011245568,18446633084011220992,140712899206080,9,237559373824,8312,237558366208,237558333440,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.5732911Z","2025-11-19 19:51:20.5732911Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1388 svchost.exe",,,,,,,,,,,,,1763581880573291100,18446633084043304960,18446633084043280384,140712899206080,0,867845025792,11356,867846062080,867846029312,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.5733821Z","2025-11-19 19:51:20.5733821Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1564 svchost.exe",,,,,,,,,,,,,1763581880573382100,18446633083995619328,18446633083995594752,140712899206080,0,86741536768,13068,86739845120,86739812352,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.5734717Z","2025-11-19 19:51:20.5734717Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1676 svchost.exe",,,,,,,,,,,,,1763581880573471700,18446633084006277120,18446633084006252544,140712899206080,0,289651171328,9168,289649328128,289649295360,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.5735685Z","2025-11-19 19:51:20.5735685Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1796 svchost.exe",,,,,,,,,,,,,1763581880573568500,18446633084007567360,18446633084007542784,140712899206080,0,708991619072,8208,708990205952,708990173184,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.5736152Z","2025-11-19 19:51:20.5736152Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1660 svchost.exe",,,,,,,,,,,,,1763581880573615200,18446633084046409728,18446633084046385152,140712899206080,0,265906413568,13016,265905373184,265905340416,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.5737346Z","2025-11-19 19:51:20.5737346Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1580 svchost.exe",,,,,,,,,,,,,1763581880573734600,18446633084041408512,18446633084041383936,140712899206080,0,966821441536,500,966823247872,966823215104,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.7004875Z","2025-11-19 19:51:20.7004875Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 2244 svchost.exe",,,,,,,,,,,,,1763581880700487500,18446633084042616832,18446633084042592256,140712899206080,0,927664209920,5500,927665225728,927665192960,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.7323852Z","2025-11-19 19:51:20.7323852Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 2384 svchost.exe",,,,,,,,,,,,,1763581880732385200,18446633084042645504,18446633084042620928,140712899206080,0,928822153216,12408,928820035584,928820002816,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.7964031Z","2025-11-19 19:51:20.7964031Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 2572 svchost.exe",,,,,,,,,,,,,1763581880796403100,18446633084042702848,18446633084042678272,140712899206080,0,140318842880,1864,140317556736,140317523968,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.7965326Z","2025-11-19 19:51:20.7965326Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 2580 svchost.exe",,,,,,,,,,,,,1763581880796532600,18446633084042731520,18446633084042706944,140712899206080,0,139709366272,11504,139707613184,139707580416,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.8746075Z","2025-11-19 19:51:20.8746075Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 2688 svchost.exe",,,,,,,,,,,,,1763581880874607500,18446633084043046912,18446633084043022336,140712899206080,0,461861085184,12512,461859520512,461859487744,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.8747287Z","2025-11-19 19:51:20.8747287Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 2824 svchost.exe",,,,,,,,,,,,,1763581880874728700,18446633084007624704,18446633084007600128,140712899206080,0,912958402560,4252,912960520192,912960487424,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.8748579Z","2025-11-19 19:51:20.8748579Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 2924 svchost.exe",,,,,,,,,,,,,1763581880874857900,18446633084007510016,18446633084007485440,140712899206080,0,22795177984,10452,22796566528,22796533760,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9540010Z","2025-11-19 19:51:20.9540010Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 2724 svchost.exe",,,,,,,,,,,,,1763581880954001000,18446633084043075584,18446633084043051008,140712899206080,0,89489301504,7700,89490718720,89490685952,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9624111Z","2025-11-19 19:51:20.9624111Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",5020,,," 5184 explorer.exe",,,,,,,,,,,,,1763581880962411100,18446633084043362304,18446633084043337728,140712891545280,0,15286272,5116,467664896,467607552,140712891545280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9698780Z","2025-11-19 19:51:20.9698780Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4608 svchost.exe",11692,,," 4608 svchost.exe",,,,,,,,,,,,,1763581880969878000,18446633084008919040,18446633084008894464,140712899206080,0,287385964544,11692,287387942912,287387910144,140712899206080,352306,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9763041Z","2025-11-19 19:51:20.9763041Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1040 svchost.exe",2280,,,"11956 smartscreen.exe",,,"C:\Windows\System32\smartscreen.exe",,,,,,,,,,1763581880976304100,,,,,,,,,,,,,664452,,419447766,,,,134080554805558624,,,,,3391,,,,,,0,"0x","","",1040,13,3,0,0,1 -"2025-11-19 19:51:20.9772717Z","2025-11-19 19:51:20.9772717Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",2280,,,"11956 smartscreen.exe",,,,,,,,,,,,,1763581880977271700,18446633084008919040,18446633084008894464,140696524147856,40,4299116544,12552,4295491584,4295483392,140696524147856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9789415Z","2025-11-19 19:51:20.9789415Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\smartscreen.exe",,,,,,,,,,1763581880978941500,,,,,,,,,,,140696524029952,140696524029952,664452,614400,419447766,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9789788Z","2025-11-19 19:51:20.9789788Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581880978978800,,,,,,,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9823811Z","2025-11-19 19:51:20.9823811Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581880982381100,,,,,,,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9825014Z","2025-11-19 19:51:20.9825014Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581880982501400,,,,,,,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9836941Z","2025-11-19 19:51:20.9836941Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581880983694100,,,,,,,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9837895Z","2025-11-19 19:51:20.9837895Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,,,,,,,,,,,1763581880983789500,18446633084042788864,18446633084042764288,140712899206080,0,4299124736,6108,4296015872,4296007680,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9838695Z","2025-11-19 19:51:20.9838695Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,1763581880983869500,,,,,,,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9840834Z","2025-11-19 19:51:20.9840834Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581880984083400,,,,,,,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9841934Z","2025-11-19 19:51:20.9841934Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,,,,,,,,,,,1763581880984193400,18446633084043190272,18446633084043165696,140712899206080,0,4299132928,6996,4296540160,4296531968,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9842740Z","2025-11-19 19:51:20.9842740Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,1763581880984274000,,,,,,,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9842847Z","2025-11-19 19:51:20.9842847Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,,,,,,,,,,,1763581880984284700,18446633084043247616,18446633084043223040,140712899206080,0,4299141120,204,4297064448,4297056256,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9844610Z","2025-11-19 19:51:20.9844610Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,1763581880984461000,,,,,,,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9846184Z","2025-11-19 19:51:20.9846184Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,1763581880984618400,,,,,,,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9847528Z","2025-11-19 19:51:20.9847528Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,"C:\Windows\System32\smartscreen.dll",,,,,,,,,,1763581880984752800,,,,,,,,,,,140712383414272,140712383414272,6028386,6057984,1751620389,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9847585Z","2025-11-19 19:51:20.9847585Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,1763581880984758500,,,,,,,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9849421Z","2025-11-19 19:51:20.9849421Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581880984942100,,,,,,,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9849424Z","2025-11-19 19:51:20.9849424Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,1763581880984942400,,,,,,,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9851390Z","2025-11-19 19:51:20.9851390Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581880985139000,,,,,,,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9851423Z","2025-11-19 19:51:20.9851423Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",204,,,"11956 smartscreen.exe",,,"C:\Windows\System32\winhttp.dll",,,,,,,,,,1763581880985142300,,,,,,,,,,,140712750350336,140712750350336,1261038,1212416,84984727,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9851960Z","2025-11-19 19:51:20.9851960Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581880985196000,,,,,,,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9854024Z","2025-11-19 19:51:20.9854024Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",204,,,"11956 smartscreen.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581880985402400,,,,,,,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9854512Z","2025-11-19 19:51:20.9854512Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581880985451200,,,,,,,,,,,1646826618880,1646826618880,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9854713Z","2025-11-19 19:51:20.9854713Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\crypt32.dll",,,,,,,,,,1763581880985471300,,,,,,,,,,,140712849768448,140712849768448,1584869,1536000,3438168074,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9855242Z","2025-11-19 19:51:20.9855242Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581880985524200,,,,,,,,,,,1646826618880,1646826618880,716301,692224,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9856395Z","2025-11-19 19:51:20.9856395Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,"C:\Windows\System32\ws2_32.dll",,,,,,,,,,1763581880985639500,,,,,,,,,,,140712881094656,140712881094656,513405,475136,3967481067,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9856905Z","2025-11-19 19:51:20.9856905Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,1763581880985690500,,,,,,,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9858908Z","2025-11-19 19:51:20.9858908Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",204,,,"11956 smartscreen.exe",,,"C:\Windows\System32\cryptsp.dll",,,,,,,,,,1763581880985890800,,,,,,,,,,,140712839217152,140712839217152,146168,110592,1658328178,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9859779Z","2025-11-19 19:51:20.9859779Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3316 svchost.exe",,,,,,,,,,,,,1763581880985977900,18446633084043276288,18446633084043251712,140712899206080,0,725981229056,5216,725982642176,725982609408,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9860302Z","2025-11-19 19:51:20.9860302Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,1763581880986030200,,,,,,,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9860717Z","2025-11-19 19:51:20.9860717Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3256 svchost.exe",,,,,,,,,,,,,1763581880986071700,18446633084043390976,18446633084043366400,140712899206080,0,435930505216,13464,433793794048,433793761280,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9861764Z","2025-11-19 19:51:20.9861764Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3000 svchost.exe",,,,,,,,,,,,,1763581880986176400,18446633084043476992,18446633084043452416,140712899206080,0,1014020706304,13692,1014021750784,1014021718016,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9862140Z","2025-11-19 19:51:20.9862140Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3456 svchost.exe",,,,,,,,,,,,,1763581880986214000,18446633084043538432,18446633084043513856,140712899206080,0,94398504960,12164,94400151552,94400118784,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9863024Z","2025-11-19 19:51:20.9863024Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3532 svchost.exe",,,,,,,,,,,,,1763581880986302400,18446633084043997184,18446633084043972608,140712899206080,0,761505026048,6444,761506299904,761506267136,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9864111Z","2025-11-19 19:51:20.9864111Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",204,,,"11956 smartscreen.exe",,,"C:\Windows\System32\dnsapi.dll",,,,,,,,,,1763581880986411100,,,,,,,,,,,140712824274944,140712824274944,1293169,1228800,1381219389,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9864222Z","2025-11-19 19:51:20.9864222Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,1763581880986422200,,,,,,,,,,,140712851341312,140712851341312,1524912,1486848,1404855129,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9866834Z","2025-11-19 19:51:20.9866834Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,"C:\Windows\System32\wintrust.dll",,,,,,,,,,1763581880986683400,,,,,,,,,,,140712860844032,140712860844032,590783,520192,452262045,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9867955Z","2025-11-19 19:51:20.9867955Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",204,,,"11956 smartscreen.exe",,,"C:\Windows\System32\IPHLPAPI.DLL",,,,,,,,,,1763581880986795500,,,,,,,,,,,140712824012800,140712824012800,233044,212992,945822897,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9869651Z","2025-11-19 19:51:20.9869651Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,"C:\Windows\System32\ole32.dll",,,,,,,,,,1763581880986965100,,,,,,,,,,,140712878473216,140712878473216,1689904,1667072,1018821057,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9890552Z","2025-11-19 19:51:20.9890552Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\nsi.dll",,,,,,,,,,1763581880989055200,,,,,,,,,,,140712892956672,140712892956672,111648,40960,4223476491,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9896219Z","2025-11-19 19:51:20.9896219Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,1763581880989621900,,,,,,,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9913559Z","2025-11-19 19:51:20.9913559Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\msasn1.dll",,,,,,,,,,1763581880991355900,,,,,,,,,,,140712839675904,140712839675904,150871,77824,2536054058,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9921028Z","2025-11-19 19:51:20.9921028Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,,,,,,,,,,,1763581880992102800,18446633084042960896,18446633084042936320,140712387241344,0,4299149312,5980,4299685888,4299677696,140712387241344,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9924315Z","2025-11-19 19:51:20.9924315Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",5980,,,"11956 smartscreen.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,1763581880992431500,,,,,,,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9928273Z","2025-11-19 19:51:20.9928273Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,1763581880992827300,,,,,,,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9932375Z","2025-11-19 19:51:20.9932375Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"11956 smartscreen.exe",,,,,,,,,,,,,1763581880993237500,18446633084044025856,18446633084044001280,140712899206080,0,4297064448,3708,4300210176,4300201984,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9935171Z","2025-11-19 19:51:20.9935171Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",3708,,,"11956 smartscreen.exe",,,"C:\Windows\System32\wtdsensor.dll",,,,,,,,,,1763581880993517100,,,,,,,,,,,140712681996288,140712681996288,56489,45056,4237415889,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9946637Z","2025-11-19 19:51:20.9946637Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,1763581880994663700,,,,,,,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9955563Z","2025-11-19 19:51:20.9955563Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,,,,,,,,,,,1763581880995556300,18446633084044054528,18446633084044029952,140712865112144,0,4297072640,2328,4300734464,4300726272,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9958285Z","2025-11-19 19:51:20.9958285Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11956 smartscreen.exe",3708,,,"11956 smartscreen.exe",,,,,,,,,,,,,1763581880995828500,18446633084044197888,18446633084044173312,140712899206080,0,4297080832,4856,4301258752,4301250560,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9975541Z","2025-11-19 19:51:20.9975541Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11956 smartscreen.exe",3708,,,"11956 smartscreen.exe",,,,,,,,,,,,,1763581880997554100,18446633084044255232,18446633084044230656,140712899206080,0,4297089024,11364,4301783040,4301774848,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9987968Z","2025-11-19 19:51:20.9987968Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",3708,,,"11956 smartscreen.exe",,,"C:\Windows\System32\smartscreenps.dll",,,,,,,,,,1763581880998796800,,,,,,,,,,,140712623865856,140712623865856,151429,122880,4089359051,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0003864Z","2025-11-19 19:51:21.0003864Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",3708,,,"11956 smartscreen.exe",,,"C:\Windows\System32\Windows.Management.Workplace.dll",,,,,,,,,,1763581881000386400,,,,,,,,,,,140712429879296,140712429879296,215437,204800,170946563,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0012539Z","2025-11-19 19:51:21.0012539Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",3708,,,"11956 smartscreen.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581881001253900,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0017586Z","2025-11-19 19:51:21.0017586Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11956 smartscreen.exe",3708,,,"11956 smartscreen.exe",,,,,,,,,,,,,1763581881001758600,18446633084044283904,18446633084044259328,140712387241344,0,4297097216,9852,4302307328,4302299136,140712387241344,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0413450Z","2025-11-19 19:51:21.0413450Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 5184 explorer.exe",5116,,," 3348 attack-589.exe",,,"C:\Users\Public\Downloads\attack-589.exe",,,,,,,,,,1763581881041345000,,,,,,,,,,,,,0,,1763491559,,,,134080554806144016,,,,,3392,,,,,,0,"0x","","",5184,140,3,0,0,1 -"2025-11-19 19:51:21.0443828Z","2025-11-19 19:51:21.0443828Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",5116,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581881044382800,18446633084044398592,18446633084044374016,140695599400816,0,289797906432,11212,289800192000,289800187904,140695599400816,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0471547Z","2025-11-19 19:51:21.0471547Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 5536 svchost.exe",,,,,,,,,,,,,1763581881047154700,18446633084043419648,18446633084043395072,140712899206080,0,151912587264,1300,151915069440,151915036672,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0473929Z","2025-11-19 19:51:21.0473929Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5536 svchost.exe",1300,,," 5536 svchost.exe",,,,,,,,,,,,,1763581881047392900,18446633084044513280,18446633084044488704,140712899206080,132,151912595456,7072,151915593728,151915560960,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0502108Z","2025-11-19 19:51:21.0502108Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5536 svchost.exe",1300,,," 5536 svchost.exe",,,"C:\Windows\System32\pcadm.dll",,,,,,,,,,1763581881050210800,,,,,,,,,,,140711755710464,140711755710464,249405,204800,3376468140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0503483Z","2025-11-19 19:51:21.0503483Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5536 svchost.exe",11248,,," 5536 svchost.exe",,,,,,,,,,,,,1763581881050348300,18446633084043161600,18446633084043137024,140712899206080,0,151912603648,1620,151916118016,151916085248,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0504664Z","2025-11-19 19:51:21.0504664Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5536 svchost.exe",1620,,," 5536 svchost.exe",,,,,,,,,,,,,1763581881050466400,18446633084044455936,18446633084044431360,140712899206080,0,151912611840,8960,151920836608,151920803840,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0505067Z","2025-11-19 19:51:21.0505067Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5536 svchost.exe",1300,,," 5536 svchost.exe",,,"C:\Windows\System32\wdi.dll",,,,,,,,,,1763581881050506700,,,,,,,,,,,140712669413376,140712669413376,172159,126976,589396027,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0505702Z","2025-11-19 19:51:21.0505702Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5536 svchost.exe",11248,,," 5536 svchost.exe",,,"C:\Windows\System32\pcacli.dll",,,,,,,,,,1763581881050570200,,,,,,,,,,,140712543977472,140712543977472,146563,102400,3048676746,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0506830Z","2025-11-19 19:51:21.0506830Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5536 svchost.exe",1620,,," 5536 svchost.exe",,,"C:\Windows\System32\aepic.dll",,,,,,,,,,1763581881050683000,,,,,,,,,,,140712428109824,140712428109824,641436,577536,321124434,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0509198Z","2025-11-19 19:51:21.0509198Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5536 svchost.exe",1300,,," 5536 svchost.exe",,,"C:\Windows\System32\mpr.dll",,,,,,,,,,1763581881050919800,,,,,,,,,,,140712737832960,140712737832960,203967,135168,2433114060,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0540458Z","2025-11-19 19:51:21.0540458Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5536 svchost.exe",1300,,," 5536 svchost.exe",,,"C:\Windows\System32\wdi.dll",,,,,,,,,,1763581881054045800,,,,,,,,,,,140712669413376,140712669413376,172159,139264,589396027,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0541183Z","2025-11-19 19:51:21.0541183Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5536 svchost.exe",1300,,," 5536 svchost.exe",,,"C:\Windows\System32\mpr.dll",,,,,,,,,,1763581881054118300,,,,,,,,,,,140712737832960,140712737832960,203967,147456,2433114060,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0541690Z","2025-11-19 19:51:21.0541690Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5536 svchost.exe",1300,,," 5536 svchost.exe",,,"C:\Windows\System32\pcacli.dll",,,,,,,,,,1763581881054169000,,,,,,,,,,,140712543977472,140712543977472,146563,114688,3048676746,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0542753Z","2025-11-19 19:51:21.0542753Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5536 svchost.exe",1300,,," 5536 svchost.exe",,,"C:\Windows\System32\aepic.dll",,,,,,,,,,1763581881054275300,,,,,,,,,,,140712428109824,140712428109824,641436,589824,321124434,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0543297Z","2025-11-19 19:51:21.0543297Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5536 svchost.exe",1300,,," 5536 svchost.exe",,,"C:\Windows\System32\pcadm.dll",,,,,,,,,,1763581881054329700,,,,,,,,,,,140711755710464,140711755710464,249405,217088,3376468140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0550224Z","2025-11-19 19:51:21.0550224Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Users\Public\Downloads\attack-589.exe",,,,,,,,,,1763581881055022400,,,,,,,,,,,140695599382528,140695599382528,0,53248,1763491559,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0550597Z","2025-11-19 19:51:21.0550597Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581881055059700,,,,,,,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0557966Z","2025-11-19 19:51:21.0557966Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581881055796600,,,,,,,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0559164Z","2025-11-19 19:51:21.0559164Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581881055916400,,,,,,,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0568214Z","2025-11-19 19:51:21.0568214Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 3348 attack-589.exe",11212,,," 3100 conhost.exe",,,"C:\Windows\System32\conhost.exe",,,,,,,,,,1763581881056821400,,,,,,,,,,,,,1035098,,2671108986,,,,134080554806283315,,,,,3393,,,,,,0,"0x","","",3348,3392,3,0,0,1 -"2025-11-19 19:51:21.0581639Z","2025-11-19 19:51:21.0581639Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3348 attack-589.exe",11212,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881058163900,18446633084006535168,18446633084006510592,140696384751904,0,1013857710080,13484,1013860270080,1013860261888,140696384751904,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0582474Z","2025-11-19 19:51:21.0582474Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",13484,,," 3100 conhost.exe",,,"C:\Windows\System32\conhost.exe",,,,,,,,,,1763581881058247400,,,,,,,,,,,140696384438272,140696384438272,1035098,1028096,2671108986,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0582687Z","2025-11-19 19:51:21.0582687Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",13484,,," 3100 conhost.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581881058268700,,,,,,,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0588502Z","2025-11-19 19:51:21.0588502Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",13484,,," 3100 conhost.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581881058850200,,,,,,,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0589666Z","2025-11-19 19:51:21.0589666Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",13484,,," 3100 conhost.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581881058966600,,,,,,,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0601426Z","2025-11-19 19:51:21.0601426Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",13484,,," 3100 conhost.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581881060142600,,,,,,,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0602700Z","2025-11-19 19:51:21.0602700Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",13484,,," 3100 conhost.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581881060270000,,,,,,,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0603778Z","2025-11-19 19:51:21.0603778Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3100 conhost.exe",13484,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881060377800,18446633084044943360,18446633084044918784,140712899206080,0,1013857718272,4844,1013860794368,1013860786176,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0604718Z","2025-11-19 19:51:21.0604718Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3100 conhost.exe",4844,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881060471800,18446633084044570624,18446633084044546048,140712899206080,0,1013857726464,11404,1013861318656,1013861310464,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0611900Z","2025-11-19 19:51:21.0611900Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",13484,,," 3100 conhost.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581881061190000,,,,,,,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0613159Z","2025-11-19 19:51:21.0613159Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",13484,,," 3100 conhost.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581881061315900,,,,,,,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0614814Z","2025-11-19 19:51:21.0614814Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",13484,,," 3100 conhost.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581881061481400,,,,,,,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0616334Z","2025-11-19 19:51:21.0616334Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",13484,,," 3100 conhost.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581881061633400,,,,,,,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0622388Z","2025-11-19 19:51:21.0622388Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",13484,,," 3100 conhost.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,1763581881062238800,,,,,,,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0623650Z","2025-11-19 19:51:21.0623650Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",13484,,," 3100 conhost.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,1763581881062365000,,,,,,,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0624923Z","2025-11-19 19:51:21.0624923Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",13484,,," 3100 conhost.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,1763581881062492300,,,,,,,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0626266Z","2025-11-19 19:51:21.0626266Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",13484,,," 3100 conhost.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,1763581881062626600,,,,,,,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0631789Z","2025-11-19 19:51:21.0631789Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",13484,,," 3100 conhost.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,1763581881063178900,,,,,,,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0649429Z","2025-11-19 19:51:21.0649429Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3100 conhost.exe",13484,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881064942900,18446633084044627968,18446633084044603392,140696384580832,0,1013857734656,6724,1013861842944,1013861834752,140696384580832,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0650293Z","2025-11-19 19:51:21.0650293Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3100 conhost.exe",11404,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881065029300,18446633084044570624,18446633084044546048,140712899206080,0,1013857726464,11404,1013861318656,1013861310464,140712899206080,1647609,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0650435Z","2025-11-19 19:51:21.0650435Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3100 conhost.exe",4844,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881065043500,18446633084044943360,18446633084044918784,140712899206080,0,1013857718272,4844,1013860794368,1013860786176,140712899206080,754023,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0651883Z","2025-11-19 19:51:21.0651883Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3100 conhost.exe",13484,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881065188400,18446633084006535168,18446633084006510592,140696384751904,0,1013857710080,13484,1013860270080,1013860253696,140696384751904,23804713,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0651943Z","2025-11-19 19:51:21.0651943Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",6724,,," 3100 conhost.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,1763581881065194300,,,,,,,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0654850Z","2025-11-19 19:51:21.0654850Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3100 conhost.exe",6724,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881065485000,18446633084006535168,18446633084006510592,140712899206080,0,1013857742848,4376,1013860270080,1013860261888,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0663851Z","2025-11-19 19:51:21.0663851Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",6724,,," 3100 conhost.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,1763581881066385100,,,,,,,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0666224Z","2025-11-19 19:51:21.0666224Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",6724,,," 3100 conhost.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,1763581881066622400,,,,,,,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0670806Z","2025-11-19 19:51:21.0670806Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",6724,,," 3100 conhost.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,1763581881067080600,,,,,,,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0678039Z","2025-11-19 19:51:21.0678039Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",6724,,," 3100 conhost.exe",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,1763581881067803900,,,,,,,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0707449Z","2025-11-19 19:51:21.0707449Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3100 conhost.exe",6724,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881070744900,18446633084044943360,18446633084044918784,140712865112144,0,1013857751040,2976,1013860794368,1013860786176,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0709822Z","2025-11-19 19:51:21.0709822Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881070982200,18446633084044656640,18446633084044632064,140712899206080,0,1013857759232,9260,1013861318656,1013861310464,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0711453Z","2025-11-19 19:51:21.0711453Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3100 conhost.exe",9260,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881071145300,18446633084044828672,18446633084044804096,140712899206080,0,1013857767424,1400,1013862367232,1013862359040,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0809895Z","2025-11-19 19:51:21.0809895Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3608 svchost.exe",,,,,,,,,,,,,1763581881080989500,18446633084044972032,18446633084044947456,140712899206080,0,310404608000,2980,310406807552,310406774784,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0810351Z","2025-11-19 19:51:21.0810351Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3740 svchost.exe",,,,,,,,,,,,,1763581881081035100,18446633084045029376,18446633084045004800,140712899206080,0,100414390272,14328,100416356352,100416323584,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0819304Z","2025-11-19 19:51:21.0819304Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1040 svchost.exe",2280,,,"13828 OpenConsole.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\OpenConsole.exe",,,,,,,,,,1763581881081930400,,,,,,,,,,,,,1210794,,1759975785,,,,134080554806509408,,,,,3394,,,,,,3,"0x","Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe","App",1040,13,3,0,0,1 -"2025-11-19 19:51:21.0828506Z","2025-11-19 19:51:21.0828506Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",2280,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881082850600,18446633084045201408,18446633084045176832,140702989817872,40,132813885440,4736,132815781888,132815777792,140702989817872,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0854337Z","2025-11-19 19:51:21.0854337Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\OpenConsole.exe",,,,,,,,,,1763581881085433700,,,,,,,,,,,140702989025280,140702989025280,1210794,1159168,1759975785,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0854753Z","2025-11-19 19:51:21.0854753Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581881085475300,,,,,,,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0893306Z","2025-11-19 19:51:21.0893306Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581881089330600,,,,,,,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0894603Z","2025-11-19 19:51:21.0894603Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581881089460300,,,,,,,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0907756Z","2025-11-19 19:51:21.0907756Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,1763581881090775600,,,,,,,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0909113Z","2025-11-19 19:51:21.0909113Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581881090911300,,,,,,,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0910041Z","2025-11-19 19:51:21.0910041Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881091004200,18446633084045402112,18446633084045377536,140712899206080,0,132813893632,14136,132816830464,132816826368,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0910719Z","2025-11-19 19:51:21.0910719Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581881091071900,,,,,,,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0912384Z","2025-11-19 19:51:21.0912384Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881091238400,18446633084045430784,18446633084045406208,140712899206080,0,132813901824,12136,132817879040,132817874944,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0913154Z","2025-11-19 19:51:21.0913154Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,1763581881091315500,,,,,,,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0913292Z","2025-11-19 19:51:21.0913292Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13828 OpenConsole.exe",12136,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881091329200,18446633084045807616,18446633084045783040,140712899206080,0,132813910016,1824,132818927616,132818923520,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0914877Z","2025-11-19 19:51:21.0914877Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581881091487800,,,,,,,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0916535Z","2025-11-19 19:51:21.0916535Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",12136,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\UIAutomationCore.dll",,,,,,,,,,1763581881091653500,,,,,,,,,,,140712432762880,140712432762880,4328257,4296704,2096711852,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0916829Z","2025-11-19 19:51:21.0916829Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,1763581881091682900,,,,,,,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0919373Z","2025-11-19 19:51:21.0919373Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,1763581881091937300,,,,,,,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0921223Z","2025-11-19 19:51:21.0921223Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,1763581881092122400,,,,,,,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0922357Z","2025-11-19 19:51:21.0922357Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,1763581881092235700,,,,,,,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0923469Z","2025-11-19 19:51:21.0923469Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,1763581881092346900,,,,,,,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0924867Z","2025-11-19 19:51:21.0924867Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581881092486800,,,,,,,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0926696Z","2025-11-19 19:51:21.0926696Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581881092669600,,,,,,,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0927800Z","2025-11-19 19:51:21.0927800Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",12136,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\windows.storage.dll",,,,,,,,,,1763581881092780000,,,,,,,,,,,140712812412928,140712812412928,8877403,8769536,3667346596,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0928599Z","2025-11-19 19:51:21.0928599Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581881092859900,,,,,,,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0929362Z","2025-11-19 19:51:21.0929362Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",1824,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\propsys.dll",,,,,,,,,,1763581881092936200,,,,,,,,,,,140712761491456,140712761491456,1123662,1060864,3228732737,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0931622Z","2025-11-19 19:51:21.0931622Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,1763581881093162200,,,,,,,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0934193Z","2025-11-19 19:51:21.0934193Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,1763581881093419300,,,,,,,,,,,140712851341312,140712851341312,1524912,1486848,1404855129,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0935568Z","2025-11-19 19:51:21.0935568Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,1763581881093556800,,,,,,,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0938215Z","2025-11-19 19:51:21.0938215Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",1824,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\winmm.dll",,,,,,,,,,1763581881093821500,,,,,,,,,,,140712663842816,140712663842816,263815,217088,2106743460,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0940906Z","2025-11-19 19:51:21.0940906Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\d2d1.dll",,,,,,,,,,1763581881094090600,,,,,,,,,,,140712777744384,140712777744384,6610469,6537216,3013069957,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0941664Z","2025-11-19 19:51:21.0941664Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",12136,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\DWrite.dll",,,,,,,,,,1763581881094166400,,,,,,,,,,,140712784297984,140712784297984,2543119,2519040,1462185185,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0942448Z","2025-11-19 19:51:21.0942448Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",1824,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\dxgi.dll",,,,,,,,,,1763581881094244800,,,,,,,,,,,140712803631104,140712803631104,1320096,1282048,1861212996,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0943214Z","2025-11-19 19:51:21.0943214Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",14136,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\usp10.dll",,,,,,,,,,1763581881094321400,,,,,,,,,,,140711462174720,140711462174720,161304,102400,728066498,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0947967Z","2025-11-19 19:51:21.0947967Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",14136,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\powrprof.dll",,,,,,,,,,1763581881094796700,,,,,,,,,,,140712848195584,140712848195584,457799,385024,2858637235,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0947970Z","2025-11-19 19:51:21.0947970Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",1824,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\D3DCompiler_47.dll",,,,,,,,,,1763581881094797000,,,,,,,,,,,140712769814528,140712769814528,4685395,4714496,796813953,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0948030Z","2025-11-19 19:51:21.0948030Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\d3d11.dll",,,,,,,,,,1763581881094803000,,,,,,,,,,,140712786853888,140712786853888,2582658,2498560,2128032819,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0951898Z","2025-11-19 19:51:21.0951898Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\cryptsp.dll",,,,,,,,,,1763581881095189800,,,,,,,,,,,140712839217152,140712839217152,146168,110592,1658328178,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0994629Z","2025-11-19 19:51:21.0994629Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,1763581881099462900,,,,,,,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0999599Z","2025-11-19 19:51:21.0999599Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\umpdc.dll",,,,,,,,,,1763581881099960000,,,,,,,,,,,140712848064512,140712848064512,98535,81920,1714427184,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1016003Z","2025-11-19 19:51:21.1016003Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,1763581881101600400,,,,,,,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1020667Z","2025-11-19 19:51:21.1020667Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,1763581881102066700,,,,,,,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1028095Z","2025-11-19 19:51:21.1028095Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,1763581881102809500,,,,,,,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1063298Z","2025-11-19 19:51:21.1063298Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881106329800,18446633084045864960,18446633084045840384,140712865112144,0,132813918208,13020,132819976192,132819968000,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1065155Z","2025-11-19 19:51:21.1065155Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881106515500,18446633084045922304,18446633084045897728,140712899206080,0,132813926400,5064,132821024768,132821020672,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1066984Z","2025-11-19 19:51:21.1066984Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13828 OpenConsole.exe",5064,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881106698400,18446633084045950976,18446633084045926400,140712899206080,0,132813934592,2364,132822073344,132822069248,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1144974Z","2025-11-19 19:51:21.1144974Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",2364,,,"13828 OpenConsole.exe",,,"C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\PackagedCom\OpenConsoleProxy.dll",,,,,,,,,,1763581881114497400,,,,,,,,,,,140712723349504,140712723349504,51292,53248,1759975238,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1167784Z","2025-11-19 19:51:21.1167784Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",6724,,," 3100 conhost.exe",,,"C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\PackagedCom\OpenConsoleProxy.dll",,,,,,,,,,1763581881116778400,,,,,,,,,,,140712723349504,140712723349504,51292,53248,1759975238,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1171911Z","2025-11-19 19:51:21.1171911Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",6724,,," 3100 conhost.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,1763581881117191100,,,,,,,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1341345Z","2025-11-19 19:51:21.1341345Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1040 svchost.exe",2280,,," 2344 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe",,,,,,,,,,1763581881134134500,,,,,,,,,,,,,738129,,1759975821,,,,134080554806979193,,,,,3395,,,,,,3,"0x","Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe","App",1040,13,3,0,0,1 -"2025-11-19 19:51:21.1352167Z","2025-11-19 19:51:21.1352167Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",2280,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881135216700,18446633084046352384,18446633084046327808,140702319920256,40,1068179636224,5964,1068177817600,1068177813504,140702319920256,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1380470Z","2025-11-19 19:51:21.1380470Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe",,,,,,,,,,1763581881138047000,,,,,,,,,,,140702319640576,140702319640576,738129,684032,1759975821,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1381031Z","2025-11-19 19:51:21.1381031Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581881138103100,,,,,,,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1471912Z","2025-11-19 19:51:21.1471912Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581881147191200,,,,,,,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1473790Z","2025-11-19 19:51:21.1473790Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581881147379000,,,,,,,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1487993Z","2025-11-19 19:51:21.1487993Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881148799300,18446633084046610432,18446633084046585856,140712899206080,0,1068179644416,11152,1068181225472,1068181221376,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1488621Z","2025-11-19 19:51:21.1488621Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,1763581881148862100,,,,,,,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1490680Z","2025-11-19 19:51:21.1490680Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,1763581881149068000,,,,,,,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1490864Z","2025-11-19 19:51:21.1490864Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",11152,,," 2344 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\TerminalThemeHelpers.dll",,,,,,,,,,1763581881149086400,,,,,,,,,,,140712799895552,140712799895552,93641,61440,1754949712,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1491777Z","2025-11-19 19:51:21.1491777Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881149177700,18446633084046667776,18446633084046643200,140712899206080,0,1068179652608,4348,1068182274048,1068182269952,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1492781Z","2025-11-19 19:51:21.1492781Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,1763581881149278100,,,,,,,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1494533Z","2025-11-19 19:51:21.1494533Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,1763581881149453300,,,,,,,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1496294Z","2025-11-19 19:51:21.1496294Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581881149629400,,,,,,,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1497795Z","2025-11-19 19:51:21.1497795Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581881149779500,,,,,,,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1499435Z","2025-11-19 19:51:21.1499435Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",4348,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881149943500,18446633084046725120,18446633084046700544,140712899206080,0,1068179660800,12024,1068183322624,1068183318528,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1499725Z","2025-11-19 19:51:21.1499725Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,1763581881149972500,,,,,,,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1502065Z","2025-11-19 19:51:21.1502065Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,1763581881150206500,,,,,,,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1504417Z","2025-11-19 19:51:21.1504417Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",11152,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,1763581881150441800,,,,,,,,,,,3023123251200,3023123251200,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1504672Z","2025-11-19 19:51:21.1504672Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581881150467200,,,,,,,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1505520Z","2025-11-19 19:51:21.1505520Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",11152,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,1763581881150552000,,,,,,,,,,,3023123251200,3023123251200,3798760,3727360,2772520021,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1507224Z","2025-11-19 19:51:21.1507224Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,1763581881150722400,,,,,,,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1508978Z","2025-11-19 19:51:21.1508978Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",4348,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,1763581881150897800,,,,,,,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1510182Z","2025-11-19 19:51:21.1510182Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,1763581881151018200,,,,,,,,,,,140712851341312,140712851341312,1524912,1486848,1404855129,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1510625Z","2025-11-19 19:51:21.1510625Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",11152,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\dwmapi.dll",,,,,,,,,,1763581881151062500,,,,,,,,,,,140712805072896,140712805072896,203843,196608,2709117439,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1512242Z","2025-11-19 19:51:21.1512242Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",4348,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581881151224200,,,,,,,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1512747Z","2025-11-19 19:51:21.1512747Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,1763581881151274800,,,,,,,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1514654Z","2025-11-19 19:51:21.1514654Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",12024,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\uxtheme.dll",,,,,,,,,,1763581881151465400,,,,,,,,,,,140712802254848,140712802254848,696534,696320,1695798817,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1531731Z","2025-11-19 19:51:21.1531731Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,1763581881153173100,,,,,,,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1559010Z","2025-11-19 19:51:21.1559010Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,1763581881155901000,,,,,,,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1572477Z","2025-11-19 19:51:21.1572477Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,1763581881157247700,,,,,,,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1577376Z","2025-11-19 19:51:21.1577376Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581881157737600,,,,,,,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1585992Z","2025-11-19 19:51:21.1585992Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,1763581881158599200,,,,,,,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1598069Z","2025-11-19 19:51:21.1598069Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\TerminalApp.dll",,,,,,,,,,1763581881159806900,,,,,,,,,,,140712379940864,140712379940864,3444084,3444736,1759975751,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1599235Z","2025-11-19 19:51:21.1599235Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\ole32.dll",,,,,,,,,,1763581881159923500,,,,,,,,,,,140712878473216,140712878473216,1689904,1667072,1018821057,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1601943Z","2025-11-19 19:51:21.1601943Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",11152,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\winmm.dll",,,,,,,,,,1763581881160194300,,,,,,,,,,,140712663842816,140712663842816,263815,217088,2106743460,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1611402Z","2025-11-19 19:51:21.1611402Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.UI.Xaml.dll",,,,,,,,,,1763581881161140300,,,,,,,,,,,140712596865024,140712596865024,17882163,17858560,706442395,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1626116Z","2025-11-19 19:51:21.1626116Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\twinapi.appcore.dll",,,,,,,,,,1763581881162611600,,,,,,,,,,,140712720924672,140712720924672,2401519,2375680,2646458233,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1630475Z","2025-11-19 19:51:21.1630475Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881163047500,18446633084042817536,18446633084042792960,140712899206080,0,1068179668992,14844,1068184371200,1068184367104,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1658291Z","2025-11-19 19:51:21.1658291Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881165829100,18446633084046983168,18446633084046958592,140712865112144,0,1068179677184,11108,1068185419776,1068185411584,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1661013Z","2025-11-19 19:51:21.1661013Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",14844,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881166101300,18446633084047183872,18446633084047159296,140712899206080,0,1068179685376,8404,1068186468352,1068186464256,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1676192Z","2025-11-19 19:51:21.1676192Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\OneCoreUAPCommonProxyStub.dll",,,,,,,,,,1763581881167619200,,,,,,,,,,,140712713977856,140712713977856,6740758,6615040,2011948997,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1702039Z","2025-11-19 19:51:21.1702039Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\Microsoft.Terminal.Control.dll",,,,,,,,,,1763581881170203900,,,,,,,,,,,140712377909248,140712377909248,1976337,1986560,1759975378,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1705635Z","2025-11-19 19:51:21.1705635Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",12024,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\UIAutomationCore.dll",,,,,,,,,,1763581881170563500,,,,,,,,,,,140712432762880,140712432762880,4328257,4296704,2096711852,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1705724Z","2025-11-19 19:51:21.1705724Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\d2d1.dll",,,,,,,,,,1763581881170572400,,,,,,,,,,,140712777744384,140712777744384,6610469,6537216,3013069957,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1708295Z","2025-11-19 19:51:21.1708295Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",11152,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\DWrite.dll",,,,,,,,,,1763581881170829500,,,,,,,,,,,140712784297984,140712784297984,2543119,2519040,1462185185,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1708432Z","2025-11-19 19:51:21.1708432Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",4348,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\UIAutomationCore.dll",,,,,,,,,,1763581881170843200,,,,,,,,,,,3023127773184,3023127773184,4328257,4296704,2096711852,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1709961Z","2025-11-19 19:51:21.1709961Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",4348,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\UIAutomationCore.dll",,,,,,,,,,1763581881170996200,,,,,,,,,,,3023127773184,3023127773184,4328257,4308992,2096711852,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1710897Z","2025-11-19 19:51:21.1710897Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\dxgi.dll",,,,,,,,,,1763581881171089800,,,,,,,,,,,140712803631104,140712803631104,1320096,1282048,1861212996,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1714438Z","2025-11-19 19:51:21.1714438Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",4348,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\D3DCompiler_47.dll",,,,,,,,,,1763581881171443800,,,,,,,,,,,140712769814528,140712769814528,4685395,4714496,796813953,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1714596Z","2025-11-19 19:51:21.1714596Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\powrprof.dll",,,,,,,,,,1763581881171459600,,,,,,,,,,,140712848195584,140712848195584,457799,385024,2858637235,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1715518Z","2025-11-19 19:51:21.1715518Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",12024,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\d3d11.dll",,,,,,,,,,1763581881171551800,,,,,,,,,,,140712786853888,140712786853888,2582658,2498560,2128032819,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1718598Z","2025-11-19 19:51:21.1718598Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\cryptsp.dll",,,,,,,,,,1763581881171859800,,,,,,,,,,,140712839217152,140712839217152,146168,110592,1658328178,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1730632Z","2025-11-19 19:51:21.1730632Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\umpdc.dll",,,,,,,,,,1763581881173063200,,,,,,,,,,,140712848064512,140712848064512,98535,81920,1714427184,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1755023Z","2025-11-19 19:51:21.1755023Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.8_8.2501.31001.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.dll",,,,,,,,,,1763581881175502300,,,,,,,,,,,140712372011008,140712372011008,5866761,5873664,2056920596,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1762729Z","2025-11-19 19:51:21.1762729Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\CoreMessaging.dll",,,,,,,,,,1763581881176272900,,,,,,,,,,,140712796160000,140712796160000,1232710,1208320,2155847221,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1769292Z","2025-11-19 19:51:21.1769292Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.UI.dll",,,,,,,,,,1763581881176929200,,,,,,,,,,,140712615346176,140712615346176,1414164,1376256,3301850593,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1778568Z","2025-11-19 19:51:21.1778568Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\InputHost.dll",,,,,,,,,,1763581881177856800,,,,,,,,,,,140712583757824,140712583757824,1989124,1970176,2937052880,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1793178Z","2025-11-19 19:51:21.1793178Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581881179317800,,,,,,,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1797227Z","2025-11-19 19:51:21.1797227Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\cryptbase.dll",,,,,,,,,,1763581881179722700,,,,,,,,,,,140712839348224,140712839348224,63718,49152,3897879906,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1819086Z","2025-11-19 19:51:21.1819086Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\msctf.dll",,,,,,,,,,1763581881181908600,,,,,,,,,,,140712893022208,140712893022208,1455420,1433600,4155718050,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1867074Z","2025-11-19 19:51:21.1867074Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\UiaManager.dll",,,,,,,,,,1763581881186707400,,,,,,,,,,,140712461205504,140712461205504,941078,897024,2628067039,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1916998Z","2025-11-19 19:51:21.1916998Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881191699800,18446633084045144064,18446633084045119488,140712891292720,0,1068179693568,6876,1068187516928,1068187512832,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1922859Z","2025-11-19 19:51:21.1922859Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\WindowManagementAPI.dll",,,,,,,,,,1763581881192285900,,,,,,,,,,,140712738422784,140712738422784,1825044,1794048,1605274449,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1936303Z","2025-11-19 19:51:21.1936303Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\urlmon.dll",,,,,,,,,,1763581881193630300,,,,,,,,,,,140712669609984,140712669609984,1970671,1957888,260716450,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1939425Z","2025-11-19 19:51:21.1939425Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",12024,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\windows.storage.dll",,,,,,,,,,1763581881193942500,,,,,,,,,,,140712812412928,140712812412928,8877403,8769536,3667346596,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1939631Z","2025-11-19 19:51:21.1939631Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",4348,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\iertutil.dll",,,,,,,,,,1763581881193963100,,,,,,,,,,,140712642805760,140712642805760,2984761,2904064,3815768453,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1944076Z","2025-11-19 19:51:21.1944076Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",4348,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\srvcli.dll",,,,,,,,,,1763581881194407600,,,,,,,,,,,140712668954624,140712668954624,181029,167936,239922031,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1945330Z","2025-11-19 19:51:21.1945330Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",12024,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\netutils.dll",,,,,,,,,,1763581881194533100,,,,,,,,,,,140712825847808,140712825847808,80696,53248,865845000,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1962029Z","2025-11-19 19:51:21.1962029Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3204 Taskmgr.exe",5876,,," 3204 Taskmgr.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,1763581881196202900,,,,,,,,,,,140712479096832,140712479096832,1613415,1552384,2231457550,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1967609Z","2025-11-19 19:51:21.1967609Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3204 Taskmgr.exe",5876,,," 3204 Taskmgr.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,1763581881196760900,,,,,,,,,,,140712479096832,140712479096832,1613415,1564672,2231457550,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1974505Z","2025-11-19 19:51:21.1974505Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3204 Taskmgr.exe",5876,,," 3204 Taskmgr.exe",,,,,,,,,,,,,1763581881197450500,18446633084047499264,18446633084047474688,140712891292720,0,552496058368,11128,552502034432,552502026240,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1977017Z","2025-11-19 19:51:21.1977017Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881197701700,18446633084047642624,18446633084047618048,140712600145104,0,1068179701760,13936,1068188565504,1068188561408,140712600145104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1977569Z","2025-11-19 19:51:21.1977569Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881197756900,18446633084047790080,18446633084047765504,140712604173856,0,1068179709952,10116,1068189614080,1068189609984,140712604173856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1983622Z","2025-11-19 19:51:21.1983622Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",13936,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\DXCore.dll",,,,,,,,,,1763581881198362200,,,,,,,,,,,140712805400576,140712805400576,331386,274432,2354081039,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1990409Z","2025-11-19 19:51:21.1990409Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",13936,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\ResourcePolicyClient.dll",,,,,,,,,,1763581881199040900,,,,,,,,,,,140712809070592,140712809070592,104020,81920,2069163340,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2005198Z","2025-11-19 19:51:21.2005198Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",13936,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\ResourcePolicyClient.dll",,,,,,,,,,1763581881200519800,,,,,,,,,,,140712809070592,140712809070592,104020,94208,2069163340,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2007046Z","2025-11-19 19:51:21.2007046Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",13936,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\directxdatabasehelper.dll",,,,,,,,,,1763581881200704600,,,,,,,,,,,140712752709632,140712752709632,426573,405504,145563491,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2012776Z","2025-11-19 19:51:21.2012776Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\MrmCoreR.dll",,,,,,,,,,1763581881201277600,,,,,,,,,,,140712631926784,140712631926784,1191374,1146880,1078870765,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2017644Z","2025-11-19 19:51:21.2017644Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",13936,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\cfgmgr32.dll",,,,,,,,,,1763581881201764400,,,,,,,,,,,140712845049856,140712845049856,385808,356352,1737777300,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2022307Z","2025-11-19 19:51:21.2022307Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.StateRepositoryClient.dll",,,,,,,,,,1763581881202230700,,,,,,,,,,,140712696610816,140712696610816,303673,290816,424989122,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2066625Z","2025-11-19 19:51:21.2066625Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",13936,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\d3d10warp.dll",,,,,,,,,,1763581881206662500,,,,,,,,,,,140712731869184,140712731869184,5958575,5943296,1147803111,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2073443Z","2025-11-19 19:51:21.2073443Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\profapi.dll",,,,,,,,,,1763581881207344300,,,,,,,,,,,140712848850944,140712848850944,229548,167936,2447194521,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2082263Z","2025-11-19 19:51:21.2082263Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\dcomp.dll",,,,,,,,,,1763581881208226300,,,,,,,,,,,140712789409792,140712789409792,2309196,2240512,1200801128,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2087632Z","2025-11-19 19:51:21.2087632Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",11152,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Microsoft.Internal.WarpPal.dll",,,,,,,,,,1763581881208763200,,,,,,,,,,,140712769683456,140712769683456,167600,102400,2132685858,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2101600Z","2025-11-19 19:51:21.2101600Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\BCP47mrm.dll",,,,,,,,,,1763581881210160000,,,,,,,,,,,140712628322304,140712628322304,278903,212992,835504572,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2114197Z","2025-11-19 19:51:21.2114197Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",13936,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\TextShaping.dll",,,,,,,,,,1763581881211419700,,,,,,,,,,,140712585789440,140712585789440,770155,733184,2109619091,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2126399Z","2025-11-19 19:51:21.2126399Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",13936,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881212639900,18446633084047642624,18446633084047618048,140712600145104,0,1068179701760,13936,1068188565504,1068188536832,140712600145104,46394848,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2137996Z","2025-11-19 19:51:21.2137996Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881213799600,18446633084047642624,18446633084047618048,140712632221632,0,1068179718144,14500,1068188565504,1068188561408,140712632221632,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2168053Z","2025-11-19 19:51:21.2168053Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3204 Taskmgr.exe",5876,,," 3204 Taskmgr.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,1763581881216805300,,,,,,,,,,,140712479096832,140712479096832,1613415,1552384,2231457550,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2172665Z","2025-11-19 19:51:21.2172665Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3204 Taskmgr.exe",5876,,," 3204 Taskmgr.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,1763581881217266500,,,,,,,,,,,140712479096832,140712479096832,1613415,1564672,2231457550,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2232174Z","2025-11-19 19:51:21.2232174Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.UI.Xaml.Controls.dll",,,,,,,,,,1763581881223217400,,,,,,,,,,,140712586575872,140712586575872,3327252,3313664,3689468694,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2321711Z","2025-11-19 19:51:21.2321711Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.UI.Immersive.dll",,,,,,,,,,1763581881232171100,,,,,,,,,,,140712595423232,140712595423232,1424120,1372160,1559948871,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2338460Z","2025-11-19 19:51:21.2338460Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\DataExchange.dll",,,,,,,,,,1763581881233846000,,,,,,,,,,,140712406614016,140712406614016,399312,368640,696309968,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2359517Z","2025-11-19 19:51:21.2359517Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.ApplicationModel.dll",,,,,,,,,,1763581881235951700,,,,,,,,,,,140712508391424,140712508391424,945679,876544,2857312343,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2392977Z","2025-11-19 19:51:21.2392977Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\Microsoft.Terminal.Settings.Model.dll",,,,,,,,,,1763581881239297700,,,,,,,,,,,140709601476608,140709601476608,2281369,2252800,1759975487,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2395714Z","2025-11-19 19:51:21.2395714Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",4348,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\ntmarta.dll",,,,,,,,,,1763581881239571400,,,,,,,,,,,140712831811584,140712831811584,265798,221184,3598506564,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2398560Z","2025-11-19 19:51:21.2398560Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",12024,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\bcrypt.dll",,,,,,,,,,1763581881239856000,,,,,,,,,,,140712848654336,140712848654336,206048,172032,2893678010,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2399243Z","2025-11-19 19:51:21.2399243Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 4192 svchost.exe",,,,,,,,,,,,,1763581881239924300,18446633084047818752,18446633084047794176,140712899206080,0,330479370240,10680,330476748800,330476716032,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2412638Z","2025-11-19 19:51:21.2412638Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\shlwapi.dll",,,,,,,,,,1763581881241263800,,,,,,,,,,,140712868839424,140712868839424,479562,421888,2142510382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2476772Z","2025-11-19 19:51:21.2476772Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\TerminalConnection.dll",,,,,,,,,,1763581881247677200,,,,,,,,,,,140712371486720,140712371486720,522798,495616,1759975254,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2480478Z","2025-11-19 19:51:21.2480478Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",4348,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\winhttp.dll",,,,,,,,,,1763581881248047800,,,,,,,,,,,140712750350336,140712750350336,1261038,1212416,84984727,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2496031Z","2025-11-19 19:51:21.2496031Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\ProgramData\Microsoft\VisualStudio\Setup\x64\Microsoft.VisualStudio.Setup.Configuration.Native.dll",,,,,,,,,,1763581881249603100,,,,,,,,,,,140711212089344,140711212089344,1007466,1015808,1726088073,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2532698Z","2025-11-19 19:51:21.2532698Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\AppExtension.dll",,,,,,,,,,1763581881253269800,,,,,,,,,,,140712467365888,140712467365888,337294,299008,1656953249,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2562964Z","2025-11-19 19:51:21.2562964Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",6876,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.StateRepositoryPS.dll",,,,,,,,,,1763581881256296400,,,,,,,,,,,140712490369024,140712490369024,879719,802816,374042279,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2604808Z","2025-11-19 19:51:21.2604808Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.Globalization.dll",,,,,,,,,,1763581881260480800,,,,,,,,,,,140712593457152,140712593457152,1640332,1634304,3240919660,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2609450Z","2025-11-19 19:51:21.2609450Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\BCP47Langs.dll",,,,,,,,,,1763581881260945000,,,,,,,,,,,140712631468032,140712631468032,402331,385024,2065030180,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.821877500Z","2025-11-19 19:51:21.2718203Z","myETW","EDRi-Provider",4242,"EDRiTask","12472 EDRi.exe",,,,,,"After starting the attack exe",,,,,,,,,,,1763581881271820300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2731140Z","2025-11-19 19:51:21.2731140Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\PackagedCom\OpenConsoleProxy.dll",,,,,,,,,,1763581881273114000,,,,,,,,,,,140712723349504,140712723349504,51292,53248,1759975238,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2956095Z","2025-11-19 19:51:21.2956095Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\ExplorerFrame.dll",,,,,,,,,,1763581881295609500,,,,,,,,,,,140712345862144,140712345862144,2919775,2867200,3427672670,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3039247Z","2025-11-19 19:51:21.3039247Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4440 svchost.exe",15252,,," 4440 svchost.exe",,,,,,,,,,,,,1763581881303924700,18446633084039225344,18446633084039200768,140712899206080,0,985498337280,15252,985501007872,985500975104,140712899206080,3620366,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3135286Z","2025-11-19 19:51:21.3135286Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\Microsoft.Terminal.UI.dll",,,,,,,,,,1763581881313528600,,,,,,,,,,,140712371224576,140712371224576,255391,258048,1759975265,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3153663Z","2025-11-19 19:51:21.3153663Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\WindowsCodecs.dll",,,,,,,,,,1763581881315366300,,,,,,,,,,,140712775385088,140712775385088,2352359,2293760,3466818398,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3281911Z","2025-11-19 19:51:21.3281911Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\TextInputFramework.dll",,,,,,,,,,1763581881328191100,,,,,,,,,,,140712628846592,140712628846592,1374424,1339392,3535451269,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3351734Z","2025-11-19 19:51:21.3351734Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13828 OpenConsole.exe",2364,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881335173400,18446633084047904768,18446633084047880192,140702989217024,0,132813942784,5760,132823121920,132823117824,140702989217024,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3352289Z","2025-11-19 19:51:21.3352289Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13828 OpenConsole.exe",2364,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881335228900,18446633084039225344,18446633084039200768,140702989233856,0,132813950976,14196,132824170496,132824166400,140702989233856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3369403Z","2025-11-19 19:51:21.3369403Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3100 conhost.exe",6724,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881336940400,18446633084047990784,18446633084047966208,140696385038832,0,1013857775616,11136,1013862891520,1013862883328,140696385038832,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3370686Z","2025-11-19 19:51:21.3370686Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\uxtheme.dll",,,,,,,,,,1763581881337068600,,,,,,,,,,,140712802254848,140712802254848,696534,696320,1695798817,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3414284Z","2025-11-19 19:51:21.3414284Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881341428400,18446633084048019456,18446633084047994880,140702989086576,0,132813959168,5520,132825219072,132825214976,140702989086576,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3415372Z","2025-11-19 19:51:21.3415372Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\directmanipulation.dll",,,,,,,,,,1763581881341537200,,,,,,,,,,,140712583036928,140712583036928,714070,667648,3434535107,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3429436Z","2025-11-19 19:51:21.3429436Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881342943600,18446633084044541952,18446633084044517376,140712583404848,0,1068179726336,11716,1068190662656,1068190658560,140712583404848,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3431486Z","2025-11-19 19:51:21.3431486Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881343148700,18446633084042874880,18446633084042850304,140702989404080,0,132813967360,12916,132826267648,132826263552,140702989404080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3435982Z","2025-11-19 19:51:21.3435982Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",14844,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881343598200,18446633084047876096,18446633084047851520,140712899206080,0,1068179734528,9740,1068191711232,1068191707136,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3840381Z","2025-11-19 19:51:21.3840381Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8448 OneDrive.exe",12656,,," 8448 OneDrive.exe",,,,,,,,,,,,,1763581881384038100,18446633084042072064,18446633084042047488,140712859481984,0,70345129984,12656,70351060992,70351048704,140712859481984,5254774,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3843919Z","2025-11-19 19:51:21.3843919Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\msftedit.dll",,,,,,,,,,1763581881384391900,,,,,,,,,,,140712289107968,140712289107968,3297357,3305472,3878106343,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3869265Z","2025-11-19 19:51:21.3869265Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\globinputhost.dll",,,,,,,,,,1763581881386926500,,,,,,,,,,,140712627863552,140712627863552,263563,208896,1786968813,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3875820Z","2025-11-19 19:51:21.3875820Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.UI.Core.TextInput.dll",,,,,,,,,,1763581881387582000,,,,,,,,,,,140712572354560,140712572354560,1511216,1499136,21441667,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3882611Z","2025-11-19 19:51:21.3882611Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\CoreUIComponents.dll",,,,,,,,,,1763581881388261200,,,,,,,,,,,140712742944768,140712742944768,3046501,3022848,801552868,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3990087Z","2025-11-19 19:51:21.3990087Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4784 svchost.exe",10016,,," 4784 svchost.exe",,,,,,,,,,,,,1763581881399008700,18446633084049223680,18446633084049199104,140712899206080,0,476842119168,10016,476845178880,476845146112,140712899206080,233109,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3991102Z","2025-11-19 19:51:21.3991102Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4148 svchost.exe",14944,,," 4148 svchost.exe",,,,,,,,,,,,,1763581881399110200,18446633084008603648,18446633084008579072,140712899206080,0,934391029760,14944,934392889344,934392856576,140712899206080,547695,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3991392Z","2025-11-19 19:51:21.3991392Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4284 svchost.exe",12524,,," 4284 svchost.exe",,,,,,,,,,,,,1763581881399139300,18446633083996708864,18446633083996684288,140712899206080,0,216311418880,12524,216310611968,216310579200,140712899206080,609932,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4014776Z","2025-11-19 19:51:21.4014776Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881401477600,18446633084042072064,18446633084042047488,140712865112144,0,1068179742720,12568,1068192759808,1068192751616,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4033568Z","2025-11-19 19:51:21.4033568Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",12568,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\sxs.dll",,,,,,,,,,1763581881403356800,,,,,,,,,,,140712846622720,140712846622720,697955,659456,3834976666,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4123099Z","2025-11-19 19:51:21.4123099Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\xmllite.dll",,,,,,,,,,1763581881412309900,,,,,,,,,,,140712684027904,140712684027904,342897,274432,974526834,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4281758Z","2025-11-19 19:51:21.4281758Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\icu.dll",,,,,,,,,,1763581881428175800,,,,,,,,,,,140712684617728,140712684617728,2775448,2744320,3611555297,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4298365Z","2025-11-19 19:51:21.4298365Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881429836500,18446633084042932224,18446633084042907648,140712371704112,0,1068179750912,4932,1068193808384,1068193804288,140712371704112,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4299053Z","2025-11-19 19:51:21.4299053Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881429905300,18446633084007337984,18446633084007313408,140712378178864,0,1068179759104,3968,1068194856960,1068194852864,140712378178864,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4330267Z","2025-11-19 19:51:21.4330267Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\apphelp.dll",,,,,,,,,,1763581881433026700,,,,,,,,,,,140712800485376,140712800485376,675806,651264,4108425587,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4330576Z","2025-11-19 19:51:21.4330576Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",3968,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881433057600,18446633084048162816,18446633084048138240,140712899206080,0,1068179767296,11960,1068195905536,1068195901440,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4385550Z","2025-11-19 19:51:21.4385550Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581881438555000,,,,,,,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4386944Z","2025-11-19 19:51:21.4386944Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581881438694400,,,,,,,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4388601Z","2025-11-19 19:51:21.4388601Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581881438860100,18446633083996708864,18446633083996684288,140712899206080,0,289797914624,11468,289801240576,289801236480,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4389513Z","2025-11-19 19:51:21.4389513Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581881438951300,,,,,,,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4391936Z","2025-11-19 19:51:21.4391936Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581881439193600,,,,,,,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4393533Z","2025-11-19 19:51:21.4393533Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581881439353300,18446633084049022976,18446633084048998400,140712899206080,0,289797922816,3088,289802289152,289802285056,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4394768Z","2025-11-19 19:51:21.4394768Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581881439476800,,,,,,,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4394810Z","2025-11-19 19:51:21.4394810Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3348 attack-589.exe",3088,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581881439481000,18446633084049080320,18446633084049055744,140712899206080,0,289797931008,12904,289803337728,289803333632,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4397699Z","2025-11-19 19:51:21.4397699Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11468,,," 3348 attack-589.exe",,,"C:\Windows\System32\msvcp140.dll",,,,,,,,,,1763581881439769900,,,,,,,,,,,140711213137920,140711213137920,570439,561152,1564323704,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4397897Z","2025-11-19 19:51:21.4397897Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",3088,,," 3348 attack-589.exe",,,"C:\Windows\System32\vcruntime140_1.dll",,,,,,,,,,1763581881439789700,,,,,,,,,,,140712354119680,140712354119680,57827,49152,240324076,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4398073Z","2025-11-19 19:51:21.4398073Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",12904,,," 3348 attack-589.exe",,,"C:\Windows\System32\vcruntime140.dll",,,,,,,,,,1763581881439807300,,,,,,,,,,,140712353988608,140712353988608,146072,122880,254123393,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.974665800Z","2025-11-19 19:51:21.4415712Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Injector started with PID 3348",,,,,,,,,,,1763581881441571200,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4676380Z","2025-11-19 19:51:21.4676380Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",9740,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881467638000,18446633084049252352,18446633084049227776,140712899206080,0,1068179775488,12140,1068196954112,1068196950016,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4804511Z","2025-11-19 19:51:21.4804511Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.Graphics.dll",,,,,,,,,,1763581881480451100,,,,,,,,,,,140712711225344,140712711225344,669723,593920,1068018205,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5091155Z","2025-11-19 19:51:21.5091155Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\threadpoolwinrt.dll",,,,,,,,,,1763581881509115500,,,,,,,,,,,140712555839488,140712555839488,130107,90112,2299561022,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5095245Z","2025-11-19 19:51:21.5095245Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881509524500,18446633084044570624,18446633084044546048,140712899206080,0,1068179783680,3600,1068198002688,1068197998592,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5099019Z","2025-11-19 19:51:21.5099019Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",3600,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881509901900,18446633084046180352,18446633084046155776,140712899206080,0,1068179791872,11228,1068199051264,1068199047168,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5101012Z","2025-11-19 19:51:21.5101012Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",11228,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881510101200,18446633084049424384,18446633084049399808,140712899206080,0,1068179800064,1960,1068200099840,1068200095744,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5102588Z","2025-11-19 19:51:21.5102588Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",3600,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\pfclient.dll",,,,,,,,,,1763581881510258800,,,,,,,,,,,140712803500032,140712803500032,92868,73728,3163590703,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5107492Z","2025-11-19 19:51:21.5107492Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",1960,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881510749200,18446633084049453056,18446633084049428480,140712899206080,0,1068179808256,12764,1068201148416,1068201144320,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5109197Z","2025-11-19 19:51:21.5109197Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",12764,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881510919700,18446633084049481728,18446633084049457152,140712899206080,0,1068179816448,14948,1068202196992,1068202192896,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5586241Z","2025-11-19 19:51:21.5586241Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3564 MsMpEng.exe",15224,,," 3564 MsMpEng.exe",,,,,,,,,,,,,1763581881558624100,18446633084048191488,18446633084048166912,140712899206080,247,273686052864,4152,273715036160,273714970624,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5586910Z","2025-11-19 19:51:21.5586910Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3564 MsMpEng.exe",15224,,," 3564 MsMpEng.exe",,,,,,,,,,,,,1763581881558691000,18446633084049653760,18446633084049629184,140712647800224,247,273686061056,6492,273715560448,273715494912,140712647800224,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5588912Z","2025-11-19 19:51:21.5588912Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3564 MsMpEng.exe",4152,,," 3564 MsMpEng.exe",,,,,,,,,,,,,1763581881558891200,18446633084049739776,18446633084049715200,140712899206080,0,273686069248,908,273716084736,273716019200,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5934226Z","2025-11-19 19:51:21.5934226Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3492 svchost.exe",5904,,," 3492 svchost.exe",,,"C:\Windows\System32\wintrust.dll",,,,,,,,,,1763581881593422600,,,,,,,,,,,140712860844032,140712860844032,590783,520192,452262045,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5947441Z","2025-11-19 19:51:21.5947441Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3564 MsMpEng.exe",6492,,," 3564 MsMpEng.exe",,,,,,,,,,,,,1763581881594744200,18446633084049653760,18446633084049629184,140712647800224,247,273686061056,6492,273715560448,273715494912,140712647800224,444719,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5948825Z","2025-11-19 19:51:21.5948825Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3492 svchost.exe",5904,,," 3492 svchost.exe",,,,,,,,,,,,,1763581881594882500,18446633084049653760,18446633084049629184,140712850417280,51,390179405824,6828,390182469632,390182436864,140712850417280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5949276Z","2025-11-19 19:51:21.5949276Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8972 VBoxTray.exe",9020,,," 8972 VBoxTray.exe",,,,,,,,,,,,,1763581881594927600,18446633084049825792,18446633084049801216,140700131109808,0,471284236288,10404,471286677504,471286673408,140700131109808,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5950105Z","2025-11-19 19:51:21.5950105Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3492 svchost.exe",5904,,," 3492 svchost.exe",,,"C:\Windows\System32\imagehlp.dll",,,,,,,,,,1763581881595010500,,,,,,,,,,,140712892760064,140712892760064,200866,131072,2156568970,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5952887Z","2025-11-19 19:51:21.5952887Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8972 VBoxTray.exe",10404,,," 8972 VBoxTray.exe",,,,,,,,,,,,,1763581881595288800,18446633084049825792,18446633084049801216,140700131109808,0,471284236288,10404,471286677504,471286669312,140700131109808,498282,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.7341752Z","2025-11-19 19:51:21.7341752Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5492 svchost.exe",14880,,," 5492 svchost.exe",,,,,,,,,,,,,1763581881734175200,18446633083981475840,18446633083981451264,140712899206080,0,915765288960,14880,915762446336,915762413568,140712899206080,296102,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.7983187Z","2025-11-19 19:51:21.7983187Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","12224 svchost.exe",9032,,,"12224 svchost.exe",,,,,,,,,,,,,1763581881798318700,18446633084060700672,18446633084060676096,140712899206080,0,706015498240,9032,706018803712,706018770944,140712899206080,8518314,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.7983803Z","2025-11-19 19:51:21.7983803Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","12224 svchost.exe",10960,,,"12224 svchost.exe",,,,,,,,,,,,,1763581881798380300,18446633084060872704,18446633084060848128,140712899206080,0,706015514624,10960,706019852288,706019819520,140712899206080,2446520,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.8777317Z","2025-11-19 19:51:21.8777317Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","12036 svchost.exe",9152,,,"12036 svchost.exe",,,,,,,,,,,,,1763581881877731700,18446633084061933568,18446633084061908992,140712899206080,0,457933398016,9152,457937780736,457937747968,140712899206080,1219109,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.8777978Z","2025-11-19 19:51:21.8777978Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","12036 svchost.exe",1972,,,"12036 svchost.exe",,,,,,,,,,,,,1763581881877797800,18446633084061589504,18446633084061564928,140712899206080,0,457933357056,1972,457935159296,457935126528,140712899206080,44750634,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.8778273Z","2025-11-19 19:51:21.8778273Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","12036 svchost.exe",6012,,,"12036 svchost.exe",,,,,,,,,,,,,1763581881877827300,18446633084061876224,18446633084061851648,140712899206080,0,457933389824,6012,457937256448,457937223680,140712899206080,909052,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.9736609Z","2025-11-19 19:51:21.9736609Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 4608 svchost.exe",,,,,,,,,,,,,1763581881973660900,18446633084061876224,18446633084061851648,140712899206080,0,287385972736,12852,287387942912,287387910144,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.0373099Z","2025-11-19 19:51:22.0373099Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 9692 PerfWatson2.exe",9752,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,1763581882037309900,18446633084061589504,18446633084061564928,140711612509856,0,1046353248256,8132,1046352232448,1046352216064,140711612509856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.0697083Z","2025-11-19 19:51:22.0697083Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6096 svchost.exe",11408,,," 6096 svchost.exe",,,,,,,,,,,,,1763581882069708300,18446633084055818240,18446633084055793664,140712899206080,0,338489364480,11408,338488393728,338488360960,140712899206080,684617,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.1476357Z","2025-11-19 19:51:22.1476357Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9388 devenv.exe",5524,,," 9388 devenv.exe",,,,,,,,,,,,,1763581882147635700,18446633084010299392,18446633084010274816,140711613062896,0,1033376530432,5524,1033400483840,1033400401920,140711613062896,847113123,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.1480054Z","2025-11-19 19:51:22.1480054Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9388 devenv.exe",8848,,," 9388 devenv.exe",,,,,,,,,,,,,1763581882148005400,18446633084060069888,18446633084060045312,140711613062896,0,1033376243712,8848,1033378988032,1033378902016,140711613062896,697768345,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.3061593Z","2025-11-19 19:51:22.3061593Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 4440 svchost.exe",,,,,,,,,,,,,1763581882306159300,18446633084060069888,18446633084060045312,140712899206080,0,985498419200,13764,985501007872,985500975104,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.4015320Z","2025-11-19 19:51:22.4015320Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 4784 svchost.exe",,,,,,,,,,,,,1763581882401532000,18446633084010299392,18446633084010274816,140712899206080,0,476842127360,6624,476845178880,476845146112,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.4016565Z","2025-11-19 19:51:22.4016565Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 4148 svchost.exe",,,,,,,,,,,,,1763581882401656500,18446633084060872704,18446633084060848128,140712899206080,0,934391037952,15288,934392889344,934392856576,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.4017245Z","2025-11-19 19:51:22.4017245Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 4284 svchost.exe",,,,,,,,,,,,,1763581882401724500,18446633084061933568,18446633084061908992,140712899206080,0,216311427072,4948,216310611968,216310579200,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.852182900Z","2025-11-19 19:51:22.4165908Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Running 'standard' config",,,,,,,,,,,1763581882416590800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.852392100Z","2025-11-19 19:51:22.4168223Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Before starting subprocess to inject to",,,,,,,,,,,1763581882416822300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.4176543Z","2025-11-19 19:51:22.4176543Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 3348 attack-589.exe",11212,,," 1436 whoami.exe",,,"C:\Windows\System32\whoami.exe",,,,,,,,,,1763581882417654300,,,,,,,,,,,,,160109,,3602411345,,,,134080554818530829,,,,,3396,,,,,,0,"0x","","",3348,3392,3,0,0,1 -"2025-11-19 19:51:22.4206852Z","2025-11-19 19:51:22.4206852Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3348 attack-589.exe",11212,,," 1436 whoami.exe",,,,,,,,,,,,,1763581882420685200,18446633084049825792,18446633084049801216,140702344617136,0,521061564416,12400,521063104512,521063096320,140702344617136,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.858891900Z","2025-11-19 19:51:22.4240441Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"After starting subprocess with PID 1436",,,,,,,,,,,1763581882424044100,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.5270232Z","2025-11-19 19:51:22.5270232Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2564 svchost.exe",4464,,," 2564 svchost.exe",,,,,,,,,,,,,1763581882527023200,18446633084007137280,18446633084007112704,140712899206080,0,914261585920,4464,914258788352,914258755584,140712899206080,182942,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.5270233Z","2025-11-19 19:51:22.5270233Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6028 svchost.exe",3044,,," 6028 svchost.exe",,,,,,,,,,,,,1763581882527023300,18446633084008202240,18446633084008177664,140712899206080,0,661507956736,3044,661509373952,661509341184,140712899206080,585791,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.5270234Z","2025-11-19 19:51:22.5270234Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","12708 svchost.exe",7104,,,"12708 svchost.exe",,,,,,,,,,,,,1763581882527023400,18446633083981504512,18446633083981479936,140712899206080,0,305338654720,7104,305336352768,305336320000,140712899206080,235373,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.5270347Z","2025-11-19 19:51:22.5270347Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 7916 svchost.exe",5744,,," 7916 svchost.exe",,,,,,,,,,,,,1763581882527034700,18446633084004753408,18446633084004728832,140712899206080,0,401963933696,5744,401962827776,401962795008,140712899206080,435290,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.5586311Z","2025-11-19 19:51:22.5586311Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1356 CrossDeviceResume.exe",14964,,," 1356 CrossDeviceResume.exe",,,,,,,,,,,,,1763581882558631100,18446633083982278656,18446633083982254080,140712899206080,0,401574907904,14964,399433007104,399433003008,140712899206080,155784,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.7344771Z","2025-11-19 19:51:22.7344771Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 5492 svchost.exe",,,,,,,,,,,,,1763581882734477100,18446633084060700672,18446633084060676096,140712899206080,0,915765297152,2416,915762446336,915762413568,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.7967772Z","2025-11-19 19:51:22.7967772Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",6292,,," 5184 explorer.exe",,,,,,,,,,,,,1763581882796777200,18446633083982278656,18446633083982254080,140712899206080,0,15294464,13628,470876160,470818816,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.8136763Z","2025-11-19 19:51:22.8136763Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"12224 svchost.exe",,,,,,,,,,,,,1763581882813676300,18446633084048994304,18446633084048969728,140712899206080,0,706015555584,2892,706017230848,706017198080,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.8602030Z","2025-11-19 19:51:22.8602030Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\twinapi.dll",,,,,,,,,,1763581882860203000,,,,,,,,,,,140712415789056,140712415789056,924452,868352,2129603828,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.8936636Z","2025-11-19 19:51:22.8936636Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"12036 svchost.exe",,,,,,,,,,,,,1763581882893663600,18446633084049969152,18446633084049944576,140712899206080,0,457933406208,2408,457931489280,457931456512,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.9405137Z","2025-11-19 19:51:22.9405137Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1744 svchost.exe",6132,,," 1744 svchost.exe",,,,,,,,,,,,,1763581882940513700,18446633083994210304,18446633083994185728,140712899206080,0,481879539712,6132,481878671360,481878638592,140712899206080,362866,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.9405682Z","2025-11-19 19:51:22.9405682Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1288 mmc.exe",10868,,," 1288 mmc.exe",,,,,,,,,,,,,1763581882940568200,18446633084007137280,18446633084007112704,140711612509856,0,7143424,14856,82575360,82493440,140711612509856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.0825789Z","2025-11-19 19:51:23.0825789Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 6096 svchost.exe",,,,,,,,,,,,,1763581883082578900,18446633083994210304,18446633083994185728,140712899206080,0,338489372672,15276,338488393728,338488360960,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.1468947Z","2025-11-19 19:51:23.1468947Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1520 powershell.exe",14016,,," 1520 powershell.exe",,,,,,,,,,,,,1763581883146894700,18446633084033425408,18446633084033400832,140711613062896,0,931706298368,14016,931709583360,931709571072,140711613062896,897359,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.1469567Z","2025-11-19 19:51:23.1469567Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1520 powershell.exe",7828,,," 1520 powershell.exe",,,,,,,,,,,,,1763581883146956700,18446633084032733184,18446633084032708608,140711613062896,0,931706281984,7828,931709059072,931709046784,140711613062896,2453686,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.2263639Z","2025-11-19 19:51:23.2263639Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8984 svchost.exe",12448,,," 8984 svchost.exe",,,,,,,,,,,,,1763581883226363900,18446633084008632320,18446633084008607744,140712899206080,0,213146189824,12448,213148762112,213148729344,140712899206080,610310,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.737817600Z","2025-11-19 19:51:23.4006311Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Before opening process handle",,,,,,,,,,,1763581883400631100,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.738077500Z","2025-11-19 19:51:23.4009294Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"After opening process handle",,,,,,,,,,,1763581883400929400,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.5280186Z","2025-11-19 19:51:23.5280186Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 6028 svchost.exe",,,,,,,,,,,,,1763581883528018700,18446633084050083840,18446633084050059264,140712899206080,0,661507964928,5984,661509373952,661509341184,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.5280753Z","2025-11-19 19:51:23.5280753Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 2564 svchost.exe",,,,,,,,,,,,,1763581883528075300,18446633084033425408,18446633084033400832,140712899206080,0,914261594112,8752,914258788352,914258755584,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.5282059Z","2025-11-19 19:51:23.5282059Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"12708 svchost.exe",,,,,,,,,,,,,1763581883528205900,18446633084050112512,18446633084050087936,140712899206080,0,305338662912,14960,305336352768,305336320000,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.5283076Z","2025-11-19 19:51:23.5283076Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 7916 svchost.exe",,,,,,,,,,,,,1763581883528307600,18446633084050141184,18446633084050116608,140712899206080,0,401963941888,14924,401962827776,401962795008,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.5439313Z","2025-11-19 19:51:23.5439313Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9832 svchost.exe",12936,,," 9832 svchost.exe",,,,,,,,,,,,,1763581883543931300,18446633084008488960,18446633084008464384,140712899206080,0,234793099264,12936,234792878080,234792845312,140712899206080,581642,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.5439491Z","2025-11-19 19:51:23.5439491Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9184 svchost.exe",10120,,," 9184 svchost.exe",,,,,,,,,,,,,1763581883543949100,18446633084007596032,18446633084007571456,140712899206080,0,580428570624,10120,580430856192,580430823424,140712899206080,265172,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.5441731Z","2025-11-19 19:51:23.5441731Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",8132,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,1763581883544173100,18446633084061589504,18446633084061564928,140711612509856,0,1046353248256,8132,1046352232448,1046352216064,140711612509856,1009010,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.5598467Z","2025-11-19 19:51:23.5598467Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1356 CrossDeviceResume.exe",,,,,,,,,,,,,1763581883559846700,18446633084061589504,18446633084061564928,140712899206080,0,401574932480,6020,399433007104,399433003008,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.8464387Z","2025-11-19 19:51:23.8464387Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6588 Widgets.exe",9292,,," 6588 Widgets.exe",,,,,,,,,,,,,1763581883846438700,18446633084009119744,18446633084009095168,140712899206080,0,120133607424,9292,120137449472,120137445376,140712899206080,571457,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.9424379Z","2025-11-19 19:51:23.9424379Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","11528 msedgewebview2.exe",11184,,,"11528 msedgewebview2.exe",,,,,,,,,,,,,1763581883942437900,18446633084001447936,18446633084001423360,140712899206080,0,473244606464,11184,473262194688,473262186496,140712899206080,36366232,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.9425488Z","2025-11-19 19:51:23.9425488Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1744 svchost.exe",,,,,,,,,,,,,1763581883942548800,18446633084009119744,18446633084009095168,140712899206080,0,481879547904,14720,481878671360,481878638592,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.0224211Z","2025-11-19 19:51:24.0224211Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6904 WidgetService.exe",5232,,," 6904 WidgetService.exe",,,,,,,,,,,,,1763581884022421100,18446633084009377792,18446633084009353216,140712899206080,0,274672095232,5232,274673434624,274673430528,140712899206080,283654,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.1338922Z","2025-11-19 19:51:24.1338922Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9324 msedgewebview2.exe",3756,,," 9324 msedgewebview2.exe",,,,,,,,,,,,,1763581884133892200,18446633084009492480,18446633084009467904,140712899206080,0,717035753472,3756,717054017536,717054013440,140712899206080,302513,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.2294186Z","2025-11-19 19:51:24.2294186Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 8984 svchost.exe",,,,,,,,,,,,,1763581884229418600,18446633084008488960,18446633084008464384,140712899206080,0,213146198016,11968,213148762112,213148729344,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.2665429Z","2025-11-19 19:51:24.2665429Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","15184 SearchProtocolHost.exe",4084,,,"15184 SearchProtocolHost.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,1763581884266542900,,,,,,,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.2699363Z","2025-11-19 19:51:24.2699363Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","15184 SearchProtocolHost.exe",4084,,,"15184 SearchProtocolHost.exe",,,"C:\Windows\System32\profapi.dll",,,,,,,,,,1763581884269936300,,,,,,,,,,,140712848850944,140712848850944,229548,167936,2447194521,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.2770172Z","2025-11-19 19:51:24.2770172Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6500 SearchHost.exe",14416,,," 6500 SearchHost.exe",,,,,,,,,,,,,1763581884277017200,18446633084041756672,18446633084041732096,140712449945792,0,1050565771264,14416,1050568294400,1050568228864,140712449945792,1313034,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.2771868Z","2025-11-19 19:51:24.2771868Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6500 SearchHost.exe",11280,,," 6500 SearchHost.exe",,,,,,,,,,,,,1763581884277186800,18446633084041756672,18446633084041732096,140712449945792,0,1050565779456,14564,1050568294400,1050568228864,140712449945792,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.3409661Z","2025-11-19 19:51:24.3409661Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3540 svchost.exe",9968,,," 3540 svchost.exe",,,,,,,,,,,,,1763581884340966100,18446633084035059712,18446633084035035136,140711742624160,249,589657714688,9968,589661470720,589661437952,140711742624160,391728995,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.3409681Z","2025-11-19 19:51:24.3409681Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3540 svchost.exe",1184,,," 3540 svchost.exe",,,,,,,,,,,,,1763581884340968100,18446633084035031040,18446633084035006464,140711742624160,249,589657706496,1184,589660946432,589660913664,140711742624160,10633090708,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.612812600Z","2025-11-19 19:51:24.3728485Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Before allocating memory for shellcode",,,,,,,,,,,1763581884372848500,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.613174800Z","2025-11-19 19:51:24.3732488Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"After allocating memory for shellcode at 000001FF40840000",,,,,,,,,,,1763581884373248800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.4527822Z","2025-11-19 19:51:24.4527822Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6424 msedgewebview2.exe",9252,,," 6424 msedgewebview2.exe",,,,,,,,,,,,,1763581884452782200,18446633084056793088,18446633084056768512,140712899206080,0,795610513408,9252,795628011520,795628007424,140712899206080,13231797,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.4528000Z","2025-11-19 19:51:24.4528000Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1768 msedgewebview2.exe",7724,,," 1768 msedgewebview2.exe",,,,,,,,,,,,,1763581884452800000,18446633084009091072,18446633084009066496,140712899206080,0,1047163273216,7724,1047324000256,1047323996160,140712899206080,493756,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.5476392Z","2025-11-19 19:51:24.5476392Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9832 svchost.exe",,,,,,,,,,,,,1763581884547639200,18446633084050571264,18446633084050546688,140712899206080,0,234793107456,4980,234792878080,234792845312,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.5476971Z","2025-11-19 19:51:24.5476971Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9184 svchost.exe",,,,,,,,,,,,,1763581884547697100,18446633084009091072,18446633084009066496,140712899206080,0,580428578816,15320,580430856192,580430823424,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.8347452Z","2025-11-19 19:51:24.8347452Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3628 msedgewebview2.exe",2068,,," 3628 msedgewebview2.exe",,,,,,,,,,,,,1763581884834745200,18446633084009865216,18446633084009840640,140712899206080,0,1084563218432,2068,1084732997632,1084732993536,140712899206080,442456,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.8509683Z","2025-11-19 19:51:24.8509683Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 6588 Widgets.exe",,,,,,,,,,,,,1763581884850968300,18446633084009865216,18446633084009840640,140712899206080,0,120133615616,10764,120137449472,120137445376,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.9462310Z","2025-11-19 19:51:24.9462310Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"11528 msedgewebview2.exe",,,,,,,,,,,,,1763581884946231000,18446633084050599936,18446633084050575360,140712899206080,0,473244639232,14000,473262194688,473262190592,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.9464943Z","2025-11-19 19:51:24.9464943Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1288 mmc.exe",14856,,," 1288 mmc.exe",,,,,,,,,,,,,1763581884946494300,18446633084007137280,18446633084007112704,140711612509856,0,7143424,14856,82575360,82493440,140711612509856,1574057,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.0259698Z","2025-11-19 19:51:25.0259698Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 6904 WidgetService.exe",,,,,,,,,,,,,1763581885025969800,18446633084007137280,18446633084007112704,140712899206080,0,274672103424,12200,274673434624,274673430528,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.1377420Z","2025-11-19 19:51:25.1377420Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9324 msedgewebview2.exe",,,,,,,,,,,,,1763581885137742000,18446633083981475840,18446633083981451264,140712899206080,0,717035761664,1928,717054017536,717054013440,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.486948200Z","2025-11-19 19:51:25.3441106Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Before writing shellcode to process",,,,,,,,,,,1763581885344110600,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.487258200Z","2025-11-19 19:51:25.3444526Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"After writing shellcode to process at 000001FF40840000",,,,,,,,,,,1763581885344452600,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.4554544Z","2025-11-19 19:51:25.4554544Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1768 msedgewebview2.exe",,,,,,,,,,,,,1763581885455454400,18446633084050857984,18446633084050833408,140712899206080,0,1047163281408,12460,1047324000256,1047323996160,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.4555172Z","2025-11-19 19:51:25.4555172Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 6424 msedgewebview2.exe",,,,,,,,,,,,,1763581885455517200,18446633084051030016,18446633084051005440,140712899206080,0,795610558464,744,795628011520,795628007424,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.4882512Z","2025-11-19 19:51:25.4882512Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8268 svchost.exe",14888,,," 8268 svchost.exe",,,,,,,,,,,,,1763581885488251200,18446633083999670272,18446633083999645696,140712899206080,0,178507935744,14888,178510102528,178510069760,140712899206080,379840,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.8389195Z","2025-11-19 19:51:25.8389195Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3628 msedgewebview2.exe",,,,,,,,,,,,,1763581885838919500,18446633084050169856,18446633084050145280,140712899206080,0,1084563226624,2912,1084732997632,1084732993536,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.9987993Z","2025-11-19 19:51:25.9987993Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13112 TimelineExplorer.exe",13516,,,"13112 TimelineExplorer.exe",,,,,,,,,,,,,1763581885998799300,18446633083996135424,18446633083996110848,140712899206080,0,1007263227904,13516,1007289368576,1007289360384,140712899206080,343629,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.9989283Z","2025-11-19 19:51:25.9989283Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13112 TimelineExplorer.exe",10004,,,"13112 TimelineExplorer.exe",,,,,,,,,,,,,1763581885998928300,18446633084056133632,18446633084056109056,140712899206080,0,1007263203328,10004,1007284649984,1007284637696,140712899206080,1595177,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:26.0638848Z","2025-11-19 19:51:26.0638848Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5184 explorer.exe",5116,,," 5184 explorer.exe",,,,,,,,,,,,,1763581886063884800,18446633084043362304,18446633084043337728,140712891545280,0,15286272,5116,467664896,467607552,140712891545280,69722029,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:26.0786440Z","2025-11-19 19:51:26.0786440Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 9920 ServiceHub.IntellicodeModelService.exe",9760,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,1763581886078644000,18446633084043362304,18446633084043337728,140711612509856,0,46014316544,11908,46012694528,46012678144,140711612509856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.362253700Z","2025-11-19 19:51:26.3166701Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Before changing memory protection to PAGE_EXECUTE_READ",,,,,,,,,,,1763581886316670100,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.362529500Z","2025-11-19 19:51:26.3169751Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"After changing memory protection to PAGE_EXECUTE_READ",,,,,,,,,,,1763581886316975100,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:26.4924720Z","2025-11-19 19:51:26.4924720Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 8268 svchost.exe",,,,,,,,,,,,,1763581886492472000,18446633084051116032,18446633084051091456,140712899206080,0,178507943936,4236,178510102528,178510069760,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:26.6059639Z","2025-11-19 19:51:26.6059639Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8972 VBoxTray.exe",9020,,," 8972 VBoxTray.exe",,,,,,,,,,,,,1763581886605964000,18446633084051144704,18446633084051120128,140700131109808,0,471284244480,3136,471286677504,471286673408,140700131109808,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:26.6062393Z","2025-11-19 19:51:26.6062393Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8972 VBoxTray.exe",3136,,," 8972 VBoxTray.exe",,,,,,,,,,,,,1763581886606239300,18446633084051144704,18446633084051120128,140700131109808,0,471284244480,3136,471286677504,471286669312,140700131109808,649161,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:26.7793053Z","2025-11-19 19:51:26.7793053Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5184 explorer.exe",8788,,," 5184 explorer.exe",,,,,,,,,,,,,1763581886779305300,18446633084051058688,18446633084051034112,140712891292720,0,15097856,8788,214564864,214507520,140712891292720,14753796,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:26.296106600Z","2025-11-19 19:51:27.3019664Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Before reading memory to verify write",,,,,,,,,,,1763581887301966400,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:26.296340900Z","2025-11-19 19:51:27.3022001Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Before creating remote thread",,,,,,,,,,,1763581887302200100,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3024711Z","2025-11-19 19:51:27.3024711Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3348 attack-589.exe",11212,,," 1436 whoami.exe",,,,,,,,,,,,,1763581887302471100,18446633084051144704,18446633084051120128,2195810680832,0,521061572608,6380,521063628800,521063620608,2195810680832,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:26.296634600Z","2025-11-19 19:51:27.3024967Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"After creating remote thread",,,,,,,,,,,1763581887302496700,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3025746Z","2025-11-19 19:51:27.3025746Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\whoami.exe",,,,,,,,,,1763581887302574600,,,,,,,,,,,140702344609792,140702344609792,160109,98304,3602411345,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3026097Z","2025-11-19 19:51:27.3026097Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581887302609700,,,,,,,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3056213Z","2025-11-19 19:51:27.3056213Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581887305621300,,,,,,,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3057466Z","2025-11-19 19:51:27.3057466Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581887305746600,,,,,,,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3071785Z","2025-11-19 19:51:27.3071785Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\apphelp.dll",,,,,,,,,,1763581887307178500,,,,,,,,,,,140712800485376,140712800485376,675806,651264,4108425587,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3090501Z","2025-11-19 19:51:27.3090501Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581887309050100,,,,,,,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3091555Z","2025-11-19 19:51:27.3091555Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581887309155600,,,,,,,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3092448Z","2025-11-19 19:51:27.3092448Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,,,,,,,,,,,1763581887309244800,18446633084051173376,18446633084051148800,140712899206080,0,521061580800,8880,521064153088,521064144896,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3093136Z","2025-11-19 19:51:27.3093136Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581887309313600,,,,,,,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3095347Z","2025-11-19 19:51:27.3095347Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581887309534700,,,,,,,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3096825Z","2025-11-19 19:51:27.3096825Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,1763581887309682500,,,,,,,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3096888Z","2025-11-19 19:51:27.3096888Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1436 whoami.exe",8880,,," 1436 whoami.exe",,,,,,,,,,,,,1763581887309688800,18446633084051230720,18446633084051206144,140712899206080,0,521061588992,12688,521064677376,521064669184,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3098080Z","2025-11-19 19:51:27.3098080Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3564 MsMpEng.exe",15224,,," 3564 MsMpEng.exe",,,,,,,,,,,,,1763581887309808100,18446633084051259392,18446633084051234816,140712899206080,247,273686077440,11372,273715560448,273715494912,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3099257Z","2025-11-19 19:51:27.3099257Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,1763581887309925700,,,,,,,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3101194Z","2025-11-19 19:51:27.3101194Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,1763581887310119400,,,,,,,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3102504Z","2025-11-19 19:51:27.3102504Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,1763581887310250400,,,,,,,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3103899Z","2025-11-19 19:51:27.3103899Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581887310389900,,,,,,,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3105193Z","2025-11-19 19:51:27.3105193Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581887310519300,,,,,,,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3107041Z","2025-11-19 19:51:27.3107041Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,,,,,,,,,,,1763581887310704100,18446633084051288064,18446633084051263488,140712899206080,0,521061597184,1528,521065201664,521065193472,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3108191Z","2025-11-19 19:51:27.3108191Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\ws2_32.dll",,,,,,,,,,1763581887310819100,,,,,,,,,,,140712881094656,140712881094656,513405,475136,3967481067,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3111648Z","2025-11-19 19:51:27.3111648Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\wkscli.dll",,,,,,,,,,1763581887311164800,,,,,,,,,,,140712738291712,140712738291712,170846,110592,1225555544,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3111762Z","2025-11-19 19:51:27.3111762Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",1528,,," 1436 whoami.exe",,,"C:\Windows\System32\version.dll",,,,,,,,,,1763581887311176200,,,,,,,,,,,140712753168384,140712753168384,72452,45056,2275202464,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3111842Z","2025-11-19 19:51:27.3111842Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",12688,,," 1436 whoami.exe",,,"C:\Windows\System32\authz.dll",,,,,,,,,,1763581887311184200,,,,,,,,,,,140712826241024,140712826241024,372179,327680,771731569,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3111842Z","2025-11-19 19:51:27.3111842Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",8880,,," 1436 whoami.exe",,,"C:\Windows\System32\sspicli.dll",,,,,,,,,,1763581887311184200,,,,,,,,,,,140712833384448,140712833384448,339222,299008,3030302172,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3115813Z","2025-11-19 19:51:27.3115813Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\netutils.dll",,,,,,,,,,1763581887311581300,,,,,,,,,,,140712825847808,140712825847808,80696,53248,865845000,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3132484Z","2025-11-19 19:51:27.3132484Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,1763581887313248400,,,,,,,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3158199Z","2025-11-19 19:51:27.3158199Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1436 whoami.exe",6380,,,"11148 calc.exe",,,"C:\Windows\System32\calc.exe",,,,,,,,,,1763581887315819900,,,,,,,,,,,,,90741,,4001445627,,,,134080554863097645,,,,,3397,,,,,,0,"0x","","",1436,3396,3,0,0,1 -"2025-11-19 19:51:27.3177666Z","2025-11-19 19:51:27.3177666Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4372 vctip.exe",12540,,," 4372 vctip.exe",,,,,,,,,,,,,1763581887317766600,18446633084051431424,18446633084051406848,140711613062896,0,740355272704,8244,740356521984,740356513792,140711613062896,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3178282Z","2025-11-19 19:51:27.3178282Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4372 vctip.exe",12540,,," 4372 vctip.exe",,,,,,,,,,,,,1763581887317828200,18446633084051488768,18446633084051464192,140711612509856,0,740355280896,3948,740352917504,740352909312,140711612509856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3181875Z","2025-11-19 19:51:27.3181875Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4372 vctip.exe",8244,,," 4372 vctip.exe",,,,,,,,,,,,,1763581887318187500,18446633084051517440,18446633084051492864,140711613062896,0,740355289088,8128,740357570560,740357562368,140711613062896,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3182888Z","2025-11-19 19:51:27.3182888Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4372 vctip.exe",8244,,," 4372 vctip.exe",,,,,,,,,,,,,1763581887318288800,18446633084051546112,18446633084051521536,140711613062896,0,740355297280,6044,740358619136,740358610944,140711613062896,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3183397Z","2025-11-19 19:51:27.3183397Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1436 whoami.exe",6380,,,"11148 calc.exe",,,,,,,,,,,,,1763581887318339700,18446633084051058688,18446633084051034112,140696878126912,0,728547835904,4224,728545624064,728545615872,140696878126912,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3194990Z","2025-11-19 19:51:27.3194990Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4372 vctip.exe",8244,,," 4372 vctip.exe",,,,,,,,,,,,,1763581887319499000,18446633084051603456,18446633084051578880,140711613062896,0,740355305472,14984,740361764864,740361756672,140711613062896,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3195689Z","2025-11-19 19:51:27.3195689Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\calc.exe",,,,,,,,,,1763581887319568900,,,,,,,,,,,140696878120960,140696878120960,90741,49152,4001445627,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3195880Z","2025-11-19 19:51:27.3195880Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581887319588000,,,,,,,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3235352Z","2025-11-19 19:51:27.3235352Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581887323535200,,,,,,,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3236546Z","2025-11-19 19:51:27.3236546Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581887323654600,,,,,,,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3246614Z","2025-11-19 19:51:27.3246614Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,1763581887324661400,,,,,,,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3248541Z","2025-11-19 19:51:27.3248541Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581887324854100,,,,,,,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3249716Z","2025-11-19 19:51:27.3249716Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581887324971600,,,,,,,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3250774Z","2025-11-19 19:51:27.3250774Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11148 calc.exe",4224,,,"11148 calc.exe",,,,,,,,,,,,,1763581887325077400,18446633084051718144,18446633084051693568,140712899206080,0,728547844096,5464,728546148352,728546140160,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3251688Z","2025-11-19 19:51:27.3251688Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11148 calc.exe",5464,,,"11148 calc.exe",,,,,,,,,,,,,1763581887325168800,18446633084051746816,18446633084051722240,140712899206080,0,728547852288,12924,728549031936,728549023744,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3251902Z","2025-11-19 19:51:27.3251902Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,1763581887325190200,,,,,,,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3254114Z","2025-11-19 19:51:27.3254114Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,1763581887325411400,,,,,,,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3255722Z","2025-11-19 19:51:27.3255722Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,1763581887325572200,,,,,,,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3256752Z","2025-11-19 19:51:27.3256752Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,1763581887325675200,,,,,,,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3258194Z","2025-11-19 19:51:27.3258194Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,1763581887325819400,,,,,,,,,,,140712851341312,140712851341312,1524912,1486848,1404855129,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3258220Z","2025-11-19 19:51:27.3258220Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11148 calc.exe",5464,,,"11148 calc.exe",,,,,,,,,,,,,1763581887325822000,18446633084051804160,18446633084051779584,140712899206080,0,728547860480,14656,728549556224,728549548032,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3260183Z","2025-11-19 19:51:27.3260183Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,1763581887326018300,,,,,,,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3261489Z","2025-11-19 19:51:27.3261489Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581887326148900,,,,,,,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3263108Z","2025-11-19 19:51:27.3263108Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581887326310800,,,,,,,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3264675Z","2025-11-19 19:51:27.3264675Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581887326467500,,,,,,,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3266221Z","2025-11-19 19:51:27.3266221Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581887326622100,,,,,,,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3274344Z","2025-11-19 19:51:27.3274344Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,1763581887327434400,,,,,,,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3298621Z","2025-11-19 19:51:27.3298621Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\windows.storage.dll",,,,,,,,,,1763581887329862100,,,,,,,,,,,140712812412928,140712812412928,8877403,8769536,3667346596,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3305419Z","2025-11-19 19:51:27.3305419Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,1763581887330541900,,,,,,,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3311302Z","2025-11-19 19:51:27.3311302Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,1763581887331130200,,,,,,,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3316071Z","2025-11-19 19:51:27.3316071Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\shlwapi.dll",,,,,,,,,,1763581887331607100,,,,,,,,,,,140712868839424,140712868839424,479562,421888,2142510382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3319762Z","2025-11-19 19:51:27.3319762Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11148 calc.exe",4224,,,"11148 calc.exe",,,,,,,,,,,,,1763581887331976200,18446633084051861504,18446633084051836928,140712891545280,0,728547868672,8768,728550080512,728550072320,140712891545280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3321090Z","2025-11-19 19:51:27.3321090Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\ole32.dll",,,,,,,,,,1763581887332109000,,,,,,,,,,,140712878473216,140712878473216,1689904,1667072,1018821057,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3324057Z","2025-11-19 19:51:27.3324057Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1436 whoami.exe",12688,,," 1436 whoami.exe",,,,,,,,,,,,,1763581887332405700,18446633084051230720,18446633084051206144,140712899206080,0,521061588992,12688,521064677376,521064669184,140712899206080,4300456,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3324064Z","2025-11-19 19:51:27.3324064Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1436 whoami.exe",12400,,," 1436 whoami.exe",,,,,,,,,,,,,1763581887332406400,18446633084049825792,18446633084049801216,140702344617136,0,521061564416,12400,521063104512,521063096320,140702344617136,33571,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3324102Z","2025-11-19 19:51:27.3324102Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1436 whoami.exe",8880,,," 1436 whoami.exe",,,,,,,,,,,,,1763581887332410200,18446633084051173376,18446633084051148800,140712899206080,0,521061580800,8880,521064153088,521064144896,140712899206080,4289897,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3324118Z","2025-11-19 19:51:27.3324118Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1436 whoami.exe",1528,,," 1436 whoami.exe",,,,,,,,,,,,,1763581887332411800,18446633084051288064,18446633084051263488,140712899206080,0,521061597184,1528,521065201664,521065193472,140712899206080,2544210,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3329388Z","2025-11-19 19:51:27.3329388Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,1763581887332938800,,,,,,,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3335073Z","2025-11-19 19:51:27.3335073Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\uxtheme.dll",,,,,,,,,,1763581887333507300,,,,,,,,,,,140712802254848,140712802254848,696534,696320,1695798817,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3348701Z","2025-11-19 19:51:27.3348701Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\propsys.dll",,,,,,,,,,1763581887334870100,,,,,,,,,,,140712761491456,140712761491456,1123662,1060864,3228732737,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3353689Z","2025-11-19 19:51:27.3353689Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1016 services.exe",15196,,,"13688 svchost.exe",,,"C:\Windows\System32\svchost.exe",,,,,,,,,,1763581887335369000,,,,,,,,,,,,,143552,,14788416,,,,134080554863291166,,,,,3398,,,,,,0,"0x","","",1016,11,1,1,0,0 -"2025-11-19 19:51:27.3353693Z","2025-11-19 19:51:27.3353693Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,1763581887335369300,,,,,,,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3360542Z","2025-11-19 19:51:27.3360542Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1016 services.exe",15196,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887336054200,18446633084051230720,18446633084051206144,140696171073504,0,780822601728,14412,780821725184,780821708800,140696171073504,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3376962Z","2025-11-19 19:51:27.3376962Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",14412,,,"13688 svchost.exe",,,"C:\Windows\System32\svchost.exe",,,,,,,,,,1763581887337696200,,,,,,,,,,,140696171053056,140696171053056,143552,77824,14788416,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3377241Z","2025-11-19 19:51:27.3377241Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",14412,,,"13688 svchost.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581887337724100,,,,,,,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3396922Z","2025-11-19 19:51:27.3396922Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,1763581887339692200,,,,,,,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3402331Z","2025-11-19 19:51:27.3402331Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",14412,,,"13688 svchost.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581887340233100,,,,,,,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3403088Z","2025-11-19 19:51:27.3403088Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,1763581887340308800,,,,,,,,,,,140712479096832,140712479096832,1613415,1552384,2231457550,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3403537Z","2025-11-19 19:51:27.3403537Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",14412,,,"13688 svchost.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581887340353700,,,,,,,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3407912Z","2025-11-19 19:51:27.3407912Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,1763581887340791200,,,,,,,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3414678Z","2025-11-19 19:51:27.3414678Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",14412,,,"13688 svchost.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581887341467800,,,,,,,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3416650Z","2025-11-19 19:51:27.3416650Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13688 svchost.exe",14412,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887341665000,18446633084049825792,18446633084049801216,140712899206080,0,780822609920,9652,780824739840,780824707072,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3423688Z","2025-11-19 19:51:27.3423688Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",14412,,,"13688 svchost.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581887342368900,,,,,,,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3429412Z","2025-11-19 19:51:27.3429412Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",14412,,,"13688 svchost.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581887342941200,,,,,,,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3436525Z","2025-11-19 19:51:27.3436525Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887343652500,18446633084051288064,18446633084051263488,140712899206080,0,780822618112,628,780825264128,780825231360,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3437598Z","2025-11-19 19:51:27.3437598Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13688 svchost.exe",14412,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887343759800,18446633084051173376,18446633084051148800,140712863364608,0,780822626304,12520,780825788416,780825755648,140712863364608,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3438660Z","2025-11-19 19:51:27.3438660Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\urlmon.dll",,,,,,,,,,1763581887343866000,,,,,,,,,,,140712669609984,140712669609984,1970671,1957888,260716450,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3441113Z","2025-11-19 19:51:27.3441113Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",12520,,,"13688 svchost.exe",,,"C:\Windows\System32\wersvc.dll",,,,,,,,,,1763581887344111300,,,,,,,,,,,140709772656640,140709772656640,393902,335872,651237193,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3441416Z","2025-11-19 19:51:27.3441416Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",5464,,,"11148 calc.exe",,,"C:\Windows\System32\iertutil.dll",,,,,,,,,,1763581887344141600,,,,,,,,,,,140712642805760,140712642805760,2984761,2904064,3815768453,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3442471Z","2025-11-19 19:51:27.3442471Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13688 svchost.exe",9652,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887344247200,18446633084051918848,18446633084051894272,140712899206080,0,780822634496,6208,780826312704,780826279936,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3443117Z","2025-11-19 19:51:27.3443117Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13688 svchost.exe",6208,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887344311700,18446633084051976192,18446633084051951616,140712899206080,0,780822642688,14796,780826836992,780826804224,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3443853Z","2025-11-19 19:51:27.3443853Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",12520,,,"13688 svchost.exe",,,"C:\Windows\System32\DiagnosticDataSettings.dll",,,,,,,,,,1763581887344385300,,,,,,,,,,,140712462319616,140712462319616,108991,61440,3234151774,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3444144Z","2025-11-19 19:51:27.3444144Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",12924,,,"11148 calc.exe",,,"C:\Windows\System32\srvcli.dll",,,,,,,,,,1763581887344414400,,,,,,,,,,,140712668954624,140712668954624,181029,167936,239922031,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3444158Z","2025-11-19 19:51:27.3444158Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",5464,,,"11148 calc.exe",,,"C:\Windows\System32\netutils.dll",,,,,,,,,,1763581887344415800,,,,,,,,,,,140712825847808,140712825847808,80696,53248,865845000,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3444853Z","2025-11-19 19:51:27.3444853Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",9652,,,"13688 svchost.exe",,,"C:\Windows\System32\windowsperformancerecordercontrol.dll",,,,,,,,,,1763581887344485300,,,,,,,,,,,140712357462016,140712357462016,1367144,1302528,1403099383,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3445883Z","2025-11-19 19:51:27.3445883Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",6208,,,"13688 svchost.exe",,,"C:\Windows\System32\weretw.dll",,,,,,,,,,1763581887344588300,,,,,,,,,,,140712281899008,140712281899008,267808,245760,3299957735,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3448571Z","2025-11-19 19:51:27.3448571Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",6208,,,"13688 svchost.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,1763581887344857100,,,,,,,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3450467Z","2025-11-19 19:51:27.3450467Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",6208,,,"13688 svchost.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581887345046700,,,,,,,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3451958Z","2025-11-19 19:51:27.3451958Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",6208,,,"13688 svchost.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,1763581887345195800,,,,,,,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3454742Z","2025-11-19 19:51:27.3454742Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",6208,,,"13688 svchost.exe",,,"C:\Windows\System32\bcrypt.dll",,,,,,,,,,1763581887345474200,,,,,,,,,,,140712848654336,140712848654336,206048,172032,2893678010,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3476957Z","2025-11-19 19:51:27.3476957Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\ieframe.dll",,,,,,,,,,1763581887347695700,,,,,,,,,,,140710222364672,140710222364672,7531896,7499776,575051316,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3477126Z","2025-11-19 19:51:27.3477126Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13688 svchost.exe",12520,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887347712600,18446633084052119552,18446633084052094976,140709772859968,243,780822650880,1108,780827361280,780827328512,140709772859968,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3481994Z","2025-11-19 19:51:27.3481994Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13688 svchost.exe",12520,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887348199400,18446633084052148224,18446633084052123648,140709772762688,243,780822659072,15312,780827885568,780827852800,140709772762688,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3484052Z","2025-11-19 19:51:27.3484052Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13688 svchost.exe",12520,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887348405200,18446633084051173376,18446633084051148800,140712863364608,0,780822626304,12520,780825788416,780825755648,140712863364608,10191193,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3485086Z","2025-11-19 19:51:27.3485086Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.7019_none_3e06ffa0e335b8a8\comctl32.dll",,,,,,,,,,1763581887348508600,,,,,,,,,,,140712659910656,140712659910656,2747780,2703360,4095768276,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3486735Z","2025-11-19 19:51:27.3486735Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",628,,,"13688 svchost.exe",,,"C:\Windows\System32\wer.dll",,,,,,,,,,1763581887348673500,,,,,,,,,,,140712805728256,140712805728256,993632,983040,1987637995,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3496249Z","2025-11-19 19:51:27.3496249Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",628,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887349624900,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3502043Z","2025-11-19 19:51:27.3502043Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13688 svchost.exe",628,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887350204300,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3503616Z","2025-11-19 19:51:27.3503616Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",628,,,"13688 svchost.exe",,,"C:\Windows\System32\CorePrivacySettingsStore.dll",,,,,,,,,,1763581887350361600,,,,,,,,,,,140712456290304,140712456290304,263379,196608,2978004593,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3504940Z","2025-11-19 19:51:27.3504940Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\secur32.dll",,,,,,,,,,1763581887350494000,,,,,,,,,,,140712800223232,140712800223232,112844,53248,632019051,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3507703Z","2025-11-19 19:51:27.3507703Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\sspicli.dll",,,,,,,,,,1763581887350770300,,,,,,,,,,,140712833384448,140712833384448,339222,299008,3030302172,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3513844Z","2025-11-19 19:51:27.3513844Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\mlang.dll",,,,,,,,,,1763581887351384400,,,,,,,,,,,140712293761024,140712293761024,318858,278528,3734874788,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3518307Z","2025-11-19 19:51:27.3518307Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\wininet.dll",,,,,,,,,,1763581887351830700,,,,,,,,,,,140712675573760,140712675573760,2677835,2658304,2422963474,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3528482Z","2025-11-19 19:51:27.3528482Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",628,,,"13688 svchost.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,1763581887352848200,,,,,,,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3535252Z","2025-11-19 19:51:27.3535252Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\profapi.dll",,,,,,,,,,1763581887353525200,,,,,,,,,,,140712848850944,140712848850944,229548,167936,2447194521,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3539346Z","2025-11-19 19:51:27.3539346Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",628,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887353934600,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3544717Z","2025-11-19 19:51:27.3544717Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13688 svchost.exe",628,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887354471700,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3567254Z","2025-11-19 19:51:27.3567254Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13688 svchost.exe",628,,,"13688 svchost.exe",,,"C:\Windows\System32\wer.dll",,,,,,,,,,1763581887356725400,,,,,,,,,,,140712805728256,140712805728256,993632,995328,1987637995,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3571880Z","2025-11-19 19:51:27.3571880Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start ","13688 svchost.exe",628,,," 3864 WerFault.exe",,,"C:\Windows\System32\WerFault.exe",,,,,,,,,,1763581887357188000,,,,,,,,,,,,,681036,,630084362,,,,134080554863507391,,,,,3399,,,,,,0,"0x","","",13688,3398,1,1,0,0 -"2025-11-19 19:51:27.3587974Z","2025-11-19 19:51:27.3587974Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13688 svchost.exe",628,,," 3864 WerFault.exe",,,,,,,,,,,,,1763581887358797400,18446633084051173376,18446633084051148800,140702556693600,243,400613777408,2088,400611737600,400611729408,140702556693600,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3602299Z","2025-11-19 19:51:27.3602299Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\edputil.dll",,,,,,,,,,1763581887360229900,,,,,,,,,,,140712471560192,140712471560192,178059,167936,3474529356,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3602549Z","2025-11-19 19:51:27.3602549Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\WerFault.exe",,,,,,,,,,1763581887360254900,,,,,,,,,,,140702556684288,140702556684288,681036,647168,630084362,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3602715Z","2025-11-19 19:51:27.3602715Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581887360271500,,,,,,,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3631150Z","2025-11-19 19:51:27.3631150Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581887363115000,,,,,,,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3632467Z","2025-11-19 19:51:27.3632467Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581887363246700,,,,,,,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3632726Z","2025-11-19 19:51:27.3632726Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\AppXDeploymentClient.dll",,,,,,,,,,1763581887363272600,,,,,,,,,,,140712740257792,140712740257792,1575781,1499136,2615972959,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3633993Z","2025-11-19 19:51:27.3633993Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\imagehlp.dll",,,,,,,,,,1763581887363399300,,,,,,,,,,,140712892760064,140712892760064,200866,131072,2156568970,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3642495Z","2025-11-19 19:51:27.3642495Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581887364249500,,,,,,,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3643485Z","2025-11-19 19:51:27.3643485Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,,,,,,,,,,,1763581887364348500,18446633084052176896,18446633084052152320,140712899206080,0,400613785600,7460,400612261888,400612253696,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3644374Z","2025-11-19 19:51:27.3644374Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,1763581887364437400,,,,,,,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3644418Z","2025-11-19 19:51:27.3644418Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3864 WerFault.exe",7460,,," 3864 WerFault.exe",,,,,,,,,,,,,1763581887364441800,18446633084052205568,18446633084052180992,140712899206080,0,400613793792,9616,400615276544,400615268352,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3646595Z","2025-11-19 19:51:27.3646595Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581887364659600,,,,,,,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3647403Z","2025-11-19 19:51:27.3647403Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",9616,,," 3864 WerFault.exe",,,"C:\Windows\System32\cryptsp.dll",,,,,,,,,,1763581887364740300,,,,,,,,,,,140712839217152,140712839217152,146168,110592,1658328178,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3649326Z","2025-11-19 19:51:27.3649326Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3864 WerFault.exe",9616,,," 3864 WerFault.exe",,,,,,,,,,,,,1763581887364932600,18446633084052320256,18446633084052295680,140712899206080,0,400613801984,15292,400615800832,400615792640,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3649542Z","2025-11-19 19:51:27.3649542Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11148 calc.exe",8768,,,"11148 calc.exe",,,,,,,,,,,,,1763581887364954200,18446633084052348928,18446633084052324352,140712865112144,0,728547876864,13680,728550604800,728550596608,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3649911Z","2025-11-19 19:51:27.3649911Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581887364991100,,,,,,,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3651576Z","2025-11-19 19:51:27.3651576Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"11148 calc.exe",,,,,,,,,,,,,1763581887365157600,18446633084052377600,18446633084052353024,140712899206080,0,728547885056,4656,728551129088,728551120896,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3652532Z","2025-11-19 19:51:27.3652532Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581887365253200,,,,,,,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3652972Z","2025-11-19 19:51:27.3652972Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11148 calc.exe",4656,,,"11148 calc.exe",,,,,,,,,,,,,1763581887365297200,18446633084052406272,18446633084052381696,140712899206080,0,728547893248,11220,728551653376,728551645184,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3653666Z","2025-11-19 19:51:27.3653666Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",7460,,," 3864 WerFault.exe",,,"C:\Windows\System32\DiagnosticDataSettings.dll",,,,,,,,,,1763581887365366600,,,,,,,,,,,140712462319616,140712462319616,108991,61440,3234151774,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3654030Z","2025-11-19 19:51:27.3654030Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",15292,,," 3864 WerFault.exe",,,"C:\Windows\System32\wer.dll",,,,,,,,,,1763581887365403000,,,,,,,,,,,140712805728256,140712805728256,993632,983040,1987637995,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3655048Z","2025-11-19 19:51:27.3655048Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",4600,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,1763581887365504800,18446633084039716864,18446633084039692288,140711613062896,0,1046353240064,4600,1046401253376,1046401236992,140711613062896,1088976,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3655514Z","2025-11-19 19:51:27.3655514Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581887365551400,,,,,,,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3656953Z","2025-11-19 19:51:27.3656953Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",9616,,," 3864 WerFault.exe",,,"C:\Windows\System32\dbghelp.dll",,,,,,,,,,1763581887365695300,,,,,,,,,,,140712664104960,140712664104960,2282862,2367488,82455296,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3657638Z","2025-11-19 19:51:27.3657638Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,1763581887365763900,,,,,,,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3658290Z","2025-11-19 19:51:27.3658290Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",15292,,," 3864 WerFault.exe",,,"C:\Windows\System32\powrprof.dll",,,,,,,,,,1763581887365829000,,,,,,,,,,,140712848195584,140712848195584,457799,385024,2858637235,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3659218Z","2025-11-19 19:51:27.3659218Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",7460,,," 3864 WerFault.exe",,,"C:\Windows\System32\bcrypt.dll",,,,,,,,,,1763581887365921800,,,,,,,,,,,140712848654336,140712848654336,206048,172032,2893678010,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3661565Z","2025-11-19 19:51:27.3661565Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",9616,,," 3864 WerFault.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,1763581887366156500,,,,,,,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3662762Z","2025-11-19 19:51:27.3662762Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887366276200,18446633084039716864,18446633084039692288,140712899206080,0,780822667264,13720,780825788416,780825755648,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3663298Z","2025-11-19 19:51:27.3663298Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,1763581887366329800,,,,,,,,,,,1795834707968,1795834707968,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3663314Z","2025-11-19 19:51:27.3663314Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\twinui.appcore.dll",,,,,,,,,,1763581887366331500,,,,,,,,,,,140712458059776,140712458059776,827472,806912,3228774028,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3663661Z","2025-11-19 19:51:27.3663661Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",9616,,," 3864 WerFault.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581887366366200,,,,,,,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3663906Z","2025-11-19 19:51:27.3663906Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",7460,,," 3864 WerFault.exe",,,"C:\Windows\System32\cfgmgr32.dll",,,,,,,,,,1763581887366390600,,,,,,,,,,,140712845049856,140712845049856,385808,356352,1737777300,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3664039Z","2025-11-19 19:51:27.3664039Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,1763581887366403900,,,,,,,,,,,1795834707968,1795834707968,899838,892928,2878277657,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3666791Z","2025-11-19 19:51:27.3666791Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\ntmarta.dll",,,,,,,,,,1763581887366679100,,,,,,,,,,,140712831811584,140712831811584,265798,221184,3598506564,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3668651Z","2025-11-19 19:51:27.3668651Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",15292,,," 3864 WerFault.exe",,,"C:\Windows\System32\Faultrep.dll",,,,,,,,,,1763581887366865100,,,,,,,,,,,140712281309184,140712281309184,594974,548864,3149101438,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3673538Z","2025-11-19 19:51:27.3673538Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\dbgcore.dll",,,,,,,,,,1763581887367353800,,,,,,,,,,,140712478244864,140712478244864,263772,245760,3120784319,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3692321Z","2025-11-19 19:51:27.3692321Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\umpdc.dll",,,,,,,,,,1763581887369232100,,,,,,,,,,,140712848064512,140712848064512,98535,81920,1714427184,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3692565Z","2025-11-19 19:51:27.3692565Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\OneCoreUAPCommonProxyStub.dll",,,,,,,,,,1763581887369256500,,,,,,,,,,,140712713977856,140712713977856,6740758,6615040,2011948997,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3707568Z","2025-11-19 19:51:27.3707568Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.7019_none_3e06ffa0e335b8a8\comctl32.dll",,,,,,,,,,1763581887370756800,,,,,,,,,,,140712659910656,140712659910656,2747780,2703360,4095768276,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3708896Z","2025-11-19 19:51:27.3708896Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,1763581887370889600,,,,,,,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3710066Z","2025-11-19 19:51:27.3710066Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,1763581887371006600,,,,,,,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3711186Z","2025-11-19 19:51:27.3711186Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,1763581887371118600,,,,,,,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3712575Z","2025-11-19 19:51:27.3712575Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,1763581887371257500,,,,,,,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3736545Z","2025-11-19 19:51:27.3736545Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887373654500,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3742277Z","2025-11-19 19:51:27.3742277Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887374227700,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3743770Z","2025-11-19 19:51:27.3743770Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\CorePrivacySettingsStore.dll",,,,,,,,,,1763581887374377000,,,,,,,,,,,140712456290304,140712456290304,263379,196608,2978004593,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3767542Z","2025-11-19 19:51:27.3767542Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,1763581887376754200,,,,,,,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3778395Z","2025-11-19 19:51:27.3778395Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887377839500,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3783459Z","2025-11-19 19:51:27.3783459Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887378345900,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3812649Z","2025-11-19 19:51:27.3812649Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",14368,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,1763581887381264900,18446633084052434944,18446633084052410368,140712891545280,0,199839866880,11156,199839318016,199839309824,140712891545280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3823710Z","2025-11-19 19:51:27.3823710Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3532 svchost.exe",,,,,,,,,,,,,1763581887382371000,18446633084052578304,18446633084052553728,140712899206080,0,761505034240,3332,761506824192,761506791424,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3824362Z","2025-11-19 19:51:27.3824362Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4404 svchost.exe",12560,,," 4404 svchost.exe",,,,,,,,,,,,,1763581887382436200,18446633084052750336,18446633084052725760,140712865112144,98,679905837056,13712,679909261312,679909228544,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3850457Z","2025-11-19 19:51:27.3850457Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1416 ApplicationFrameHost.exe",11156,,," 1416 ApplicationFrameHost.exe",,,"C:\Windows\System32\d3d10warp.dll",,,,,,,,,,1763581887385045700,,,,,,,,,,,140712731869184,140712731869184,5958575,5943296,1147803111,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3860383Z","2025-11-19 19:51:27.3860383Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,1763581887386038300,,,,,,,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3862869Z","2025-11-19 19:51:27.3862869Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3864 WerFault.exe",9616,,," 3864 WerFault.exe",,,,,,,,,,,,,1763581887386286900,18446633084052205568,18446633084052180992,140712899206080,0,400613793792,9616,400615276544,400615264256,140712899206080,6645135,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3862920Z","2025-11-19 19:51:27.3862920Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3864 WerFault.exe",15292,,," 3864 WerFault.exe",,,,,,,,,,,,,1763581887386292000,18446633084052320256,18446633084052295680,140712899206080,0,400613801984,15292,400615800832,400615792640,140712899206080,7320318,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3863070Z","2025-11-19 19:51:27.3863070Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3864 WerFault.exe",7460,,," 3864 WerFault.exe",,,,,,,,,,,,,1763581887386307000,18446633084052176896,18446633084052152320,140712899206080,0,400613785600,7460,400612261888,400612253696,140712899206080,8436825,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3868922Z","2025-11-19 19:51:27.3868922Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,,,,,,,,,,,1763581887386892200,18446633084051173376,18446633084051148800,140702556693600,0,400613777408,2088,400611737600,400611696640,140702556693600,88862289,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3870995Z","2025-11-19 19:51:27.3870995Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\WerFault.exe",,,,,,,,,,1763581887387099500,,,,,,,,,,,140702556684288,140702556684288,681036,647168,630084362,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3871200Z","2025-11-19 19:51:27.3871200Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\Faultrep.dll",,,,,,,,,,1763581887387120000,,,,,,,,,,,140712281309184,140712281309184,594974,548864,3149101438,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3871304Z","2025-11-19 19:51:27.3871304Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\CorePrivacySettingsStore.dll",,,,,,,,,,1763581887387130400,,,,,,,,,,,140712456290304,140712456290304,263379,196608,2978004593,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3871400Z","2025-11-19 19:51:27.3871400Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\DiagnosticDataSettings.dll",,,,,,,,,,1763581887387140000,,,,,,,,,,,140712462319616,140712462319616,108991,61440,3234151774,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3871483Z","2025-11-19 19:51:27.3871483Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\dbgcore.dll",,,,,,,,,,1763581887387148300,,,,,,,,,,,140712478244864,140712478244864,263772,245760,3120784319,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3871520Z","2025-11-19 19:51:27.3871520Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.7019_none_3e06ffa0e335b8a8\comctl32.dll",,,,,,,,,,1763581887387152000,,,,,,,,,,,140712659910656,140712659910656,2747780,2703360,4095768276,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3871837Z","2025-11-19 19:51:27.3871837Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\dbghelp.dll",,,,,,,,,,1763581887387183700,,,,,,,,,,,140712664104960,140712664104960,2282862,2367488,82455296,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3871932Z","2025-11-19 19:51:27.3871932Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\wer.dll",,,,,,,,,,1763581887387193200,,,,,,,,,,,140712805728256,140712805728256,993632,983040,1987637995,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3871997Z","2025-11-19 19:51:27.3871997Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,1763581887387199700,,,,,,,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3872082Z","2025-11-19 19:51:27.3872082Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\ntmarta.dll",,,,,,,,,,1763581887387208200,,,,,,,,,,,140712831811584,140712831811584,265798,221184,3598506564,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3872171Z","2025-11-19 19:51:27.3872171Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\cryptsp.dll",,,,,,,,,,1763581887387217100,,,,,,,,,,,140712839217152,140712839217152,146168,110592,1658328178,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3872252Z","2025-11-19 19:51:27.3872252Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\cfgmgr32.dll",,,,,,,,,,1763581887387225200,,,,,,,,,,,140712845049856,140712845049856,385808,356352,1737777300,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3872647Z","2025-11-19 19:51:27.3872647Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\umpdc.dll",,,,,,,,,,1763581887387264700,,,,,,,,,,,140712848064512,140712848064512,98535,81920,1714427184,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3872743Z","2025-11-19 19:51:27.3872743Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\powrprof.dll",,,,,,,,,,1763581887387274300,,,,,,,,,,,140712848195584,140712848195584,457799,385024,2858637235,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3872833Z","2025-11-19 19:51:27.3872833Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\bcrypt.dll",,,,,,,,,,1763581887387283300,,,,,,,,,,,140712848654336,140712848654336,206048,172032,2893678010,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3872907Z","2025-11-19 19:51:27.3872907Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,1763581887387290700,,,,,,,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3873058Z","2025-11-19 19:51:27.3873058Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581887387305800,,,,,,,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3873120Z","2025-11-19 19:51:27.3873120Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,1763581887387312000,,,,,,,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3873193Z","2025-11-19 19:51:27.3873193Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581887387319300,,,,,,,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3873259Z","2025-11-19 19:51:27.3873259Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581887387325900,,,,,,,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3873323Z","2025-11-19 19:51:27.3873323Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,1763581887387332300,,,,,,,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3873401Z","2025-11-19 19:51:27.3873401Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581887387340100,,,,,,,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3873470Z","2025-11-19 19:51:27.3873470Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,1763581887387347000,,,,,,,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3873596Z","2025-11-19 19:51:27.3873596Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581887387359600,,,,,,,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3873691Z","2025-11-19 19:51:27.3873691Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,1763581887387369100,,,,,,,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3873757Z","2025-11-19 19:51:27.3873757Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581887387375700,,,,,,,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3873811Z","2025-11-19 19:51:27.3873811Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,1763581887387381100,,,,,,,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3873879Z","2025-11-19 19:51:27.3873879Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,1763581887387387900,,,,,,,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3873943Z","2025-11-19 19:51:27.3873943Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,1763581887387394300,,,,,,,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3874017Z","2025-11-19 19:51:27.3874017Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581887387401700,,,,,,,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3874082Z","2025-11-19 19:51:27.3874082Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581887387408200,,,,,,,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3874198Z","2025-11-19 19:51:27.3874198Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581887387419800,,,,,,,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3874280Z","2025-11-19 19:51:27.3874280Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"WerFault.exe",,,,,,,,,,1763581887387428000,,,,,,,,,,,,,,,,1851392,1888256,113864608,134080554863507391,0,134080554863803366,64,0,3399,1,5,1,0,0,,,,,,,,,, -"2025-11-19 19:51:27.3884600Z","2025-11-19 19:51:27.3884600Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",11156,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,1763581887388460000,18446633084052320256,18446633084052295680,140712891292720,0,199839875072,10204,199842332672,199842324480,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3889413Z","2025-11-19 19:51:27.3889413Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",628,,,"13688 svchost.exe",,,"C:\Windows\System32\Faultrep.dll",,,,,,,,,,1763581887388941300,,,,,,,,,,,140712281309184,140712281309184,594974,548864,3149101438,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3891231Z","2025-11-19 19:51:27.3891231Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",11156,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,1763581887389123100,18446633084051173376,18446633084051148800,140712891292720,0,199839883264,1424,199843381248,199843373056,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3897882Z","2025-11-19 19:51:27.3897882Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",15228,,," 2456 Memory Compression",,,,,,,,,,,,,1763581887389788300,18446633084052205568,18446633084052180992,18446735306729542320,0,0,11548,0,0,18446735306729542320,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3898079Z","2025-11-19 19:51:27.3898079Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",15228,,," 2456 Memory Compression",,,,,,,,,,,,,1763581887389807900,18446633084052807680,18446633084052783104,18446735306729542320,0,0,636,0,0,18446735306729542320,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3898424Z","2025-11-19 19:51:27.3898424Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",15228,,," 2456 Memory Compression",,,,,,,,,,,,,1763581887389842400,18446633084052922368,18446633084052897792,18446735306728238208,0,0,13072,0,0,18446735306728238208,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3898960Z","2025-11-19 19:51:27.3898960Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",15228,,," 2456 Memory Compression",,,,,,,,,,,,,1763581887389896000,18446633084053008384,18446633084052983808,18446735306729822480,0,0,13508,0,0,18446735306729822480,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3899741Z","2025-11-19 19:51:27.3899741Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",628,,,"13688 svchost.exe",,,"C:\Windows\System32\wer.dll",,,,,,,,,,1763581887389974100,,,,,,,,,,,140712805728256,140712805728256,993632,983040,1987637995,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3902495Z","2025-11-19 19:51:27.3902495Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 6028 svchost.exe",15228,,,"13736 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe\CalculatorApp.exe",,,,,,,,,,1763581887390249500,,,,,,,,,,,,,0,,1758293941,,,,134080554863834658,,,,,3401,,,,,,3,"0x","Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe","App",4340,106,3,0,0,1 -"2025-11-19 19:51:27.3906927Z","2025-11-19 19:51:27.3906927Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4404 svchost.exe",11720,,," 4404 svchost.exe",,,,,,,,,,,,,1763581887390692700,18446633084053065728,18446633084053041152,140712899206080,0,679905845248,14572,679909785600,679909752832,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3909406Z","2025-11-19 19:51:27.3909406Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",628,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887390940600,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3912189Z","2025-11-19 19:51:27.3912189Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",15228,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887391218900,18446633084050886656,18446633084050862080,140700165242880,5,320273809408,6548,320276004864,320276000768,140700165242880,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3915564Z","2025-11-19 19:51:27.3915564Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13688 svchost.exe",628,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887391556400,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3930939Z","2025-11-19 19:51:27.3930939Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe\CalculatorApp.exe",,,,,,,,,,1763581887393093900,,,,,,,,,,,140700165210112,140700165210112,0,36864,1758293941,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3931206Z","2025-11-19 19:51:27.3931206Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581887393120600,,,,,,,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3937673Z","2025-11-19 19:51:27.3937673Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581887393767300,,,,,,,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3938781Z","2025-11-19 19:51:27.3938781Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581887393878100,,,,,,,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3945627Z","2025-11-19 19:51:27.3945627Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",628,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887394562700,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3951958Z","2025-11-19 19:51:27.3951958Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13688 svchost.exe",628,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887395195800,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3959109Z","2025-11-19 19:51:27.3959109Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887395910900,18446633084053323776,18446633084053299200,140712899206080,0,320273817600,14660,320277053440,320277049344,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3976099Z","2025-11-19 19:51:27.3976099Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe\CalculatorApp.dll",,,,,,,,,,1763581887397609900,,,,,,,,,,,140709595119616,140709595119616,0,6352896,1758293941,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3977891Z","2025-11-19 19:51:27.3977891Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,1763581887397789100,,,,,,,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3977969Z","2025-11-19 19:51:27.3977969Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",14660,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887397796900,18446633084053237760,18446633084053213184,140712899206080,0,320273825792,6780,320278102016,320278097920,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3979342Z","2025-11-19 19:51:27.3979342Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581887397934200,,,,,,,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3980521Z","2025-11-19 19:51:27.3980521Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887398052100,18446633084053610496,18446633084053585920,140712899206080,0,320273833984,8620,320279150592,320279146496,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3980821Z","2025-11-19 19:51:27.3980821Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",628,,,"13688 svchost.exe",,,"C:\Windows\System32\userenv.dll",,,,,,,,,,1763581887398082100,,,,,,,,,,,140712837054464,140712837054464,245008,176128,731547084,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3981144Z","2025-11-19 19:51:27.3981144Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581887398114400,,,,,,,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3982898Z","2025-11-19 19:51:27.3982898Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6780,,,"13736 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.2.2_2.2.28604.0_x64__8wekyb3d8bbwe\mrt100_app.dll",,,,,,,,,,1763581887398289900,,,,,,,,,,,140711791951872,140711791951872,491795,548864,1580779188,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3983144Z","2025-11-19 19:51:27.3983144Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,1763581887398314400,,,,,,,,,,,140712851341312,140712851341312,1524912,1486848,1404855129,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3986643Z","2025-11-19 19:51:27.3986643Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6780,,,"13736 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe\clrcompression.dll",,,,,,,,,,1763581887398664400,,,,,,,,,,,140712630616064,140712630616064,70610,77824,1653667599,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3987145Z","2025-11-19 19:51:27.3987145Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.33519.0_x64__8wekyb3d8bbwe\vcruntime140_app.dll",,,,,,,,,,1763581887398714500,,,,,,,,,,,140712297627648,140712297627648,155734,118784,1024347489,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3987993Z","2025-11-19 19:51:27.3987993Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6780,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\ole32.dll",,,,,,,,,,1763581887398799300,,,,,,,,,,,140712878473216,140712878473216,1689904,1667072,1018821057,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3988476Z","2025-11-19 19:51:27.3988476Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",628,,,"13688 svchost.exe",,,"C:\Windows\System32\profapi.dll",,,,,,,,,,1763581887398847600,,,,,,,,,,,140712848850944,140712848850944,229548,167936,2447194521,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3989457Z","2025-11-19 19:51:27.3989457Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6780,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581887398945700,,,,,,,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3991252Z","2025-11-19 19:51:27.3991252Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6780,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,1763581887399125200,,,,,,,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3992666Z","2025-11-19 19:51:27.3992666Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6780,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,1763581887399266700,,,,,,,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3993866Z","2025-11-19 19:51:27.3993866Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6780,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,1763581887399386600,,,,,,,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3995441Z","2025-11-19 19:51:27.3995441Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6780,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,1763581887399544100,,,,,,,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4002208Z","2025-11-19 19:51:27.4002208Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",628,,,"13688 svchost.exe",,,"C:\Windows\System32\sspicli.dll",,,,,,,,,,1763581887400220800,,,,,,,,,,,140712833384448,140712833384448,339222,299008,3030302172,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4003875Z","2025-11-19 19:51:27.4003875Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",14660,,,"13736 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.2.2_2.2.29512.0_x64__8wekyb3d8bbwe\SharedLibrary.dll",,,,,,,,,,1763581887400387500,,,,,,,,,,,140709581684736,140709581684736,13461317,13422592,1605180014,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4004983Z","2025-11-19 19:51:27.4004983Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",14660,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581887400498400,,,,,,,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4005967Z","2025-11-19 19:51:27.4005967Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",14660,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581887400596800,,,,,,,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4007005Z","2025-11-19 19:51:27.4007005Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",14660,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581887400700500,,,,,,,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4008393Z","2025-11-19 19:51:27.4008393Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",14660,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,1763581887400839300,,,,,,,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4010598Z","2025-11-19 19:51:27.4010598Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",14660,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\normaliz.dll",,,,,,,,,,1763581887401059800,,,,,,,,,,,140712868773888,140712868773888,48733,32768,3139002400,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4011699Z","2025-11-19 19:51:27.4011699Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6780,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\bcrypt.dll",,,,,,,,,,1763581887401169900,,,,,,,,,,,140712848654336,140712848654336,206048,172032,2893678010,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4011746Z","2025-11-19 19:51:27.4011746Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",14660,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\crypt32.dll",,,,,,,,,,1763581887401174600,,,,,,,,,,,140712849768448,140712849768448,1584869,1536000,3438168074,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4011829Z","2025-11-19 19:51:27.4011829Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start ","13688 svchost.exe",628,,," 3676 WerFault.exe",,,"C:\Windows\System32\WerFault.exe",,,,,,,,,,1763581887401182900,,,,,,,,,,,,,681036,,630084362,,,,134080554863942943,,,,,3402,,,,,,0,"0x","","",1436,3396,3,0,0,1 -"2025-11-19 19:51:27.4017608Z","2025-11-19 19:51:27.4017608Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",14660,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\dpapi.dll",,,,,,,,,,1763581887401760900,,,,,,,,,,,140712845574144,140712845574144,42814,40960,2473566603,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4029543Z","2025-11-19 19:51:27.4029543Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\mrt100.dll",,,,,,,,,,1763581887402954300,,,,,,,,,,,140712630550528,140712630550528,102582,40960,1265422184,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4030141Z","2025-11-19 19:51:27.4030141Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13688 svchost.exe",628,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581887403014100,18446633084051374080,18446633084051349504,140702556693600,243,859767218176,14180,859767832576,859767824384,140702556693600,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4032996Z","2025-11-19 19:51:27.4032996Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",6292,,," 5184 explorer.exe",,,,,,,,,,,,,1763581887403299600,18446633084053667840,18446633084053643264,140712891292720,0,15302656,6204,214564864,214507520,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4037373Z","2025-11-19 19:51:27.4037373Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887403737300,18446633084053696512,18446633084053671936,140712899206080,0,320273842176,9360,320280199168,320280195072,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4039839Z","2025-11-19 19:51:27.4039839Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,1763581887403983900,,,,,,,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4044498Z","2025-11-19 19:51:27.4044498Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,1763581887404449800,,,,,,,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4047110Z","2025-11-19 19:51:27.4047110Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\WerFault.exe",,,,,,,,,,1763581887404711000,,,,,,,,,,,140702556684288,140702556684288,681036,647168,630084362,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4047575Z","2025-11-19 19:51:27.4047575Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581887404757500,,,,,,,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4053230Z","2025-11-19 19:51:27.4053230Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\rmclient.dll",,,,,,,,,,1763581887405323000,,,,,,,,,,,140712808808448,140712808808448,282526,221184,1891057501,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4054583Z","2025-11-19 19:51:27.4054583Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581887405458300,,,,,,,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4055710Z","2025-11-19 19:51:27.4055710Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581887405571000,,,,,,,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4056941Z","2025-11-19 19:51:27.4056941Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887405694100,18446633084053839872,18446633084053815296,140711792263472,0,320273850368,10884,320281247744,320281243648,140711792263472,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4062220Z","2025-11-19 19:51:27.4062220Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,1763581887406222100,,,,,,,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4067884Z","2025-11-19 19:51:27.4067884Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581887406788400,,,,,,,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4068904Z","2025-11-19 19:51:27.4068904Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581887406890400,18446633084053581824,18446633084053557248,140712899206080,0,859767226368,13460,859768356864,859768348672,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4069825Z","2025-11-19 19:51:27.4069825Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,1763581887406982500,,,,,,,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4069840Z","2025-11-19 19:51:27.4069840Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3676 WerFault.exe",13460,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581887406984000,18446633084053868544,18446633084053843968,140712899206080,0,859767234560,8356,859768881152,859768872960,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4071480Z","2025-11-19 19:51:27.4071480Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581887407148000,,,,,,,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4073150Z","2025-11-19 19:51:27.4073150Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",8356,,," 3676 WerFault.exe",,,"C:\Windows\System32\cryptsp.dll",,,,,,,,,,1763581887407315000,,,,,,,,,,,140712839217152,140712839217152,146168,110592,1658328178,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4073300Z","2025-11-19 19:51:27.4073300Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581887407330100,18446633084053897216,18446633084053872640,140712899206080,0,859767242752,11036,859769405440,859769397248,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4074423Z","2025-11-19 19:51:27.4074423Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581887407442300,,,,,,,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4074830Z","2025-11-19 19:51:27.4074830Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1416 ApplicationFrameHost.exe",10204,,," 1416 ApplicationFrameHost.exe",,,"C:\Windows\System32\AppXDeploymentClient.dll",,,,,,,,,,1763581887407483000,,,,,,,,,,,140712740257792,140712740257792,1575781,1499136,2615972959,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4076592Z","2025-11-19 19:51:27.4076592Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1416 ApplicationFrameHost.exe",10204,,," 1416 ApplicationFrameHost.exe",,,"C:\Windows\System32\imagehlp.dll",,,,,,,,,,1763581887407659200,,,,,,,,,,,140712892760064,140712892760064,200866,131072,2156568970,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4076795Z","2025-11-19 19:51:27.4076795Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581887407679600,,,,,,,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4077531Z","2025-11-19 19:51:27.4077531Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",10204,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,1763581887407753100,18446633084053925888,18446633084053901312,140712899206080,0,199839891456,4732,199843905536,199843897344,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4078161Z","2025-11-19 19:51:27.4078161Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",11036,,," 3676 WerFault.exe",,,"C:\Windows\System32\wer.dll",,,,,,,,,,1763581887407816100,,,,,,,,,,,140712805728256,140712805728256,993632,983040,1987637995,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4078845Z","2025-11-19 19:51:27.4078845Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581887407884500,,,,,,,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4079188Z","2025-11-19 19:51:27.4079188Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",13460,,," 3676 WerFault.exe",,,"C:\Windows\System32\dbghelp.dll",,,,,,,,,,1763581887407918900,,,,,,,,,,,140712664104960,140712664104960,2282862,2367488,82455296,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4081531Z","2025-11-19 19:51:27.4081531Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",13460,,," 3676 WerFault.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,1763581887408153100,,,,,,,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4082664Z","2025-11-19 19:51:27.4082664Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,1763581887408266500,,,,,,,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4083184Z","2025-11-19 19:51:27.4083184Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",13460,,," 3676 WerFault.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581887408318500,,,,,,,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4083693Z","2025-11-19 19:51:27.4083693Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1416 ApplicationFrameHost.exe",1424,,," 1416 ApplicationFrameHost.exe",,,"C:\Windows\System32\Windows.StateRepositoryPS.dll",,,,,,,,,,1763581887408369300,,,,,,,,,,,140712490369024,140712490369024,879719,802816,374042279,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4085440Z","2025-11-19 19:51:27.4085440Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",11036,,," 3676 WerFault.exe",,,"C:\Windows\System32\powrprof.dll",,,,,,,,,,1763581887408544000,,,,,,,,,,,140712848195584,140712848195584,457799,385024,2858637235,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4086792Z","2025-11-19 19:51:27.4086792Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\bcrypt.dll",,,,,,,,,,1763581887408679200,,,,,,,,,,,140712848654336,140712848654336,206048,172032,2893678010,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4086899Z","2025-11-19 19:51:27.4086899Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",13460,,," 3676 WerFault.exe",,,"C:\Windows\System32\cfgmgr32.dll",,,,,,,,,,1763581887408689900,,,,,,,,,,,140712845049856,140712845049856,385808,356352,1737777300,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4088844Z","2025-11-19 19:51:27.4088844Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",8356,,," 3676 WerFault.exe",,,"C:\Windows\System32\DiagnosticDataSettings.dll",,,,,,,,,,1763581887408884400,,,,,,,,,,,140712462319616,140712462319616,108991,61440,3234151774,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4090222Z","2025-11-19 19:51:27.4090222Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1416 ApplicationFrameHost.exe",10204,,," 1416 ApplicationFrameHost.exe",,,"C:\Windows\System32\imagehlp.dll",,,,,,,,,,1763581887409022200,,,,,,,,,,,140712892760064,140712892760064,200866,143360,2156568970,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4090349Z","2025-11-19 19:51:27.4090349Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\ntmarta.dll",,,,,,,,,,1763581887409034900,,,,,,,,,,,140712831811584,140712831811584,265798,221184,3598506564,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4090868Z","2025-11-19 19:51:27.4090868Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1416 ApplicationFrameHost.exe",10204,,," 1416 ApplicationFrameHost.exe",,,"C:\Windows\System32\AppXDeploymentClient.dll",,,,,,,,,,1763581887409086900,,,,,,,,,,,140712740257792,140712740257792,1575781,1511424,2615972959,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4093744Z","2025-11-19 19:51:27.4093744Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",11036,,," 3676 WerFault.exe",,,"C:\Windows\System32\Faultrep.dll",,,,,,,,,,1763581887409374500,,,,,,,,,,,140712281309184,140712281309184,594974,548864,3149101438,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4096890Z","2025-11-19 19:51:27.4096890Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",13460,,," 3676 WerFault.exe",,,"C:\Windows\System32\dbgcore.dll",,,,,,,,,,1763581887409689000,,,,,,,,,,,140712478244864,140712478244864,263772,245760,3120784319,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4104144Z","2025-11-19 19:51:27.4104144Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\twinapi.appcore.dll",,,,,,,,,,1763581887410414400,,,,,,,,,,,140712720924672,140712720924672,2401519,2375680,2646458233,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4109892Z","2025-11-19 19:51:27.4109892Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",1424,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,1763581887410989200,18446633084053954560,18446633084053929984,140712891292720,0,199839899648,13520,199847051264,199847043072,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4113830Z","2025-11-19 19:51:27.4113830Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\umpdc.dll",,,,,,,,,,1763581887411383000,,,,,,,,,,,140712848064512,140712848064512,98535,81920,1714427184,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4122533Z","2025-11-19 19:51:27.4122533Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887412253300,18446633084053409792,18446633084053385216,140712865112144,0,320273858560,14384,320282296320,320282288128,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4125886Z","2025-11-19 19:51:27.4125886Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",9360,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887412588700,18446633084053983232,18446633084053958656,140712899206080,0,320273866752,14544,320283344896,320283340800,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4129553Z","2025-11-19 19:51:27.4129553Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.7019_none_3e06ffa0e335b8a8\comctl32.dll",,,,,,,,,,1763581887412955300,,,,,,,,,,,140712659910656,140712659910656,2747780,2703360,4095768276,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4129568Z","2025-11-19 19:51:27.4129568Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\Windows.UI.Xaml.dll",,,,,,,,,,1763581887412956800,,,,,,,,,,,140712596865024,140712596865024,17882163,17858560,706442395,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4130748Z","2025-11-19 19:51:27.4130748Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,1763581887413074800,,,,,,,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4131880Z","2025-11-19 19:51:27.4131880Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,1763581887413188000,,,,,,,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4133043Z","2025-11-19 19:51:27.4133043Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,1763581887413304300,,,,,,,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4134368Z","2025-11-19 19:51:27.4134368Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,1763581887413436800,,,,,,,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4137159Z","2025-11-19 19:51:27.4137159Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\iertutil.dll",,,,,,,,,,1763581887413716000,,,,,,,,,,,140712642805760,140712642805760,2984761,2904064,3815768453,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4139854Z","2025-11-19 19:51:27.4139854Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,1763581887413985400,,,,,,,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4141245Z","2025-11-19 19:51:27.4141245Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",14660,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\srvcli.dll",,,,,,,,,,1763581887414124500,,,,,,,,,,,140712668954624,140712668954624,181029,167936,239922031,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4143023Z","2025-11-19 19:51:27.4143023Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6780,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\netutils.dll",,,,,,,,,,1763581887414302300,,,,,,,,,,,140712825847808,140712825847808,80696,53248,865845000,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4167011Z","2025-11-19 19:51:27.4167011Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\uxtheme.dll",,,,,,,,,,1763581887416701100,,,,,,,,,,,140712802254848,140712802254848,696534,696320,1695798817,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4178760Z","2025-11-19 19:51:27.4178760Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\msctf.dll",,,,,,,,,,1763581887417876100,,,,,,,,,,,140712893022208,140712893022208,1455420,1433600,4155718050,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4184679Z","2025-11-19 19:51:27.4184679Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\execmodelproxy.dll",,,,,,,,,,1763581887418467900,,,,,,,,,,,140712462647296,140712462647296,123398,81920,3588866498,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4201691Z","2025-11-19 19:51:27.4201691Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",9360,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\OneCoreUAPCommonProxyStub.dll",,,,,,,,,,1763581887420169100,,,,,,,,,,,140712713977856,140712713977856,6740758,6615040,2011948997,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4214049Z","2025-11-19 19:51:27.4214049Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887421404900,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4218764Z","2025-11-19 19:51:27.4218764Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,1763581887421876400,,,,,,,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4219402Z","2025-11-19 19:51:27.4219402Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887421940200,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4220809Z","2025-11-19 19:51:27.4220809Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\CorePrivacySettingsStore.dll",,,,,,,,,,1763581887422080900,,,,,,,,,,,140712456290304,140712456290304,263379,196608,2978004593,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4222062Z","2025-11-19 19:51:27.4222062Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887422206200,18446633084054126592,18446633084054102016,140712891545280,0,320273874944,7540,320284393472,320284389376,140712891545280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4226943Z","2025-11-19 19:51:27.4226943Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\Windows.UI.dll",,,,,,,,,,1763581887422694300,,,,,,,,,,,140712615346176,140712615346176,1414164,1376256,3301850593,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4234297Z","2025-11-19 19:51:27.4234297Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\CoreMessaging.dll",,,,,,,,,,1763581887423429700,,,,,,,,,,,140712796160000,140712796160000,1232710,1208320,2155847221,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4240647Z","2025-11-19 19:51:27.4240647Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,1763581887424064700,,,,,,,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4252911Z","2025-11-19 19:51:27.4252911Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\uxtheme.dll",,,,,,,,,,1763581887425291100,,,,,,,,,,,140712802254848,140712802254848,696534,696320,1695798817,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4253028Z","2025-11-19 19:51:27.4253028Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887425302800,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4259673Z","2025-11-19 19:51:27.4259673Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887425967300,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4267062Z","2025-11-19 19:51:27.4267062Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\urlmon.dll",,,,,,,,,,1763581887426706200,,,,,,,,,,,140712669609984,140712669609984,1970671,1957888,260716450,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4268614Z","2025-11-19 19:51:27.4268614Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,1763581887426861400,,,,,,,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4270275Z","2025-11-19 19:51:27.4270275Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",8620,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\windows.storage.dll",,,,,,,,,,1763581887427027500,,,,,,,,,,,140712812412928,140712812412928,8877403,8769536,3667346596,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4290882Z","2025-11-19 19:51:27.4290882Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887429088200,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4296578Z","2025-11-19 19:51:27.4296578Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887429657800,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4302869Z","2025-11-19 19:51:27.4302869Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887430286900,18446633084053524480,18446633084053499904,140712600145104,0,320273883136,8000,320285442048,320285437952,140712600145104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4303353Z","2025-11-19 19:51:27.4303353Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887430335300,18446633084054011904,18446633084053987328,140712604173856,0,320273891328,4596,320286490624,320286486528,140712604173856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4308158Z","2025-11-19 19:51:27.4308158Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",8000,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\dxgi.dll",,,,,,,,,,1763581887430815800,,,,,,,,,,,140712803631104,140712803631104,1320096,1282048,1861212996,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4310946Z","2025-11-19 19:51:27.4310946Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",8620,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\powrprof.dll",,,,,,,,,,1763581887431094600,,,,,,,,,,,140712848195584,140712848195584,457799,385024,2858637235,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4316411Z","2025-11-19 19:51:27.4316411Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",8000,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\umpdc.dll",,,,,,,,,,1763581887431641100,,,,,,,,,,,140712848064512,140712848064512,98535,81920,1714427184,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4329182Z","2025-11-19 19:51:27.4329182Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",8000,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\DXCore.dll",,,,,,,,,,1763581887432918200,,,,,,,,,,,140712805400576,140712805400576,331386,274432,2354081039,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4333119Z","2025-11-19 19:51:27.4333119Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",8000,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\ResourcePolicyClient.dll",,,,,,,,,,1763581887433311900,,,,,,,,,,,140712809070592,140712809070592,104020,81920,2069163340,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4339882Z","2025-11-19 19:51:27.4339882Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887433988200,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4346169Z","2025-11-19 19:51:27.4346169Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887434616900,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4346960Z","2025-11-19 19:51:27.4346960Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13736 CalculatorApp.exe",8000,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\ResourcePolicyClient.dll",,,,,,,,,,1763581887434696000,,,,,,,,,,,140712809070592,140712809070592,104020,94208,2069163340,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4349142Z","2025-11-19 19:51:27.4349142Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",8000,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\directxdatabasehelper.dll",,,,,,,,,,1763581887434914200,,,,,,,,,,,140712752709632,140712752709632,426573,405504,145563491,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4356916Z","2025-11-19 19:51:27.4356916Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",8000,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\cfgmgr32.dll",,,,,,,,,,1763581887435691600,,,,,,,,,,,140712845049856,140712845049856,385808,356352,1737777300,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4373316Z","2025-11-19 19:51:27.4373316Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887437331600,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4379117Z","2025-11-19 19:51:27.4379117Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887437911700,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4385144Z","2025-11-19 19:51:27.4385144Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",8000,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,1763581887438514400,,,,,,,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4401061Z","2025-11-19 19:51:27.4401061Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe\CalcViewModel.dll",,,,,,,,,,1763581887440106100,,,,,,,,,,,140709579456512,140709579456512,0,2224128,1758293703,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4404353Z","2025-11-19 19:51:27.4404353Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",14660,,,"13736 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.33519.0_x64__8wekyb3d8bbwe\msvcp140_app.dll",,,,,,,,,,1763581887440435300,,,,,,,,,,,140712297037824,140712297037824,626197,573440,3775341646,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4404381Z","2025-11-19 19:51:27.4404381Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",8620,,,"13736 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.33519.0_x64__8wekyb3d8bbwe\concrt140_app.dll",,,,,,,,,,1763581887440438100,,,,,,,,,,,140712297758720,140712297758720,326544,303104,3173964004,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4405198Z","2025-11-19 19:51:27.4405198Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6780,,,"13736 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.33519.0_x64__8wekyb3d8bbwe\vccorlib140_app.dll",,,,,,,,,,1763581887440519800,,,,,,,,,,,140711789264896,140711789264896,385886,335872,1316406955,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4405975Z","2025-11-19 19:51:27.4405975Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.33519.0_x64__8wekyb3d8bbwe\vcruntime140_1_app.dll",,,,,,,,,,1763581887440597500,,,,,,,,,,,140712543911936,140712543911936,99370,49152,606015248,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4414851Z","2025-11-19 19:51:27.4414851Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887441485100,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4420117Z","2025-11-19 19:51:27.4420117Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887442011700,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4422855Z","2025-11-19 19:51:27.4422855Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",8000,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\d3d11.dll",,,,,,,,,,1763581887442285500,,,,,,,,,,,140712786853888,140712786853888,2582658,2498560,2128032819,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4428160Z","2025-11-19 19:51:27.4428160Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\MrmCoreR.dll",,,,,,,,,,1763581887442816000,,,,,,,,,,,140712631926784,140712631926784,1191374,1146880,1078870765,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4435319Z","2025-11-19 19:51:27.4435319Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",8000,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\d3d10warp.dll",,,,,,,,,,1763581887443531900,,,,,,,,,,,140712731869184,140712731869184,5958575,5943296,1147803111,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4440256Z","2025-11-19 19:51:27.4440256Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\Windows.StateRepositoryClient.dll",,,,,,,,,,1763581887444025600,,,,,,,,,,,140712696610816,140712696610816,303673,290816,424989122,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4463643Z","2025-11-19 19:51:27.4463643Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",8000,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\d2d1.dll",,,,,,,,,,1763581887446364300,,,,,,,,,,,140712777744384,140712777744384,6610469,6537216,3013069957,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4487221Z","2025-11-19 19:51:27.4487221Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887448722100,18446633084054241280,18446633084054216704,140712899206080,0,780822675456,5172,780828409856,780828377088,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4488543Z","2025-11-19 19:51:27.4488543Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",8000,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\DWrite.dll",,,,,,,,,,1763581887448854300,,,,,,,,,,,140712784297984,140712784297984,2543119,2519040,1462185185,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4504577Z","2025-11-19 19:51:27.4504577Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\profapi.dll",,,,,,,,,,1763581887450457700,,,,,,,,,,,140712848850944,140712848850944,229548,167936,2447194521,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4509995Z","2025-11-19 19:51:27.4509995Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,1763581887450999500,,,,,,,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4510666Z","2025-11-19 19:51:27.4510666Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\AppXDeploymentClient.dll",,,,,,,,,,1763581887451066600,,,,,,,,,,,140712740257792,140712740257792,1575781,1499136,2615972959,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4512410Z","2025-11-19 19:51:27.4512410Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\imagehlp.dll",,,,,,,,,,1763581887451241000,,,,,,,,,,,140712892760064,140712892760064,200866,131072,2156568970,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4520175Z","2025-11-19 19:51:27.4520175Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",8000,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\TextShaping.dll",,,,,,,,,,1763581887452017500,,,,,,,,,,,140712585789440,140712585789440,770155,733184,2109619091,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4524504Z","2025-11-19 19:51:27.4524504Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\imagehlp.dll",,,,,,,,,,1763581887452450400,,,,,,,,,,,140712892760064,140712892760064,200866,143360,2156568970,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4525514Z","2025-11-19 19:51:27.4525514Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\AppXDeploymentClient.dll",,,,,,,,,,1763581887452551400,,,,,,,,,,,140712740257792,140712740257792,1575781,1511424,2615972959,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4528104Z","2025-11-19 19:51:27.4528104Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\aepic.dll",,,,,,,,,,1763581887452810400,,,,,,,,,,,140712428109824,140712428109824,641436,577536,321124434,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4535033Z","2025-11-19 19:51:27.4535033Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13736 CalculatorApp.exe",8000,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887453503300,18446633084053524480,18446633084053499904,140712600145104,0,320273883136,8000,320285442048,320285413376,140712600145104,59889936,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4541216Z","2025-11-19 19:51:27.4541216Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\BCP47mrm.dll",,,,,,,,,,1763581887454121600,,,,,,,,,,,140712628322304,140712628322304,278903,212992,835504572,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4549744Z","2025-11-19 19:51:27.4549744Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 7916 svchost.exe",,,,,,,,,,,,,1763581887454974400,18446633084054040576,18446633084054016000,140712899206080,0,401963950080,5540,401965842432,401965809664,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4551451Z","2025-11-19 19:51:27.4551451Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 7916 svchost.exe",5540,,," 7916 svchost.exe",,,,,,,,,,,,,1763581887455145100,18446633084054212608,18446633084054188032,140712899206080,90,401963958272,1484,401966366720,401966333952,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4554160Z","2025-11-19 19:51:27.4554160Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\AppXDeploymentClient.dll",,,,,,,,,,1763581887455416000,,,,,,,,,,,140712740257792,140712740257792,1575781,1499136,2615972959,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4555397Z","2025-11-19 19:51:27.4555397Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\imagehlp.dll",,,,,,,,,,1763581887455539700,,,,,,,,,,,140712892760064,140712892760064,200866,131072,2156568970,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4561714Z","2025-11-19 19:51:27.4561714Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\imagehlp.dll",,,,,,,,,,1763581887456171400,,,,,,,,,,,140712892760064,140712892760064,200866,143360,2156568970,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4562302Z","2025-11-19 19:51:27.4562302Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\AppXDeploymentClient.dll",,,,,,,,,,1763581887456230200,,,,,,,,,,,140712740257792,140712740257792,1575781,1511424,2615972959,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4578509Z","2025-11-19 19:51:27.4578509Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",6292,,," 5184 explorer.exe",,,,,,,,,,,,,1763581887457850900,18446633084053037056,18446633084053012480,140712891292720,0,15310848,3032,467664896,467607552,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4581793Z","2025-11-19 19:51:27.4581793Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887458179300,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4587989Z","2025-11-19 19:51:27.4587989Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887458798900,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4594189Z","2025-11-19 19:51:27.4594189Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887459418900,18446633084053524480,18446633084053499904,140712632221632,0,320273899520,11208,320285442048,320285437952,140712632221632,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4638483Z","2025-11-19 19:51:27.4638483Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.8_8.2501.31001.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.dll",,,,,,,,,,1763581887463848300,,,,,,,,,,,140712372011008,140712372011008,5866761,5873664,2056920596,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4668871Z","2025-11-19 19:51:27.4668871Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe\GraphControl.dll",,,,,,,,,,1763581887466887100,,,,,,,,,,,140711787692032,140711787692032,0,761856,1758293638,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4734579Z","2025-11-19 19:51:27.4734579Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\Windows.UI.Xaml.Controls.dll",,,,,,,,,,1763581887473457900,,,,,,,,,,,140712586575872,140712586575872,3327252,3313664,3689468694,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4798406Z","2025-11-19 19:51:27.4798406Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\msctf.dll",,,,,,,,,,1763581887479840600,,,,,,,,,,,140712893022208,140712893022208,1455420,1433600,4155718050,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4806572Z","2025-11-19 19:51:27.4806572Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2992 svchost.exe",14592,,," 2992 svchost.exe",,,,,,,,,,,,,1763581887480657200,18446633084053639168,18446633084053614592,140712899206080,186,170617987072,6428,170619043840,170619011072,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4824726Z","2025-11-19 19:51:27.4824726Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",9360,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\Windows.Shell.ServiceHostBuilder.dll",,,,,,,,,,1763581887482472600,,,,,,,,,,,140712531066880,140712531066880,142966,126976,3904637359,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4833157Z","2025-11-19 19:51:27.4833157Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2960 svchost.exe",13820,,," 2960 svchost.exe",,,,,,,,,,,,,1763581887483315700,18446633084054470656,18446633084054446080,140712891292720,287,403329781760,2140,403332661248,403332628480,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4835767Z","2025-11-19 19:51:27.4835767Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",9360,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\CoreUIComponents.dll",,,,,,,,,,1763581887483576700,,,,,,,,,,,140712742944768,140712742944768,3046501,3022848,801552868,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4862759Z","2025-11-19 19:51:27.4862759Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3204 Taskmgr.exe",5876,,," 3204 Taskmgr.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,1763581887486275900,,,,,,,,,,,140712479096832,140712479096832,1613415,1552384,2231457550,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4868565Z","2025-11-19 19:51:27.4868565Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\InputHost.dll",,,,,,,,,,1763581887486856500,,,,,,,,,,,140712583757824,140712583757824,1989124,1970176,2937052880,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4868955Z","2025-11-19 19:51:27.4868955Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3204 Taskmgr.exe",5876,,," 3204 Taskmgr.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,1763581887486895500,,,,,,,,,,,140712479096832,140712479096832,1613415,1564672,2231457550,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4879547Z","2025-11-19 19:51:27.4879547Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\cryptbase.dll",,,,,,,,,,1763581887487954700,,,,,,,,,,,140712839348224,140712839348224,63718,49152,3897879906,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4880926Z","2025-11-19 19:51:27.4880926Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2992 svchost.exe",4396,,," 2992 svchost.exe",,,,,,,,,,,,,1763581887488092600,18446633084054441984,18446633084054417408,140712899206080,186,170615898112,13424,170620092416,170620059648,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4915654Z","2025-11-19 19:51:27.4915654Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887491565400,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4921816Z","2025-11-19 19:51:27.4921816Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887492181600,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4935016Z","2025-11-19 19:51:27.4935016Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887493501600,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4944361Z","2025-11-19 19:51:27.4944361Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887494436100,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4960737Z","2025-11-19 19:51:27.4960737Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887496073700,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4966319Z","2025-11-19 19:51:27.4966319Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887496631900,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4976216Z","2025-11-19 19:51:27.4976216Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\netapi32.dll",,,,,,,,,,1763581887497621600,,,,,,,,,,,140712696348672,140712696348672,171999,106496,898597876,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4979770Z","2025-11-19 19:51:27.4979770Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\dsreg.dll",,,,,,,,,,1763581887497977000,,,,,,,,,,,140712764768256,140712764768256,1520707,1466368,4143332483,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4982389Z","2025-11-19 19:51:27.4982389Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",8356,,," 3676 WerFault.exe",,,"C:\Windows\System32\userenv.dll",,,,,,,,,,1763581887498238900,,,,,,,,,,,140712837054464,140712837054464,245008,176128,731547084,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4988065Z","2025-11-19 19:51:27.4988065Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\crypt32.dll",,,,,,,,,,1763581887498806500,,,,,,,,,,,140712849768448,140712849768448,1584869,1536000,3438168074,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4993768Z","2025-11-19 19:51:27.4993768Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581887499376800,18446633084054069248,18446633084054044672,140712899206080,0,859767250944,456,859769929728,859769921536,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5002393Z","2025-11-19 19:51:27.5002393Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\profapi.dll",,,,,,,,,,1763581887500239300,,,,,,,,,,,140712848850944,140712848850944,229548,167936,2447194521,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5006428Z","2025-11-19 19:51:27.5006428Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\UiaManager.dll",,,,,,,,,,1763581887500642800,,,,,,,,,,,140712461205504,140712461205504,941078,897024,2628067039,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5014047Z","2025-11-19 19:51:27.5014047Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887501404700,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5019608Z","2025-11-19 19:51:27.5019608Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887501960800,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5036392Z","2025-11-19 19:51:27.5036392Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887503639200,18446633084054880256,18446633084054855680,140712891292720,0,320273907712,14028,320287539200,320287535104,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5041948Z","2025-11-19 19:51:27.5041948Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887504194800,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5042407Z","2025-11-19 19:51:27.5042407Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\WindowManagementAPI.dll",,,,,,,,,,1763581887504240700,,,,,,,,,,,140712738422784,140712738422784,1825044,1794048,1605274449,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5048659Z","2025-11-19 19:51:27.5048659Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887504865900,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5074606Z","2025-11-19 19:51:27.5074606Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887507460600,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5074843Z","2025-11-19 19:51:27.5074843Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4340 sihost.exe",4288,,," 4340 sihost.exe",,,,,,,,,,,,,1763581887507484300,18446633084054736896,18446633084054712320,140712891292720,0,645640560640,12684,645647040512,645647032320,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5080079Z","2025-11-19 19:51:27.5080079Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887508007900,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5115085Z","2025-11-19 19:51:27.5115085Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887511508500,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5121006Z","2025-11-19 19:51:27.5121006Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887512100600,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5122408Z","2025-11-19 19:51:27.5122408Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\Windows.UI.Core.TextInput.dll",,,,,,,,,,1763581887512240800,,,,,,,,,,,140712572354560,140712572354560,1511216,1499136,21441667,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5128279Z","2025-11-19 19:51:27.5128279Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\TextInputFramework.dll",,,,,,,,,,1763581887512827900,,,,,,,,,,,140712628846592,140712628846592,1374424,1339392,3535451269,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5142559Z","2025-11-19 19:51:27.5142559Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887514255900,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5148329Z","2025-11-19 19:51:27.5148329Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887514832900,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5176411Z","2025-11-19 19:51:27.5176411Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887517641100,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5182726Z","2025-11-19 19:51:27.5182726Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887518272600,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5211286Z","2025-11-19 19:51:27.5211286Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\Windows.UI.Immersive.dll",,,,,,,,,,1763581887521128600,,,,,,,,,,,140712595423232,140712595423232,1424120,1372160,1559948871,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5216757Z","2025-11-19 19:51:27.5216757Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887521675700,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5223269Z","2025-11-19 19:51:27.5223269Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887522326900,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5227411Z","2025-11-19 19:51:27.5227411Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\DataExchange.dll",,,,,,,,,,1763581887522741100,,,,,,,,,,,140712406614016,140712406614016,399312,368640,696309968,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5241557Z","2025-11-19 19:51:27.5241557Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887524155700,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5248204Z","2025-11-19 19:51:27.5248204Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887524820400,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5249959Z","2025-11-19 19:51:27.5249959Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",8472,,," 1040 svchost.exe",,,,,,,,,,,,,1763581887524995900,18446633084054822912,18446633084054798336,140712899206080,0,256030941184,13368,256038141952,256038109184,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5251521Z","2025-11-19 19:51:27.5251521Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",14544,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887525152100,18446633084054851584,18446633084054827008,140712899206080,0,320273915904,8232,320288587776,320288583680,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5272466Z","2025-11-19 19:51:27.5272466Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887527246600,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5278286Z","2025-11-19 19:51:27.5278286Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887527828600,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5297584Z","2025-11-19 19:51:27.5297584Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\Windows.Storage.ApplicationData.dll",,,,,,,,,,1763581887529758400,,,,,,,,,,,140712299528192,140712299528192,453266,393216,843877859,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5301687Z","2025-11-19 19:51:27.5301687Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887530168700,18446633084054183936,18446633084054159360,140712865112144,0,320273924096,12316,320289636352,320289628160,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5480885Z","2025-11-19 19:51:27.5480885Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\psapi.dll",,,,,,,,,,1763581887548088500,,,,,,,,,,,140712898396160,140712898396160,102773,32768,992462114,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5485557Z","2025-11-19 19:51:27.5485557Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\version.dll",,,,,,,,,,1763581887548555700,,,,,,,,,,,140712753168384,140712753168384,72452,45056,2275202464,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5490372Z","2025-11-19 19:51:27.5490372Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",8232,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887549037200,18446633084053782528,18446633084053757952,140712899206080,0,320273932288,4792,320290684928,320290680832,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5528390Z","2025-11-19 19:51:27.5528390Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887552839000,18446633084054298624,18446633084054274048,140712297841152,0,320273940480,1904,320291733504,320291729408,140712297841152,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5531803Z","2025-11-19 19:51:27.5531803Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\Windows.Globalization.dll",,,,,,,,,,1763581887553180300,,,,,,,,,,,140712593457152,140712593457152,1640332,1634304,3240919660,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5646449Z","2025-11-19 19:51:27.5646449Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\verifier.dll",,,,,,,,,,1763581887564644900,,,,,,,,,,,140712390295552,140712390295552,444365,466944,1438812236,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5650330Z","2025-11-19 19:51:27.5650330Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\verifier.dll",,,,,,,,,,1763581887565033000,,,,,,,,,,,140712390295552,140712390295552,444365,479232,1438812236,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5650641Z","2025-11-19 19:51:27.5650641Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\psapi.dll",,,,,,,,,,1763581887565064100,,,,,,,,,,,140712898396160,140712898396160,102773,45056,992462114,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5651167Z","2025-11-19 19:51:27.5651167Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\version.dll",,,,,,,,,,1763581887565116700,,,,,,,,,,,140712753168384,140712753168384,72452,57344,2275202464,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5668151Z","2025-11-19 19:51:27.5668151Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887566815100,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5673824Z","2025-11-19 19:51:27.5673824Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887567382400,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5695239Z","2025-11-19 19:51:27.5695239Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\windows.storage.dll",,,,,,,,,,1763581887569523900,,,,,,,,,,,140712812412928,140712812412928,8877403,8769536,3667346596,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5706960Z","2025-11-19 19:51:27.5706960Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\shlwapi.dll",,,,,,,,,,1763581887570696000,,,,,,,,,,,140712868839424,140712868839424,479562,421888,2142510382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5725766Z","2025-11-19 19:51:27.5725766Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887572576600,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5730959Z","2025-11-19 19:51:27.5730959Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\Windows.Globalization.Fontgroups.dll",,,,,,,,,,1763581887573095900,,,,,,,,,,,140712285044736,140712285044736,126310,86016,2401575024,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5735973Z","2025-11-19 19:51:27.5735973Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887573597300,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5736081Z","2025-11-19 19:51:27.5736081Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",14660,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\BCP47Langs.dll",,,,,,,,,,1763581887573608100,,,,,,,,,,,140712631468032,140712631468032,402331,385024,2065030180,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5747666Z","2025-11-19 19:51:27.5747666Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",12316,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\fontgroupsoverride.dll",,,,,,,,,,1763581887574766600,,,,,,,,,,,140712536702976,140712536702976,84550,45056,3684684608,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5749819Z","2025-11-19 19:51:27.5749819Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887574981900,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5755582Z","2025-11-19 19:51:27.5755582Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887575558200,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5799285Z","2025-11-19 19:51:27.5799285Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\dcomp.dll",,,,,,,,,,1763581887579928500,,,,,,,,,,,140712789409792,140712789409792,2309196,2240512,1200801128,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5803791Z","2025-11-19 19:51:27.5803791Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",8620,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\Microsoft.Internal.WarpPal.dll",,,,,,,,,,1763581887580379100,,,,,,,,,,,140712769683456,140712769683456,167600,102400,2132685858,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5818922Z","2025-11-19 19:51:27.5818922Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\Windows.Energy.dll",,,,,,,,,,1763581887581892200,,,,,,,,,,,140712294088704,140712294088704,340121,335872,1240800996,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5890217Z","2025-11-19 19:51:27.5890217Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9920 ServiceHub.IntellicodeModelService.exe",11908,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,1763581887589021700,18446633084043362304,18446633084043337728,140711612509856,0,46014316544,11908,46012694528,46012678144,140711612509856,1303981,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5962844Z","2025-11-19 19:51:27.5962844Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887596284400,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5969253Z","2025-11-19 19:51:27.5969253Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887596925300,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5997444Z","2025-11-19 19:51:27.5997444Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\Windows.ApplicationModel.dll",,,,,,,,,,1763581887599744400,,,,,,,,,,,140712508391424,140712508391424,945679,876544,2857312343,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5998495Z","2025-11-19 19:51:27.5998495Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887599849500,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6003624Z","2025-11-19 19:51:27.6003624Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\Windows.Graphics.dll",,,,,,,,,,1763581887600362400,,,,,,,,,,,140712711225344,140712711225344,669723,593920,1068018205,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6004028Z","2025-11-19 19:51:27.6004028Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887600402800,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6011803Z","2025-11-19 19:51:27.6011803Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887601180400,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6016582Z","2025-11-19 19:51:27.6016582Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887601658200,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6028793Z","2025-11-19 19:51:27.6028793Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887602879300,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6034536Z","2025-11-19 19:51:27.6034536Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887603453600,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6044832Z","2025-11-19 19:51:27.6044832Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,1763581887604483200,,,,,,,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6059873Z","2025-11-19 19:51:27.6059873Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\netprofm.dll",,,,,,,,,,1763581887605987300,,,,,,,,,,,140712762802176,140712762802176,450621,450560,2204449876,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6078731Z","2025-11-19 19:51:27.6078731Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581887607873100,18446633084043362304,18446633084043337728,140712865112144,0,859767259136,7032,859770454016,859770445824,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6081019Z","2025-11-19 19:51:27.6081019Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581887608101900,18446633084054708224,18446633084054683648,140712899206080,0,859767267328,3716,859770978304,859770970112,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6082851Z","2025-11-19 19:51:27.6082851Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3676 WerFault.exe",3716,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581887608285100,18446633084054908928,18446633084054884352,140712899206080,0,859767275520,12996,859771502592,859771494400,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6117108Z","2025-11-19 19:51:27.6117108Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\npmproxy.dll",,,,,,,,,,1763581887611710900,,,,,,,,,,,140712730820608,140712730820608,124253,102400,1533975845,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6131879Z","2025-11-19 19:51:27.6131879Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\netprofm.dll",,,,,,,,,,1763581887613187900,,,,,,,,,,,140712762802176,140712762802176,450621,462848,2204449876,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6132454Z","2025-11-19 19:51:27.6132454Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\npmproxy.dll",,,,,,,,,,1763581887613245400,,,,,,,,,,,140712730820608,140712730820608,124253,114688,1533975845,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6135246Z","2025-11-19 19:51:27.6135246Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\xmllite.dll",,,,,,,,,,1763581887613524600,,,,,,,,,,,140712684027904,140712684027904,342897,274432,974526834,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6146646Z","2025-11-19 19:51:27.6146646Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\WinRtTracing.dll",,,,,,,,,,1763581887614664700,,,,,,,,,,,140712799240192,140712799240192,246648,212992,1391536235,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6151398Z","2025-11-19 19:51:27.6151398Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,1763581887615139800,,,,,,,,,,,140712426930176,140712426930176,1213372,1146880,2699219668,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6155886Z","2025-11-19 19:51:27.6155886Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe\TraceLogging.dll",,,,,,,,,,1763581887615588600,,,,,,,,,,,140712619671552,140712619671552,0,49152,1758293586,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6157920Z","2025-11-19 19:51:27.6157920Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887615792000,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6165249Z","2025-11-19 19:51:27.6165249Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887616524900,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6165988Z","2025-11-19 19:51:27.6165988Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,1763581887616598800,,,,,,,,,,,140712426930176,140712426930176,1213372,1159168,2699219668,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6172681Z","2025-11-19 19:51:27.6172681Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,1763581887617268100,,,,,,,,,,,140712426930176,140712426930176,1213372,1146880,2699219668,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6293151Z","2025-11-19 19:51:27.6293151Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,1763581887629315100,,,,,,,,,,,140712531263488,140712531263488,1042724,999424,915912993,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6298254Z","2025-11-19 19:51:27.6298254Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\Windows.UI.Xaml.Phone.dll",,,,,,,,,,1763581887629825400,,,,,,,,,,,140712592146432,140712592146432,1295254,1273856,3672194386,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6338041Z","2025-11-19 19:51:27.6338041Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,1763581887633804100,,,,,,,,,,,140712531263488,140712531263488,1042724,1011712,915912993,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6339361Z","2025-11-19 19:51:27.6339361Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,1763581887633936200,,,,,,,,,,,140712426930176,140712426930176,1213372,1159168,2699219668,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6342600Z","2025-11-19 19:51:27.6342600Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,1763581887634260000,,,,,,,,,,,140712531263488,140712531263488,1042724,999424,915912993,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6508282Z","2025-11-19 19:51:27.6508282Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\MrmCoreR.dll",,,,,,,,,,1763581887650828200,,,,,,,,,,,140712631926784,140712631926784,1191374,1146880,1078870765,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6517745Z","2025-11-19 19:51:27.6517745Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\UserMgrProxy.dll",,,,,,,,,,1763581887651774500,,,,,,,,,,,140712724660224,140712724660224,390456,393216,1431596644,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6518499Z","2025-11-19 19:51:27.6518499Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\Windows.StateRepositoryClient.dll",,,,,,,,,,1763581887651849900,,,,,,,,,,,140712696610816,140712696610816,303673,290816,424989122,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6542435Z","2025-11-19 19:51:27.6542435Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\BCP47mrm.dll",,,,,,,,,,1763581887654243500,,,,,,,,,,,140712628322304,140712628322304,278903,212992,835504572,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6545344Z","2025-11-19 19:51:27.6545344Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\directmanipulation.dll",,,,,,,,,,1763581887654534400,,,,,,,,,,,140712583036928,140712583036928,714070,667648,3434535107,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6552068Z","2025-11-19 19:51:27.6552068Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\Windows.UI.dll",,,,,,,,,,1763581887655206800,,,,,,,,,,,140712615346176,140712615346176,1414164,1376256,3301850593,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6552156Z","2025-11-19 19:51:27.6552156Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887655215600,18446633084054966272,18446633084054941696,140712583404848,0,320273948672,4172,320292782080,320292777984,140712583404848,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6556590Z","2025-11-19 19:51:27.6556590Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",8232,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887655659000,18446633084055023616,18446633084054999040,140712899206080,0,320273956864,11028,320293830656,320293826560,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6564440Z","2025-11-19 19:51:27.6564440Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","11148 calc.exe",8768,,,"11148 calc.exe",,,,,,,,,,,,,1763581887656444000,18446633084051861504,18446633084051836928,140712891545280,0,728547868672,8768,728550080512,728550047744,140712891545280,153309545,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6564444Z","2025-11-19 19:51:27.6564444Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","11148 calc.exe",13680,,,"11148 calc.exe",,,,,,,,,,,,,1763581887656444400,18446633084052348928,18446633084052324352,140712865112144,0,728547876864,13680,728550604800,728550596608,140712865112144,185583,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6564455Z","2025-11-19 19:51:27.6564455Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","11148 calc.exe",11220,,,"11148 calc.exe",,,,,,,,,,,,,1763581887656445500,18446633084052406272,18446633084052381696,140712899206080,0,728547893248,11220,728551653376,728551645184,140712899206080,861901,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6564455Z","2025-11-19 19:51:27.6564455Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","11148 calc.exe",4656,,,"11148 calc.exe",,,,,,,,,,,,,1763581887656445500,18446633084052377600,18446633084052353024,140712899206080,0,728547885056,4656,728551129088,728551120896,140712899206080,508465,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6564713Z","2025-11-19 19:51:27.6564713Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","11148 calc.exe",14656,,,"11148 calc.exe",,,,,,,,,,,,,1763581887656471300,18446633084051804160,18446633084051779584,140712899206080,0,728547860480,14656,728549556224,728549548032,140712899206080,2722632,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6564795Z","2025-11-19 19:51:27.6564795Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","11148 calc.exe",12924,,,"11148 calc.exe",,,,,,,,,,,,,1763581887656479500,18446633084051746816,18446633084051722240,140712899206080,0,728547852288,12924,728549031936,728549023744,140712899206080,4240860,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6564840Z","2025-11-19 19:51:27.6564840Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","11148 calc.exe",5464,,,"11148 calc.exe",,,,,,,,,,,,,1763581887656484000,18446633084051718144,18446633084051693568,140712899206080,0,728547844096,5464,728546148352,728546136064,140712899206080,6521410,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6567818Z","2025-11-19 19:51:27.6567818Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\threadpoolwinrt.dll",,,,,,,,,,1763581887656781800,,,,,,,,,,,140712555839488,140712555839488,130107,90112,2299561022,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6571683Z","2025-11-19 19:51:27.6571683Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887657168300,18446633084051861504,18446633084051836928,140712899206080,0,320273965056,13636,320294879232,320294875136,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6578769Z","2025-11-19 19:51:27.6578769Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","11148 calc.exe",4224,,,"11148 calc.exe",,,,,,,,,,,,,1763581887657876900,18446633084051058688,18446633084051034112,140696878126912,0,728547835904,4224,728545624064,728545603584,140696878126912,36933534,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6579983Z","2025-11-19 19:51:27.6579983Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\WindowsCodecs.dll",,,,,,,,,,1763581887657998300,,,,,,,,,,,140712775385088,140712775385088,2352359,2293760,3466818398,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6587368Z","2025-11-19 19:51:27.6587368Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\calc.exe",,,,,,,,,,1763581887658736800,,,,,,,,,,,140696878120960,140696878120960,90741,49152,4001445627,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6587482Z","2025-11-19 19:51:27.6587482Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\ieframe.dll",,,,,,,,,,1763581887658748300,,,,,,,,,,,140710222364672,140710222364672,7531896,7499776,575051316,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6587652Z","2025-11-19 19:51:27.6587652Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\mlang.dll",,,,,,,,,,1763581887658765200,,,,,,,,,,,140712293761024,140712293761024,318858,278528,3734874788,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6587767Z","2025-11-19 19:51:27.6587767Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\twinui.appcore.dll",,,,,,,,,,1763581887658776700,,,,,,,,,,,140712458059776,140712458059776,827472,806912,3228774028,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6587847Z","2025-11-19 19:51:27.6587847Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\edputil.dll",,,,,,,,,,1763581887658784800,,,,,,,,,,,140712471560192,140712471560192,178059,167936,3474529356,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6587942Z","2025-11-19 19:51:27.6587942Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,1763581887658794200,,,,,,,,,,,140712479096832,140712479096832,1613415,1552384,2231457550,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6588001Z","2025-11-19 19:51:27.6588001Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\Windows.UI.dll",,,,,,,,,,1763581887658800100,,,,,,,,,,,140712615346176,140712615346176,1414164,1376256,3301850593,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6588065Z","2025-11-19 19:51:27.6588065Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\BCP47mrm.dll",,,,,,,,,,1763581887658806500,,,,,,,,,,,140712628322304,140712628322304,278903,212992,835504572,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6588141Z","2025-11-19 19:51:27.6588141Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\MrmCoreR.dll",,,,,,,,,,1763581887658814100,,,,,,,,,,,140712631926784,140712631926784,1191374,1146880,1078870765,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6588303Z","2025-11-19 19:51:27.6588303Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\iertutil.dll",,,,,,,,,,1763581887658830300,,,,,,,,,,,140712642805760,140712642805760,2984761,2904064,3815768453,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6588406Z","2025-11-19 19:51:27.6588406Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.7019_none_3e06ffa0e335b8a8\comctl32.dll",,,,,,,,,,1763581887658840600,,,,,,,,,,,140712659910656,140712659910656,2747780,2703360,4095768276,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6588494Z","2025-11-19 19:51:27.6588494Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\srvcli.dll",,,,,,,,,,1763581887658849400,,,,,,,,,,,140712668954624,140712668954624,181029,167936,239922031,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6588566Z","2025-11-19 19:51:27.6588566Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\urlmon.dll",,,,,,,,,,1763581887658856600,,,,,,,,,,,140712669609984,140712669609984,1970671,1957888,260716450,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6588647Z","2025-11-19 19:51:27.6588647Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\wininet.dll",,,,,,,,,,1763581887658864700,,,,,,,,,,,140712675573760,140712675573760,2677835,2658304,2422963474,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6588727Z","2025-11-19 19:51:27.6588727Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,1763581887658872700,,,,,,,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6588796Z","2025-11-19 19:51:27.6588796Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\Windows.StateRepositoryClient.dll",,,,,,,,,,1763581887658879600,,,,,,,,,,,140712696610816,140712696610816,303673,290816,424989122,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6588967Z","2025-11-19 19:51:27.6588967Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\OneCoreUAPCommonProxyStub.dll",,,,,,,,,,1763581887658896800,,,,,,,,,,,140712713977856,140712713977856,6740758,6615040,2011948997,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6589058Z","2025-11-19 19:51:27.6589058Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\AppXDeploymentClient.dll",,,,,,,,,,1763581887658905800,,,,,,,,,,,140712740257792,140712740257792,1575781,1499136,2615972959,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6589138Z","2025-11-19 19:51:27.6589138Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\propsys.dll",,,,,,,,,,1763581887658913800,,,,,,,,,,,140712761491456,140712761491456,1123662,1060864,3228732737,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6589207Z","2025-11-19 19:51:27.6589207Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\secur32.dll",,,,,,,,,,1763581887658920700,,,,,,,,,,,140712800223232,140712800223232,112844,53248,632019051,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6589289Z","2025-11-19 19:51:27.6589289Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\uxtheme.dll",,,,,,,,,,1763581887658928900,,,,,,,,,,,140712802254848,140712802254848,696534,696320,1695798817,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6589553Z","2025-11-19 19:51:27.6589553Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\windows.storage.dll",,,,,,,,,,1763581887658955300,,,,,,,,,,,140712812412928,140712812412928,8877403,8769536,3667346596,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6589636Z","2025-11-19 19:51:27.6589636Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\netutils.dll",,,,,,,,,,1763581887658963600,,,,,,,,,,,140712825847808,140712825847808,80696,53248,865845000,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6589733Z","2025-11-19 19:51:27.6589733Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,1763581887658973300,,,,,,,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6589813Z","2025-11-19 19:51:27.6589813Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\sspicli.dll",,,,,,,,,,1763581887658981300,,,,,,,,,,,140712833384448,140712833384448,339222,299008,3030302172,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6589890Z","2025-11-19 19:51:27.6589890Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\profapi.dll",,,,,,,,,,1763581887658989000,,,,,,,,,,,140712848850944,140712848850944,229548,167936,2447194521,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6589975Z","2025-11-19 19:51:27.6589975Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,1763581887658997500,,,,,,,,,,,140712851341312,140712851341312,1524912,1486848,1404855129,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6590124Z","2025-11-19 19:51:27.6590124Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,1763581887659012400,,,,,,,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6590209Z","2025-11-19 19:51:27.6590209Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581887659020900,,,,,,,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6590279Z","2025-11-19 19:51:27.6590279Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,1763581887659027900,,,,,,,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6590357Z","2025-11-19 19:51:27.6590357Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581887659035800,,,,,,,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6590427Z","2025-11-19 19:51:27.6590427Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581887659042700,,,,,,,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6590499Z","2025-11-19 19:51:27.6590499Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,1763581887659049900,,,,,,,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6590568Z","2025-11-19 19:51:27.6590568Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581887659056800,,,,,,,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6590635Z","2025-11-19 19:51:27.6590635Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,1763581887659063500,,,,,,,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6590783Z","2025-11-19 19:51:27.6590783Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\shlwapi.dll",,,,,,,,,,1763581887659078300,,,,,,,,,,,140712868839424,140712868839424,479562,421888,2142510382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6590850Z","2025-11-19 19:51:27.6590850Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,1763581887659085000,,,,,,,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6590922Z","2025-11-19 19:51:27.6590922Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581887659092200,,,,,,,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6591002Z","2025-11-19 19:51:27.6591002Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\ole32.dll",,,,,,,,,,1763581887659100200,,,,,,,,,,,140712878473216,140712878473216,1689904,1667072,1018821057,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6591074Z","2025-11-19 19:51:27.6591074Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,1763581887659107400,,,,,,,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6591151Z","2025-11-19 19:51:27.6591151Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581887659115100,,,,,,,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6591216Z","2025-11-19 19:51:27.6591216Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,1763581887659121600,,,,,,,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6591468Z","2025-11-19 19:51:27.6591468Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,1763581887659146800,,,,,,,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6591558Z","2025-11-19 19:51:27.6591558Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,1763581887659155800,,,,,,,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6591637Z","2025-11-19 19:51:27.6591637Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,1763581887659163700,,,,,,,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6591711Z","2025-11-19 19:51:27.6591711Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,1763581887659171100,,,,,,,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6591779Z","2025-11-19 19:51:27.6591779Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\imagehlp.dll",,,,,,,,,,1763581887659177900,,,,,,,,,,,140712892760064,140712892760064,200866,131072,2156568970,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6591847Z","2025-11-19 19:51:27.6591847Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581887659184700,,,,,,,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6591989Z","2025-11-19 19:51:27.6591989Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581887659198900,,,,,,,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6592065Z","2025-11-19 19:51:27.6592065Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581887659206500,,,,,,,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6592157Z","2025-11-19 19:51:27.6592157Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop ","11148 calc.exe",4224,,,"11148 calc.exe",,,"calc.exe",,,,,,,,,,1763581887659215700,,,,,,,,,,,,,,,,3203072,3239936,214335219,134080554863097645,0,134080554866492537,116,0,3397,1,12,3,0,0,,,,,,,,,, -"2025-11-19 19:51:27.7973948Z","2025-11-19 19:51:27.7973948Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",9360,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887797394800,18446633084050915328,18446633084050890752,140712899206080,0,320273973248,13212,320295927808,320295923712,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.7978389Z","2025-11-19 19:51:27.7978389Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",13212,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887797838900,18446633084051058688,18446633084051034112,140712899206080,0,320273981440,2940,320296976384,320296972288,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.7980763Z","2025-11-19 19:51:27.7980763Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",2940,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887798076300,18446633084051746816,18446633084051722240,140712899206080,0,320273989632,6112,320298024960,320298020864,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.7982318Z","2025-11-19 19:51:27.7982318Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1168 svchost.exe",9264,,," 1168 svchost.exe",,,,,,,,,,,,,1763581887798231800,18446633084051718144,18446633084051693568,140712899206080,157,641014476800,8364,641021247488,641021214720,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.7986525Z","2025-11-19 19:51:27.7986525Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\twinapi.dll",,,,,,,,,,1763581887798652500,,,,,,,,,,,140712415789056,140712415789056,924452,868352,2129603828,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.7991738Z","2025-11-19 19:51:27.7991738Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",14660,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\xmllite.dll",,,,,,,,,,1763581887799173800,,,,,,,,,,,140712684027904,140712684027904,342897,274432,974526834,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8197198Z","2025-11-19 19:51:27.8197198Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",6112,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887819719900,18446633084052377600,18446633084052353024,140712899206080,0,320273997824,14224,320299073536,320299069440,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8199462Z","2025-11-19 19:51:27.8199462Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",14224,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887819946200,18446633084052348928,18446633084052324352,140712899206080,0,320274006016,13984,320300122112,320300118016,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8347693Z","2025-11-19 19:51:27.8347693Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",11156,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,1763581887834769300,18446633084054269952,18446633084054245376,140712891292720,0,199839907840,11824,199852294144,199852285952,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8471695Z","2025-11-19 19:51:27.8471695Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2960 svchost.exe",14536,,," 2960 svchost.exe",,,,,,,,,,,,,1763581887847169500,18446633084051804160,18446633084051779584,140712899206080,287,403329789952,4884,403333185536,403333152768,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8573571Z","2025-11-19 19:51:27.8573571Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\userenv.dll",,,,,,,,,,1763581887857357100,,,,,,,,,,,140712837054464,140712837054464,245008,176128,731547084,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8573941Z","2025-11-19 19:51:27.8573941Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1040 svchost.exe",13300,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\RuntimeBroker.exe",,,,,,,,,,1763581887857394100,,,,,,,,,,,,,148437,,1175682367,,,,134080554868459116,,,,,3403,,,,,,3,"0x","Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe","runtimebroker07f4358a809ac99a64a67c1",1040,13,3,0,0,1 -"2025-11-19 19:51:27.8577990Z","2025-11-19 19:51:27.8577990Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\profext.dll",,,,,,,,,,1763581887857799000,,,,,,,,,,,140712823488512,140712823488512,220952,200704,1125089802,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8582768Z","2025-11-19 19:51:27.8582768Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",13300,,," 5316 RuntimeBroker.exe",,,,,,,,,,,,,1763581887858276800,18446633084055273472,18446633084055248896,140699399787184,40,1098350678016,7040,1098352427008,1098352377856,140699399787184,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8597804Z","2025-11-19 19:51:27.8597804Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,1763581887859780400,,,,,,,,,,,140712531263488,140712531263488,1042724,1011712,915912993,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8601542Z","2025-11-19 19:51:27.8601542Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\RuntimeBroker.exe",,,,,,,,,,1763581887860154200,,,,,,,,,,,140699399749632,140699399749632,148437,126976,1175682367,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8601818Z","2025-11-19 19:51:27.8601818Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581887860181800,,,,,,,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8601943Z","2025-11-19 19:51:27.8601943Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\twinapi.appcore.dll",,,,,,,,,,1763581887860194300,,,,,,,,,,,140712720924672,140712720924672,2401519,2375680,2646458233,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8610326Z","2025-11-19 19:51:27.8610326Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887861032600,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8622316Z","2025-11-19 19:51:27.8622316Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887862231600,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8623373Z","2025-11-19 19:51:27.8623373Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\twinapi.appcore.dll",,,,,,,,,,1763581887862337300,,,,,,,,,,,140712720924672,140712720924672,2401519,2387968,2646458233,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8638227Z","2025-11-19 19:51:27.8638227Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887863822700,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8646493Z","2025-11-19 19:51:27.8646493Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887864649300,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8653320Z","2025-11-19 19:51:27.8653320Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581887865332000,,,,,,,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8654688Z","2025-11-19 19:51:27.8654688Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581887865468800,,,,,,,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8665581Z","2025-11-19 19:51:27.8665581Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581887866558100,,,,,,,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8666770Z","2025-11-19 19:51:27.8666770Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,,,,,,,,,,,1763581887866677000,18446633084055330816,18446633084055306240,140712899206080,0,1098350686208,9964,1098352951296,1098352902144,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8666978Z","2025-11-19 19:51:27.8666978Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887866697800,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8667674Z","2025-11-19 19:51:27.8667674Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581887866767400,,,,,,,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8672823Z","2025-11-19 19:51:27.8672823Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887867282300,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8675120Z","2025-11-19 19:51:27.8675120Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,1763581887867512000,,,,,,,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8676126Z","2025-11-19 19:51:27.8676126Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581887867612600,,,,,,,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8677378Z","2025-11-19 19:51:27.8677378Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,,,,,,,,,,,1763581887867737800,18446633084054499328,18446633084054474752,140712899206080,0,1098350694400,13000,1098353475584,1098353426432,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8687133Z","2025-11-19 19:51:27.8687133Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,1763581887868713300,,,,,,,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8688315Z","2025-11-19 19:51:27.8688315Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581887868831500,,,,,,,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8691856Z","2025-11-19 19:51:27.8691856Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,1763581887869185600,,,,,,,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8696355Z","2025-11-19 19:51:27.8696355Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\powrprof.dll",,,,,,,,,,1763581887869635500,,,,,,,,,,,140712848195584,140712848195584,457799,385024,2858637235,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8699474Z","2025-11-19 19:51:27.8699474Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\umpdc.dll",,,,,,,,,,1763581887869947400,,,,,,,,,,,140712848064512,140712848064512,98535,81920,1714427184,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8700610Z","2025-11-19 19:51:27.8700610Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887870061000,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8701475Z","2025-11-19 19:51:27.8701475Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 5316 RuntimeBroker.exe",,,,,,,,,,,,,1763581887870147500,18446633084055187456,18446633084055162880,140712899206080,0,1098350702592,13676,1098353999872,1098353950720,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8702475Z","2025-11-19 19:51:27.8702475Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 5316 RuntimeBroker.exe",,,,,,,,,,,,,1763581887870247500,18446633084055359488,18446633084055334912,140712899206080,0,1098350710784,2076,1098354524160,1098354475008,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8705220Z","2025-11-19 19:51:27.8705220Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,1763581887870522000,,,,,,,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8706331Z","2025-11-19 19:51:27.8706331Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,1763581887870633100,,,,,,,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8706461Z","2025-11-19 19:51:27.8706461Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887870646100,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8707694Z","2025-11-19 19:51:27.8707694Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,1763581887870769400,,,,,,,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8708822Z","2025-11-19 19:51:27.8708822Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,1763581887870882200,,,,,,,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8710273Z","2025-11-19 19:51:27.8710273Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5316 RuntimeBroker.exe",13000,,," 5316 RuntimeBroker.exe",,,,,,,,,,,,,1763581887871027300,18446633084055388160,18446633084055363584,140712899206080,0,1098350718976,15148,1098355048448,1098354999296,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8714949Z","2025-11-19 19:51:27.8714949Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,1763581887871494900,,,,,,,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8726023Z","2025-11-19 19:51:27.8726023Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\netprofm.dll",,,,,,,,,,1763581887872602300,,,,,,,,,,,140712762802176,140712762802176,450621,450560,2204449876,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8735961Z","2025-11-19 19:51:27.8735961Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581887873596100,,,,,,,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8745060Z","2025-11-19 19:51:27.8745060Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,1763581887874506000,,,,,,,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8753174Z","2025-11-19 19:51:27.8753174Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,,,,,,,,,,,1763581887875317400,18446633084055416832,18446633084055392256,140712865112144,0,1098350727168,5804,1098355572736,1098355523584,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8753347Z","2025-11-19 19:51:27.8753347Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\npmproxy.dll",,,,,,,,,,1763581887875334700,,,,,,,,,,,140712730820608,140712730820608,124253,102400,1533975845,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8765526Z","2025-11-19 19:51:27.8765526Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\netprofm.dll",,,,,,,,,,1763581887876552600,,,,,,,,,,,140712762802176,140712762802176,450621,462848,2204449876,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8766150Z","2025-11-19 19:51:27.8766150Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\npmproxy.dll",,,,,,,,,,1763581887876615000,,,,,,,,,,,140712730820608,140712730820608,124253,114688,1533975845,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8768601Z","2025-11-19 19:51:27.8768601Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\rmclient.dll",,,,,,,,,,1763581887876860100,,,,,,,,,,,140712808808448,140712808808448,282526,221184,1891057501,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8776426Z","2025-11-19 19:51:27.8776426Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581887877642600,18446633084055445504,18446633084055420928,140712806010720,0,859767283712,4060,859772026880,859772018688,140712806010720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8779951Z","2025-11-19 19:51:27.8779951Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\rometadata.dll",,,,,,,,,,1763581887877995100,,,,,,,,,,,140712295006208,140712295006208,267714,233472,1750277957,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8781009Z","2025-11-19 19:51:27.8781009Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5316 RuntimeBroker.exe",2076,,," 5316 RuntimeBroker.exe",,,,,,,,,,,,,1763581887878100900,18446633084055474176,18446633084055449600,140712899206080,0,1098350735360,12556,1098356097024,1098356047872,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8782289Z","2025-11-19 19:51:27.8782289Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\Windows.Security.Authentication.OnlineId.dll",,,,,,,,,,1763581887878228900,,,,,,,,,,,140712517107712,140712517107712,983040,942080,2052763288,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8784673Z","2025-11-19 19:51:27.8784673Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\WinMetadata\Windows.Foundation.winmd",,,,,,,,,,1763581887878467300,,,,,,,,,,,18014398509481984,1829655543808,134275,69632,1761294834,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8785817Z","2025-11-19 19:51:27.8785817Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",2076,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\twinui.dll",,,,,,,,,,1763581887878581700,,,,,,,,,,,140712339046400,140712339046400,5239409,5242880,279122806,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8786524Z","2025-11-19 19:51:27.8786524Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887878652400,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8787566Z","2025-11-19 19:51:27.8787566Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",2076,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,1763581887878756600,,,,,,,,,,,140712851341312,140712851341312,1524912,1486848,1404855129,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8788237Z","2025-11-19 19:51:27.8788237Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\WinMetadata\Windows.UI.winmd",,,,,,,,,,1763581887878823700,,,,,,,,,,,18014398509481984,1829681233920,773504,737280,1761294835,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8789285Z","2025-11-19 19:51:27.8789285Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",2076,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,1763581887878928500,,,,,,,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8792124Z","2025-11-19 19:51:27.8792124Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",2076,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\gamemode.dll",,,,,,,,,,1763581887879212400,,,,,,,,,,,140712543387648,140712543387648,164324,114688,328629043,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8792172Z","2025-11-19 19:51:27.8792172Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",13000,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\mscms.dll",,,,,,,,,,1763581887879217200,,,,,,,,,,,140712711880704,140712711880704,859508,786432,1878966387,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8794679Z","2025-11-19 19:51:27.8794679Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887879467900,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8796502Z","2025-11-19 19:51:27.8796502Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,1763581887879650200,,,,,,,,,,,140712851341312,140712851341312,1524912,1486848,1404855129,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8799315Z","2025-11-19 19:51:27.8799315Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",2076,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\windows.storage.dll",,,,,,,,,,1763581887879931500,,,,,,,,,,,140712812412928,140712812412928,8877403,8769536,3667346596,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8799559Z","2025-11-19 19:51:27.8799559Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",13636,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887879955900,18446633084055502848,18446633084055478272,140712899206080,0,320274014208,14648,320301170688,320301166592,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8801055Z","2025-11-19 19:51:27.8801055Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",2076,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581887880105500,,,,,,,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8804552Z","2025-11-19 19:51:27.8804552Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",2076,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\DXCore.dll",,,,,,,,,,1763581887880455200,,,,,,,,,,,140712805400576,140712805400576,331386,274432,2354081039,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8804961Z","2025-11-19 19:51:27.8804961Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",12996,,," 3676 WerFault.exe",,,"C:\Windows\System32\dpapi.dll",,,,,,,,,,1763581887880496100,,,,,,,,,,,140712845574144,140712845574144,42814,40960,2473566603,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8815483Z","2025-11-19 19:51:27.8815483Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",12996,,," 3676 WerFault.exe",,,"C:\Windows\System32\cryptbase.dll",,,,,,,,,,1763581887881548300,,,,,,,,,,,140712839348224,140712839348224,63718,49152,3897879906,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8818340Z","2025-11-19 19:51:27.8818340Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",2076,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,1763581887881834000,,,,,,,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8819091Z","2025-11-19 19:51:27.8819091Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\netprofm.dll",,,,,,,,,,1763581887881909100,,,,,,,,,,,140712762802176,140712762802176,450621,450560,2204449876,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8823575Z","2025-11-19 19:51:27.8823575Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\OneCoreUAPCommonProxyStub.dll",,,,,,,,,,1763581887882357500,,,,,,,,,,,140712713977856,140712713977856,6740758,6615040,2011948997,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8829511Z","2025-11-19 19:51:27.8829511Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",2076,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\OneCoreUAPCommonProxyStub.dll",,,,,,,,,,1763581887882951100,,,,,,,,,,,140712713977856,140712713977856,6740758,6615040,2011948997,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8837273Z","2025-11-19 19:51:27.8837273Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\npmproxy.dll",,,,,,,,,,1763581887883727300,,,,,,,,,,,140712730820608,140712730820608,124253,102400,1533975845,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8847613Z","2025-11-19 19:51:27.8847613Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",12556,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,1763581887884761300,,,,,,,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8855369Z","2025-11-19 19:51:27.8855369Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5316 RuntimeBroker.exe",12556,,," 5316 RuntimeBroker.exe",,,,,,,,,,,,,1763581887885536900,18446633084054413312,18446633084054388736,140712865112144,0,1098350743552,9412,1098356621312,1098356572160,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8857542Z","2025-11-19 19:51:27.8857542Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,1763581887885754200,,,,,,,,,,,140712426930176,140712426930176,1213372,1146880,2699219668,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8859883Z","2025-11-19 19:51:27.8859883Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",9412,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\uxtheme.dll",,,,,,,,,,1763581887885988300,,,,,,,,,,,140712802254848,140712802254848,696534,696320,1695798817,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8865289Z","2025-11-19 19:51:27.8865289Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887886528900,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8877574Z","2025-11-19 19:51:27.8877574Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\netprofm.dll",,,,,,,,,,1763581887887757400,,,,,,,,,,,140712762802176,140712762802176,450621,462848,2204449876,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8878769Z","2025-11-19 19:51:27.8878769Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\Windows.Security.Authentication.OnlineId.dll",,,,,,,,,,1763581887887876900,,,,,,,,,,,140712517107712,140712517107712,983040,954368,2052763288,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8879331Z","2025-11-19 19:51:27.8879331Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\npmproxy.dll",,,,,,,,,,1763581887887933100,,,,,,,,,,,140712730820608,140712730820608,124253,114688,1533975845,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8880495Z","2025-11-19 19:51:27.8880495Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887888049500,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8881150Z","2025-11-19 19:51:27.8881150Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,1763581887888115000,,,,,,,,,,,140712426930176,140712426930176,1213372,1159168,2699219668,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8882805Z","2025-11-19 19:51:27.8882805Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\OneCoreUAPCommonProxyStub.dll",,,,,,,,,,1763581887888280500,,,,,,,,,,,140712713977856,140712713977856,6740758,6627328,2011948997,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8883747Z","2025-11-19 19:51:27.8883747Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,1763581887888374700,,,,,,,,,,,140712851341312,140712851341312,1524912,1499136,1404855129,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8888989Z","2025-11-19 19:51:27.8888989Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",9412,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\shlwapi.dll",,,,,,,,,,1763581887888898900,,,,,,,,,,,140712868839424,140712868839424,479562,421888,2142510382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8890915Z","2025-11-19 19:51:27.8890915Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,1763581887889091500,,,,,,,,,,,140712426930176,140712426930176,1213372,1146880,2699219668,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8901899Z","2025-11-19 19:51:27.8901899Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",12556,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\twinapi.appcore.dll",,,,,,,,,,1763581887890189900,,,,,,,,,,,140712720924672,140712720924672,2401519,2375680,2646458233,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8922337Z","2025-11-19 19:51:27.8922337Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",9412,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,1763581887892233700,,,,,,,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8933989Z","2025-11-19 19:51:27.8933989Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",9412,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\ole32.dll",,,,,,,,,,1763581887893398900,,,,,,,,,,,140712878473216,140712878473216,1689904,1667072,1018821057,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8945701Z","2025-11-19 19:51:27.8945701Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",2076,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\cfgmgr32.dll",,,,,,,,,,1763581887894570100,,,,,,,,,,,140712845049856,140712845049856,385808,356352,1737777300,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8951431Z","2025-11-19 19:51:27.8951431Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",9412,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\propsys.dll",,,,,,,,,,1763581887895143100,,,,,,,,,,,140712761491456,140712761491456,1123662,1060864,3228732737,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8976135Z","2025-11-19 19:51:27.8976135Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5316 RuntimeBroker.exe",9412,,," 5316 RuntimeBroker.exe",,,,,,,,,,,,,1763581887897613500,18446633084052406272,18446633084052381696,140712891292720,0,1098350751744,2008,1098357145600,1098357096448,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8992253Z","2025-11-19 19:51:27.8992253Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",2008,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\Windows.StateRepositoryPS.dll",,,,,,,,,,1763581887899225300,,,,,,,,,,,140712490369024,140712490369024,879719,802816,374042279,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9007624Z","2025-11-19 19:51:27.9007624Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",9412,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,1763581887900762400,,,,,,,,,,,140712479096832,140712479096832,1613415,1552384,2231457550,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9044495Z","2025-11-19 19:51:27.9044495Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",9412,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\OneCoreCommonProxyStub.dll",,,,,,,,,,1763581887904449500,,,,,,,,,,,140712570257408,140712570257408,903222,823296,2010952444,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9060955Z","2025-11-19 19:51:27.9060955Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",12556,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\iertutil.dll",,,,,,,,,,1763581887906095500,,,,,,,,,,,140712642805760,140712642805760,2984761,2904064,3815768453,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9062538Z","2025-11-19 19:51:27.9062538Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,1763581887906253800,,,,,,,,,,,140712531263488,140712531263488,1042724,999424,915912993,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9063564Z","2025-11-19 19:51:27.9063564Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",15148,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\srvcli.dll",,,,,,,,,,1763581887906356400,,,,,,,,,,,140712668954624,140712668954624,181029,167936,239922031,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9063629Z","2025-11-19 19:51:27.9063629Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",9964,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\netutils.dll",,,,,,,,,,1763581887906362900,,,,,,,,,,,140712825847808,140712825847808,80696,53248,865845000,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9096350Z","2025-11-19 19:51:27.9096350Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",12556,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\Windows.Web.dll",,,,,,,,,,1763581887909635000,,,,,,,,,,,140712467955712,140712467955712,678716,638976,1581530023,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9109320Z","2025-11-19 19:51:27.9109320Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,1763581887910932000,,,,,,,,,,,140712531263488,140712531263488,1042724,1011712,915912993,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9110781Z","2025-11-19 19:51:27.9110781Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,1763581887911078100,,,,,,,,,,,140712426930176,140712426930176,1213372,1159168,2699219668,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9110873Z","2025-11-19 19:51:27.9110873Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",14028,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\Windows.Web.dll",,,,,,,,,,1763581887911087300,,,,,,,,,,,140712467955712,140712467955712,678716,638976,1581530023,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9114183Z","2025-11-19 19:51:27.9114183Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,1763581887911418300,,,,,,,,,,,140712531263488,140712531263488,1042724,999424,915912993,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9208163Z","2025-11-19 19:51:27.9208163Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",2076,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\profapi.dll",,,,,,,,,,1763581887920816300,,,,,,,,,,,140712848850944,140712848850944,229548,167936,2447194521,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9230450Z","2025-11-19 19:51:27.9230450Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6096 svchost.exe",8040,,," 6096 svchost.exe",,,,,,,,,,,,,1763581887923045000,18446633084055560192,18446633084055535616,140712899206080,25,338489380864,8508,338491342848,338491310080,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9306346Z","2025-11-19 19:51:27.9306346Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",9412,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887930634600,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9322463Z","2025-11-19 19:51:27.9322463Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",9412,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\bcrypt.dll",,,,,,,,,,1763581887932246300,,,,,,,,,,,140712848654336,140712848654336,206048,172032,2893678010,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9417148Z","2025-11-19 19:51:27.9417148Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",9412,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\ntmarta.dll",,,,,,,,,,1763581887941714800,,,,,,,,,,,140712831811584,140712831811584,265798,221184,3598506564,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9502687Z","2025-11-19 19:51:27.9502687Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2724 svchost.exe",3692,,," 2724 svchost.exe",,,,,,,,,,,,,1763581887950268700,18446633084056133632,18446633084056109056,140712899206080,232,89489309696,7980,89491243008,89491177472,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9503755Z","2025-11-19 19:51:27.9503755Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2724 svchost.exe",3692,,," 2724 svchost.exe",,,,,,,,,,,,,1763581887950375500,18446633084053151744,18446633084053127168,140712899206080,232,89489317888,14444,89492291584,89492258816,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9627380Z","2025-11-19 19:51:27.9627380Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3204 Taskmgr.exe",5876,,," 3204 Taskmgr.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,1763581887962738000,,,,,,,,,,,140712479096832,140712479096832,1613415,1552384,2231457550,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9637828Z","2025-11-19 19:51:27.9637828Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3204 Taskmgr.exe",5876,,," 3204 Taskmgr.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,1763581887963782800,,,,,,,,,,,140712479096832,140712479096832,1613415,1564672,2231457550,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1314166Z","2025-11-19 19:51:28.1314166Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,1763581888131416600,,,,,,,,,,,140712531263488,140712531263488,1042724,1011712,915912993,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1319160Z","2025-11-19 19:51:28.1319160Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\twinapi.appcore.dll",,,,,,,,,,1763581888131916000,,,,,,,,,,,140712720924672,140712720924672,2401519,2375680,2646458233,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1324896Z","2025-11-19 19:51:28.1324896Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581888132489700,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1335793Z","2025-11-19 19:51:28.1335793Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581888133579400,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1336659Z","2025-11-19 19:51:28.1336659Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\twinapi.appcore.dll",,,,,,,,,,1763581888133665900,,,,,,,,,,,140712720924672,140712720924672,2401519,2387968,2646458233,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1346129Z","2025-11-19 19:51:28.1346129Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581888134612900,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1350968Z","2025-11-19 19:51:28.1350968Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581888135096800,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1366987Z","2025-11-19 19:51:28.1366987Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\winhttp.dll",,,,,,,,,,1763581888136698700,,,,,,,,,,,140712750350336,140712750350336,1261038,1212416,84984727,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1374525Z","2025-11-19 19:51:28.1374525Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\ws2_32.dll",,,,,,,,,,1763581888137452500,,,,,,,,,,,140712881094656,140712881094656,513405,475136,3967481067,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1387808Z","2025-11-19 19:51:28.1387808Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3676 WerFault.exe",3716,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581888138780800,18446633084055674880,18446633084055650304,140712899206080,0,859767291904,1844,859772551168,859772542976,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1389202Z","2025-11-19 19:51:28.1389202Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\mswsock.dll",,,,,,,,,,1763581888138920200,,,,,,,,,,,140712836333568,140712836333568,491870,438272,897307513,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1395785Z","2025-11-19 19:51:28.1395785Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\IPHLPAPI.DLL",,,,,,,,,,1763581888139578500,,,,,,,,,,,140712824012800,140712824012800,233044,212992,945822897,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1399706Z","2025-11-19 19:51:28.1399706Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\winnsi.dll",,,,,,,,,,1763581888139970600,,,,,,,,,,,140712802975744,140712802975744,95519,61440,2268955118,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1401672Z","2025-11-19 19:51:28.1401672Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\nsi.dll",,,,,,,,,,1763581888140167200,,,,,,,,,,,140712892956672,140712892956672,111648,40960,4223476491,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1454079Z","2025-11-19 19:51:28.1454079Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\dhcpcsvc6.dll",,,,,,,,,,1763581888145407900,,,,,,,,,,,140712753233920,140712753233920,145503,122880,2114927498,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1461970Z","2025-11-19 19:51:28.1461970Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\dhcpcsvc.dll",,,,,,,,,,1763581888146197000,,,,,,,,,,,140712746024960,140712746024960,184216,143360,916390222,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1472980Z","2025-11-19 19:51:28.1472980Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\webio.dll",,,,,,,,,,1763581888147298100,,,,,,,,,,,140712635531264,140712635531264,873482,827392,338769958,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1492579Z","2025-11-19 19:51:28.1492579Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\sspicli.dll",,,,,,,,,,1763581888149257900,,,,,,,,,,,140712833384448,140712833384448,339222,299008,3030302172,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1534700Z","2025-11-19 19:51:28.1534700Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",1844,,," 3676 WerFault.exe",,,"C:\Windows\System32\dnsapi.dll",,,,,,,,,,1763581888153470000,,,,,,,,,,,140712824274944,140712824274944,1293169,1228800,1381219389,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1547388Z","2025-11-19 19:51:28.1547388Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",3716,,," 3676 WerFault.exe",,,"C:\Windows\System32\rasadhlp.dll",,,,,,,,,,1763581888154738800,,,,,,,,,,,140712730755072,140712730755072,108990,45056,352477361,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1609860Z","2025-11-19 19:51:28.1609860Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",1844,,," 3676 WerFault.exe",,,"C:\Windows\System32\FWPUCLNT.DLL",,,,,,,,,,1763581888160986000,,,,,,,,,,,140712731279360,140712731279360,561494,548864,3096342574,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2219561Z","2025-11-19 19:51:28.2219561Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",14224,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581888221956100,18446633084055703552,18446633084055678976,140712899206080,0,320274022400,8572,320302219264,320302215168,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.261554400Z","2025-11-19 19:51:28.2771678Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Attack done",,,,,,,,,,,1763581888277167800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2777846Z","2025-11-19 19:51:28.2777846Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,1763581888277784600,,,,,,,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2782317Z","2025-11-19 19:51:28.2782317Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3348 attack-589.exe",3088,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581888278231700,18446633084049022976,18446633084048998400,140712899206080,0,289797922816,3088,289802289152,289802280960,140712899206080,2024057,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2782317Z","2025-11-19 19:51:28.2782317Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3348 attack-589.exe",12904,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581888278231700,18446633084049080320,18446633084049055744,140712899206080,0,289797931008,12904,289803337728,289803329536,140712899206080,1558590,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2782336Z","2025-11-19 19:51:28.2782336Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3348 attack-589.exe",11468,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581888278233700,18446633083996708864,18446633083996684288,140712899206080,0,289797914624,11468,289801240576,289801232384,140712899206080,3363869,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2783990Z","2025-11-19 19:51:28.2783990Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581888278399000,18446633084044398592,18446633084044374016,140695599400816,0,289797906432,11212,289800192000,289800171520,140695599400816,64789380,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2785133Z","2025-11-19 19:51:28.2785133Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Users\Public\Downloads\attack-589.exe",,,,,,,,,,1763581888278513300,,,,,,,,,,,140695599382528,140695599382528,0,53248,1763491559,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2785202Z","2025-11-19 19:51:28.2785202Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\msvcp140.dll",,,,,,,,,,1763581888278520200,,,,,,,,,,,140711213137920,140711213137920,570439,561152,1564323704,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2785241Z","2025-11-19 19:51:28.2785241Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\vcruntime140.dll",,,,,,,,,,1763581888278524100,,,,,,,,,,,140712353988608,140712353988608,146072,122880,254123393,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2785276Z","2025-11-19 19:51:28.2785276Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\vcruntime140_1.dll",,,,,,,,,,1763581888278527600,,,,,,,,,,,140712354119680,140712354119680,57827,49152,240324076,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2785509Z","2025-11-19 19:51:28.2785509Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\apphelp.dll",,,,,,,,,,1763581888278550900,,,,,,,,,,,140712800485376,140712800485376,675806,651264,4108425587,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2785585Z","2025-11-19 19:51:28.2785585Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,1763581888278558500,,,,,,,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2785670Z","2025-11-19 19:51:28.2785670Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581888278567000,,,,,,,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2785759Z","2025-11-19 19:51:28.2785759Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581888278575900,,,,,,,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2785835Z","2025-11-19 19:51:28.2785835Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581888278583500,,,,,,,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2785901Z","2025-11-19 19:51:28.2785901Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581888278590100,,,,,,,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2786055Z","2025-11-19 19:51:28.2786055Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581888278605500,,,,,,,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2786133Z","2025-11-19 19:51:28.2786133Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581888278613300,,,,,,,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2786208Z","2025-11-19 19:51:28.2786208Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581888278620800,,,,,,,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2786279Z","2025-11-19 19:51:28.2786279Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581888278627900,,,,,,,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2786366Z","2025-11-19 19:51:28.2786366Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"attack-589.exe",,,,,,,,,,1763581888278636600,,,,,,,,,,,,,,,,958464,958464,72053875,134080554806144016,0,134080554872628582,52,9,3392,0,0,3,48,0,,,,,,,,,, -"2025-11-19 19:51:28.2872477Z","2025-11-19 19:51:28.2872477Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",3716,,," 3676 WerFault.exe",,,"C:\Windows\System32\schannel.dll",,,,,,,,,,1763581888287247700,,,,,,,,,,,140712828731392,140712828731392,849052,802816,24806266,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.3902746Z","2025-11-19 19:51:28.3902746Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1288 mmc.exe",,,,,,,,,,,,,1763581888390274600,18446633084049080320,18446633084049055744,140712899206080,0,7151616,8412,548274176,548192256,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.3904146Z","2025-11-19 19:51:28.3904146Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4868 svchost.exe",6388,,," 4868 svchost.exe",,,,,,,,,,,,,1763581888390414600,18446633083996708864,18446633083996684288,140712899206080,0,47919407104,14244,47921496064,47921463296,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.3905737Z","2025-11-19 19:51:28.3905737Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1288 mmc.exe",8412,,," 1288 mmc.exe",,,,,,,,,,,,,1763581888390573700,18446633084049022976,18446633084048998400,140712899206080,0,7159808,7028,548798464,548716544,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.4693653Z","2025-11-19 19:51:28.4693653Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 4192 svchost.exe",,,,,,,,,,,,,1763581888469365300,18446633084055875584,18446633084055851008,140712899206080,0,330479378432,15260,330477273088,330477240320,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.4695259Z","2025-11-19 19:51:28.4695259Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4192 svchost.exe",15260,,," 4192 svchost.exe",,,,,,,,,,,,,1763581888469525900,18446633084055904256,18446633084055879680,140712899206080,0,330479386624,11272,330480222208,330480189440,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.4698578Z","2025-11-19 19:51:28.4698578Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5536 svchost.exe",7072,,," 5536 svchost.exe",,,,,,,,,,,,,1763581888469857800,18446633084055932928,18446633084055908352,140712899206080,132,151912620032,13504,151921360896,151921328128,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.5348823Z","2025-11-19 19:51:28.5348823Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",3716,,," 3676 WerFault.exe",,,"C:\Windows\System32\ncrypt.dll",,,,,,,,,,1763581888534882300,,,,,,,,,,,140712841445376,140712841445376,272959,196608,3912253876,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.5352695Z","2025-11-19 19:51:28.5352695Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",3716,,," 3676 WerFault.exe",,,"C:\Windows\System32\ntasn1.dll",,,,,,,,,,1763581888535269500,,,,,,,,,,,140712841117696,140712841117696,300816,258048,2667946327,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.5357145Z","2025-11-19 19:51:28.5357145Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",3716,,," 3676 WerFault.exe",,,"C:\Windows\System32\ncryptsslp.dll",,,,,,,,,,1763581888535714500,,,,,,,,,,,140712682061824,140712682061824,310492,270336,4015176457,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.5366068Z","2025-11-19 19:51:28.5366068Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",3716,,," 3676 WerFault.exe",,,"C:\Windows\System32\msasn1.dll",,,,,,,,,,1763581888536606800,,,,,,,,,,,140712839675904,140712839675904,150871,77824,2536054058,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.5402989Z","2025-11-19 19:51:28.5402989Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",3716,,," 3676 WerFault.exe",,,"C:\Windows\System32\cryptnet.dll",,,,,,,,,,1763581888540298900,,,,,,,,,,,140712595161088,140712595161088,304772,241664,919073152,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.8201829Z","2025-11-19 19:51:28.8201829Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4372 vctip.exe",3948,,," 4372 vctip.exe",,,,,,,,,,,,,1763581888820182900,18446633084051488768,18446633084051464192,140711612509856,0,740355280896,3948,740352917504,740352909312,140711612509856,820035,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.8211588Z","2025-11-19 19:51:28.8211588Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581888821158800,18446633084055445504,18446633084055420928,140712806010720,0,859767283712,4060,859772026880,859771981824,140712806010720,967555353,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.8218990Z","2025-11-19 19:51:28.8218990Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581888821899000,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.8225452Z","2025-11-19 19:51:28.8225452Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581888822545200,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.8248238Z","2025-11-19 19:51:28.8248238Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581888824823800,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.8254380Z","2025-11-19 19:51:28.8254380Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581888825438000,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.8278658Z","2025-11-19 19:51:28.8278658Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581888827865800,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.8284518Z","2025-11-19 19:51:28.8284518Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581888828451800,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.9301581Z","2025-11-19 19:51:28.9301581Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\rsaenh.dll",,,,,,,,,,1763581888930158100,,,,,,,,,,,140712829976576,140712829976576,300007,237568,1319378437,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.9328146Z","2025-11-19 19:51:28.9328146Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,1763581888932814600,,,,,,,,,,,140712426930176,140712426930176,1213372,1146880,2699219668,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.9334459Z","2025-11-19 19:51:28.9334459Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581888933445900,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.9343016Z","2025-11-19 19:51:28.9343016Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581888934301600,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.9343697Z","2025-11-19 19:51:28.9343697Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,1763581888934369700,,,,,,,,,,,140712426930176,140712426930176,1213372,1159168,2699219668,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.9349533Z","2025-11-19 19:51:28.9349533Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,1763581888934953300,,,,,,,,,,,140712426930176,140712426930176,1213372,1146880,2699219668,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.9499068Z","2025-11-19 19:51:28.9499068Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,1763581888949906800,,,,,,,,,,,140712531263488,140712531263488,1042724,999424,915912993,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.9538395Z","2025-11-19 19:51:28.9538395Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,1763581888953839500,,,,,,,,,,,140712531263488,140712531263488,1042724,1011712,915912993,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.9539474Z","2025-11-19 19:51:28.9539474Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,1763581888953947400,,,,,,,,,,,140712426930176,140712426930176,1213372,1159168,2699219668,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.9542392Z","2025-11-19 19:51:28.9542392Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,1763581888954239200,,,,,,,,,,,140712531263488,140712531263488,1042724,999424,915912993,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1436921Z","2025-11-19 19:51:29.1436921Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,1763581889143692100,,,,,,,,,,,140712531263488,140712531263488,1042724,1011712,915912993,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1441822Z","2025-11-19 19:51:29.1441822Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\twinapi.appcore.dll",,,,,,,,,,1763581889144182200,,,,,,,,,,,140712720924672,140712720924672,2401519,2375680,2646458233,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1447540Z","2025-11-19 19:51:29.1447540Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581889144754000,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1458814Z","2025-11-19 19:51:29.1458814Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581889145881400,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1459531Z","2025-11-19 19:51:29.1459531Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\twinapi.appcore.dll",,,,,,,,,,1763581889145953100,,,,,,,,,,,140712720924672,140712720924672,2401519,2387968,2646458233,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1636841Z","2025-11-19 19:51:29.1636841Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3676 WerFault.exe",13460,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581889163684100,18446633084053581824,18446633084053557248,140712899206080,0,859767226368,13460,859768356864,859768344576,140712899206080,11957619,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1636865Z","2025-11-19 19:51:29.1636865Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3676 WerFault.exe",8356,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581889163686500,18446633084053868544,18446633084053843968,140712899206080,0,859767234560,8356,859768881152,859768868864,140712899206080,7043082,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1636930Z","2025-11-19 19:51:29.1636930Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3676 WerFault.exe",11036,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581889163693000,18446633084053897216,18446633084053872640,140712899206080,0,859767242752,11036,859769405440,859769397248,140712899206080,9124852,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1636935Z","2025-11-19 19:51:29.1636935Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3676 WerFault.exe",7032,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581889163693500,18446633084043362304,18446633084043337728,140712865112144,0,859767259136,7032,859770454016,859770445824,140712865112144,363244,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1636952Z","2025-11-19 19:51:29.1636952Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3676 WerFault.exe",456,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581889163695300,18446633084054069248,18446633084054044672,140712899206080,0,859767250944,456,859769929728,859769921536,140712899206080,310812,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1637012Z","2025-11-19 19:51:29.1637012Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3676 WerFault.exe",3716,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581889163701200,18446633084054708224,18446633084054683648,140712899206080,0,859767267328,3716,859770978304,859770953728,140712899206080,52584328,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1637054Z","2025-11-19 19:51:29.1637054Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3676 WerFault.exe",1844,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581889163705400,18446633084055674880,18446633084055650304,140712899206080,0,859767291904,1844,859772551168,859772522496,140712899206080,16559079,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1637161Z","2025-11-19 19:51:29.1637161Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3676 WerFault.exe",12996,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581889163716100,18446633084054908928,18446633084054884352,140712899206080,0,859767275520,12996,859771502592,859771482112,140712899206080,7689979,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1651994Z","2025-11-19 19:51:29.1651994Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581889165199400,18446633084051374080,18446633084051349504,140702556693600,0,859767218176,14180,859767832576,859767754752,140702556693600,2657930717,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1663997Z","2025-11-19 19:51:29.1663997Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\WerFault.exe",,,,,,,,,,1763581889166399700,,,,,,,,,,,140702556684288,140702556684288,681036,647168,630084362,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1664197Z","2025-11-19 19:51:29.1664197Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\Faultrep.dll",,,,,,,,,,1763581889166419700,,,,,,,,,,,140712281309184,140712281309184,594974,548864,3149101438,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1664308Z","2025-11-19 19:51:29.1664308Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\aepic.dll",,,,,,,,,,1763581889166430800,,,,,,,,,,,140712428109824,140712428109824,641436,577536,321124434,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1664397Z","2025-11-19 19:51:29.1664397Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\CorePrivacySettingsStore.dll",,,,,,,,,,1763581889166439700,,,,,,,,,,,140712456290304,140712456290304,263379,196608,2978004593,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1664483Z","2025-11-19 19:51:29.1664483Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\DiagnosticDataSettings.dll",,,,,,,,,,1763581889166448300,,,,,,,,,,,140712462319616,140712462319616,108991,61440,3234151774,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1664559Z","2025-11-19 19:51:29.1664559Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\dbgcore.dll",,,,,,,,,,1763581889166455900,,,,,,,,,,,140712478244864,140712478244864,263772,245760,3120784319,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1664644Z","2025-11-19 19:51:29.1664644Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\cryptnet.dll",,,,,,,,,,1763581889166464500,,,,,,,,,,,140712595161088,140712595161088,304772,241664,919073152,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1664813Z","2025-11-19 19:51:29.1664813Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\webio.dll",,,,,,,,,,1763581889166481300,,,,,,,,,,,140712635531264,140712635531264,873482,827392,338769958,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1664859Z","2025-11-19 19:51:29.1664859Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.7019_none_3e06ffa0e335b8a8\comctl32.dll",,,,,,,,,,1763581889166485900,,,,,,,,,,,140712659910656,140712659910656,2747780,2703360,4095768276,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1664953Z","2025-11-19 19:51:29.1664953Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\dbghelp.dll",,,,,,,,,,1763581889166495400,,,,,,,,,,,140712664104960,140712664104960,2282862,2367488,82455296,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1665039Z","2025-11-19 19:51:29.1665039Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\ncryptsslp.dll",,,,,,,,,,1763581889166503900,,,,,,,,,,,140712682061824,140712682061824,310492,270336,4015176457,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1665114Z","2025-11-19 19:51:29.1665114Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\xmllite.dll",,,,,,,,,,1763581889166511400,,,,,,,,,,,140712684027904,140712684027904,342897,274432,974526834,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1665182Z","2025-11-19 19:51:29.1665182Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\netapi32.dll",,,,,,,,,,1763581889166518200,,,,,,,,,,,140712696348672,140712696348672,171999,106496,898597876,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1665258Z","2025-11-19 19:51:29.1665258Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\rasadhlp.dll",,,,,,,,,,1763581889166525800,,,,,,,,,,,140712730755072,140712730755072,108990,45056,352477361,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1665409Z","2025-11-19 19:51:29.1665409Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\FWPUCLNT.DLL",,,,,,,,,,1763581889166540900,,,,,,,,,,,140712731279360,140712731279360,561494,548864,3096342574,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1665498Z","2025-11-19 19:51:29.1665498Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\dhcpcsvc.dll",,,,,,,,,,1763581889166549800,,,,,,,,,,,140712746024960,140712746024960,184216,143360,916390222,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1665564Z","2025-11-19 19:51:29.1665564Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\winhttp.dll",,,,,,,,,,1763581889166556400,,,,,,,,,,,140712750350336,140712750350336,1261038,1212416,84984727,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1665638Z","2025-11-19 19:51:29.1665638Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\dhcpcsvc6.dll",,,,,,,,,,1763581889166563900,,,,,,,,,,,140712753233920,140712753233920,145503,122880,2114927498,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1665715Z","2025-11-19 19:51:29.1665715Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\dsreg.dll",,,,,,,,,,1763581889166571500,,,,,,,,,,,140712764768256,140712764768256,1520707,1466368,4143332483,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1665788Z","2025-11-19 19:51:29.1665788Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\uxtheme.dll",,,,,,,,,,1763581889166578800,,,,,,,,,,,140712802254848,140712802254848,696534,696320,1695798817,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1665853Z","2025-11-19 19:51:29.1665853Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\winnsi.dll",,,,,,,,,,1763581889166585300,,,,,,,,,,,140712802975744,140712802975744,95519,61440,2268955118,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1665918Z","2025-11-19 19:51:29.1665918Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\wer.dll",,,,,,,,,,1763581889166591900,,,,,,,,,,,140712805728256,140712805728256,993632,983040,1987637995,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1666077Z","2025-11-19 19:51:29.1666077Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\rmclient.dll",,,,,,,,,,1763581889166607700,,,,,,,,,,,140712808808448,140712808808448,282526,221184,1891057501,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1666159Z","2025-11-19 19:51:29.1666159Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\windows.storage.dll",,,,,,,,,,1763581889166616000,,,,,,,,,,,140712812412928,140712812412928,8877403,8769536,3667346596,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1666226Z","2025-11-19 19:51:29.1666226Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\IPHLPAPI.DLL",,,,,,,,,,1763581889166622600,,,,,,,,,,,140712824012800,140712824012800,233044,212992,945822897,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1666296Z","2025-11-19 19:51:29.1666296Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\dnsapi.dll",,,,,,,,,,1763581889166629600,,,,,,,,,,,140712824274944,140712824274944,1293169,1228800,1381219389,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1666362Z","2025-11-19 19:51:29.1666362Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\schannel.dll",,,,,,,,,,1763581889166636300,,,,,,,,,,,140712828731392,140712828731392,849052,802816,24806266,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1666435Z","2025-11-19 19:51:29.1666435Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\rsaenh.dll",,,,,,,,,,1763581889166643500,,,,,,,,,,,140712829976576,140712829976576,300007,237568,1319378437,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1666513Z","2025-11-19 19:51:29.1666513Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,1763581889166651300,,,,,,,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1666659Z","2025-11-19 19:51:29.1666659Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\ntmarta.dll",,,,,,,,,,1763581889166665900,,,,,,,,,,,140712831811584,140712831811584,265798,221184,3598506564,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1666736Z","2025-11-19 19:51:29.1666736Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\sspicli.dll",,,,,,,,,,1763581889166673600,,,,,,,,,,,140712833384448,140712833384448,339222,299008,3030302172,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1666806Z","2025-11-19 19:51:29.1666806Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\mswsock.dll",,,,,,,,,,1763581889166680700,,,,,,,,,,,140712836333568,140712836333568,491870,438272,897307513,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1666870Z","2025-11-19 19:51:29.1666870Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\userenv.dll",,,,,,,,,,1763581889166687000,,,,,,,,,,,140712837054464,140712837054464,245008,176128,731547084,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1666938Z","2025-11-19 19:51:29.1666938Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\cryptsp.dll",,,,,,,,,,1763581889166693800,,,,,,,,,,,140712839217152,140712839217152,146168,110592,1658328178,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1667004Z","2025-11-19 19:51:29.1667004Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\cryptbase.dll",,,,,,,,,,1763581889166700400,,,,,,,,,,,140712839348224,140712839348224,63718,49152,3897879906,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1667070Z","2025-11-19 19:51:29.1667070Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\msasn1.dll",,,,,,,,,,1763581889166707000,,,,,,,,,,,140712839675904,140712839675904,150871,77824,2536054058,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1667134Z","2025-11-19 19:51:29.1667134Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\ntasn1.dll",,,,,,,,,,1763581889166713400,,,,,,,,,,,140712841117696,140712841117696,300816,258048,2667946327,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1667278Z","2025-11-19 19:51:29.1667278Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\ncrypt.dll",,,,,,,,,,1763581889166727800,,,,,,,,,,,140712841445376,140712841445376,272959,196608,3912253876,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1667449Z","2025-11-19 19:51:29.1667449Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\cfgmgr32.dll",,,,,,,,,,1763581889166744900,,,,,,,,,,,140712845049856,140712845049856,385808,356352,1737777300,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1667522Z","2025-11-19 19:51:29.1667522Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\dpapi.dll",,,,,,,,,,1763581889166752200,,,,,,,,,,,140712845574144,140712845574144,42814,40960,2473566603,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1667591Z","2025-11-19 19:51:29.1667591Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\umpdc.dll",,,,,,,,,,1763581889166759100,,,,,,,,,,,140712848064512,140712848064512,98535,81920,1714427184,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1667653Z","2025-11-19 19:51:29.1667653Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\powrprof.dll",,,,,,,,,,1763581889166765300,,,,,,,,,,,140712848195584,140712848195584,457799,385024,2858637235,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1667721Z","2025-11-19 19:51:29.1667721Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\bcrypt.dll",,,,,,,,,,1763581889166772100,,,,,,,,,,,140712848654336,140712848654336,206048,172032,2893678010,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1667861Z","2025-11-19 19:51:29.1667861Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\profapi.dll",,,,,,,,,,1763581889166786100,,,,,,,,,,,140712848850944,140712848850944,229548,167936,2447194521,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1667937Z","2025-11-19 19:51:29.1667937Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\crypt32.dll",,,,,,,,,,1763581889166793700,,,,,,,,,,,140712849768448,140712849768448,1584869,1536000,3438168074,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1668011Z","2025-11-19 19:51:29.1668011Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,1763581889166801100,,,,,,,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1668080Z","2025-11-19 19:51:29.1668080Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581889166808000,,,,,,,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1668142Z","2025-11-19 19:51:29.1668142Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,1763581889166814200,,,,,,,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1668214Z","2025-11-19 19:51:29.1668214Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581889166821400,,,,,,,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1668277Z","2025-11-19 19:51:29.1668277Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581889166827700,,,,,,,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1668346Z","2025-11-19 19:51:29.1668346Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,1763581889166834600,,,,,,,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1668484Z","2025-11-19 19:51:29.1668484Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581889166848400,,,,,,,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1668560Z","2025-11-19 19:51:29.1668560Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,1763581889166856000,,,,,,,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1668627Z","2025-11-19 19:51:29.1668627Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\shlwapi.dll",,,,,,,,,,1763581889166862700,,,,,,,,,,,140712868839424,140712868839424,479562,421888,2142510382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1668698Z","2025-11-19 19:51:29.1668698Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581889166869900,,,,,,,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1668770Z","2025-11-19 19:51:29.1668770Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,1763581889166877000,,,,,,,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1668836Z","2025-11-19 19:51:29.1668836Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\ws2_32.dll",,,,,,,,,,1763581889166883600,,,,,,,,,,,140712881094656,140712881094656,513405,475136,3967481067,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1668906Z","2025-11-19 19:51:29.1668906Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581889166890600,,,,,,,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1668964Z","2025-11-19 19:51:29.1668964Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,1763581889166896400,,,,,,,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1669110Z","2025-11-19 19:51:29.1669110Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,1763581889166911000,,,,,,,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1669183Z","2025-11-19 19:51:29.1669183Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,1763581889166918300,,,,,,,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1669251Z","2025-11-19 19:51:29.1669251Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,1763581889166925100,,,,,,,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1669317Z","2025-11-19 19:51:29.1669317Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,1763581889166931700,,,,,,,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1669379Z","2025-11-19 19:51:29.1669379Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\nsi.dll",,,,,,,,,,1763581889166937900,,,,,,,,,,,140712892956672,140712892956672,111648,40960,4223476491,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1669445Z","2025-11-19 19:51:29.1669445Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\msctf.dll",,,,,,,,,,1763581889166944500,,,,,,,,,,,140712893022208,140712893022208,1455420,1433600,4155718050,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1669507Z","2025-11-19 19:51:29.1669507Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581889166950700,,,,,,,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1669571Z","2025-11-19 19:51:29.1669571Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581889166957100,,,,,,,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1669710Z","2025-11-19 19:51:29.1669710Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581889166971000,,,,,,,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1669895Z","2025-11-19 19:51:29.1669895Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"WerFault.exe",,,,,,,,,,1763581889166989600,,,,,,,,,,,,,,,,4272128,14024704,3739576266,134080554863942943,0,134080554881418238,203,0,3402,85,2343,3,406,81,,,,,,,,,, -"2025-11-19 19:51:29.1675068Z","2025-11-19 19:51:29.1675068Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1660 svchost.exe",11196,,," 1660 svchost.exe",,,,,,,,,,,,,1763581889167506900,18446633084053581824,18446633084053557248,140712899206080,0,265906421760,7712,265905897472,265905864704,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1704217Z","2025-11-19 19:51:29.1704217Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,,,,,,,,,,,1763581889170421700,18446633084051144704,18446633084051120128,2195810680832,0,521061572608,6380,521063628800,521063608320,2195810680832,45706462,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1706933Z","2025-11-19 19:51:29.1706933Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\whoami.exe",,,,,,,,,,1763581889170693300,,,,,,,,,,,140702344609792,140702344609792,160109,98304,3602411345,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1707129Z","2025-11-19 19:51:29.1707129Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\wkscli.dll",,,,,,,,,,1763581889170712900,,,,,,,,,,,140712738291712,140712738291712,170846,110592,1225555544,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1707242Z","2025-11-19 19:51:29.1707242Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\version.dll",,,,,,,,,,1763581889170724200,,,,,,,,,,,140712753168384,140712753168384,72452,45056,2275202464,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1707328Z","2025-11-19 19:51:29.1707328Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\apphelp.dll",,,,,,,,,,1763581889170732800,,,,,,,,,,,140712800485376,140712800485376,675806,651264,4108425587,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1707405Z","2025-11-19 19:51:29.1707405Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\netutils.dll",,,,,,,,,,1763581889170740500,,,,,,,,,,,140712825847808,140712825847808,80696,53248,865845000,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1707478Z","2025-11-19 19:51:29.1707478Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\authz.dll",,,,,,,,,,1763581889170747800,,,,,,,,,,,140712826241024,140712826241024,372179,327680,771731569,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1707558Z","2025-11-19 19:51:29.1707558Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\sspicli.dll",,,,,,,,,,1763581889170755800,,,,,,,,,,,140712833384448,140712833384448,339222,299008,3030302172,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1707624Z","2025-11-19 19:51:29.1707624Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581889170762400,,,,,,,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1707770Z","2025-11-19 19:51:29.1707770Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,1763581889170777100,,,,,,,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1707839Z","2025-11-19 19:51:29.1707839Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581889170783900,,,,,,,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1707901Z","2025-11-19 19:51:29.1707901Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581889170790100,,,,,,,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1707963Z","2025-11-19 19:51:29.1707963Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,1763581889170796400,,,,,,,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1708021Z","2025-11-19 19:51:29.1708021Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581889170802200,,,,,,,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1708087Z","2025-11-19 19:51:29.1708087Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581889170808700,,,,,,,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1708158Z","2025-11-19 19:51:29.1708158Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\ws2_32.dll",,,,,,,,,,1763581889170815800,,,,,,,,,,,140712881094656,140712881094656,513405,475136,3967481067,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1708219Z","2025-11-19 19:51:29.1708219Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581889170821900,,,,,,,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1708353Z","2025-11-19 19:51:29.1708353Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,1763581889170835300,,,,,,,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1708422Z","2025-11-19 19:51:29.1708422Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,1763581889170842200,,,,,,,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1708492Z","2025-11-19 19:51:29.1708492Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,1763581889170849200,,,,,,,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1708555Z","2025-11-19 19:51:29.1708555Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581889170855500,,,,,,,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1708613Z","2025-11-19 19:51:29.1708613Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581889170861300,,,,,,,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1708672Z","2025-11-19 19:51:29.1708672Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581889170867200,,,,,,,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1708754Z","2025-11-19 19:51:29.1708754Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"whoami.exe",,,,,,,,,,1763581889170875400,,,,,,,,,,,,,,,,1257472,1302528,57157118,134080554818530829,3221225477,134080554881460737,83,0,3396,1,3,3,0,0,,,,,,,,,, -"2025-11-19 19:51:29.1712017Z","2025-11-19 19:51:29.1712017Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",14196,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889171201700,18446633084039225344,18446633084039200768,140702989233856,0,132813950976,14196,132824170496,132824162304,140702989233856,1237595,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1712021Z","2025-11-19 19:51:29.1712021Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",5064,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889171202100,18446633084045922304,18446633084045897728,140712899206080,0,132813926400,5064,132821024768,132821016576,140712899206080,512990,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1712022Z","2025-11-19 19:51:29.1712022Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",13020,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889171202200,18446633084045864960,18446633084045840384,140712865112144,0,132813918208,13020,132819976192,132819968000,140712865112144,214628,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1712025Z","2025-11-19 19:51:29.1712025Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",5520,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889171202500,18446633084017422336,18446633084017397760,140702989086576,0,132813959168,5520,132825219072,132825210880,140702989086576,4438889,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1712026Z","2025-11-19 19:51:29.1712026Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889171202600,18446633084045201408,18446633084045176832,140702989817872,0,132813885440,4736,132815781888,132815761408,140702989817872,67793028,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1712036Z","2025-11-19 19:51:29.1712036Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",12136,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889171203600,18446633084045430784,18446633084045406208,140712899206080,0,132813901824,12136,132817879040,132817870848,140712899206080,12037587,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1712126Z","2025-11-19 19:51:29.1712126Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",12916,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889171212600,18446633084042874880,18446633084042850304,140702989404080,0,132813967360,12916,132826267648,132826255360,140702989404080,1037678,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1712275Z","2025-11-19 19:51:29.1712275Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",14136,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889171227500,18446633084045402112,18446633084045377536,140712899206080,0,132813893632,14136,132816830464,132816822272,140712899206080,8912478,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1712302Z","2025-11-19 19:51:29.1712302Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",2364,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889171230200,18446633084045950976,18446633084045926400,140712899206080,0,132813934592,2364,132822073344,132822032384,140712899206080,41279257,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1712388Z","2025-11-19 19:51:29.1712388Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",1824,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889171238800,18446633084045807616,18446633084045783040,140712899206080,0,132813910016,1824,132818927616,132818915328,140712899206080,9551452,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1723363Z","2025-11-19 19:51:29.1723363Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889172336300,18446633084047904768,18446633084047880192,140702989217024,0,132813942784,5760,132823121920,132823093248,140702989217024,23273616,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1732074Z","2025-11-19 19:51:29.1732074Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\OpenConsole.exe",,,,,,,,,,1763581889173207400,,,,,,,,,,,140702989025280,140702989025280,1210794,1159168,1759975785,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1732299Z","2025-11-19 19:51:29.1732299Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\usp10.dll",,,,,,,,,,1763581889173229900,,,,,,,,,,,140711462174720,140711462174720,161304,102400,728066498,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1732435Z","2025-11-19 19:51:29.1732435Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\UIAutomationCore.dll",,,,,,,,,,1763581889173243500,,,,,,,,,,,140712432762880,140712432762880,4328257,4296704,2096711852,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1732511Z","2025-11-19 19:51:29.1732511Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\winmm.dll",,,,,,,,,,1763581889173251100,,,,,,,,,,,140712663842816,140712663842816,263815,217088,2106743460,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1732602Z","2025-11-19 19:51:29.1732602Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,1763581889173260200,,,,,,,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1732656Z","2025-11-19 19:51:29.1732656Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\PackagedCom\OpenConsoleProxy.dll",,,,,,,,,,1763581889173265600,,,,,,,,,,,140712723349504,140712723349504,51292,53248,1759975238,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1732744Z","2025-11-19 19:51:29.1732744Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\propsys.dll",,,,,,,,,,1763581889173274400,,,,,,,,,,,140712761491456,140712761491456,1123662,1060864,3228732737,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1732824Z","2025-11-19 19:51:29.1732824Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\D3DCompiler_47.dll",,,,,,,,,,1763581889173282400,,,,,,,,,,,140712769814528,140712769814528,4685395,4714496,796813953,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1732964Z","2025-11-19 19:51:29.1732964Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\d2d1.dll",,,,,,,,,,1763581889173296400,,,,,,,,,,,140712777744384,140712777744384,6610469,6537216,3013069957,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1733030Z","2025-11-19 19:51:29.1733030Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\DWrite.dll",,,,,,,,,,1763581889173303100,,,,,,,,,,,140712784297984,140712784297984,2543119,2519040,1462185185,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1733092Z","2025-11-19 19:51:29.1733092Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\d3d11.dll",,,,,,,,,,1763581889173309200,,,,,,,,,,,140712786853888,140712786853888,2582658,2498560,2128032819,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1733160Z","2025-11-19 19:51:29.1733160Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\uxtheme.dll",,,,,,,,,,1763581889173316000,,,,,,,,,,,140712802254848,140712802254848,696534,696320,1695798817,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1733226Z","2025-11-19 19:51:29.1733226Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\dxgi.dll",,,,,,,,,,1763581889173322600,,,,,,,,,,,140712803631104,140712803631104,1320096,1282048,1861212996,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1733305Z","2025-11-19 19:51:29.1733305Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\windows.storage.dll",,,,,,,,,,1763581889173330500,,,,,,,,,,,140712812412928,140712812412928,8877403,8769536,3667346596,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1733393Z","2025-11-19 19:51:29.1733393Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,1763581889173339300,,,,,,,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1733558Z","2025-11-19 19:51:29.1733558Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\cryptsp.dll",,,,,,,,,,1763581889173355800,,,,,,,,,,,140712839217152,140712839217152,146168,110592,1658328178,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1733652Z","2025-11-19 19:51:29.1733652Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\umpdc.dll",,,,,,,,,,1763581889173365200,,,,,,,,,,,140712848064512,140712848064512,98535,81920,1714427184,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1733723Z","2025-11-19 19:51:29.1733723Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\powrprof.dll",,,,,,,,,,1763581889173372300,,,,,,,,,,,140712848195584,140712848195584,457799,385024,2858637235,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1733797Z","2025-11-19 19:51:29.1733797Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,1763581889173379700,,,,,,,,,,,140712851341312,140712851341312,1524912,1486848,1404855129,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1733872Z","2025-11-19 19:51:29.1733872Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,1763581889173387200,,,,,,,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1733932Z","2025-11-19 19:51:29.1733932Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581889173393200,,,,,,,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1733995Z","2025-11-19 19:51:29.1733995Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,1763581889173399500,,,,,,,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1734052Z","2025-11-19 19:51:29.1734052Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581889173405200,,,,,,,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1734179Z","2025-11-19 19:51:29.1734179Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581889173417900,,,,,,,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1734240Z","2025-11-19 19:51:29.1734240Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,1763581889173424000,,,,,,,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1734294Z","2025-11-19 19:51:29.1734294Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581889173429400,,,,,,,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1734358Z","2025-11-19 19:51:29.1734358Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,1763581889173435800,,,,,,,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1734425Z","2025-11-19 19:51:29.1734425Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,1763581889173442500,,,,,,,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1734482Z","2025-11-19 19:51:29.1734482Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581889173448200,,,,,,,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1734554Z","2025-11-19 19:51:29.1734554Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,1763581889173455400,,,,,,,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1734619Z","2025-11-19 19:51:29.1734619Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581889173461900,,,,,,,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1734671Z","2025-11-19 19:51:29.1734671Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,1763581889173467100,,,,,,,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1734800Z","2025-11-19 19:51:29.1734800Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,1763581889173480000,,,,,,,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1734871Z","2025-11-19 19:51:29.1734871Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,1763581889173487100,,,,,,,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1734930Z","2025-11-19 19:51:29.1734930Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,1763581889173493000,,,,,,,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1734996Z","2025-11-19 19:51:29.1734996Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,1763581889173499600,,,,,,,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1735050Z","2025-11-19 19:51:29.1735050Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581889173505000,,,,,,,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1735102Z","2025-11-19 19:51:29.1735102Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581889173510200,,,,,,,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1735153Z","2025-11-19 19:51:29.1735153Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581889173515400,,,,,,,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1735274Z","2025-11-19 19:51:29.1735274Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"OpenConsole.ex",,,,,,,,,,1763581889173527400,,,,,,,,,,,,,,,,2887680,2940928,176179930,134080554806509408,0,134080554881486007,111,0,3394,12,7,3,52,0,,,,,,,,,, -"2025-11-19 19:51:29.1738607Z","2025-11-19 19:51:29.1738607Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3100 conhost.exe",1400,,," 3100 conhost.exe",,,,,,,,,,,,,1763581889173860700,18446633084044828672,18446633084044804096,140712899206080,0,1013857767424,1400,1013862367232,1013862359040,140712899206080,175021,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1738641Z","2025-11-19 19:51:29.1738641Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3100 conhost.exe",9260,,," 3100 conhost.exe",,,,,,,,,,,,,1763581889173864100,18446633084044656640,18446633084044632064,140712899206080,0,1013857759232,9260,1013861318656,1013861310464,140712899206080,523176,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1738680Z","2025-11-19 19:51:29.1738680Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3100 conhost.exe",2976,,," 3100 conhost.exe",,,,,,,,,,,,,1763581889173868000,18446633084044943360,18446633084044918784,140712865112144,0,1013857751040,2976,1013860794368,1013860786176,140712865112144,139564,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1738783Z","2025-11-19 19:51:29.1738783Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3100 conhost.exe",6724,,," 3100 conhost.exe",,,,,,,,,,,,,1763581889173878300,18446633084044627968,18446633084044603392,140696384580832,0,1013857734656,6724,1013861842944,1013861818368,140696384580832,33378427,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1738825Z","2025-11-19 19:51:29.1738825Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3100 conhost.exe",4376,,," 3100 conhost.exe",,,,,,,,,,,,,1763581889173882500,18446633084006535168,18446633084006510592,140712899206080,0,1013857742848,4376,1013860270080,1013860261888,140712899206080,858507,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1741667Z","2025-11-19 19:51:29.1741667Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,,,,,,,,,,,1763581889174166700,18446633084047990784,18446633084047966208,140696385038832,0,1013857775616,11136,1013862891520,1013862879232,140696385038832,732523,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1744927Z","2025-11-19 19:51:29.1744927Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\Windows\System32\conhost.exe",,,,,,,,,,1763581889174492700,,,,,,,,,,,140696384438272,140696384438272,1035098,1028096,2671108986,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1745034Z","2025-11-19 19:51:29.1745034Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,1763581889174503400,,,,,,,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1745074Z","2025-11-19 19:51:29.1745074Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\PackagedCom\OpenConsoleProxy.dll",,,,,,,,,,1763581889174507400,,,,,,,,,,,140712723349504,140712723349504,51292,53248,1759975238,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1745208Z","2025-11-19 19:51:29.1745208Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,1763581889174520800,,,,,,,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1745302Z","2025-11-19 19:51:29.1745302Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,1763581889174530200,,,,,,,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1745358Z","2025-11-19 19:51:29.1745358Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581889174535800,,,,,,,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1745412Z","2025-11-19 19:51:29.1745412Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,1763581889174541200,,,,,,,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1745469Z","2025-11-19 19:51:29.1745469Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581889174546900,,,,,,,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1745524Z","2025-11-19 19:51:29.1745524Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581889174552400,,,,,,,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1745577Z","2025-11-19 19:51:29.1745577Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,1763581889174557700,,,,,,,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1745652Z","2025-11-19 19:51:29.1745652Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581889174565200,,,,,,,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1745709Z","2025-11-19 19:51:29.1745709Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,1763581889174570900,,,,,,,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1745826Z","2025-11-19 19:51:29.1745826Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581889174582600,,,,,,,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1745901Z","2025-11-19 19:51:29.1745901Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,1763581889174590100,,,,,,,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1745956Z","2025-11-19 19:51:29.1745956Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581889174595600,,,,,,,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1746006Z","2025-11-19 19:51:29.1746006Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,1763581889174600600,,,,,,,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1746063Z","2025-11-19 19:51:29.1746063Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,1763581889174606300,,,,,,,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1746124Z","2025-11-19 19:51:29.1746124Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,1763581889174612400,,,,,,,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1746178Z","2025-11-19 19:51:29.1746178Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,1763581889174617800,,,,,,,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1746243Z","2025-11-19 19:51:29.1746243Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581889174624300,,,,,,,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1746299Z","2025-11-19 19:51:29.1746299Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581889174629900,,,,,,,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1746349Z","2025-11-19 19:51:29.1746349Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581889174634900,,,,,,,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1746376Z","2025-11-19 19:51:29.1746376Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",4932,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889174637600,18446633084042932224,18446633084042907648,140712371704112,0,1068179750912,4932,1068193808384,1068193669120,140712371704112,6957459,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1746466Z","2025-11-19 19:51:29.1746466Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"conhost.exe",,,,,,,,,,1763581889174646600,,,,,,,,,,,,,,,,1503232,1552384,66220850,134080554806283315,109,134080554881498658,93,0,3393,5,0,3,0,0,,,,,,,,,, -"2025-11-19 19:51:29.1871394Z","2025-11-19 19:51:29.1871394Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",6876,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187139500,18446633084045144064,18446633084045119488,140712891292720,0,1068179693568,6876,1068187516928,1068187496448,140712891292720,12018349,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1871396Z","2025-11-19 19:51:29.1871396Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",14948,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187139600,18446633084049481728,18446633084049457152,140712899206080,0,1068179816448,14948,1068202196992,1068202188800,140712899206080,346270,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1871397Z","2025-11-19 19:51:29.1871397Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187139700,18446633084046352384,18446633084046327808,140702319920256,0,1068179636224,5964,1068177817600,1068177727488,140702319920256,1443654158,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1871409Z","2025-11-19 19:51:29.1871409Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",11716,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187140900,18446633084044541952,18446633084044517376,140712583404848,0,1068179726336,11716,1068190662656,1068190654464,140712583404848,1102557,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1871452Z","2025-11-19 19:51:29.1871452Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",3968,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187145200,18446633084007337984,18446633084007313408,140712378178864,0,1068179759104,3968,1068194856960,1068194828288,140712378178864,69473835,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1871491Z","2025-11-19 19:51:29.1871491Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",8404,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187149200,18446633084047183872,18446633084047159296,140712899206080,0,1068179685376,8404,1068186468352,1068186451968,140712899206080,8231254,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1871524Z","2025-11-19 19:51:29.1871524Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",9740,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187152400,18446633084047876096,18446633084047851520,140712899206080,0,1068179734528,9740,1068191711232,1068191694848,140712899206080,7053264,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1871535Z","2025-11-19 19:51:29.1871535Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",11228,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187153500,18446633084046180352,18446633084046155776,140712899206080,0,1068179791872,11228,1068199051264,1068199043072,140712899206080,1385833,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1871773Z","2025-11-19 19:51:29.1871773Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",12764,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187177300,18446633084049453056,18446633084049428480,140712899206080,0,1068179808256,12764,1068201148416,1068201140224,140712899206080,780050,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1872444Z","2025-11-19 19:51:29.1872444Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",1960,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187244400,18446633084049424384,18446633084049399808,140712899206080,0,1068179800064,1960,1068200099840,1068200091648,140712899206080,1114250,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1872641Z","2025-11-19 19:51:29.1872641Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",3600,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187264100,18446633084044570624,18446633084044546048,140712899206080,0,1068179783680,3600,1068198002688,1068197990400,140712899206080,4580339,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1872760Z","2025-11-19 19:51:29.1872760Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",12568,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187276000,18446633084042072064,18446633084042047488,140712865112144,0,1068179742720,12568,1068192759808,1068192739328,140712865112144,7322583,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1872767Z","2025-11-19 19:51:29.1872767Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",12140,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187276700,18446633084049252352,18446633084049227776,140712899206080,0,1068179775488,12140,1068196954112,1068196945920,140712899206080,3097568,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1872895Z","2025-11-19 19:51:29.1872895Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",14500,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187289500,18446633084047642624,18446633084047618048,140712632221632,0,1068179718144,14500,1068188565504,1068188553216,140712632221632,3940609,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1873052Z","2025-11-19 19:51:29.1873052Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",14844,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187305200,18446633084042817536,18446633084042792960,140712899206080,0,1068179668992,14844,1068184371200,1068184358912,140712899206080,6994044,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1873232Z","2025-11-19 19:51:29.1873232Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",12024,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187323200,18446633084046725120,18446633084046700544,140712899206080,0,1068179660800,12024,1068183322624,1068183314432,140712899206080,26231986,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1873245Z","2025-11-19 19:51:29.1873245Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",4348,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187324500,18446633084046667776,18446633084046643200,140712899206080,0,1068179652608,4348,1068182274048,1068182261760,140712899206080,20408407,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1873476Z","2025-11-19 19:51:29.1873476Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",11152,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187347600,18446633084046610432,18446633084046585856,140712899206080,0,1068179644416,11152,1068181225472,1068181209088,140712899206080,21606025,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1873670Z","2025-11-19 19:51:29.1873670Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",11960,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187367000,18446633084048162816,18446633084048138240,140712899206080,0,1068179767296,11960,1068195905536,1068195885056,140712899206080,1970379630,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1873893Z","2025-11-19 19:51:29.1873893Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",11108,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187389300,18446633084046983168,18446633084046958592,140712865112144,0,1068179677184,11108,1068185419776,1068185411584,140712865112144,197276,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1878454Z","2025-11-19 19:51:29.1878454Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187845400,18446633084047790080,18446633084047765504,140712604173856,0,1068179709952,10116,1068189614080,1068189605888,140712604173856,13884359,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1940446Z","2025-11-19 19:51:29.1940446Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe",,,,,,,,,,1763581889194044600,,,,,,,,,,,140702319640576,140702319640576,738129,684032,1759975821,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1940562Z","2025-11-19 19:51:29.1940562Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\Microsoft.Terminal.Settings.Model.dll",,,,,,,,,,1763581889194056300,,,,,,,,,,,140709601476608,140709601476608,2281369,2252800,1759975487,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1940676Z","2025-11-19 19:51:29.1940676Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\ProgramData\Microsoft\VisualStudio\Setup\x64\Microsoft.VisualStudio.Setup.Configuration.Native.dll",,,,,,,,,,1763581889194067600,,,,,,,,,,,140711212089344,140711212089344,1007466,1015808,1726088073,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1940933Z","2025-11-19 19:51:29.1940933Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\msftedit.dll",,,,,,,,,,1763581889194093300,,,,,,,,,,,140712289107968,140712289107968,3297357,3305472,3878106343,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1941031Z","2025-11-19 19:51:29.1941031Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\ExplorerFrame.dll",,,,,,,,,,1763581889194103100,,,,,,,,,,,140712345862144,140712345862144,2919775,2867200,3427672670,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1941076Z","2025-11-19 19:51:29.1941076Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\Microsoft.Terminal.UI.dll",,,,,,,,,,1763581889194107600,,,,,,,,,,,140712371224576,140712371224576,255391,258048,1759975265,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1941116Z","2025-11-19 19:51:29.1941116Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\TerminalConnection.dll",,,,,,,,,,1763581889194111600,,,,,,,,,,,140712371486720,140712371486720,522798,495616,1759975254,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1941159Z","2025-11-19 19:51:29.1941159Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.8_8.2501.31001.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.dll",,,,,,,,,,1763581889194115900,,,,,,,,,,,140712372011008,140712372011008,5866761,5873664,2056920596,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1941198Z","2025-11-19 19:51:29.1941198Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\Microsoft.Terminal.Control.dll",,,,,,,,,,1763581889194119800,,,,,,,,,,,140712377909248,140712377909248,1976337,1986560,1759975378,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1941311Z","2025-11-19 19:51:29.1941311Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\TerminalApp.dll",,,,,,,,,,1763581889194131100,,,,,,,,,,,140712379940864,140712379940864,3444084,3444736,1759975751,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1941421Z","2025-11-19 19:51:29.1941421Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\DataExchange.dll",,,,,,,,,,1763581889194142100,,,,,,,,,,,140712406614016,140712406614016,399312,368640,696309968,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1941511Z","2025-11-19 19:51:29.1941511Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\twinapi.dll",,,,,,,,,,1763581889194151100,,,,,,,,,,,140712415789056,140712415789056,924452,868352,2129603828,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1941599Z","2025-11-19 19:51:29.1941599Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\UIAutomationCore.dll",,,,,,,,,,1763581889194159900,,,,,,,,,,,140712432762880,140712432762880,4328257,4296704,2096711852,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1941687Z","2025-11-19 19:51:29.1941687Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\UiaManager.dll",,,,,,,,,,1763581889194168700,,,,,,,,,,,140712461205504,140712461205504,941078,897024,2628067039,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1941778Z","2025-11-19 19:51:29.1941778Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\AppExtension.dll",,,,,,,,,,1763581889194177800,,,,,,,,,,,140712467365888,140712467365888,337294,299008,1656953249,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1941991Z","2025-11-19 19:51:29.1941991Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.StateRepositoryPS.dll",,,,,,,,,,1763581889194199100,,,,,,,,,,,140712490369024,140712490369024,879719,802816,374042279,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1942075Z","2025-11-19 19:51:29.1942075Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.ApplicationModel.dll",,,,,,,,,,1763581889194207500,,,,,,,,,,,140712508391424,140712508391424,945679,876544,2857312343,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1942157Z","2025-11-19 19:51:29.1942157Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\threadpoolwinrt.dll",,,,,,,,,,1763581889194215700,,,,,,,,,,,140712555839488,140712555839488,130107,90112,2299561022,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1942242Z","2025-11-19 19:51:29.1942242Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.UI.Core.TextInput.dll",,,,,,,,,,1763581889194224200,,,,,,,,,,,140712572354560,140712572354560,1511216,1499136,21441667,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1942334Z","2025-11-19 19:51:29.1942334Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\directmanipulation.dll",,,,,,,,,,1763581889194233400,,,,,,,,,,,140712583036928,140712583036928,714070,667648,3434535107,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1942414Z","2025-11-19 19:51:29.1942414Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\InputHost.dll",,,,,,,,,,1763581889194241400,,,,,,,,,,,140712583757824,140712583757824,1989124,1970176,2937052880,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1942566Z","2025-11-19 19:51:29.1942566Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\TextShaping.dll",,,,,,,,,,1763581889194256600,,,,,,,,,,,140712585789440,140712585789440,770155,733184,2109619091,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1942644Z","2025-11-19 19:51:29.1942644Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.UI.Xaml.Controls.dll",,,,,,,,,,1763581889194264400,,,,,,,,,,,140712586575872,140712586575872,3327252,3313664,3689468694,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1942730Z","2025-11-19 19:51:29.1942730Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.Globalization.dll",,,,,,,,,,1763581889194273000,,,,,,,,,,,140712593457152,140712593457152,1640332,1634304,3240919660,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1942816Z","2025-11-19 19:51:29.1942816Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.UI.Immersive.dll",,,,,,,,,,1763581889194281600,,,,,,,,,,,140712595423232,140712595423232,1424120,1372160,1559948871,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1942896Z","2025-11-19 19:51:29.1942896Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.UI.Xaml.dll",,,,,,,,,,1763581889194289600,,,,,,,,,,,140712596865024,140712596865024,17882163,17858560,706442395,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1942973Z","2025-11-19 19:51:29.1942973Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.UI.dll",,,,,,,,,,1763581889194297300,,,,,,,,,,,140712615346176,140712615346176,1414164,1376256,3301850593,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1943052Z","2025-11-19 19:51:29.1943052Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\globinputhost.dll",,,,,,,,,,1763581889194305300,,,,,,,,,,,140712627863552,140712627863552,263563,208896,1786968813,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1943206Z","2025-11-19 19:51:29.1943206Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\BCP47mrm.dll",,,,,,,,,,1763581889194320600,,,,,,,,,,,140712628322304,140712628322304,278903,212992,835504572,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1943291Z","2025-11-19 19:51:29.1943291Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\TextInputFramework.dll",,,,,,,,,,1763581889194329100,,,,,,,,,,,140712628846592,140712628846592,1374424,1339392,3535451269,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1943365Z","2025-11-19 19:51:29.1943365Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\BCP47Langs.dll",,,,,,,,,,1763581889194336500,,,,,,,,,,,140712631468032,140712631468032,402331,385024,2065030180,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1943444Z","2025-11-19 19:51:29.1943444Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\MrmCoreR.dll",,,,,,,,,,1763581889194344400,,,,,,,,,,,140712631926784,140712631926784,1191374,1146880,1078870765,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1943524Z","2025-11-19 19:51:29.1943524Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\iertutil.dll",,,,,,,,,,1763581889194352400,,,,,,,,,,,140712642805760,140712642805760,2984761,2904064,3815768453,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1943595Z","2025-11-19 19:51:29.1943595Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\winmm.dll",,,,,,,,,,1763581889194359500,,,,,,,,,,,140712663842816,140712663842816,263815,217088,2106743460,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1943665Z","2025-11-19 19:51:29.1943665Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\srvcli.dll",,,,,,,,,,1763581889194366500,,,,,,,,,,,140712668954624,140712668954624,181029,167936,239922031,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1943805Z","2025-11-19 19:51:29.1943805Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\urlmon.dll",,,,,,,,,,1763581889194380600,,,,,,,,,,,140712669609984,140712669609984,1970671,1957888,260716450,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1943885Z","2025-11-19 19:51:29.1943885Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\xmllite.dll",,,,,,,,,,1763581889194388500,,,,,,,,,,,140712684027904,140712684027904,342897,274432,974526834,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1943954Z","2025-11-19 19:51:29.1943954Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\icu.dll",,,,,,,,,,1763581889194395400,,,,,,,,,,,140712684617728,140712684617728,2775448,2744320,3611555297,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1944034Z","2025-11-19 19:51:29.1944034Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,1763581889194403400,,,,,,,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1944111Z","2025-11-19 19:51:29.1944111Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.StateRepositoryClient.dll",,,,,,,,,,1763581889194411100,,,,,,,,,,,140712696610816,140712696610816,303673,290816,424989122,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1944191Z","2025-11-19 19:51:29.1944191Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.Graphics.dll",,,,,,,,,,1763581889194419100,,,,,,,,,,,140712711225344,140712711225344,669723,593920,1068018205,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1944274Z","2025-11-19 19:51:29.1944274Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\OneCoreUAPCommonProxyStub.dll",,,,,,,,,,1763581889194427400,,,,,,,,,,,140712713977856,140712713977856,6740758,6615040,2011948997,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1944428Z","2025-11-19 19:51:29.1944428Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\twinapi.appcore.dll",,,,,,,,,,1763581889194442800,,,,,,,,,,,140712720924672,140712720924672,2401519,2375680,2646458233,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1944476Z","2025-11-19 19:51:29.1944476Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\PackagedCom\OpenConsoleProxy.dll",,,,,,,,,,1763581889194447600,,,,,,,,,,,140712723349504,140712723349504,51292,53248,1759975238,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1944558Z","2025-11-19 19:51:29.1944558Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\d3d10warp.dll",,,,,,,,,,1763581889194455800,,,,,,,,,,,140712731869184,140712731869184,5958575,5943296,1147803111,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1944638Z","2025-11-19 19:51:29.1944638Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\WindowManagementAPI.dll",,,,,,,,,,1763581889194463800,,,,,,,,,,,140712738422784,140712738422784,1825044,1794048,1605274449,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1944716Z","2025-11-19 19:51:29.1944716Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\CoreUIComponents.dll",,,,,,,,,,1763581889194471600,,,,,,,,,,,140712742944768,140712742944768,3046501,3022848,801552868,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1944784Z","2025-11-19 19:51:29.1944784Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\winhttp.dll",,,,,,,,,,1763581889194478400,,,,,,,,,,,140712750350336,140712750350336,1261038,1212416,84984727,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1944867Z","2025-11-19 19:51:29.1944867Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\directxdatabasehelper.dll",,,,,,,,,,1763581889194486800,,,,,,,,,,,140712752709632,140712752709632,426573,405504,145563491,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1945018Z","2025-11-19 19:51:29.1945018Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Microsoft.Internal.WarpPal.dll",,,,,,,,,,1763581889194501800,,,,,,,,,,,140712769683456,140712769683456,167600,102400,2132685858,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1945098Z","2025-11-19 19:51:29.1945098Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\D3DCompiler_47.dll",,,,,,,,,,1763581889194509800,,,,,,,,,,,140712769814528,140712769814528,4685395,4714496,796813953,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1945171Z","2025-11-19 19:51:29.1945171Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\WindowsCodecs.dll",,,,,,,,,,1763581889194517100,,,,,,,,,,,140712775385088,140712775385088,2352359,2293760,3466818398,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1945237Z","2025-11-19 19:51:29.1945237Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\d2d1.dll",,,,,,,,,,1763581889194523700,,,,,,,,,,,140712777744384,140712777744384,6610469,6537216,3013069957,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1945298Z","2025-11-19 19:51:29.1945298Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\DWrite.dll",,,,,,,,,,1763581889194529800,,,,,,,,,,,140712784297984,140712784297984,2543119,2519040,1462185185,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1945358Z","2025-11-19 19:51:29.1945358Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\d3d11.dll",,,,,,,,,,1763581889194535800,,,,,,,,,,,140712786853888,140712786853888,2582658,2498560,2128032819,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1945429Z","2025-11-19 19:51:29.1945429Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\dcomp.dll",,,,,,,,,,1763581889194542900,,,,,,,,,,,140712789409792,140712789409792,2309196,2240512,1200801128,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1945503Z","2025-11-19 19:51:29.1945503Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\CoreMessaging.dll",,,,,,,,,,1763581889194550300,,,,,,,,,,,140712796160000,140712796160000,1232710,1208320,2155847221,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1945607Z","2025-11-19 19:51:29.1945607Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\TerminalThemeHelpers.dll",,,,,,,,,,1763581889194560700,,,,,,,,,,,140712799895552,140712799895552,93641,61440,1754949712,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1945692Z","2025-11-19 19:51:29.1945692Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\uxtheme.dll",,,,,,,,,,1763581889194569200,,,,,,,,,,,140712802254848,140712802254848,696534,696320,1695798817,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1945761Z","2025-11-19 19:51:29.1945761Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\pfclient.dll",,,,,,,,,,1763581889194576100,,,,,,,,,,,140712803500032,140712803500032,92868,73728,3163590703,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1945827Z","2025-11-19 19:51:29.1945827Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\dxgi.dll",,,,,,,,,,1763581889194582700,,,,,,,,,,,140712803631104,140712803631104,1320096,1282048,1861212996,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1945898Z","2025-11-19 19:51:29.1945898Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\dwmapi.dll",,,,,,,,,,1763581889194589800,,,,,,,,,,,140712805072896,140712805072896,203843,196608,2709117439,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1945964Z","2025-11-19 19:51:29.1945964Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\DXCore.dll",,,,,,,,,,1763581889194596400,,,,,,,,,,,140712805400576,140712805400576,331386,274432,2354081039,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1946048Z","2025-11-19 19:51:29.1946048Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\windows.storage.dll",,,,,,,,,,1763581889194604800,,,,,,,,,,,140712812412928,140712812412928,8877403,8769536,3667346596,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1946125Z","2025-11-19 19:51:29.1946125Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\netutils.dll",,,,,,,,,,1763581889194612500,,,,,,,,,,,140712825847808,140712825847808,80696,53248,865845000,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1946274Z","2025-11-19 19:51:29.1946274Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,1763581889194627400,,,,,,,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1946350Z","2025-11-19 19:51:29.1946350Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\ntmarta.dll",,,,,,,,,,1763581889194635000,,,,,,,,,,,140712831811584,140712831811584,265798,221184,3598506564,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1946427Z","2025-11-19 19:51:29.1946427Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\cryptsp.dll",,,,,,,,,,1763581889194642700,,,,,,,,,,,140712839217152,140712839217152,146168,110592,1658328178,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1946496Z","2025-11-19 19:51:29.1946496Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\cryptbase.dll",,,,,,,,,,1763581889194649600,,,,,,,,,,,140712839348224,140712839348224,63718,49152,3897879906,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1946578Z","2025-11-19 19:51:29.1946578Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\cfgmgr32.dll",,,,,,,,,,1763581889194657800,,,,,,,,,,,140712845049856,140712845049856,385808,356352,1737777300,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1946643Z","2025-11-19 19:51:29.1946643Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\sxs.dll",,,,,,,,,,1763581889194664300,,,,,,,,,,,140712846622720,140712846622720,697955,659456,3834976666,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1946718Z","2025-11-19 19:51:29.1946718Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\umpdc.dll",,,,,,,,,,1763581889194671800,,,,,,,,,,,140712848064512,140712848064512,98535,81920,1714427184,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1946853Z","2025-11-19 19:51:29.1946853Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\powrprof.dll",,,,,,,,,,1763581889194685300,,,,,,,,,,,140712848195584,140712848195584,457799,385024,2858637235,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1946929Z","2025-11-19 19:51:29.1946929Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\bcrypt.dll",,,,,,,,,,1763581889194692900,,,,,,,,,,,140712848654336,140712848654336,206048,172032,2893678010,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1947003Z","2025-11-19 19:51:29.1947003Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\profapi.dll",,,,,,,,,,1763581889194700300,,,,,,,,,,,140712848850944,140712848850944,229548,167936,2447194521,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1947080Z","2025-11-19 19:51:29.1947080Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,1763581889194708000,,,,,,,,,,,140712851341312,140712851341312,1524912,1486848,1404855129,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1947150Z","2025-11-19 19:51:29.1947150Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,1763581889194715000,,,,,,,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1947225Z","2025-11-19 19:51:29.1947225Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581889194722500,,,,,,,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1947290Z","2025-11-19 19:51:29.1947290Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,1763581889194729100,,,,,,,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1947357Z","2025-11-19 19:51:29.1947357Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581889194735700,,,,,,,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1947496Z","2025-11-19 19:51:29.1947496Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581889194749600,,,,,,,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1947704Z","2025-11-19 19:51:29.1947704Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,1763581889194770400,,,,,,,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1947784Z","2025-11-19 19:51:29.1947784Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581889194778400,,,,,,,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1947856Z","2025-11-19 19:51:29.1947856Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,1763581889194785600,,,,,,,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1947927Z","2025-11-19 19:51:29.1947927Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\shlwapi.dll",,,,,,,,,,1763581889194792700,,,,,,,,,,,140712868839424,140712868839424,479562,421888,2142510382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1948058Z","2025-11-19 19:51:29.1948058Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,1763581889194805800,,,,,,,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1948143Z","2025-11-19 19:51:29.1948143Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581889194814300,,,,,,,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1948213Z","2025-11-19 19:51:29.1948213Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\ole32.dll",,,,,,,,,,1763581889194821300,,,,,,,,,,,140712878473216,140712878473216,1689904,1667072,1018821057,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1948280Z","2025-11-19 19:51:29.1948280Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,1763581889194828000,,,,,,,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1948350Z","2025-11-19 19:51:29.1948350Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581889194835000,,,,,,,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1948412Z","2025-11-19 19:51:29.1948412Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,1763581889194841200,,,,,,,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1948481Z","2025-11-19 19:51:29.1948481Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,1763581889194848100,,,,,,,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1948549Z","2025-11-19 19:51:29.1948549Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,1763581889194854900,,,,,,,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1948685Z","2025-11-19 19:51:29.1948685Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,1763581889194868500,,,,,,,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1948764Z","2025-11-19 19:51:29.1948764Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,1763581889194876400,,,,,,,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1948833Z","2025-11-19 19:51:29.1948833Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\msctf.dll",,,,,,,,,,1763581889194883300,,,,,,,,,,,140712893022208,140712893022208,1455420,1433600,4155718050,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1948900Z","2025-11-19 19:51:29.1948900Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581889194890000,,,,,,,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1948967Z","2025-11-19 19:51:29.1948967Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581889194896700,,,,,,,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1949033Z","2025-11-19 19:51:29.1949033Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581889194903300,,,,,,,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1949230Z","2025-11-19 19:51:29.1949230Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"WindowsTermina",,,,,,,,,,1763581889194923100,,,,,,,,,,,,,,,,16732160,19222528,3702983350,134080554806979193,0,134080554881691430,577,0,3395,60,52,3,7,0,,,,,,,,,, -"2025-11-19 19:51:29.2994897Z","2025-11-19 19:51:29.2994897Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6220 svchost.exe",1512,,," 6220 svchost.exe",,,,,,,,,,,,,1763581889299489800,18446633084047761408,18446633084047736832,140712865112144,278,101940486144,1512,101943607296,101943574528,140712865112144,4277070,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.3321791Z","2025-11-19 19:51:29.3321791Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 8476 ServiceHub.IdentityHost.exe",,,,,,,,,,,,,1763581889332179100,18446633084047761408,18446633084047736832,140712899206080,0,843736039424,14488,843738251264,843738247168,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.3322610Z","2025-11-19 19:51:29.3322610Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1956 MSBuild.exe",,,,,,,,,,,,,1763581889332261100,18446633084055846912,18446633084055822336,140712899206080,0,641477595136,11260,641487339520,641487323136,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.3323015Z","2025-11-19 19:51:29.3323015Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 4372 vctip.exe",,,,,,,,,,,,,1763581889332301600,18446633084048019456,18446633084047994880,140712899206080,0,740355313664,12168,740362813440,740362805248,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.3323369Z","2025-11-19 19:51:29.3323369Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"12052 ServiceHub.TestWindowStoreHost.exe",,,,,,,,,,,,,1763581889332336900,18446633084017422336,18446633084017397760,140712899206080,0,17906528256,14160,17910726656,17910722560,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.3323724Z","2025-11-19 19:51:29.3323724Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,1763581889332372400,18446633084042932224,18446633084042907648,140712899206080,0,46014324736,13904,46028292096,46028275712,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.3324120Z","2025-11-19 19:51:29.3324120Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"10252 ServiceHub.IndexingService.exe",,,,,,,,,,,,,1763581889332412000,18446633084039225344,18446633084039200768,140712899206080,0,848612728832,13908,848617799680,848617795584,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.3324467Z","2025-11-19 19:51:29.3324467Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"10648 ServiceHub.Host.dotnet.x64.exe",,,,,,,,,,,,,1763581889332446700,18446633084045807616,18446633084045783040,140712899206080,0,515212726272,7132,515219914752,515219910656,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.3324957Z","2025-11-19 19:51:29.3324957Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"10200 ServiceHub.VSDetouredHost.exe",,,,,,,,,,,,,1763581889332495700,18446633084044943360,18446633084044918784,140712899206080,0,617596755968,7544,617601826816,617601822720,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.3325408Z","2025-11-19 19:51:29.3325408Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9988 Microsoft.ServiceHub.Controller.exe",,,,,,,,,,,,,1763581889332540800,18446633084046180352,18446633084046155776,140712899206080,0,1049753657344,10460,1049757745152,1049757741056,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.3325713Z","2025-11-19 19:51:29.3325713Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9280 Greenshot.exe",,,,,,,,,,,,,1763581889332571300,18446633084049481728,18446633084049457152,140712899206080,0,948118790144,1372,948122419200,948122415104,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:30.2877351Z","2025-11-19 19:51:30.2877351Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5536 svchost.exe",13504,,," 5536 svchost.exe",,,"C:\Windows\System32\aepic.dll",,,,,,,,,,1763581890287735100,,,,,,,,,,,140712428109824,140712428109824,641436,577536,321124434,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:30.2889380Z","2025-11-19 19:51:30.2889380Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5536 svchost.exe",13504,,," 5536 svchost.exe",,,"C:\Windows\System32\aepic.dll",,,,,,,,,,1763581890288938100,,,,,,,,,,,140712428109824,140712428109824,641436,589824,321124434,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:31.6121866Z","2025-11-19 19:51:31.6121866Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8972 VBoxTray.exe",9020,,," 8972 VBoxTray.exe",,,,,,,,,,,,,1763581891612186600,18446633084053868544,18446633084053843968,140700131109808,0,471284252672,11456,471286677504,471286673408,140700131109808,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:31.6124072Z","2025-11-19 19:51:31.6124072Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8972 VBoxTray.exe",11456,,," 8972 VBoxTray.exe",,,,,,,,,,,,,1763581891612407200,18446633084053868544,18446633084053843968,140700131109808,0,471284252672,11456,471286677504,471286669312,140700131109808,433403,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:32.3106101Z","2025-11-19 19:51:32.3106101Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",15084,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,1763581892310610100,18446633084039487488,18446633084039462912,140711613062896,0,1046353207296,15084,1046367698944,1046367674368,140711613062896,4399662,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:32.3106424Z","2025-11-19 19:51:32.3106424Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",12628,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,1763581892310642400,18446633084005355520,18446633084005330944,140711613062896,0,1046353223680,12628,1046388670464,1046388654080,140711613062896,853227,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:32.3427056Z","2025-11-19 19:51:32.3427056Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",11644,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,1763581892342705600,18446633084038852608,18446633084038828032,140711613062896,0,1046353231872,11644,1046392864768,1046392844288,140711613062896,653688,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:32.3427596Z","2025-11-19 19:51:32.3427596Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",14980,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,1763581892342759600,18446633084038365184,18446633084038340608,140711613062896,0,1046353215488,14980,1046371893248,1046371876864,140711613062896,958462,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:33.3438855Z","2025-11-19 19:51:33.3438855Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4832 WmiPrvSE.exe",12044,,," 4832 WmiPrvSE.exe",,,,,,,,,,,,,1763581893343885500,18446633084035751936,18446633084035727360,140712899206080,0,525413761024,12044,525414694912,525414629376,140712899206080,1823386,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:33.3438935Z","2025-11-19 19:51:33.3438935Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4832 WmiPrvSE.exe",13316,,," 4832 WmiPrvSE.exe",,,,,,,,,,,,,1763581893343893500,18446633084035637248,18446633084035612672,140712899206080,0,525413744640,13316,525411221504,525411155968,140712899206080,5525225,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +timestamp_sys,timestamp_etw,src_type,provider_name,event_id,task_info,process_id,thread_id,ppid,pid,targetpid,targettid,message,filepath,cachename,result,vname,name,sigseq,sigsha,commandline,firstparam,secondparam,stackbase,stacklimit,startaddr,subprocesstag,tebbase,threadid,timestamp_ns,userstackbase,userstacklimit,win32startaddr,cycletime,defaultbase,imagebase,imagechecksum,imagesize,timedatestamp,createtime,flags,mandatorylabel,packagefullname,packagerelativeappid,parentprocessid,parentprocesssequencenumber,processsequencenumber,processtokenelevationtype,processtokeniselevated,securitymitigations,sessionid,commitcharge,commitpeak,cpucyclecount,exitcode,exittime,handlecount,hardfaultcount,readoperationcount,readtransferkilobytes,tokenelevationtype,writeoperationcount,writetransferkilobytes"2025-11-19 22:37:11.1915649Z","2025-11-19 22:37:11.1915649Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 6096 svchost.exe",,,,,,,,,,,,,18446633084024459264,18446633084024434688,140712899206080,0,338488844288,636,1763591831191564900,338488393728,338488360960,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.1916937Z","2025-11-19 22:37:11.1916937Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9920 ServiceHub.IntellicodeModelService.exe",12960,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,18446633083978407936,18446633083978383360,140711612509856,0,46015668224,12960,1763591831191693700,46012694528,46012678144,140711612509856,862657,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.2048364Z","2025-11-19 22:37:11.2048364Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",4060,,," 5184 explorer.exe",,,,,,,,,,,,,18446633084024315904,18446633084024291328,140712899206080,0,15343616,1708,1763591831204836400,515375104,515317760,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.3509174Z","2025-11-19 22:37:11.3509174Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8984 svchost.exe",11892,,," 8984 svchost.exe",,,,,,,,,,,,,18446633084049739776,18446633084049715200,140712899206080,0,213147869184,11892,1763591831350917400,213148762112,213148729344,140712899206080,303269,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.3891653Z","2025-11-19 22:37:11.3891653Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5884 SearchProtocolHost.exe",2628,,," 5884 SearchProtocolHost.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,,,,,,,1763591831389165300,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.3901368Z","2025-11-19 22:37:11.3901368Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5884 SearchProtocolHost.exe",2628,,," 5884 SearchProtocolHost.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,,,,,,,1763591831390136800,,,,,140712869888000,140712869888000,7769948,7675904,2341846616,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.3946558Z","2025-11-19 22:37:11.3946558Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5884 SearchProtocolHost.exe",2628,,," 5884 SearchProtocolHost.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,,,,,,,1763591831394655800,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.3953496Z","2025-11-19 22:37:11.3953496Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5884 SearchProtocolHost.exe",2628,,," 5884 SearchProtocolHost.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,,,,,,,1763591831395349600,,,,,140712869888000,140712869888000,7769948,7675904,2341846616,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.5426966Z","2025-11-19 22:37:11.5426966Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"11648 RuntimeBroker.exe",,,,,,,,,,,,,18446633084049739776,18446633084049715200,140712899206080,0,503394197504,7460,1763591831542696600,503396696064,503396646912,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.6406757Z","2025-11-19 22:37:11.6406757Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8972 VBoxTray.exe",9020,,," 8972 VBoxTray.exe",,,,,,,,,,,,,18446633084024516608,18446633084024492032,140700131109808,0,471283179520,1480,1763591831640675700,471299260416,471299256320,140700131109808,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.6409261Z","2025-11-19 22:37:11.6409261Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8972 VBoxTray.exe",1480,,," 8972 VBoxTray.exe",,,,,,,,,,,,,18446633084024516608,18446633084024492032,140700131109808,0,471283179520,1480,1763591831640926100,471299260416,471299252224,140700131109808,560897,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.792165000Z","2025-11-19 22:37:11.7170068Z","myETW","EDRi-Provider",4242,"EDRiTask"," 7508 EDRi.exe",,,,,,"++ EDRi START MARKER ++",,,,,,,,,,,,,,,,,1763591831717006800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.7170149Z","2025-11-19 22:37:11.7170149Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9832 svchost.exe",11208,,," 9832 svchost.exe",,,,,,,,,,,,,18446633084050743296,18446633084050718720,140712899206080,0,234794704896,11208,1763591831717014900,234792878080,234792845312,140712899206080,383989,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.9502056Z","2025-11-19 22:37:11.9502056Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",2956,,," 5184 explorer.exe",,,,,,,,,,,,,18446633084024545280,18446633084024520704,140712899206080,0,15351808,13348,1763591831950205600,515899392,515842048,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:12.2126523Z","2025-11-19 22:37:12.2126523Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 9692 PerfWatson2.exe",12736,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084023541760,18446633084023517184,140711613062896,0,1046354399232,11240,1763591832212652300,1046413836288,1046413819904,140711613062896,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:12.3065571Z","2025-11-19 22:37:12.3065571Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","11904 msedgewebview2.exe",8860,,,"11904 msedgewebview2.exe",,,,,,,,,,,,,18446633083980414976,18446633083980390400,140712899206080,0,667618459648,8860,1763591832306557100,665728319488,665728315392,140712899206080,357587,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:12.3133629Z","2025-11-19 22:37:12.3133629Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 9692 PerfWatson2.exe",12616,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084024401920,18446633084024377344,140711613062896,0,1046354407424,11288,1763591832313362900,1046418030592,1046418014208,140711613062896,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:12.3544946Z","2025-11-19 22:37:12.3544946Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9324 msedgewebview2.exe",4216,,," 9324 msedgewebview2.exe",,,,,,,,,,,,,18446633083980595200,18446633083980570624,140712899206080,0,717037178880,4216,1763591832354494600,717054017536,717054013440,140712899206080,351927,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:12.3545599Z","2025-11-19 22:37:12.3545599Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 8984 svchost.exe",,,,,,,,,,,,,18446633084024057856,18446633084024033280,140712899206080,0,213147877376,276,1763591832354559900,213148762112,213148729344,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:12.5148249Z","2025-11-19 22:37:12.5148249Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9388 devenv.exe",12204,,," 9388 devenv.exe",,,,,,,,,,,,,18446633083985420288,18446633083985395712,140711613062896,0,1033377087488,12204,1763591832514824900,1033415163904,1033415143424,140711613062896,125044070,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:12.7208620Z","2025-11-19 22:37:12.7208620Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9832 svchost.exe",,,,,,,,,,,,,18446633083980414976,18446633083980390400,140712899206080,0,234794721280,11672,1763591832720862100,234792878080,234792845312,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:12.9904828Z","2025-11-19 22:37:12.9904828Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 7884 msedgewebview2.exe",5984,,," 7884 msedgewebview2.exe",,,,,,,,,,,,,18446633083980652544,18446633083980627968,140712899206080,0,139211661312,5984,1763591832990482800,139246698496,139246694400,140712899206080,266303,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:12.9904834Z","2025-11-19 22:37:12.9904834Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 7956 msedgewebview2.exe",504,,," 7956 msedgewebview2.exe",,,,,,,,,,,,,18446633084048707584,18446633084048683008,140712899206080,0,334435393536,504,1763591832990483400,334462189568,334462181376,140712899206080,245557,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.2297646Z","2025-11-19 22:37:13.2297646Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",2776,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084047761408,18446633084047736832,140711612509856,0,1046354391040,2776,1763591833229764600,1046352232448,1046352216064,140711612509856,1727953,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.2614302Z","2025-11-19 22:37:13.2614302Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13084 MSBuild.exe",2512,,,"13084 MSBuild.exe",,,,,,,,,,,,,18446633084004839424,18446633084004814848,140711613062896,0,911121752064,2512,1763591833261430200,911223029760,911223013376,140711613062896,1215338,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.2614809Z","2025-11-19 22:37:13.2614809Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13084 MSBuild.exe",12292,,,"13084 MSBuild.exe",,,,,,,,,,,,,18446633084004552704,18446633084004528128,140711613062896,0,911121727488,12292,1763591833261480900,911210446848,911210430464,140711613062896,2454817,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3089749Z","2025-11-19 22:37:13.3089749Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13084 MSBuild.exe",1488,,,"13084 MSBuild.exe",,,,,,,,,,,,,18446633084004638720,18446633084004614144,140711613062896,0,911121735680,1488,1763591833308974900,911214641152,911214624768,140711613062896,3342749,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3090104Z","2025-11-19 22:37:13.3090104Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13084 MSBuild.exe",14060,,,"13084 MSBuild.exe",,,,,,,,,,,,,18446633084004495360,18446633084004470784,140711613062896,0,911121719296,14060,1763591833309010400,911206252544,911206236160,140711613062896,2587216,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3090477Z","2025-11-19 22:37:13.3090477Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13084 MSBuild.exe",12864,,,"13084 MSBuild.exe",,,,,,,,,,,,,18446633084003921920,18446633084003897344,140711613062896,0,911121661952,12864,1763591833309047700,911176892416,911176876032,140711613062896,7149828,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3090782Z","2025-11-19 22:37:13.3090782Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"11904 msedgewebview2.exe",,,,,,,,,,,,,18446633084004552704,18446633084004528128,140712899206080,0,667618467840,7748,1763591833309078300,665728319488,665728315392,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3091086Z","2025-11-19 22:37:13.3091086Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13084 MSBuild.exe",9556,,,"13084 MSBuild.exe",,,,,,,,,,,,,18446633084004810752,18446633084004786176,140711613062896,0,911121743872,9556,1763591833309108600,911218835456,911218819072,140711613062896,1270411,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3091215Z","2025-11-19 22:37:13.3091215Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13084 MSBuild.exe",4244,,,"13084 MSBuild.exe",,,,,,,,,,,,,18446633084003979264,18446633084003954688,140711613062896,0,911121670144,4244,1763591833309121500,911181086720,911181066240,140711613062896,4226150,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3091312Z","2025-11-19 22:37:13.3091312Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","10648 ServiceHub.Host.dotnet.x64.exe",9652,,,"10648 ServiceHub.Host.dotnet.x64.exe",,,,,,,,,,,,,18446633083986194432,18446633083986169856,140711121663952,0,515211550720,9652,1763591833309131200,515230924800,515230879744,140711121663952,150560519,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3091350Z","2025-11-19 22:37:13.3091350Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13084 MSBuild.exe",13796,,,"13084 MSBuild.exe",,,,,,,,,,,,,18446633084004380672,18446633084004356096,140711613062896,0,911121711104,13796,1763591833309135000,911202058240,911202041856,140711613062896,3047023,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3091895Z","2025-11-19 22:37:13.3091895Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","10252 ServiceHub.IndexingService.exe",2196,,,"10252 ServiceHub.IndexingService.exe",,,,,,,,,,,,,18446633083984613376,18446633083984588800,140711121663952,0,848613646336,2196,1763591833309189500,848619372544,848619352064,140711121663952,39058301,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3092519Z","2025-11-19 22:37:13.3092519Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","10252 ServiceHub.IndexingService.exe",12808,,,"10252 ServiceHub.IndexingService.exe",,,,,,,,,,,,,18446633083985076224,18446633083985051648,140711121663952,0,848613662720,12808,1763591833309251900,848627761152,848627744768,140711121663952,23238547,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3093391Z","2025-11-19 22:37:13.3093391Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","10252 ServiceHub.IndexingService.exe",3892,,,"10252 ServiceHub.IndexingService.exe",,,,,,,,,,,,,18446633083986423808,18446633083986399232,140711121663952,0,848613687296,3892,1763591833309339100,848635625472,848635600896,140711121663952,49327209,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3567871Z","2025-11-19 22:37:13.3567871Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9324 msedgewebview2.exe",,,,,,,,,,,,,18446633084004638720,18446633084004614144,140712899206080,0,717037187072,8800,1763591833356787100,717054017536,717054013440,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.7697452Z","2025-11-19 22:37:13.7697452Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8268 svchost.exe",7544,,," 8268 svchost.exe",,,,,,,,,,,,,18446633084022276096,18446633084022251520,140712899206080,0,178507522048,7544,1763591833769745200,178510102528,178510069760,140712899206080,191618,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.9920204Z","2025-11-19 22:37:13.9920204Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 7884 msedgewebview2.exe",,,,,,,,,,,,,18446633083985420288,18446633083985395712,140712899206080,0,139211669504,5744,1763591833992020400,139246698496,139246694400,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.9921417Z","2025-11-19 22:37:13.9921417Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 7956 msedgewebview2.exe",,,,,,,,,,,,,18446633084025638912,18446633084025614336,140712899206080,0,334435401728,12716,1763591833992141700,334462189568,334462185472,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:14.0077231Z","2025-11-19 22:37:14.0077231Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5884 SearchProtocolHost.exe",14676,,," 5884 SearchProtocolHost.exe",,,,,,,,,,,,,18446633084009955328,18446633084009930752,140712899206080,0,100230639616,14676,1763591834007723100,100232331264,100232298496,140712899206080,4036415,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:14.0077232Z","2025-11-19 22:37:14.0077232Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5884 SearchProtocolHost.exe",8420,,," 5884 SearchProtocolHost.exe",,,,,,,,,,,,,18446633084010127360,18446633084010102784,140712899206080,0,100230647808,8420,1763591834007723200,100232855552,100232822784,140712899206080,1875060,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:14.0077273Z","2025-11-19 22:37:14.0077273Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5884 SearchProtocolHost.exe",7836,,," 5884 SearchProtocolHost.exe",,,,,,,,,,,,,18446633083987718144,18446633083987693568,140712899206080,0,100230656000,7836,1763591834007727300,100233379840,100233347072,140712899206080,74308,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:14.7714898Z","2025-11-19 22:37:14.7714898Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8916 SecurityHealthService.exe",2640,,," 8916 SecurityHealthService.exe",,,,,,,,,,,,,18446633083981217792,18446633083981193216,140712899206080,0,33814335488,2640,1763591834771489900,33812054016,33812045824,140712899206080,256119,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:14.7715058Z","2025-11-19 22:37:14.7715058Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 8268 svchost.exe",,,,,,,,,,,,,18446633084010127360,18446633084010102784,140712899206080,0,178507530240,4892,1763591834771505800,178510102528,178510069760,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:15.2004649Z","2025-11-19 22:37:15.2004649Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 700 lsass.exe",3660,,," 700 lsass.exe",,,,,,,,,,,,,18446633084010872832,18446633084010848256,140712850417280,0,81706889216,3660,1763591835200464900,81709760512,81709740032,140712850417280,513746,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:16.175848500Z","2025-11-19 22:37:15.7424568Z","myETW","EDRi-Provider",4242,"EDRiTask"," 7508 EDRi.exe",,,,,,"Before decrypting the attack exe from C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\attacks\Injector-standard.exe.enc",,,,,,,,,,,,,,,,,1763591835742456800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:16.182157400Z","2025-11-19 22:37:15.7482493Z","myETW","EDRi-Provider",4242,"EDRiTask"," 7508 EDRi.exe",,,,,,"After decrypting the attack exe",,,,,,,,,,,,,,,,,1763591835748249300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:15.7731036Z","2025-11-19 22:37:15.7731036Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 8916 SecurityHealthService.exe",,,,,,,,,,,,,18446633083980652544,18446633083980627968,140712899206080,0,33814343680,12872,1763591835773103700,33812054016,33812045824,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:16.1094589Z","2025-11-19 22:37:16.1094589Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 9692 PerfWatson2.exe",9752,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084025667584,18446633084025643008,140711612509856,0,1046354415616,1060,1763591836109458900,1046352232448,1046352216064,140711612509856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:16.6517984Z","2025-11-19 22:37:16.6517984Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8972 VBoxTray.exe",9020,,," 8972 VBoxTray.exe",,,,,,,,,,,,,18446633084025724928,18446633084025700352,140700131109808,0,471283187712,6728,1763591836651798400,471299260416,471299256320,140700131109808,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:16.6520139Z","2025-11-19 22:37:16.6520139Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8972 VBoxTray.exe",6728,,," 8972 VBoxTray.exe",,,,,,,,,,,,,18446633084025724928,18446633084025700352,140700131109808,0,471283187712,6728,1763591836652013900,471299260416,471299252224,140700131109808,456412,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:17.282796100Z","2025-11-19 22:37:16.7589463Z","myETW","EDRi-Provider",4242,"EDRiTask"," 7508 EDRi.exe",,,,,,"Before starting the attack exe",,,,,,,,,,,,,,,,,1763591836758946300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:17.4750774Z","2025-11-19 22:37:17.4750774Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1520 powershell.exe",2068,,," 1520 powershell.exe",,,,,,,,,,,,,18446633084010586112,18446633084010561536,140711613062896,0,931707432960,2068,1763591837475077400,931708534784,931708522496,140711613062896,2147777,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:17.4751035Z","2025-11-19 22:37:17.4751035Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1520 powershell.exe",13452,,," 1520 powershell.exe",,,,,,,,,,,,,18446633084010672128,18446633084010647552,140711613062896,0,931707449344,13452,1763591837475103500,931709059072,931709046784,140711613062896,1240989,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:17.4751539Z","2025-11-19 22:37:17.4751539Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1520 powershell.exe",7756,,," 1520 powershell.exe",,,,,,,,,,,,,18446633084000100352,18446633084000075776,140711613062896,0,931707490304,7756,1763591837475153900,931710107648,931710091264,140711613062896,1639311,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:17.4752016Z","2025-11-19 22:37:17.4752016Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1520 powershell.exe",9588,,," 1520 powershell.exe",,,,,,,,,,,,,18446633083999985664,18446633083999961088,140711613062896,0,931707482112,9588,1763591837475201600,931709583360,931709571072,140711613062896,1332647,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:17.6179244Z","2025-11-19 22:37:17.6179244Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",1060,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084025667584,18446633084025643008,140711612509856,0,1046354415616,1060,1763591837617924400,1046352232448,1046352216064,140711612509856,1229672,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:18.1080912Z","2025-11-19 22:37:18.1080912Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2376 svchost.exe",10840,,," 2376 svchost.exe",,,,,,,,,,,,,18446633084000100352,18446633084000075776,140712899206080,0,36399751168,5764,1763591838108091200,36401315840,36401283072,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:18.1082195Z","2025-11-19 22:37:18.1082195Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2376 svchost.exe",5764,,," 2376 svchost.exe",,,,,,,,,,,,,18446633084010586112,18446633084010561536,140712899206080,248,36399759360,7176,1763591838108219500,36401840128,36401807360,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:18.1091428Z","2025-11-19 22:37:18.1091428Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2932 svchost.exe",6236,,," 2932 svchost.exe",,,,,,,,,,,,,18446633084026470400,18446633084026445824,140712899206080,49,212462006272,4884,1763591838109142800,212464566272,212464500736,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:18.1100127Z","2025-11-19 22:37:18.1100127Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2376 svchost.exe",5764,,," 2376 svchost.exe",,,,,,,,,,,,,18446633084026499072,18446633084026474496,140712899206080,248,36399767552,3700,1763591838110012700,36402364416,36402331648,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:18.1100995Z","2025-11-19 22:37:18.1100995Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2376 svchost.exe",3700,,," 2376 svchost.exe",,,,,,,,,,,,,18446633084026585088,18446633084026560512,140712899206080,0,36399775744,8648,1763591838110099500,36402888704,36402855936,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:18.1101842Z","2025-11-19 22:37:18.1101842Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2376 svchost.exe",8648,,," 2376 svchost.exe",,,,,,,,,,,,,18446633084026613760,18446633084026589184,140712899206080,0,36399783936,12324,1763591838110184200,36403412992,36403380224,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:18.1102113Z","2025-11-19 22:37:18.1102113Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2080 svchost.exe",11748,,," 2080 svchost.exe",,,,,,,,,,,,,18446633084026675200,18446633084026650624,140712899206080,57,246078193664,4500,1763591838110211300,246081912832,246081880064,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:18.8842832Z","2025-11-19 22:37:18.8842832Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3540 svchost.exe",1372,,," 3540 svchost.exe",,,,,,,,,,,,,18446633084056907776,18446633084056883200,140711742624160,249,589657747456,1372,1763591838884283200,589660946432,589660913664,140711742624160,10493143486,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:18.8843028Z","2025-11-19 22:37:18.8843028Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3540 svchost.exe",2056,,," 3540 svchost.exe",,,,,,,,,,,,,18446633084013084672,18446633084013060096,140711742624160,249,589657755648,2056,1763591838884302800,589661470720,589661437952,140711742624160,413754083,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:18.9486568Z","2025-11-19 22:37:18.9486568Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8448 OneDrive.exe",14752,,," 8448 OneDrive.exe",,,,,,,,,,,,,18446633083984125952,18446633083984101376,140712859481984,0,70346272768,14752,1763591838948656800,70353158144,70353149952,140712859481984,764961,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:19.6822614Z","2025-11-19 22:37:19.6822614Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 9920 ServiceHub.IntellicodeModelService.exe",9760,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,18446633084027449344,18446633084027424768,140711612509856,0,46015676416,4196,1763591839682261400,46012694528,46012678144,140711612509856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:19.8417299Z","2025-11-19 22:37:19.8417299Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","10648 ServiceHub.Host.dotnet.x64.exe",7644,,,"10648 ServiceHub.Host.dotnet.x64.exe",,,,,,,,,,,,,18446633083985477632,18446633083985453056,140711121663952,0,515211534336,7644,1763591839841729900,515226206208,515226185728,140711121663952,242289127,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:19.8417852Z","2025-11-19 22:37:19.8417852Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","10648 ServiceHub.Host.dotnet.x64.exe",13156,,,"10648 ServiceHub.Host.dotnet.x64.exe",,,,,,,,,,,,,18446633084058513408,18446633084058488832,140711121663952,0,515213594624,13156,1763591839841785200,515234070528,515234017280,140711121663952,314582142,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.0924127Z","2025-11-19 22:37:20.0924127Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",5020,,," 5184 explorer.exe",,,,,,,,,,,,,18446633084027592704,18446633084027568128,140712891545280,0,15360000,15136,1763591840092412700,470351872,470294528,140712891545280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1091605Z","2025-11-19 22:37:20.1091605Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1040 svchost.exe",4480,,,"13388 smartscreen.exe",,,"C:\Windows\System32\smartscreen.exe",,,,,,,,,,,,,,,,1763591840109160500,,,,,,,664452,,419447766,134080654409311255,0,"0x","","",1040,13,6623,3,0,0,1,,,,,,,,,,,, +"2025-11-19 22:37:20.1098332Z","2025-11-19 22:37:20.1098332Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",4480,,,"13388 smartscreen.exe",,,,,,,,,,,,,18446633083984125952,18446633083984101376,140696524147856,40,184868757504,12744,1763591840109833200,184867422208,184867414016,140696524147856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1113626Z","2025-11-19 22:37:20.1113626Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\smartscreen.exe",,,,,,,,,,,,,,,,1763591840111362600,,,,,140696524029952,140696524029952,664452,614400,419447766,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1113736Z","2025-11-19 22:37:20.1113736Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591840111373600,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1148161Z","2025-11-19 22:37:20.1148161Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591840114816100,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1149453Z","2025-11-19 22:37:20.1149453Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591840114945300,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1160739Z","2025-11-19 22:37:20.1160739Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591840116073900,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1161632Z","2025-11-19 22:37:20.1161632Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,,,,,,,,,,,18446633084027420672,18446633084027396096,140712899206080,0,184868765696,7684,1763591840116163200,184867946496,184867938304,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1162258Z","2025-11-19 22:37:20.1162258Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,,,,,,,1763591840116225800,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1163609Z","2025-11-19 22:37:20.1163609Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591840116360900,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1164719Z","2025-11-19 22:37:20.1164719Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,,,,,,,,,,,18446633084058513408,18446633084058488832,140712899206080,0,184868773888,3956,1763591840116471900,184870764544,184870756352,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1165504Z","2025-11-19 22:37:20.1165504Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,,,,,,,,,,,18446633083985477632,18446633083985453056,140712899206080,0,184868782080,11600,1763591840116550400,184871288832,184871280640,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1165516Z","2025-11-19 22:37:20.1165516Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,,,,,,,1763591840116551600,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1167496Z","2025-11-19 22:37:20.1167496Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591840116749600,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1169151Z","2025-11-19 22:37:20.1169151Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591840116915100,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1170578Z","2025-11-19 22:37:20.1170578Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,"C:\Windows\System32\smartscreen.dll",,,,,,,,,,,,,,,,1763591840117057800,,,,,140711778385920,140711778385920,6028386,6057984,1751620389,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1170667Z","2025-11-19 22:37:20.1170667Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591840117066700,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1172650Z","2025-11-19 22:37:20.1172650Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591840117265000,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1172844Z","2025-11-19 22:37:20.1172844Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591840117284400,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1174617Z","2025-11-19 22:37:20.1174617Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",7684,,,"13388 smartscreen.exe",,,"C:\Windows\System32\winhttp.dll",,,,,,,,,,,,,,,,1763591840117461700,,,,,140712750350336,140712750350336,1261038,1212416,84984727,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1174902Z","2025-11-19 22:37:20.1174902Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591840117490200,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1175715Z","2025-11-19 22:37:20.1175715Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591840117571500,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1177224Z","2025-11-19 22:37:20.1177224Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",7684,,,"13388 smartscreen.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591840117722400,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1177989Z","2025-11-19 22:37:20.1177989Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591840117798900,,,,,2261897052160,2261897052160,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1178688Z","2025-11-19 22:37:20.1178688Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\crypt32.dll",,,,,,,,,,,,,,,,1763591840117868800,,,,,140712849768448,140712849768448,1584869,1536000,3438168074,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1178750Z","2025-11-19 22:37:20.1178750Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591840117875000,,,,,2261897052160,2261897052160,716301,692224,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1180529Z","2025-11-19 22:37:20.1180529Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,"C:\Windows\System32\ws2_32.dll",,,,,,,,,,,,,,,,1763591840118052900,,,,,140712881094656,140712881094656,513405,475136,3967481067,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1180716Z","2025-11-19 22:37:20.1180716Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,,,,,,,1763591840118071600,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1183282Z","2025-11-19 22:37:20.1183282Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",7684,,,"13388 smartscreen.exe",,,"C:\Windows\System32\cryptsp.dll",,,,,,,,,,,,,,,,1763591840118328200,,,,,140712839217152,140712839217152,146168,110592,1658328178,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1184654Z","2025-11-19 22:37:20.1184654Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,,,,,,,1763591840118465400,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1186873Z","2025-11-19 22:37:20.1186873Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",7684,,,"13388 smartscreen.exe",,,"C:\Windows\System32\dnsapi.dll",,,,,,,,,,,,,,,,1763591840118687300,,,,,140712824274944,140712824274944,1293169,1228800,1381219389,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1187105Z","2025-11-19 22:37:20.1187105Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,,,,,,,1763591840118710500,,,,,140712851341312,140712851341312,1524912,1486848,1404855129,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1189211Z","2025-11-19 22:37:20.1189211Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,"C:\Windows\System32\wintrust.dll",,,,,,,,,,,,,,,,1763591840118921100,,,,,140712860844032,140712860844032,590783,520192,452262045,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1190908Z","2025-11-19 22:37:20.1190908Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",11600,,,"13388 smartscreen.exe",,,"C:\Windows\System32\IPHLPAPI.DLL",,,,,,,,,,,,,,,,1763591840119090800,,,,,140712824012800,140712824012800,233044,212992,945822897,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1191038Z","2025-11-19 22:37:20.1191038Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,"C:\Windows\System32\ole32.dll",,,,,,,,,,,,,,,,1763591840119103800,,,,,140712878473216,140712878473216,1689904,1667072,1018821057,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1211887Z","2025-11-19 22:37:20.1211887Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\nsi.dll",,,,,,,,,,,,,,,,1763591840121188700,,,,,140712892956672,140712892956672,111648,40960,4223476491,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1217296Z","2025-11-19 22:37:20.1217296Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,,,,,,,1763591840121729600,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1234427Z","2025-11-19 22:37:20.1234427Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\msasn1.dll",,,,,,,,,,,,,,,,1763591840123442700,,,,,140712839675904,140712839675904,150871,77824,2536054058,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1241762Z","2025-11-19 22:37:20.1241762Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,,,,,,,,,,,18446633084027277312,18446633084027252736,140711782212992,0,184868790272,3760,1763591840124176200,184871813120,184871804928,140711782212992,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1244097Z","2025-11-19 22:37:20.1244097Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",3760,,,"13388 smartscreen.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591840124409700,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1247167Z","2025-11-19 22:37:20.1247167Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,,,,,,,1763591840124716700,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1250862Z","2025-11-19 22:37:20.1250862Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"13388 smartscreen.exe",,,,,,,,,,,,,18446633084027650048,18446633084027625472,140712899206080,0,184868798464,14596,1763591840125086200,184872337408,184872329216,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1253125Z","2025-11-19 22:37:20.1253125Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",14596,,,"13388 smartscreen.exe",,,"C:\Windows\System32\wtdsensor.dll",,,,,,,,,,,,,,,,1763591840125312500,,,,,140712681996288,140712681996288,56489,45056,4237415889,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1267405Z","2025-11-19 22:37:20.1267405Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,,,,,,,1763591840126740500,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1275908Z","2025-11-19 22:37:20.1275908Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,,,,,,,,,,,18446633084013084672,18446633084013060096,140712865112144,0,184868806656,13360,1763591840127590800,184872861696,184872853504,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1278602Z","2025-11-19 22:37:20.1278602Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13388 smartscreen.exe",14596,,,"13388 smartscreen.exe",,,,,,,,,,,,,18446633084027764736,18446633084027740160,140712899206080,0,184868814848,6860,1763591840127860200,184873385984,184873377792,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1303812Z","2025-11-19 22:37:20.1303812Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",14596,,,"13388 smartscreen.exe",,,"C:\Windows\System32\smartscreenps.dll",,,,,,,,,,,,,,,,1763591840130381200,,,,,140712623865856,140712623865856,151429,122880,4089359051,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1319012Z","2025-11-19 22:37:20.1319012Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",14596,,,"13388 smartscreen.exe",,,"C:\Windows\System32\Windows.Management.Workplace.dll",,,,,,,,,,,,,,,,1763591840131901200,,,,,140712429879296,140712429879296,215437,204800,170946563,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1326328Z","2025-11-19 22:37:20.1326328Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",14596,,,"13388 smartscreen.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591840132632800,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1331654Z","2025-11-19 22:37:20.1331654Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13388 smartscreen.exe",14596,,,"13388 smartscreen.exe",,,,,,,,,,,,,18446633084027478016,18446633084027453440,140711782212992,0,184868823040,11928,1763591840133165400,184873910272,184873902080,140711782212992,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1334794Z","2025-11-19 22:37:20.1334794Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13388 smartscreen.exe",6860,,,"13388 smartscreen.exe",,,,,,,,,,,,,18446633084027736064,18446633084027711488,140712899206080,0,184868831232,8216,1763591840133479400,184874434560,184874426368,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1761396Z","2025-11-19 22:37:20.1761396Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 5184 explorer.exe",15136,,," 5604 attack-890.exe",,,"C:\Users\Public\Downloads\attack-890.exe",,,,,,,,,,,,,,,,1763591840176139600,,,,,,,0,,1763491559,134080654410040405,0,"0x","","",5184,140,6624,3,0,0,1,,,,,,,,,,,, +"2025-11-19 22:37:20.1789263Z","2025-11-19 22:37:20.1789263Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",15136,,," 5604 attack-890.exe",,,,,,,,,,,,,18446633084027822080,18446633084027797504,140695618865008,0,867488051200,3452,1763591840178926300,867486007296,867486003200,140695618865008,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1817085Z","2025-11-19 22:37:20.1817085Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5536 svchost.exe",13256,,," 5536 svchost.exe",,,,,,,,,,,,,18446633084027908096,18446633084027883520,140712899206080,132,151912210432,14100,1763591840181708500,151915593728,151915560960,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1842611Z","2025-11-19 22:37:20.1842611Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5536 svchost.exe",13256,,," 5536 svchost.exe",,,"C:\Windows\System32\pcadm.dll",,,,,,,,,,,,,,,,1763591840184261100,,,,,140712537882624,140712537882624,249405,204800,3376468140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1844108Z","2025-11-19 22:37:20.1844108Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5536 svchost.exe",13256,,," 5536 svchost.exe",,,,,,,,,,,,,18446633084027879424,18446633084027854848,140712899206080,132,151912218624,2184,1763591840184410800,151916118016,151916085248,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1844961Z","2025-11-19 22:37:20.1844961Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5536 svchost.exe",2184,,," 5536 svchost.exe",,,,,,,,,,,,,18446633084027994112,18446633084027969536,140712899206080,0,151912226816,9180,1763591840184496100,151920836608,151920803840,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1845349Z","2025-11-19 22:37:20.1845349Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5536 svchost.exe",3884,,," 5536 svchost.exe",,,"C:\Windows\System32\wdi.dll",,,,,,,,,,,,,,,,1763591840184534900,,,,,140712669413376,140712669413376,172159,126976,589396027,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1846510Z","2025-11-19 22:37:20.1846510Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5536 svchost.exe",13256,,," 5536 svchost.exe",,,"C:\Windows\System32\pcacli.dll",,,,,,,,,,,,,,,,1763591840184651000,,,,,140712543977472,140712543977472,146563,102400,3048676746,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1847940Z","2025-11-19 22:37:20.1847940Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5536 svchost.exe",2184,,," 5536 svchost.exe",,,"C:\Windows\System32\aepic.dll",,,,,,,,,,,,,,,,1763591840184794000,,,,,140712428109824,140712428109824,641436,577536,321124434,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1850214Z","2025-11-19 22:37:20.1850214Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5536 svchost.exe",3884,,," 5536 svchost.exe",,,"C:\Windows\System32\mpr.dll",,,,,,,,,,,,,,,,1763591840185021400,,,,,140712737832960,140712737832960,203967,135168,2433114060,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1884155Z","2025-11-19 22:37:20.1884155Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5536 svchost.exe",13256,,," 5536 svchost.exe",,,"C:\Windows\System32\wdi.dll",,,,,,,,,,,,,,,,1763591840188415500,,,,,140712669413376,140712669413376,172159,139264,589396027,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1884903Z","2025-11-19 22:37:20.1884903Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5536 svchost.exe",13256,,," 5536 svchost.exe",,,"C:\Windows\System32\mpr.dll",,,,,,,,,,,,,,,,1763591840188490300,,,,,140712737832960,140712737832960,203967,147456,2433114060,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1885390Z","2025-11-19 22:37:20.1885390Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5536 svchost.exe",13256,,," 5536 svchost.exe",,,"C:\Windows\System32\pcacli.dll",,,,,,,,,,,,,,,,1763591840188539000,,,,,140712543977472,140712543977472,146563,114688,3048676746,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1886532Z","2025-11-19 22:37:20.1886532Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5536 svchost.exe",13256,,," 5536 svchost.exe",,,"C:\Windows\System32\aepic.dll",,,,,,,,,,,,,,,,1763591840188653200,,,,,140712428109824,140712428109824,641436,589824,321124434,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1887053Z","2025-11-19 22:37:20.1887053Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5536 svchost.exe",13256,,," 5536 svchost.exe",,,"C:\Windows\System32\pcadm.dll",,,,,,,,,,,,,,,,1763591840188705300,,,,,140712537882624,140712537882624,249405,217088,3376468140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1893585Z","2025-11-19 22:37:20.1893585Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Users\Public\Downloads\attack-890.exe",,,,,,,,,,,,,,,,1763591840189358600,,,,,140695618846720,140695618846720,0,53248,1763491559,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1893886Z","2025-11-19 22:37:20.1893886Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591840189388600,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1901610Z","2025-11-19 22:37:20.1901610Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591840190161000,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1902585Z","2025-11-19 22:37:20.1902585Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591840190258500,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1912674Z","2025-11-19 22:37:20.1912674Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 5604 attack-890.exe",3452,,,"13300 conhost.exe",,,"C:\Windows\System32\conhost.exe",,,,,,,,,,,,,,,,1763591840191267400,,,,,,,1035098,,2671108986,134080654410205145,0,"0x","","",5604,6624,6625,3,0,0,1,,,,,,,,,,,, +"2025-11-19 22:37:20.1924430Z","2025-11-19 22:37:20.1924430Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5604 attack-890.exe",3452,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084027535360,18446633084027510784,140696384751904,0,689119371264,4616,1763591840192443000,689120477184,689120468992,140696384751904,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1925113Z","2025-11-19 22:37:20.1925113Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",4616,,,"13300 conhost.exe",,,"C:\Windows\System32\conhost.exe",,,,,,,,,,,,,,,,1763591840192511300,,,,,140696384438272,140696384438272,1035098,1028096,2671108986,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1925439Z","2025-11-19 22:37:20.1925439Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",4616,,,"13300 conhost.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591840192543900,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1931167Z","2025-11-19 22:37:20.1931167Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",4616,,,"13300 conhost.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591840193116700,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1932481Z","2025-11-19 22:37:20.1932481Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",4616,,,"13300 conhost.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591840193248100,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1945040Z","2025-11-19 22:37:20.1945040Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",4616,,,"13300 conhost.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591840194504000,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1946398Z","2025-11-19 22:37:20.1946398Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",4616,,,"13300 conhost.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591840194639800,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1947313Z","2025-11-19 22:37:20.1947313Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13300 conhost.exe",4616,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028108800,18446633084028084224,140712899206080,0,689119379456,12308,1763591840194731300,689121001472,689120993280,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1948066Z","2025-11-19 22:37:20.1948066Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13300 conhost.exe",12308,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028137472,18446633084028112896,140712899206080,0,689119387648,3500,1763591840194806600,689121525760,689121517568,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1955230Z","2025-11-19 22:37:20.1955230Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",4616,,,"13300 conhost.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591840195523000,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1956281Z","2025-11-19 22:37:20.1956281Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",4616,,,"13300 conhost.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591840195628100,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1957266Z","2025-11-19 22:37:20.1957266Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",4616,,,"13300 conhost.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591840195726600,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1958833Z","2025-11-19 22:37:20.1958833Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",4616,,,"13300 conhost.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591840195883300,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1964362Z","2025-11-19 22:37:20.1964362Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",4616,,,"13300 conhost.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591840196436200,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1965271Z","2025-11-19 22:37:20.1965271Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",4616,,,"13300 conhost.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591840196527100,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1966343Z","2025-11-19 22:37:20.1966343Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",4616,,,"13300 conhost.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591840196634300,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1967289Z","2025-11-19 22:37:20.1967289Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",4616,,,"13300 conhost.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591840196729000,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1972874Z","2025-11-19 22:37:20.1972874Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",4616,,,"13300 conhost.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,,,,,,,1763591840197287400,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1989205Z","2025-11-19 22:37:20.1989205Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13300 conhost.exe",4616,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028252160,18446633084028227584,140696384580832,0,689119395840,6452,1763591840198920500,689122050048,689122041856,140696384580832,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1990028Z","2025-11-19 22:37:20.1990028Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13300 conhost.exe",3500,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028137472,18446633084028112896,140712899206080,0,689119387648,3500,1763591840199002800,689121525760,689121517568,140712899206080,1810182,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1990139Z","2025-11-19 22:37:20.1990139Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13300 conhost.exe",12308,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028108800,18446633084028084224,140712899206080,0,689119379456,12308,1763591840199013900,689121001472,689120993280,140712899206080,569572,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1991188Z","2025-11-19 22:37:20.1991188Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13300 conhost.exe",4616,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084027535360,18446633084027510784,140696384751904,0,689119371264,4616,1763591840199118900,689120477184,689120460800,140696384751904,22444533,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1991908Z","2025-11-19 22:37:20.1991908Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",6452,,,"13300 conhost.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,,,,,,,1763591840199190800,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1994019Z","2025-11-19 22:37:20.1994019Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13300 conhost.exe",6452,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084027535360,18446633084027510784,140712899206080,0,689119404032,10848,1763591840199401900,689120477184,689120468992,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2002361Z","2025-11-19 22:37:20.2002361Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",6452,,,"13300 conhost.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591840200236100,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2004689Z","2025-11-19 22:37:20.2004689Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",6452,,,"13300 conhost.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,,,,,,,1763591840200468900,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2009502Z","2025-11-19 22:37:20.2009502Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",6452,,,"13300 conhost.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,,,,,,,1763591840200950200,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2016575Z","2025-11-19 22:37:20.2016575Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",6452,,,"13300 conhost.exe",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,,,,,,,1763591840201657500,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2042774Z","2025-11-19 22:37:20.2042774Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13300 conhost.exe",6452,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028108800,18446633084028084224,140712865112144,0,689119412224,3620,1763591840204277400,689121001472,689120993280,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2044792Z","2025-11-19 22:37:20.2044792Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028137472,18446633084028112896,140712899206080,0,689119420416,14856,1763591840204479200,689121525760,689121517568,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2046406Z","2025-11-19 22:37:20.2046406Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13300 conhost.exe",14856,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028309504,18446633084028284928,140712899206080,0,689119428608,6828,1763591840204640600,689122574336,689122566144,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2084663Z","2025-11-19 22:37:20.2084663Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2992 svchost.exe",8856,,," 2992 svchost.exe",,,,,,,,,,,,,18446633084028338176,18446633084028313600,140712899206080,186,170617454592,14440,1763591840208466300,170615767040,170615734272,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2118325Z","2025-11-19 22:37:20.2118325Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1040 svchost.exe",4480,,," 632 OpenConsole.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\OpenConsole.exe",,,,,,,,,,,,,,,,1763591840211832500,,,,,,,1210794,,1759975785,134080654410427174,3,"0x","Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe","App",1040,13,6626,3,0,0,1,,,,,,,,,,,, +"2025-11-19 22:37:20.2124452Z","2025-11-19 22:37:20.2124452Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",4480,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028022784,18446633084027998208,140702989817872,40,696750407680,5408,1763591840212445200,696748802048,696748797952,140702989817872,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2146117Z","2025-11-19 22:37:20.2146117Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1040 svchost.exe",,,,,,,,,,,,,18446633084028366848,18446633084028342272,140712899206080,0,256031023104,9432,1763591840214611700,256033947648,256033914880,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2148741Z","2025-11-19 22:37:20.2148741Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\OpenConsole.exe",,,,,,,,,,,,,,,,1763591840214874100,,,,,140702989025280,140702989025280,1210794,1159168,1759975785,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2149027Z","2025-11-19 22:37:20.2149027Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591840214902700,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2183156Z","2025-11-19 22:37:20.2183156Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591840218315600,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2184582Z","2025-11-19 22:37:20.2184582Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591840218458200,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2196960Z","2025-11-19 22:37:20.2196960Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,,,,,,,1763591840219696000,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2198222Z","2025-11-19 22:37:20.2198222Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591840219822200,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2198977Z","2025-11-19 22:37:20.2198977Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028424192,18446633084028399616,140712899206080,0,696750415872,3864,1763591840219897700,696752537600,696752533504,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2199559Z","2025-11-19 22:37:20.2199559Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591840219955900,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2201168Z","2025-11-19 22:37:20.2201168Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028481536,18446633084028456960,140712899206080,0,696750424064,12484,1763591840220116800,696753586176,696753582080,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2201837Z","2025-11-19 22:37:20.2201837Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,,,,,,,1763591840220183700,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2202127Z","2025-11-19 22:37:20.2202127Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 632 OpenConsole.exe",12484,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028510208,18446633084028485632,140712899206080,0,696750432256,14384,1763591840220212700,696754634752,696754630656,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2203444Z","2025-11-19 22:37:20.2203444Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591840220344400,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2205371Z","2025-11-19 22:37:20.2205371Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,,,,,,,1763591840220537100,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2205413Z","2025-11-19 22:37:20.2205413Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",12484,,," 632 OpenConsole.exe",,,"C:\Windows\System32\UIAutomationCore.dll",,,,,,,,,,,,,,,,1763591840220541300,,,,,140712432762880,140712432762880,4328257,4296704,2096711852,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2207712Z","2025-11-19 22:37:20.2207712Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591840220771200,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2210529Z","2025-11-19 22:37:20.2210529Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591840221052900,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2211786Z","2025-11-19 22:37:20.2211786Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591840221178600,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2212737Z","2025-11-19 22:37:20.2212737Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591840221273700,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2214099Z","2025-11-19 22:37:20.2214099Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591840221409900,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2216296Z","2025-11-19 22:37:20.2216296Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591840221629600,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2217163Z","2025-11-19 22:37:20.2217163Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",3864,,," 632 OpenConsole.exe",,,"C:\Windows\System32\windows.storage.dll",,,,,,,,,,,,,,,,1763591840221716300,,,,,140712812412928,140712812412928,8877403,8769536,3667346596,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2217880Z","2025-11-19 22:37:20.2217880Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",12484,,," 632 OpenConsole.exe",,,"C:\Windows\System32\propsys.dll",,,,,,,,,,,,,,,,1763591840221788000,,,,,140712761491456,140712761491456,1123662,1060864,3228732737,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2218169Z","2025-11-19 22:37:20.2218169Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591840221816900,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2221345Z","2025-11-19 22:37:20.2221345Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,,,,,,,1763591840222134500,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2223554Z","2025-11-19 22:37:20.2223554Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,,,,,,,1763591840222355400,,,,,140712851341312,140712851341312,1524912,1486848,1404855129,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2225067Z","2025-11-19 22:37:20.2225067Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,,,,,,,1763591840222506700,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2228291Z","2025-11-19 22:37:20.2228291Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",12484,,," 632 OpenConsole.exe",,,"C:\Windows\System32\winmm.dll",,,,,,,,,,,,,,,,1763591840222829100,,,,,140712663842816,140712663842816,263815,217088,2106743460,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2230199Z","2025-11-19 22:37:20.2230199Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",14384,,," 632 OpenConsole.exe",,,"C:\Windows\System32\d2d1.dll",,,,,,,,,,,,,,,,1763591840223019900,,,,,140712777744384,140712777744384,6610469,6537216,3013069957,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2230365Z","2025-11-19 22:37:20.2230365Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",3864,,," 632 OpenConsole.exe",,,"C:\Windows\System32\usp10.dll",,,,,,,,,,,,,,,,1763591840223036500,,,,,140711462174720,140711462174720,161304,102400,728066498,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2231119Z","2025-11-19 22:37:20.2231119Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\DWrite.dll",,,,,,,,,,,,,,,,1763591840223111900,,,,,140712784297984,140712784297984,2543119,2519040,1462185185,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2234109Z","2025-11-19 22:37:20.2234109Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",12484,,," 632 OpenConsole.exe",,,"C:\Windows\System32\dxgi.dll",,,,,,,,,,,,,,,,1763591840223410900,,,,,140712803631104,140712803631104,1320096,1282048,1861212996,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2235191Z","2025-11-19 22:37:20.2235191Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",14384,,," 632 OpenConsole.exe",,,"C:\Windows\System32\D3DCompiler_47.dll",,,,,,,,,,,,,,,,1763591840223519100,,,,,140712769814528,140712769814528,4685395,4714496,796813953,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2235551Z","2025-11-19 22:37:20.2235551Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",3864,,," 632 OpenConsole.exe",,,"C:\Windows\System32\d3d11.dll",,,,,,,,,,,,,,,,1763591840223555100,,,,,140712786853888,140712786853888,2582658,2498560,2128032819,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2238951Z","2025-11-19 22:37:20.2238951Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",14384,,," 632 OpenConsole.exe",,,"C:\Windows\System32\cryptsp.dll",,,,,,,,,,,,,,,,1763591840223895100,,,,,140712839217152,140712839217152,146168,110592,1658328178,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2239313Z","2025-11-19 22:37:20.2239313Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\powrprof.dll",,,,,,,,,,,,,,,,1763591840223931300,,,,,140712848195584,140712848195584,457799,385024,2858637235,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2288168Z","2025-11-19 22:37:20.2288168Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,,,,,,,1763591840228816800,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2293460Z","2025-11-19 22:37:20.2293460Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\umpdc.dll",,,,,,,,,,,,,,,,1763591840229346000,,,,,140712848064512,140712848064512,98535,81920,1714427184,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2309648Z","2025-11-19 22:37:20.2309648Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591840230964800,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2314234Z","2025-11-19 22:37:20.2314234Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,,,,,,,1763591840231423400,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2321707Z","2025-11-19 22:37:20.2321707Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,,,,,,,1763591840232170700,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2353969Z","2025-11-19 22:37:20.2353969Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028223488,18446633084028198912,140712865112144,0,696750440448,8232,1763591840235396900,696755683328,696755675136,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2356120Z","2025-11-19 22:37:20.2356120Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028538880,18446633084028514304,140712899206080,0,696750448640,14248,1763591840235612000,696756731904,696756727808,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2357894Z","2025-11-19 22:37:20.2357894Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 632 OpenConsole.exe",14248,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028596224,18446633084028571648,140712899206080,0,696750456832,10496,1763591840235789400,696757780480,696757776384,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2430002Z","2025-11-19 22:37:20.2430002Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",10496,,," 632 OpenConsole.exe",,,"C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\PackagedCom\OpenConsoleProxy.dll",,,,,,,,,,,,,,,,1763591840243000200,,,,,140712723349504,140712723349504,51292,53248,1759975238,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2446215Z","2025-11-19 22:37:20.2446215Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",6452,,,"13300 conhost.exe",,,"C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\PackagedCom\OpenConsoleProxy.dll",,,,,,,,,,,,,,,,1763591840244621500,,,,,140712723349504,140712723349504,51292,53248,1759975238,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2450024Z","2025-11-19 22:37:20.2450024Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",6452,,,"13300 conhost.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,,,,,,,1763591840245002400,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2599092Z","2025-11-19 22:37:20.2599092Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1040 svchost.exe",4480,,,"13248 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe",,,,,,,,,,,,,,,,1763591840259909200,,,,,,,738129,,1759975821,134080654410898354,3,"0x","Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe","App",1040,13,6627,3,0,0,1,,,,,,,,,,,, +"2025-11-19 22:37:20.2605834Z","2025-11-19 22:37:20.2605834Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",4480,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028624896,18446633084028600320,140702319920256,40,932562440192,2344,1763591840260583400,932564697088,932564692992,140702319920256,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2632791Z","2025-11-19 22:37:20.2632791Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe",,,,,,,,,,,,,,,,1763591840263279100,,,,,140702319640576,140702319640576,738129,684032,1759975821,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2633139Z","2025-11-19 22:37:20.2633139Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591840263313900,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2725222Z","2025-11-19 22:37:20.2725222Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591840272522200,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2726420Z","2025-11-19 22:37:20.2726420Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591840272642000,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2738132Z","2025-11-19 22:37:20.2738132Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028080128,18446633084028055552,140712899206080,0,932562448384,6140,1763591840273813200,932565745664,932565741568,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2738795Z","2025-11-19 22:37:20.2738795Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591840273879500,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2740912Z","2025-11-19 22:37:20.2740912Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",6140,,,"13248 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\TerminalThemeHelpers.dll",,,,,,,,,,,,,,,,1763591840274091200,,,,,140712700477440,140712700477440,93641,61440,1754949712,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2740994Z","2025-11-19 22:37:20.2740994Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591840274099400,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2742321Z","2025-11-19 22:37:20.2742321Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028682240,18446633084028657664,140712899206080,0,932562456576,3272,1763591840274232100,932566794240,932566790144,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2743295Z","2025-11-19 22:37:20.2743295Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591840274329500,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2745410Z","2025-11-19 22:37:20.2745410Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591840274541000,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2747256Z","2025-11-19 22:37:20.2747256Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591840274725600,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2748534Z","2025-11-19 22:37:20.2748534Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",6140,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,,,,,,,1763591840274853400,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2749410Z","2025-11-19 22:37:20.2749410Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591840274941000,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2750530Z","2025-11-19 22:37:20.2750530Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",6140,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591840275053000,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2752392Z","2025-11-19 22:37:20.2752392Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",3272,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028710912,18446633084028686336,140712899206080,0,932562464768,12328,1763591840275239200,932567842816,932567838720,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2753425Z","2025-11-19 22:37:20.2753425Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,,,,,,,1763591840275342500,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2756494Z","2025-11-19 22:37:20.2756494Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,,,,,,,1763591840275649400,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2757017Z","2025-11-19 22:37:20.2757017Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",6140,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591840275701700,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2759292Z","2025-11-19 22:37:20.2759292Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",3272,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\dwmapi.dll",,,,,,,,,,,,,,,,1763591840275929200,,,,,140712805072896,140712805072896,203843,196608,2709117439,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2759552Z","2025-11-19 22:37:20.2759552Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",6140,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591840275955200,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2759632Z","2025-11-19 22:37:20.2759632Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,,,,,,,1763591840275963200,,,,,140712851341312,140712851341312,1524912,1486848,1404855129,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2761511Z","2025-11-19 22:37:20.2761511Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\uxtheme.dll",,,,,,,,,,,,,,,,1763591840276151100,,,,,140712802254848,140712802254848,696534,696320,1695798817,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2762574Z","2025-11-19 22:37:20.2762574Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,,,,,,,1763591840276257400,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2778854Z","2025-11-19 22:37:20.2778854Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,,,,,,,1763591840277885400,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2806601Z","2025-11-19 22:37:20.2806601Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,,,,,,,1763591840280660100,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2819391Z","2025-11-19 22:37:20.2819391Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,,,,,,,1763591840281939100,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2824009Z","2025-11-19 22:37:20.2824009Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591840282400900,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2832509Z","2025-11-19 22:37:20.2832509Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,,,,,,,1763591840283250900,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2844014Z","2025-11-19 22:37:20.2844014Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\TerminalApp.dll",,,,,,,,,,,,,,,,1763591840284401500,,,,,140711774912512,140711774912512,3444084,3444736,1759975751,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2845231Z","2025-11-19 22:37:20.2845231Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\ole32.dll",,,,,,,,,,,,,,,,1763591840284523200,,,,,140712878473216,140712878473216,1689904,1667072,1018821057,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2848307Z","2025-11-19 22:37:20.2848307Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",3272,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\winmm.dll",,,,,,,,,,,,,,,,1763591840284830700,,,,,140712663842816,140712663842816,263815,217088,2106743460,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2856888Z","2025-11-19 22:37:20.2856888Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.UI.Xaml.dll",,,,,,,,,,,,,,,,1763591840285688800,,,,,140712596865024,140712596865024,17882163,17858560,706442395,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2871609Z","2025-11-19 22:37:20.2871609Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\twinapi.appcore.dll",,,,,,,,,,,,,,,,1763591840287160900,,,,,140712720924672,140712720924672,2401519,2375680,2646458233,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2876075Z","2025-11-19 22:37:20.2876075Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084010672128,18446633084010647552,140712899206080,0,932562472960,10628,1763591840287607500,932568891392,932568887296,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2899172Z","2025-11-19 22:37:20.2899172Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028739584,18446633084028715008,140712865112144,0,932562481152,11164,1763591840289917200,932569939968,932569931776,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2901850Z","2025-11-19 22:37:20.2901850Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",10628,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028768256,18446633084028743680,140712899206080,0,932562489344,9736,1763591840290185100,932570988544,932570984448,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2915289Z","2025-11-19 22:37:20.2915289Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\OneCoreUAPCommonProxyStub.dll",,,,,,,,,,,,,,,,1763591840291528900,,,,,140712713977856,140712713977856,6740758,6615040,2011948997,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2939256Z","2025-11-19 22:37:20.2939256Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\Microsoft.Terminal.Control.dll",,,,,,,,,,,,,,,,1763591840293925600,,,,,140712378368000,140712378368000,1976337,1986560,1759975378,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2942453Z","2025-11-19 22:37:20.2942453Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\UIAutomationCore.dll",,,,,,,,,,,,,,,,1763591840294245300,,,,,140712432762880,140712432762880,4328257,4296704,2096711852,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2944574Z","2025-11-19 22:37:20.2944574Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",6140,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\UIAutomationCore.dll",,,,,,,,,,,,,,,,1763591840294457400,,,,,2186478157824,2186478157824,4328257,4296704,2096711852,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2944674Z","2025-11-19 22:37:20.2944674Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\d2d1.dll",,,,,,,,,,,,,,,,1763591840294467400,,,,,140712777744384,140712777744384,6610469,6537216,3013069957,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2945179Z","2025-11-19 22:37:20.2945179Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",3272,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\DWrite.dll",,,,,,,,,,,,,,,,1763591840294517900,,,,,140712784297984,140712784297984,2543119,2519040,1462185185,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2945565Z","2025-11-19 22:37:20.2945565Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",6140,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\UIAutomationCore.dll",,,,,,,,,,,,,,,,1763591840294556500,,,,,2186478157824,2186478157824,4328257,4308992,2096711852,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2948295Z","2025-11-19 22:37:20.2948295Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\dxgi.dll",,,,,,,,,,,,,,,,1763591840294829500,,,,,140712803631104,140712803631104,1320096,1282048,1861212996,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2949237Z","2025-11-19 22:37:20.2949237Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",6140,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\d3d11.dll",,,,,,,,,,,,,,,,1763591840294923700,,,,,140712786853888,140712786853888,2582658,2498560,2128032819,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2950761Z","2025-11-19 22:37:20.2950761Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",3272,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\D3DCompiler_47.dll",,,,,,,,,,,,,,,,1763591840295076100,,,,,140712769814528,140712769814528,4685395,4714496,796813953,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2952664Z","2025-11-19 22:37:20.2952664Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\powrprof.dll",,,,,,,,,,,,,,,,1763591840295266400,,,,,140712848195584,140712848195584,457799,385024,2858637235,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2954151Z","2025-11-19 22:37:20.2954151Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",6140,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\cryptsp.dll",,,,,,,,,,,,,,,,1763591840295415100,,,,,140712839217152,140712839217152,146168,110592,1658328178,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2967112Z","2025-11-19 22:37:20.2967112Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\umpdc.dll",,,,,,,,,,,,,,,,1763591840296711200,,,,,140712848064512,140712848064512,98535,81920,1714427184,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2992523Z","2025-11-19 22:37:20.2992523Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.8_8.2501.31001.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.dll",,,,,,,,,,,,,,,,1763591840299252300,,,,,140710095028224,140710095028224,5866761,5873664,2056920596,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3000178Z","2025-11-19 22:37:20.3000178Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\CoreMessaging.dll",,,,,,,,,,,,,,,,1763591840300017800,,,,,140712796160000,140712796160000,1232710,1208320,2155847221,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3007616Z","2025-11-19 22:37:20.3007616Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.UI.dll",,,,,,,,,,,,,,,,1763591840300761600,,,,,140712615346176,140712615346176,1414164,1376256,3301850593,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3016096Z","2025-11-19 22:37:20.3016096Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\InputHost.dll",,,,,,,,,,,,,,,,1763591840301609600,,,,,140712583757824,140712583757824,1989124,1970176,2937052880,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3030827Z","2025-11-19 22:37:20.3030827Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591840303082700,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3035687Z","2025-11-19 22:37:20.3035687Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\cryptbase.dll",,,,,,,,,,,,,,,,1763591840303568700,,,,,140712839348224,140712839348224,63718,49152,3897879906,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3054760Z","2025-11-19 22:37:20.3054760Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\msctf.dll",,,,,,,,,,,,,,,,1763591840305476000,,,,,140712893022208,140712893022208,1455420,1433600,4155718050,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3085814Z","2025-11-19 22:37:20.3085814Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3204 Taskmgr.exe",5876,,," 3204 Taskmgr.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,,,,,,,1763591840308581400,,,,,140712479096832,140712479096832,1613415,1552384,2231457550,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3089701Z","2025-11-19 22:37:20.3089701Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3204 Taskmgr.exe",5876,,," 3204 Taskmgr.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,,,,,,,1763591840308970200,,,,,140712479096832,140712479096832,1613415,1564672,2231457550,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3093537Z","2025-11-19 22:37:20.3093537Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3204 Taskmgr.exe",5876,,," 3204 Taskmgr.exe",,,,,,,,,,,,,18446633084027248640,18446633084027224064,140712891292720,0,552496762880,15292,1763591840309353700,552499937280,552499929088,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3100653Z","2025-11-19 22:37:20.3100653Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\UiaManager.dll",,,,,,,,,,,,,,,,1763591840310065300,,,,,140712461205504,140712461205504,941078,897024,2628067039,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3148892Z","2025-11-19 22:37:20.3148892Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4340 sihost.exe",10460,,," 4340 sihost.exe",,,,,,,,,,,,,18446633084028825600,18446633084028801024,140712899206080,0,645639995392,13916,1763591840314889200,645642321920,645642313728,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3153193Z","2025-11-19 22:37:20.3153193Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029026304,18446633084029001728,140712891292720,0,932562497536,11792,1763591840315319300,932572037120,932572033024,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3157769Z","2025-11-19 22:37:20.3157769Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\WindowManagementAPI.dll",,,,,,,,,,,,,,,,1763591840315776900,,,,,140712738422784,140712738422784,1825044,1794048,1605274449,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3168106Z","2025-11-19 22:37:20.3168106Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\urlmon.dll",,,,,,,,,,,,,,,,1763591840316810600,,,,,140712669609984,140712669609984,1970671,1957888,260716450,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3170805Z","2025-11-19 22:37:20.3170805Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\windows.storage.dll",,,,,,,,,,,,,,,,1763591840317080500,,,,,140712812412928,140712812412928,8877403,8769536,3667346596,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3170934Z","2025-11-19 22:37:20.3170934Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",3272,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\iertutil.dll",,,,,,,,,,,,,,,,1763591840317093500,,,,,140712642805760,140712642805760,2984761,2904064,3815768453,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3175653Z","2025-11-19 22:37:20.3175653Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",3272,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\srvcli.dll",,,,,,,,,,,,,,,,1763591840317565300,,,,,140712668954624,140712668954624,181029,167936,239922031,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3178450Z","2025-11-19 22:37:20.3178450Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\netutils.dll",,,,,,,,,,,,,,,,1763591840317845000,,,,,140712825847808,140712825847808,80696,53248,865845000,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3206848Z","2025-11-19 22:37:20.3206848Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029173760,18446633084029149184,140712600145104,0,932562505728,7808,1763591840320684800,932573085696,932573081600,140712600145104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3207124Z","2025-11-19 22:37:20.3207124Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028854272,18446633084028829696,140712604173856,0,932562513920,13488,1763591840320712400,932574134272,932574130176,140712604173856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3212137Z","2025-11-19 22:37:20.3212137Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",7808,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\DXCore.dll",,,,,,,,,,,,,,,,1763591840321213700,,,,,140712805400576,140712805400576,331386,274432,2354081039,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3217217Z","2025-11-19 22:37:20.3217217Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",7808,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\ResourcePolicyClient.dll",,,,,,,,,,,,,,,,1763591840321721700,,,,,140712809070592,140712809070592,104020,81920,2069163340,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3229857Z","2025-11-19 22:37:20.3229857Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",7808,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\ResourcePolicyClient.dll",,,,,,,,,,,,,,,,1763591840322985700,,,,,140712809070592,140712809070592,104020,94208,2069163340,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3231289Z","2025-11-19 22:37:20.3231289Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",7808,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\directxdatabasehelper.dll",,,,,,,,,,,,,,,,1763591840323128900,,,,,140712752709632,140712752709632,426573,405504,145563491,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3234021Z","2025-11-19 22:37:20.3234021Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3204 Taskmgr.exe",5876,,," 3204 Taskmgr.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,,,,,,,1763591840323402100,,,,,140712479096832,140712479096832,1613415,1552384,2231457550,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3237693Z","2025-11-19 22:37:20.3237693Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3204 Taskmgr.exe",5876,,," 3204 Taskmgr.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,,,,,,,1763591840323769300,,,,,140712479096832,140712479096832,1613415,1564672,2231457550,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3238215Z","2025-11-19 22:37:20.3238215Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\MrmCoreR.dll",,,,,,,,,,,,,,,,1763591840323821500,,,,,140712631926784,140712631926784,1191374,1146880,1078870765,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3242437Z","2025-11-19 22:37:20.3242437Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",7808,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\cfgmgr32.dll",,,,,,,,,,,,,,,,1763591840324243700,,,,,140712845049856,140712845049856,385808,356352,1737777300,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3246445Z","2025-11-19 22:37:20.3246445Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.StateRepositoryClient.dll",,,,,,,,,,,,,,,,1763591840324644500,,,,,140712696610816,140712696610816,303673,290816,424989122,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3282109Z","2025-11-19 22:37:20.3282109Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\profapi.dll",,,,,,,,,,,,,,,,1763591840328210900,,,,,140712848850944,140712848850944,229548,167936,2447194521,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3291000Z","2025-11-19 22:37:20.3291000Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",7808,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\d3d10warp.dll",,,,,,,,,,,,,,,,1763591840329100000,,,,,140712731869184,140712731869184,5958575,5943296,1147803111,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3296216Z","2025-11-19 22:37:20.3296216Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\dcomp.dll",,,,,,,,,,,,,,,,1763591840329621600,,,,,140712789409792,140712789409792,2309196,2240512,1200801128,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3300491Z","2025-11-19 22:37:20.3300491Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",6140,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Microsoft.Internal.WarpPal.dll",,,,,,,,,,,,,,,,1763591840330049100,,,,,140712769683456,140712769683456,167600,102400,2132685858,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3313797Z","2025-11-19 22:37:20.3313797Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\BCP47mrm.dll",,,,,,,,,,,,,,,,1763591840331379700,,,,,140712628322304,140712628322304,278903,212992,835504572,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3338243Z","2025-11-19 22:37:20.3338243Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",7808,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\TextShaping.dll",,,,,,,,,,,,,,,,1763591840333824300,,,,,140712585789440,140712585789440,770155,733184,2109619091,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3350748Z","2025-11-19 22:37:20.3350748Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",7808,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029173760,18446633084029149184,140712600145104,0,932562505728,7808,1763591840335074800,932573085696,932573057024,140712600145104,47684873,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3353558Z","2025-11-19 22:37:20.3353558Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029173760,18446633084029149184,140712632221632,0,932562522112,4192,1763591840335355800,932573085696,932573081600,140712632221632,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3423358Z","2025-11-19 22:37:20.3423358Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.UI.Xaml.Controls.dll",,,,,,,,,,,,,,,,1763591840342335800,,,,,140712586575872,140712586575872,3327252,3313664,3689468694,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3497808Z","2025-11-19 22:37:20.3497808Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.UI.Immersive.dll",,,,,,,,,,,,,,,,1763591840349780800,,,,,140712595423232,140712595423232,1424120,1372160,1559948871,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3511864Z","2025-11-19 22:37:20.3511864Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\DataExchange.dll",,,,,,,,,,,,,,,,1763591840351186400,,,,,140712406614016,140712406614016,399312,368640,696309968,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3528649Z","2025-11-19 22:37:20.3528649Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.ApplicationModel.dll",,,,,,,,,,,,,,,,1763591840352864900,,,,,140712508391424,140712508391424,945679,876544,2857312343,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3556662Z","2025-11-19 22:37:20.3556662Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\Microsoft.Terminal.Settings.Model.dll",,,,,,,,,,,,,,,,1763591840355666200,,,,,140712373518336,140712373518336,2281369,2252800,1759975487,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3559122Z","2025-11-19 22:37:20.3559122Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",3272,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\ntmarta.dll",,,,,,,,,,,,,,,,1763591840355912200,,,,,140712831811584,140712831811584,265798,221184,3598506564,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3560892Z","2025-11-19 22:37:20.3560892Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\bcrypt.dll",,,,,,,,,,,,,,,,1763591840356089200,,,,,140712848654336,140712848654336,206048,172032,2893678010,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3570938Z","2025-11-19 22:37:20.3570938Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\shlwapi.dll",,,,,,,,,,,,,,,,1763591840357093800,,,,,140712868839424,140712868839424,479562,421888,2142510382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3625434Z","2025-11-19 22:37:20.3625434Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\TerminalConnection.dll",,,,,,,,,,,,,,,,1763591840362543400,,,,,140712372994048,140712372994048,522798,495616,1759975254,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3628410Z","2025-11-19 22:37:20.3628410Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",6140,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\winhttp.dll",,,,,,,,,,,,,,,,1763591840362841000,,,,,140712750350336,140712750350336,1261038,1212416,84984727,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3642498Z","2025-11-19 22:37:20.3642498Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\ProgramData\Microsoft\VisualStudio\Setup\x64\Microsoft.VisualStudio.Setup.Configuration.Native.dll",,,,,,,,,,,,,,,,1763591840364249800,,,,,140711212089344,140711212089344,1007466,1015808,1726088073,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3680813Z","2025-11-19 22:37:20.3680813Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\AppExtension.dll",,,,,,,,,,,,,,,,1763591840368081300,,,,,140712467365888,140712467365888,337294,299008,1656953249,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3706276Z","2025-11-19 22:37:20.3706276Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",11792,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.StateRepositoryPS.dll",,,,,,,,,,,,,,,,1763591840370627600,,,,,140712490369024,140712490369024,879719,802816,374042279,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3746113Z","2025-11-19 22:37:20.3746113Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.Globalization.dll",,,,,,,,,,,,,,,,1763591840374611300,,,,,140712593457152,140712593457152,1640332,1634304,3240919660,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3750584Z","2025-11-19 22:37:20.3750584Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\BCP47Langs.dll",,,,,,,,,,,,,,,,1763591840375058400,,,,,140712631468032,140712631468032,402331,385024,2065030180,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3857419Z","2025-11-19 22:37:20.3857419Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\PackagedCom\OpenConsoleProxy.dll",,,,,,,,,,,,,,,,1763591840385741900,,,,,140712723349504,140712723349504,51292,53248,1759975238,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4060164Z","2025-11-19 22:37:20.4060164Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\ExplorerFrame.dll",,,,,,,,,,,,,,,,1763591840406016400,,,,,140712345862144,140712345862144,2919775,2867200,3427672670,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4214447Z","2025-11-19 22:37:20.4214447Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\Microsoft.Terminal.UI.dll",,,,,,,,,,,,,,,,1763591840421444700,,,,,140712537882624,140712537882624,255391,258048,1759975265,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4227887Z","2025-11-19 22:37:20.4227887Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\WindowsCodecs.dll",,,,,,,,,,,,,,,,1763591840422788700,,,,,140712775385088,140712775385088,2352359,2293760,3466818398,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4344248Z","2025-11-19 22:37:20.4344248Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\TextInputFramework.dll",,,,,,,,,,,,,,,,1763591840434424800,,,,,140712628846592,140712628846592,1374424,1339392,3535451269,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4409754Z","2025-11-19 22:37:20.4409754Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 632 OpenConsole.exe",14248,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084029116416,18446633084029091840,140702989217024,0,696750465024,8552,1763591840440975400,696758829056,696758824960,140702989217024,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4410144Z","2025-11-19 22:37:20.4410144Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 632 OpenConsole.exe",14248,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028911616,18446633084028887040,140702989233856,0,696750473216,12624,1763591840441014400,696759877632,696759873536,140702989233856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4411382Z","2025-11-19 22:37:20.4411382Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084056907776,18446633084056883200,140712899206080,0,932562530304,13068,1763591840441138200,932575182848,932575178752,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4420605Z","2025-11-19 22:37:20.4420605Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\uxtheme.dll",,,,,,,,,,,,,,,,1763591840442060500,,,,,140712802254848,140712802254848,696534,696320,1695798817,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4421089Z","2025-11-19 22:37:20.4421089Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13300 conhost.exe",6452,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084029374464,18446633084029349888,140696385038832,0,689119436800,4352,1763591840442108900,689123098624,689123090432,140696385038832,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4439257Z","2025-11-19 22:37:20.4439257Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028395520,18446633084028370944,140702989086576,0,696750481408,1184,1763591840443925700,696760926208,696760922112,140702989086576,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4450459Z","2025-11-19 22:37:20.4450459Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\directmanipulation.dll",,,,,,,,,,,,,,,,1763591840445045900,,,,,140712583036928,140712583036928,714070,667648,3434535107,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4452004Z","2025-11-19 22:37:20.4452004Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084029231104,18446633084029206528,140702989404080,0,696750489600,9776,1763591840445200400,696761974784,696761970688,140702989404080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4464556Z","2025-11-19 22:37:20.4464556Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084027793408,18446633084027768832,140712583404848,0,932562538496,4376,1763591840446455600,932576231424,932576227328,140712583404848,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4469069Z","2025-11-19 22:37:20.4469069Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",13068,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029317120,18446633084029292544,140712899206080,0,932562546688,9352,1763591840446906900,932577280000,932577275904,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4800926Z","2025-11-19 22:37:20.4800926Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9388 devenv.exe",6884,,," 9388 devenv.exe",,,,,,,,,,,,,18446633083996995584,18446633083996971008,140712899206080,0,1033377136640,6884,1763591840480092600,1033431941120,1033431932928,140712899206080,158801,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4824637Z","2025-11-19 22:37:20.4824637Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\msftedit.dll",,,,,,,,,,,,,,,,1763591840482463700,,,,,140712289107968,140712289107968,3297357,3305472,3878106343,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4850000Z","2025-11-19 22:37:20.4850000Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\globinputhost.dll",,,,,,,,,,,,,,,,1763591840485000000,,,,,140712627863552,140712627863552,263563,208896,1786968813,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4858122Z","2025-11-19 22:37:20.4858122Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.UI.Core.TextInput.dll",,,,,,,,,,,,,,,,1763591840485812200,,,,,140712572354560,140712572354560,1511216,1499136,21441667,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4864712Z","2025-11-19 22:37:20.4864712Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\CoreUIComponents.dll",,,,,,,,,,,,,,,,1763591840486471200,,,,,140712742944768,140712742944768,3046501,3022848,801552868,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5057422Z","2025-11-19 22:37:20.5057422Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028653568,18446633084028628992,140712865112144,0,932562554880,13692,1763591840505742200,932578328576,932578320384,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5078368Z","2025-11-19 22:37:20.5078368Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",13692,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\sxs.dll",,,,,,,,,,,,,,,,1763591840507836800,,,,,140712846622720,140712846622720,697955,659456,3834976666,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5184957Z","2025-11-19 22:37:20.5184957Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\xmllite.dll",,,,,,,,,,,,,,,,1763591840518495700,,,,,140712684027904,140712684027904,342897,274432,974526834,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5423103Z","2025-11-19 22:37:20.5423103Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\icu.dll",,,,,,,,,,,,,,,,1763591840542310300,,,,,140712684617728,140712684617728,2775448,2744320,3611555297,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5442487Z","2025-11-19 22:37:20.5442487Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029632512,18446633084029607936,140712373211440,0,932562563072,6612,1763591840544248700,932579377152,932579373056,140712373211440,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5443223Z","2025-11-19 22:37:20.5443223Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028882944,18446633084028858368,140712378637616,0,932562571264,6260,1763591840544322300,932580425728,932580421632,140712378637616,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5475582Z","2025-11-19 22:37:20.5475582Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\apphelp.dll",,,,,,,,,,,,,,,,1763591840547558200,,,,,140712800485376,140712800485376,675806,651264,4108425587,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5478450Z","2025-11-19 22:37:20.5478450Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",6260,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029947904,18446633084029923328,140712899206080,0,932562579456,14632,1763591840547845000,932581474304,932581470208,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5508273Z","2025-11-19 22:37:20.5508273Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591840550827300,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5509553Z","2025-11-19 22:37:20.5509553Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591840550955300,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5510805Z","2025-11-19 22:37:20.5510805Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,,,,,,,,,,,18446633084029747200,18446633084029722624,140712899206080,0,867488059392,5960,1763591840551080500,867490070528,867490066432,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5511743Z","2025-11-19 22:37:20.5511743Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591840551174300,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5513846Z","2025-11-19 22:37:20.5513846Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591840551384600,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5515459Z","2025-11-19 22:37:20.5515459Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5604 attack-890.exe",5960,,," 5604 attack-890.exe",,,,,,,,,,,,,18446633084029718528,18446633084029693952,140712899206080,0,867488067584,8672,1763591840551545900,867491119104,867491115008,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5515805Z","2025-11-19 22:37:20.5515805Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591840551580500,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5516458Z","2025-11-19 22:37:20.5516458Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5604 attack-890.exe",8672,,," 5604 attack-890.exe",,,,,,,,,,,,,18446633084029460480,18446633084029435904,140712899206080,0,867488075776,12460,1763591840551645800,867492167680,867492163584,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5518883Z","2025-11-19 22:37:20.5518883Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",8672,,," 5604 attack-890.exe",,,"C:\Windows\System32\msvcp140.dll",,,,,,,,,,,,,,,,1763591840551888300,,,,,140711213137920,140711213137920,570439,561152,1564323704,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5518888Z","2025-11-19 22:37:20.5518888Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",12460,,," 5604 attack-890.exe",,,"C:\Windows\System32\vcruntime140.dll",,,,,,,,,,,,,,,,1763591840551888800,,,,,140712353988608,140712353988608,146072,122880,254123393,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5518982Z","2025-11-19 22:37:20.5518982Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\vcruntime140_1.dll",,,,,,,,,,,,,,,,1763591840551898200,,,,,140712354119680,140712354119680,57827,49152,240324076,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:21.377891300Z","2025-11-19 22:37:20.5537813Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Injector started with PID 5604",,,,,,,,,,,,,,,,,1763591840553781300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.6045242Z","2025-11-19 22:37:20.6045242Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",10628,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029546496,18446633084029521920,140712899206080,0,932562587648,3424,1763591840604524200,932582522880,932582518784,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.6192368Z","2025-11-19 22:37:20.6192368Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.Graphics.dll",,,,,,,,,,,,,,,,1763591840619236800,,,,,140712711225344,140712711225344,669723,593920,1068018205,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.6238285Z","2025-11-19 22:37:20.6238285Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\threadpoolwinrt.dll",,,,,,,,,,,,,,,,1763591840623828500,,,,,140712555839488,140712555839488,130107,90112,2299561022,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.6242698Z","2025-11-19 22:37:20.6242698Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028968960,18446633084028944384,140712899206080,0,932562595840,14684,1763591840624269800,932583571456,932583567360,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.6245269Z","2025-11-19 22:37:20.6245269Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",14684,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029976576,18446633084029952000,140712899206080,0,932562604032,13344,1763591840624526900,932584620032,932584615936,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.6247078Z","2025-11-19 22:37:20.6247078Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",13344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084030005248,18446633084029980672,140712899206080,0,932562612224,6564,1763591840624707800,932585668608,932585664512,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.6248408Z","2025-11-19 22:37:20.6248408Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",14684,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\pfclient.dll",,,,,,,,,,,,,,,,1763591840624840800,,,,,140712803500032,140712803500032,92868,73728,3163590703,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.6252373Z","2025-11-19 22:37:20.6252373Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",6564,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084030033920,18446633084030009344,140712899206080,0,932562620416,12924,1763591840625237300,932586717184,932586713088,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.6254041Z","2025-11-19 22:37:20.6254041Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",12924,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084030062592,18446633084030038016,140712899206080,0,932562628608,13704,1763591840625404100,932587765760,932587761664,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:21.477249300Z","2025-11-19 22:37:20.6551680Z","myETW","EDRi-Provider",4242,"EDRiTask"," 7508 EDRi.exe",,,,,,"After starting the attack exe",,,,,,,,,,,,,,,,,1763591840655168000,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.6886346Z","2025-11-19 22:37:20.6886346Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4392 MsMpEng.exe",5064,,," 4392 MsMpEng.exe",,,,,,,,,,,,,18446633084030177280,18446633084030152704,140712899206080,247,389820030976,14760,1763591840688634600,389842731008,389842665472,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.6886949Z","2025-11-19 22:37:20.6886949Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4392 MsMpEng.exe",5064,,," 4392 MsMpEng.exe",,,,,,,,,,,,,18446633084030205952,18446633084030181376,140712647800224,247,389820039168,8032,1763591840688695000,389849022464,389848956928,140712647800224,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.6889335Z","2025-11-19 22:37:20.6889335Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4392 MsMpEng.exe",14760,,," 4392 MsMpEng.exe",,,,,,,,,,,,,18446633084030263296,18446633084030238720,140712899206080,0,389820047360,4232,1763591840688933500,389849546752,389849481216,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.7227607Z","2025-11-19 22:37:20.7227607Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3492 svchost.exe",5904,,," 3492 svchost.exe",,,"C:\Windows\System32\wintrust.dll",,,,,,,,,,,,,,,,1763591840722760700,,,,,140712860844032,140712860844032,590783,520192,452262045,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.7236916Z","2025-11-19 22:37:20.7236916Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4392 MsMpEng.exe",8032,,," 4392 MsMpEng.exe",,,,,,,,,,,,,18446633084030205952,18446633084030181376,140712647800224,247,389820039168,8032,1763591840723691600,389849022464,389848956928,140712647800224,428874,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.7244852Z","2025-11-19 22:37:20.7244852Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3492 svchost.exe",5904,,," 3492 svchost.exe",,,,,,,,,,,,,18446633084030492672,18446633084030468096,140712850417280,51,390180667392,11232,1763591840724485200,390182993920,390182961152,140712850417280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.7245695Z","2025-11-19 22:37:20.7245695Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3492 svchost.exe",5904,,," 3492 svchost.exe",,,"C:\Windows\System32\imagehlp.dll",,,,,,,,,,,,,,,,1763591840724569500,,,,,140712892760064,140712892760064,200866,131072,2156568970,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.8298783Z","2025-11-19 22:37:20.8298783Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 9692 PerfWatson2.exe",9752,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084030607360,18446633084030582784,140711612509856,0,1046354423808,12036,1763591840829878300,1046352232448,1046352216064,140711612509856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:21.1973315Z","2025-11-19 22:37:21.1973315Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9920 ServiceHub.IntellicodeModelService.exe",4196,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,18446633084027449344,18446633084027424768,140711612509856,0,46015676416,4196,1763591841197331500,46012694528,46012678144,140711612509856,1084450,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.337559700Z","2025-11-19 22:37:21.5329408Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Running 'standard' config",,,,,,,,,,,,,,,,,1763591841532940800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.337798100Z","2025-11-19 22:37:21.5331820Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Before starting subprocess to inject to",,,,,,,,,,,,,,,,,1763591841533182000,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:21.5339696Z","2025-11-19 22:37:21.5339696Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 5604 attack-890.exe",3452,,," 7284 whoami.exe",,,"C:\Windows\System32\whoami.exe",,,,,,,,,,,,,,,,1763591841533969600,,,,,,,160109,,3602411345,134080654423385232,0,"0x","","",5604,6624,6628,3,0,0,1,,,,,,,,,,,, +"2025-11-19 22:37:21.5373410Z","2025-11-19 22:37:21.5373410Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5604 attack-890.exe",3452,,," 7284 whoami.exe",,,,,,,,,,,,,18446633084031127552,18446633084031102976,140702344617136,0,705865940992,14048,1763591841537341000,705864925184,705864916992,140702344617136,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.345203800Z","2025-11-19 22:37:21.5407378Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"After starting subprocess with PID 7284",,,,,,,,,,,,,,,,,1763591841540737800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:21.6656904Z","2025-11-19 22:37:21.6656904Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8972 VBoxTray.exe",9020,,," 8972 VBoxTray.exe",,,,,,,,,,,,,18446633084031156224,18446633084031131648,140700131109808,0,471283195904,13812,1763591841665690400,471299260416,471299256320,140700131109808,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:21.6659145Z","2025-11-19 22:37:21.6659145Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8972 VBoxTray.exe",13812,,," 8972 VBoxTray.exe",,,,,,,,,,,,,18446633084031156224,18446633084031131648,140700131109808,0,471283195904,13812,1763591841665914500,471299260416,471299252224,140700131109808,462070,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:21.7785972Z","2025-11-19 22:37:21.7785972Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5884 SearchProtocolHost.exe",2628,,," 5884 SearchProtocolHost.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,,,,,,,1763591841778597200,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:21.7817636Z","2025-11-19 22:37:21.7817636Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5884 SearchProtocolHost.exe",2628,,," 5884 SearchProtocolHost.exe",,,"C:\Windows\System32\profapi.dll",,,,,,,,,,,,,,,,1763591841781763600,,,,,140712848850944,140712848850944,229548,167936,2447194521,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:21.7818665Z","2025-11-19 22:37:21.7818665Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5884 SearchProtocolHost.exe",2628,,," 5884 SearchProtocolHost.exe",,,,,,,,,,,,,18446633084030406656,18446633084030382080,140712899206080,0,100230713344,14588,1763591841781866500,100232331264,100232298496,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.1405740Z","2025-11-19 22:37:22.1405740Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","12492 vcpkgsrv.exe",5660,,,"12492 vcpkgsrv.exe",,,,,,,,,,,,,18446633083994841088,18446633083994816512,1996775712,0,2646016,5660,1763591842140574000,82115456,82083840,1996775712,8294629,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.1405740Z","2025-11-19 22:37:22.1405740Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","12492 vcpkgsrv.exe",11756,,,"12492 vcpkgsrv.exe",,,,,,,,,,,,,18446633083994554368,18446633083994529792,1996775712,0,2678784,11756,1763591842140574000,82639744,82608128,1996775712,7370867,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.1405831Z","2025-11-19 22:37:22.1405831Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","12492 vcpkgsrv.exe",12180,,,"12492 vcpkgsrv.exe",,,,,,,,,,,,,18446633083994812416,18446633083994787840,1996775712,0,2662400,12180,1763591842140583100,82377600,82345984,1996775712,6546307,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.1562316Z","2025-11-19 22:37:22.1562316Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6836 vcpkgsrv.exe",7868,,," 6836 vcpkgsrv.exe",,,,,,,,,,,,,18446633083994869760,18446633083994845184,1996775712,0,3006464,7868,1763591842156231600,92011392,91979776,1996775712,9602384,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.1562444Z","2025-11-19 22:37:22.1562444Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6836 vcpkgsrv.exe",9036,,," 6836 vcpkgsrv.exe",,,,,,,,,,,,,18446633083993722880,18446633083993698304,1996775712,0,2990080,9036,1763591842156244400,87554944,87523328,1996775712,7058542,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.1562554Z","2025-11-19 22:37:22.1562554Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6836 vcpkgsrv.exe",5384,,," 6836 vcpkgsrv.exe",,,,,,,,,,,,,18446633083994296320,18446633083994271744,1996775712,0,2973696,5384,1763591842156255400,81066880,81035264,1996775712,4502262,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.3316961Z","2025-11-19 22:37:22.3316961Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",12036,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084030607360,18446633084030582784,140711612509856,0,1046354423808,12036,1763591842331696100,1046352232448,1046352216064,140711612509856,931306,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:23.308564200Z","2025-11-19 22:37:22.5236651Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Before opening process handle",,,,,,,,,,,,,,,,,1763591842523665100,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:23.308868400Z","2025-11-19 22:37:22.5239746Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"After opening process handle",,,,,,,,,,,,,,,,,1763591842523974600,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.8295591Z","2025-11-19 22:37:22.8295591Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 9388 devenv.exe",9392,,," 9388 devenv.exe",,,,,,,,,,,,,18446633084031385600,18446633084031361024,140711613062896,0,1033377177600,7724,1763591842829559100,1033415163904,1033415155712,140711613062896,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.8335220Z","2025-11-19 22:37:22.8335220Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9388 devenv.exe",7724,,," 9388 devenv.exe",,,,,,,,,,,,,18446633084031385600,18446633084031361024,140711613062896,0,1033377177600,7724,1763591842833522000,1033415163904,1033415143424,140711613062896,14353592,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:24.262849900Z","2025-11-19 22:37:23.4973313Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Before allocating memory for shellcode",,,,,,,,,,,,,,,,,1763591843497331300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:24.263130400Z","2025-11-19 22:37:23.4976143Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"After allocating memory for shellcode at 00000249213E0000",,,,,,,,,,,,,,,,,1763591843497614300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:25.227755400Z","2025-11-19 22:37:24.4818310Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Before writing shellcode to process",,,,,,,,,,,,,,,,,1763591844481831000,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:25.228060100Z","2025-11-19 22:37:24.4821409Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"After writing shellcode to process at 00000249213E0000",,,,,,,,,,,,,,,,,1763591844482140900,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:25.2014730Z","2025-11-19 22:37:25.2014730Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5184 explorer.exe",15136,,," 5184 explorer.exe",,,,,,,,,,,,,18446633084027592704,18446633084027568128,140712891545280,0,15360000,15136,1763591845201473000,470351872,470294528,140712891545280,63346597,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:25.3923641Z","2025-11-19 22:37:25.3923641Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","10404 NisSrv.exe",4312,,,"10404 NisSrv.exe",,,,,,,,,,,,,18446633083999313920,18446633083999289344,140712899206080,0,792924913664,4312,1763591845392364100,792924389376,792924323840,140712899206080,494887,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:25.3923667Z","2025-11-19 22:37:25.3923667Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3604 dllhost.exe",11476,,," 3604 dllhost.exe",,,,,,,,,,,,,18446633083999285248,18446633083999260672,140712899206080,0,256852123648,11476,1763591845392366700,256853934080,256853901312,140712899206080,241408,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.182844300Z","2025-11-19 22:37:25.4563155Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Before changing memory protection to PAGE_EXECUTE_READ",,,,,,,,,,,,,,,,,1763591845456315500,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.183142300Z","2025-11-19 22:37:25.4566185Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"After changing memory protection to PAGE_EXECUTE_READ",,,,,,,,,,,,,,,,,1763591845456618500,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:25.6312786Z","2025-11-19 22:37:25.6312786Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3232 dllhost.exe",8960,,," 3232 dllhost.exe",,,,,,,,,,,,,18446633084035751936,18446633084035727360,140712899206080,0,493780983808,8960,1763591845631278600,493783875584,493783842816,140712899206080,221416,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.1657030Z","2025-11-19 22:37:26.1657030Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\twinapi.dll",,,,,,,,,,,,,,,,1763591846165703000,,,,,140712415789056,140712415789056,924452,868352,2129603828,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4082033Z","2025-11-19 22:37:26.4082033Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"10404 NisSrv.exe",,,,,,,,,,,,,18446633083999313920,18446633083999289344,140712899206080,0,792924921856,6856,1763591846408203300,792924389376,792924323840,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4083766Z","2025-11-19 22:37:26.4083766Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3604 dllhost.exe",,,,,,,,,,,,,18446633084031959040,18446633084031934464,140712899206080,0,256852131840,8832,1763591846408376600,256853934080,256853901312,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.147034500Z","2025-11-19 22:37:26.4400898Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Before reading memory to verify write",,,,,,,,,,,,,,,,,1763591846440089800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.147308700Z","2025-11-19 22:37:26.4403653Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Before creating remote thread",,,,,,,,,,,,,,,,,1763591846440365300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4406187Z","2025-11-19 22:37:26.4406187Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5604 attack-890.exe",3452,,," 7284 whoami.exe",,,,,,,,,,,,,18446633084031987712,18446633084031963136,2513113579520,0,705865949184,14412,1763591846440618700,705865449472,705865441280,2513113579520,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.147575800Z","2025-11-19 22:37:26.4406370Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"After creating remote thread",,,,,,,,,,,,,,,,,1763591846440637000,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4407225Z","2025-11-19 22:37:26.4407225Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\whoami.exe",,,,,,,,,,,,,,,,1763591846440722500,,,,,140702344609792,140702344609792,160109,98304,3602411345,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4407621Z","2025-11-19 22:37:26.4407621Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591846440762100,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4441987Z","2025-11-19 22:37:26.4441987Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591846444198700,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4443217Z","2025-11-19 22:37:26.4443217Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591846444321700,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4457000Z","2025-11-19 22:37:26.4457000Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\apphelp.dll",,,,,,,,,,,,,,,,1763591846445700000,,,,,140712800485376,140712800485376,675806,651264,4108425587,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4474777Z","2025-11-19 22:37:26.4474777Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591846447477700,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4475785Z","2025-11-19 22:37:26.4475785Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591846447578500,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4476640Z","2025-11-19 22:37:26.4476640Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,,,,,,,,,,,18446633084032073728,18446633084032049152,140712899206080,0,705865957376,2340,1763591846447664000,705868333056,705868324864,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4477295Z","2025-11-19 22:37:26.4477295Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591846447729500,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4479501Z","2025-11-19 22:37:26.4479501Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591846447950100,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4481009Z","2025-11-19 22:37:26.4481009Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 7284 whoami.exe",2340,,," 7284 whoami.exe",,,,,,,,,,,,,18446633084032102400,18446633084032077824,140712899206080,0,705865965568,10456,1763591846448100900,705868857344,705868849152,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4481023Z","2025-11-19 22:37:26.4481023Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591846448102300,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4483317Z","2025-11-19 22:37:26.4483317Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591846448331700,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4484701Z","2025-11-19 22:37:26.4484701Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591846448470100,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4485775Z","2025-11-19 22:37:26.4485775Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591846448577500,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4486883Z","2025-11-19 22:37:26.4486883Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591846448688300,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4487781Z","2025-11-19 22:37:26.4487781Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591846448778100,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4489528Z","2025-11-19 22:37:26.4489528Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 7284 whoami.exe",10456,,," 7284 whoami.exe",,,,,,,,,,,,,18446633084032131072,18446633084032106496,140712899206080,0,705865973760,14716,1763591846448952800,705869381632,705869373440,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4489859Z","2025-11-19 22:37:26.4489859Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\ws2_32.dll",,,,,,,,,,,,,,,,1763591846448985900,,,,,140712881094656,140712881094656,513405,475136,3967481067,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4490753Z","2025-11-19 22:37:26.4490753Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4392 MsMpEng.exe",4916,,," 4392 MsMpEng.exe",,,,,,,,,,,,,18446633084032159744,18446633084032135168,140712899206080,0,389820055552,1844,1763591846449075300,389849022464,389848956928,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4493466Z","2025-11-19 22:37:26.4493466Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",10456,,," 7284 whoami.exe",,,"C:\Windows\System32\version.dll",,,,,,,,,,,,,,,,1763591846449346600,,,,,140712753168384,140712753168384,72452,45056,2275202464,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4493531Z","2025-11-19 22:37:26.4493531Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14716,,," 7284 whoami.exe",,,"C:\Windows\System32\authz.dll",,,,,,,,,,,,,,,,1763591846449353100,,,,,140712826241024,140712826241024,372179,327680,771731569,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4493680Z","2025-11-19 22:37:26.4493680Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\wkscli.dll",,,,,,,,,,,,,,,,1763591846449368000,,,,,140712738291712,140712738291712,170846,110592,1225555544,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4494965Z","2025-11-19 22:37:26.4494965Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",2340,,," 7284 whoami.exe",,,"C:\Windows\System32\sspicli.dll",,,,,,,,,,,,,,,,1763591846449496500,,,,,140712833384448,140712833384448,339222,299008,3030302172,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4498152Z","2025-11-19 22:37:26.4498152Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",10456,,," 7284 whoami.exe",,,"C:\Windows\System32\netutils.dll",,,,,,,,,,,,,,,,1763591846449815200,,,,,140712825847808,140712825847808,80696,53248,865845000,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4515038Z","2025-11-19 22:37:26.4515038Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,,,,,,,1763591846451503800,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4541760Z","2025-11-19 22:37:26.4541760Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 7284 whoami.exe",14412,,," 3812 calc.exe",,,"C:\Windows\System32\calc.exe",,,,,,,,,,,,,,,,1763591846454176000,,,,,,,90741,,4001445627,134080654471607920,0,"0x","","",7284,6628,6629,3,0,0,1,,,,,,,,,,,, +"2025-11-19 22:37:26.4568912Z","2025-11-19 22:37:26.4568912Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 7284 whoami.exe",14412,,," 3812 calc.exe",,,,,,,,,,,,,18446633084032245760,18446633084032221184,140696878126912,0,801455390720,10660,1763591846456891200,801453899776,801453891584,140696878126912,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4581526Z","2025-11-19 22:37:26.4581526Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\calc.exe",,,,,,,,,,,,,,,,1763591846458152600,,,,,140696878120960,140696878120960,90741,49152,4001445627,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4581973Z","2025-11-19 22:37:26.4581973Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591846458197300,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4628811Z","2025-11-19 22:37:26.4628811Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591846462881100,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4630065Z","2025-11-19 22:37:26.4630065Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591846463006500,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4640583Z","2025-11-19 22:37:26.4640583Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,,,,,,,1763591846464058300,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4642117Z","2025-11-19 22:37:26.4642117Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591846464211700,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4643075Z","2025-11-19 22:37:26.4643075Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591846464307500,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4644282Z","2025-11-19 22:37:26.4644282Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3812 calc.exe",10660,,," 3812 calc.exe",,,,,,,,,,,,,18446633084032274432,18446633084032249856,140712899206080,0,801455398912,7976,1763591846464428200,801456521216,801456513024,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4645279Z","2025-11-19 22:37:26.4645279Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3812 calc.exe",7976,,," 3812 calc.exe",,,,,,,,,,,,,18446633084032331776,18446633084032307200,140712899206080,0,801455407104,14584,1763591846464527900,801457045504,801457037312,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4645607Z","2025-11-19 22:37:26.4645607Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591846464560700,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4647508Z","2025-11-19 22:37:26.4647508Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591846464750800,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4648516Z","2025-11-19 22:37:26.4648516Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591846464851600,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4649551Z","2025-11-19 22:37:26.4649551Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591846464955100,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4650967Z","2025-11-19 22:37:26.4650967Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3812 calc.exe",14584,,," 3812 calc.exe",,,,,,,,,,,,,18446633084032389120,18446633084032364544,140712899206080,0,801455415296,6196,1763591846465096700,801457569792,801457561600,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4651239Z","2025-11-19 22:37:26.4651239Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,,,,,,,1763591846465123900,,,,,140712851341312,140712851341312,1524912,1486848,1404855129,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4653184Z","2025-11-19 22:37:26.4653184Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,,,,,,,1763591846465318400,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4654502Z","2025-11-19 22:37:26.4654502Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591846465450200,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4656236Z","2025-11-19 22:37:26.4656236Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591846465623600,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4658267Z","2025-11-19 22:37:26.4658267Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591846465826700,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4659715Z","2025-11-19 22:37:26.4659715Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591846465971500,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4668828Z","2025-11-19 22:37:26.4668828Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,,,,,,,1763591846466882800,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4696437Z","2025-11-19 22:37:26.4696437Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\windows.storage.dll",,,,,,,,,,,,,,,,1763591846469643700,,,,,140712812412928,140712812412928,8877403,8769536,3667346596,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4703225Z","2025-11-19 22:37:26.4703225Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,,,,,,,1763591846470322500,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4709329Z","2025-11-19 22:37:26.4709329Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,,,,,,,1763591846470932900,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4714414Z","2025-11-19 22:37:26.4714414Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\shlwapi.dll",,,,,,,,,,,,,,,,1763591846471441400,,,,,140712868839424,140712868839424,479562,421888,2142510382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4718323Z","2025-11-19 22:37:26.4718323Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3812 calc.exe",10660,,," 3812 calc.exe",,,,,,,,,,,,,18446633084032417792,18446633084032393216,140712891545280,0,801455423488,6204,1763591846471832300,801458094080,801458085888,140712891545280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4719501Z","2025-11-19 22:37:26.4719501Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\ole32.dll",,,,,,,,,,,,,,,,1763591846471950100,,,,,140712878473216,140712878473216,1689904,1667072,1018821057,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4722524Z","2025-11-19 22:37:26.4722524Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 7284 whoami.exe",14716,,," 7284 whoami.exe",,,,,,,,,,,,,18446633084032131072,18446633084032106496,140712899206080,0,705865973760,14716,1763591846472252400,705869381632,705869373440,140712899206080,2406535,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4722566Z","2025-11-19 22:37:26.4722566Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 7284 whoami.exe",2340,,," 7284 whoami.exe",,,,,,,,,,,,,18446633084032073728,18446633084032049152,140712899206080,0,705865957376,2340,1763591846472256600,705868333056,705868320768,140712899206080,4734616,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4722886Z","2025-11-19 22:37:26.4722886Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 7284 whoami.exe",10456,,," 7284 whoami.exe",,,,,,,,,,,,,18446633084032102400,18446633084032077824,140712899206080,0,705865965568,10456,1763591846472288600,705868857344,705868849152,140712899206080,4410225,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4723088Z","2025-11-19 22:37:26.4723088Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 7284 whoami.exe",14048,,," 7284 whoami.exe",,,,,,,,,,,,,18446633084031127552,18446633084031102976,140702344617136,0,705865940992,14048,1763591846472308800,705864925184,705864916992,140702344617136,41492,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4728396Z","2025-11-19 22:37:26.4728396Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 700 lsass.exe",1344,,," 700 lsass.exe",,,,,,,,,,,,,18446633084031127552,18446633084031102976,140712899206080,0,81706905600,12956,1763591846472839600,81709760512,81709711360,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4731999Z","2025-11-19 22:37:26.4731999Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591846473199900,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4738359Z","2025-11-19 22:37:26.4738359Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\uxtheme.dll",,,,,,,,,,,,,,,,1763591846473835900,,,,,140712802254848,140712802254848,696534,696320,1695798817,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4748159Z","2025-11-19 22:37:26.4748159Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1016 services.exe",2816,,," 5784 svchost.exe",,,"C:\Windows\System32\svchost.exe",,,,,,,,,,,,,,,,1763591846474815900,,,,,,,143552,,14788416,134080654471810362,0,"0x","","",1016,11,6630,1,1,0,0,,,,,,,,,,,, +"2025-11-19 22:37:26.4752828Z","2025-11-19 22:37:26.4752828Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\propsys.dll",,,,,,,,,,,,,,,,1763591846475282800,,,,,140712761491456,140712761491456,1123662,1060864,3228732737,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4754583Z","2025-11-19 22:37:26.4754583Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1016 services.exe",2816,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084032217088,18446633084032192512,140696171073504,0,513414782976,14348,1763591846475458300,513413939200,513413922816,140696171073504,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4758653Z","2025-11-19 22:37:26.4758653Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,,,,,,,1763591846475865300,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4766087Z","2025-11-19 22:37:26.4766087Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",14348,,," 5784 svchost.exe",,,"C:\Windows\System32\svchost.exe",,,,,,,,,,,,,,,,1763591846476608700,,,,,140696171053056,140696171053056,143552,77824,14788416,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4766271Z","2025-11-19 22:37:26.4766271Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",14348,,," 5784 svchost.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591846476627100,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4799460Z","2025-11-19 22:37:26.4799460Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,,,,,,,1763591846479946000,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4802417Z","2025-11-19 22:37:26.4802417Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",14348,,," 5784 svchost.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591846480241700,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4803979Z","2025-11-19 22:37:26.4803979Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",14348,,," 5784 svchost.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591846480397900,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4807609Z","2025-11-19 22:37:26.4807609Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,,,,,,,1763591846480760900,,,,,140712479096832,140712479096832,1613415,1552384,2231457550,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4812229Z","2025-11-19 22:37:26.4812229Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,,,,,,,1763591846481222900,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4815090Z","2025-11-19 22:37:26.4815090Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",14348,,," 5784 svchost.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591846481509000,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4816419Z","2025-11-19 22:37:26.4816419Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5784 svchost.exe",14348,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084032102400,18446633084032077824,140712899206080,0,513414791168,12200,1763591846481641900,513416888320,513416855552,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4823900Z","2025-11-19 22:37:26.4823900Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",14348,,," 5784 svchost.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591846482390000,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4828756Z","2025-11-19 22:37:26.4828756Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",14348,,," 5784 svchost.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591846482875600,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4835328Z","2025-11-19 22:37:26.4835328Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1016 services.exe",,,,,,,,,,,,,18446633084032073728,18446633084032049152,140712899206080,0,156998295552,6816,1763591846483532800,156996403200,156996370432,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4837740Z","2025-11-19 22:37:26.4837740Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084032131072,18446633084032106496,140712899206080,0,513414799360,5288,1763591846483774000,513417412608,513417379840,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4839041Z","2025-11-19 22:37:26.4839041Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5784 svchost.exe",14348,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084032503808,18446633084032479232,140712863364608,0,513414807552,8604,1763591846483904100,513417936896,513417904128,140712863364608,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4843058Z","2025-11-19 22:37:26.4843058Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\urlmon.dll",,,,,,,,,,,,,,,,1763591846484305800,,,,,140712669609984,140712669609984,1970671,1957888,260716450,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4843095Z","2025-11-19 22:37:26.4843095Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",8604,,," 5784 svchost.exe",,,"C:\Windows\System32\wersvc.dll",,,,,,,,,,,,,,,,1763591846484309500,,,,,140712377974784,140712377974784,393902,335872,651237193,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4844347Z","2025-11-19 22:37:26.4844347Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5784 svchost.exe",12200,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084032532480,18446633084032507904,140712899206080,0,513414815744,2748,1763591846484434700,513418461184,513418428416,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4845003Z","2025-11-19 22:37:26.4845003Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5784 svchost.exe",2748,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084032589824,18446633084032565248,140712899206080,0,513414823936,8772,1763591846484500300,513418985472,513418952704,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4845732Z","2025-11-19 22:37:26.4845732Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",8604,,," 5784 svchost.exe",,,"C:\Windows\System32\DiagnosticDataSettings.dll",,,,,,,,,,,,,,,,1763591846484573200,,,,,140712462319616,140712462319616,108991,61440,3234151774,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4846229Z","2025-11-19 22:37:26.4846229Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6196,,," 3812 calc.exe",,,"C:\Windows\System32\iertutil.dll",,,,,,,,,,,,,,,,1763591846484622900,,,,,140712642805760,140712642805760,2984761,2904064,3815768453,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4846726Z","2025-11-19 22:37:26.4846726Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",12200,,," 5784 svchost.exe",,,"C:\Windows\System32\windowsperformancerecordercontrol.dll",,,,,,,,,,,,,,,,1763591846484672600,,,,,140712357462016,140712357462016,1367144,1302528,1403099383,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4847302Z","2025-11-19 22:37:26.4847302Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",2748,,," 5784 svchost.exe",,,"C:\Windows\System32\weretw.dll",,,,,,,,,,,,,,,,1763591846484730200,,,,,140712372731904,140712372731904,267808,245760,3299957735,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4849407Z","2025-11-19 22:37:26.4849407Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",2748,,," 5784 svchost.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,,,,,,,1763591846484940700,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4849950Z","2025-11-19 22:37:26.4849950Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",14584,,," 3812 calc.exe",,,"C:\Windows\System32\srvcli.dll",,,,,,,,,,,,,,,,1763591846484995000,,,,,140712668954624,140712668954624,181029,167936,239922031,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4850866Z","2025-11-19 22:37:26.4850866Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6196,,," 3812 calc.exe",,,"C:\Windows\System32\netutils.dll",,,,,,,,,,,,,,,,1763591846485086600,,,,,140712825847808,140712825847808,80696,53248,865845000,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4851748Z","2025-11-19 22:37:26.4851748Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",2748,,," 5784 svchost.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591846485174800,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4852998Z","2025-11-19 22:37:26.4852998Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",2748,,," 5784 svchost.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,,,,,,,1763591846485299800,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4855952Z","2025-11-19 22:37:26.4855952Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",2748,,," 5784 svchost.exe",,,"C:\Windows\System32\bcrypt.dll",,,,,,,,,,,,,,,,1763591846485595200,,,,,140712848654336,140712848654336,206048,172032,2893678010,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4877533Z","2025-11-19 22:37:26.4877533Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5784 svchost.exe",8604,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084032618496,18446633084032593920,140712378178112,243,513414832128,3068,1763591846487753300,513419509760,513419476992,140712378178112,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4882101Z","2025-11-19 22:37:26.4882101Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5784 svchost.exe",8604,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084032675840,18446633084032651264,140712378080832,243,513414840320,14092,1763591846488210100,513420034048,513420001280,140712378080832,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4883853Z","2025-11-19 22:37:26.4883853Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5784 svchost.exe",8604,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084032503808,18446633084032479232,140712863364608,0,513414807552,8604,1763591846488385300,513417936896,513417904128,140712863364608,9893579,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4886534Z","2025-11-19 22:37:26.4886534Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\ieframe.dll",,,,,,,,,,,,,,,,1763591846488653400,,,,,140710222364672,140710222364672,7531896,7499776,575051316,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4886694Z","2025-11-19 22:37:26.4886694Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",5288,,," 5784 svchost.exe",,,"C:\Windows\System32\wer.dll",,,,,,,,,,,,,,,,1763591846488669400,,,,,140712805728256,140712805728256,993632,983040,1987637995,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4895371Z","2025-11-19 22:37:26.4895371Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",5288,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846489537100,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4897960Z","2025-11-19 22:37:26.4897960Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.7019_none_3e06ffa0e335b8a8\comctl32.dll",,,,,,,,,,,,,,,,1763591846489796000,,,,,140712659910656,140712659910656,2747780,2703360,4095768276,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4901708Z","2025-11-19 22:37:26.4901708Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5784 svchost.exe",5288,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846490170800,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4904097Z","2025-11-19 22:37:26.4904097Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",5288,,," 5784 svchost.exe",,,"C:\Windows\System32\CorePrivacySettingsStore.dll",,,,,,,,,,,,,,,,1763591846490409700,,,,,140712456290304,140712456290304,263379,196608,2978004593,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4919326Z","2025-11-19 22:37:26.4919326Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\secur32.dll",,,,,,,,,,,,,,,,1763591846491932600,,,,,140712800223232,140712800223232,112844,53248,632019051,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4922137Z","2025-11-19 22:37:26.4922137Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\sspicli.dll",,,,,,,,,,,,,,,,1763591846492213700,,,,,140712833384448,140712833384448,339222,299008,3030302172,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4928237Z","2025-11-19 22:37:26.4928237Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\mlang.dll",,,,,,,,,,,,,,,,1763591846492823700,,,,,140712293761024,140712293761024,318858,278528,3734874788,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4929792Z","2025-11-19 22:37:26.4929792Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",5288,,," 5784 svchost.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,,,,,,,1763591846492979200,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4932006Z","2025-11-19 22:37:26.4932006Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\wininet.dll",,,,,,,,,,,,,,,,1763591846493200600,,,,,140712675573760,140712675573760,2677835,2658304,2422963474,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4940521Z","2025-11-19 22:37:26.4940521Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",5288,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846494052100,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4944064Z","2025-11-19 22:37:26.4944064Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\profapi.dll",,,,,,,,,,,,,,,,1763591846494406400,,,,,140712848850944,140712848850944,229548,167936,2447194521,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4945317Z","2025-11-19 22:37:26.4945317Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5784 svchost.exe",5288,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846494531700,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4964884Z","2025-11-19 22:37:26.4964884Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5784 svchost.exe",5288,,," 5784 svchost.exe",,,"C:\Windows\System32\wer.dll",,,,,,,,,,,,,,,,1763591846496488400,,,,,140712805728256,140712805728256,993632,995328,1987637995,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4969809Z","2025-11-19 22:37:26.4969809Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 5784 svchost.exe",5288,,,"13020 WerFault.exe",,,"C:\Windows\System32\WerFault.exe",,,,,,,,,,,,,,,,1763591846496980900,,,,,,,681036,,630084362,134080654472027581,0,"0x","","",5784,6630,6631,1,1,0,0,,,,,,,,,,,, +"2025-11-19 22:37:26.4984170Z","2025-11-19 22:37:26.4984170Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5784 svchost.exe",5288,,,"13020 WerFault.exe",,,,,,,,,,,,,18446633084032704512,18446633084032679936,140702556693600,243,4297187328,14996,1763591846498417000,4295491584,4295483392,140702556693600,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4996292Z","2025-11-19 22:37:26.4996292Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\WerFault.exe",,,,,,,,,,,,,,,,1763591846499629200,,,,,140702556684288,140702556684288,681036,647168,630084362,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4996635Z","2025-11-19 22:37:26.4996635Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591846499663500,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5006105Z","2025-11-19 22:37:26.5006105Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\edputil.dll",,,,,,,,,,,,,,,,1763591846500610500,,,,,140712471560192,140712471560192,178059,167936,3474529356,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5024731Z","2025-11-19 22:37:26.5024731Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591846502473100,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5025835Z","2025-11-19 22:37:26.5025835Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591846502583500,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5031397Z","2025-11-19 22:37:26.5031397Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\AppXDeploymentClient.dll",,,,,,,,,,,,,,,,1763591846503139700,,,,,140712740257792,140712740257792,1575781,1499136,2615972959,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5032567Z","2025-11-19 22:37:26.5032567Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\imagehlp.dll",,,,,,,,,,,,,,,,1763591846503256800,,,,,140712892760064,140712892760064,200866,131072,2156568970,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5034888Z","2025-11-19 22:37:26.5034888Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",13052,,," 1040 svchost.exe",,,,,,,,,,,,,18446633084032733184,18446633084032708608,140712899206080,0,256031031296,8500,1763591846503488800,256034471936,256034439168,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5037071Z","2025-11-19 22:37:26.5037071Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591846503707100,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5037125Z","2025-11-19 22:37:26.5037125Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",8500,,," 1040 svchost.exe",,,,,,,,,,,,,18446633084032790528,18446633084032765952,140712899206080,0,256031047680,12540,1763591846503712500,256035520512,256035487744,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5037392Z","2025-11-19 22:37:26.5037392Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1016 services.exe",2816,,," 1016 services.exe",,,,,,,,,,,,,18446633084032819200,18446633084032794624,140712899206080,0,156998303744,11304,1763591846503739200,156999614464,156999581696,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5038480Z","2025-11-19 22:37:26.5038480Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,,,,,,,,,,,18446633084032847872,18446633084032823296,140712899206080,0,4297195520,9800,1763591846503848000,4296015872,4296007680,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5039283Z","2025-11-19 22:37:26.5039283Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13020 WerFault.exe",9800,,,"13020 WerFault.exe",,,,,,,,,,,,,18446633084032876544,18446633084032851968,140712899206080,0,4297203712,8392,1763591846503928300,4296540160,4296531968,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5039434Z","2025-11-19 22:37:26.5039434Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,,,,,,,1763591846503943400,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5042193Z","2025-11-19 22:37:26.5042193Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591846504219300,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5042908Z","2025-11-19 22:37:26.5042908Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084032966656,18446633084032942080,140712899206080,0,513414848512,14268,1763591846504290800,513417936896,513417904128,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5043126Z","2025-11-19 22:37:26.5043126Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",8392,,,"13020 WerFault.exe",,,"C:\Windows\System32\cryptsp.dll",,,,,,,,,,,,,,,,1763591846504312700,,,,,140712839217152,140712839217152,146168,110592,1658328178,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5044925Z","2025-11-19 22:37:26.5044925Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13020 WerFault.exe",8392,,,"13020 WerFault.exe",,,,,,,,,,,,,18446633084033167360,18446633084033142784,140712899206080,0,4297211904,11612,1763591846504492500,4297064448,4297056256,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5045208Z","2025-11-19 22:37:26.5045208Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591846504520800,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5047618Z","2025-11-19 22:37:26.5047618Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591846504761800,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5048553Z","2025-11-19 22:37:26.5048553Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",9800,,,"13020 WerFault.exe",,,"C:\Windows\System32\wer.dll",,,,,,,,,,,,,,,,1763591846504855300,,,,,140712805728256,140712805728256,993632,983040,1987637995,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5049284Z","2025-11-19 22:37:26.5049284Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",8392,,,"13020 WerFault.exe",,,"C:\Windows\System32\dbghelp.dll",,,,,,,,,,,,,,,,1763591846504928400,,,,,140712664104960,140712664104960,2282862,2367488,82455296,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5049420Z","2025-11-19 22:37:26.5049420Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",11612,,,"13020 WerFault.exe",,,"C:\Windows\System32\DiagnosticDataSettings.dll",,,,,,,,,,,,,,,,1763591846504942000,,,,,140712462319616,140712462319616,108991,61440,3234151774,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5050027Z","2025-11-19 22:37:26.5050027Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591846505002700,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5050066Z","2025-11-19 22:37:26.5050066Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3812 calc.exe",6204,,," 3812 calc.exe",,,,,,,,,,,,,18446633084033224704,18446633084033200128,140712865112144,0,801455431680,2088,1763591846505006600,801458618368,801458610176,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5052049Z","2025-11-19 22:37:26.5052049Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",8392,,,"13020 WerFault.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,,,,,,,1763591846505204900,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5052250Z","2025-11-19 22:37:26.5052250Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3812 calc.exe",,,,,,,,,,,,,18446633084033310720,18446633084033286144,140712899206080,0,801455439872,652,1763591846505225000,801459142656,801459134464,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5053291Z","2025-11-19 22:37:26.5053291Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",9800,,,"13020 WerFault.exe",,,"C:\Windows\System32\powrprof.dll",,,,,,,,,,,,,,,,1763591846505329100,,,,,140712848195584,140712848195584,457799,385024,2858637235,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5053308Z","2025-11-19 22:37:26.5053308Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,,,,,,,1763591846505330800,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5053978Z","2025-11-19 22:37:26.5053978Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3812 calc.exe",652,,," 3812 calc.exe",,,,,,,,,,,,,18446633084033368064,18446633084033343488,140712899206080,0,801455448064,3100,1763591846505397800,801459666944,801459658752,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5054372Z","2025-11-19 22:37:26.5054372Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",11612,,,"13020 WerFault.exe",,,"C:\Windows\System32\bcrypt.dll",,,,,,,,,,,,,,,,1763591846505437200,,,,,140712848654336,140712848654336,206048,172032,2893678010,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5054424Z","2025-11-19 22:37:26.5054424Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",8392,,,"13020 WerFault.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591846505442400,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5057555Z","2025-11-19 22:37:26.5057555Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\cfgmgr32.dll",,,,,,,,,,,,,,,,1763591846505755500,,,,,140712845049856,140712845049856,385808,356352,1737777300,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5058654Z","2025-11-19 22:37:26.5058654Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",9800,,,"13020 WerFault.exe",,,"C:\Windows\System32\ntmarta.dll",,,,,,,,,,,,,,,,1763591846505865400,,,,,140712831811584,140712831811584,265798,221184,3598506564,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5060640Z","2025-11-19 22:37:26.5060640Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",8392,,,"13020 WerFault.exe",,,"C:\Windows\System32\Faultrep.dll",,,,,,,,,,,,,,,,1763591846506064000,,,,,140712371552256,140712371552256,594974,548864,3149101438,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5061970Z","2025-11-19 22:37:26.5061970Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\twinui.appcore.dll",,,,,,,,,,,,,,,,1763591846506197000,,,,,140712458059776,140712458059776,827472,806912,3228774028,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5063575Z","2025-11-19 22:37:26.5063575Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",11612,,,"13020 WerFault.exe",,,"C:\Windows\System32\dbgcore.dll",,,,,,,,,,,,,,,,1763591846506357500,,,,,140712478244864,140712478244864,263772,245760,3120784319,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5081175Z","2025-11-19 22:37:26.5081175Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\umpdc.dll",,,,,,,,,,,,,,,,1763591846508117600,,,,,140712848064512,140712848064512,98535,81920,1714427184,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5085497Z","2025-11-19 22:37:26.5085497Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\OneCoreUAPCommonProxyStub.dll",,,,,,,,,,,,,,,,1763591846508549700,,,,,140712713977856,140712713977856,6740758,6615040,2011948997,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5095118Z","2025-11-19 22:37:26.5095118Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.7019_none_3e06ffa0e335b8a8\comctl32.dll",,,,,,,,,,,,,,,,1763591846509511800,,,,,140712659910656,140712659910656,2747780,2703360,4095768276,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5096246Z","2025-11-19 22:37:26.5096246Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591846509624600,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5097060Z","2025-11-19 22:37:26.5097060Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591846509706000,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5097917Z","2025-11-19 22:37:26.5097917Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591846509791700,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5099200Z","2025-11-19 22:37:26.5099200Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591846509920000,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5120207Z","2025-11-19 22:37:26.5120207Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846512020700,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5125470Z","2025-11-19 22:37:26.5125470Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846512547000,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5126863Z","2025-11-19 22:37:26.5126863Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\CorePrivacySettingsStore.dll",,,,,,,,,,,,,,,,1763591846512686300,,,,,140712456290304,140712456290304,263379,196608,2978004593,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5132399Z","2025-11-19 22:37:26.5132399Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 4340 sihost.exe",13916,,," 4340 sihost.exe",,,"C:\Windows\System32\Windows.Security.Integrity.dll",,,,,,,,,,,,,,,,1763591846513239900,,,,,140712657616896,140712657616896,193382,118784,3625026862,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5147180Z","2025-11-19 22:37:26.5147180Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,,,,,,,1763591846514718000,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5152530Z","2025-11-19 22:37:26.5152530Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1984 svchost.exe",12532,,," 1984 svchost.exe",,,,,,,,,,,,,18446633084033511424,18446633084033486848,140712899206080,210,1068662685696,5024,1763591846515253000,1068666191872,1068666159104,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5155636Z","2025-11-19 22:37:26.5155636Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846515563600,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5160022Z","2025-11-19 22:37:26.5160022Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846516002200,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5170650Z","2025-11-19 22:37:26.5170650Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",9432,,," 1040 svchost.exe",,,,,,,,,,,,,18446633084033568768,18446633084033544192,140712899206080,0,256031055872,4220,1763591846517065000,256037617664,256037584896,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5171078Z","2025-11-19 22:37:26.5171078Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2228 svchost.exe",14732,,," 2228 svchost.exe",,,,,,,,,,,,,18446633084033626112,18446633084033601536,140712899206080,191,717848268800,12692,1763591846517107800,717850935296,717850902528,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5196294Z","2025-11-19 22:37:26.5196294Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084033712128,18446633084033687552,140712899206080,0,199841259520,8664,1763591846519629400,199839318016,199839309824,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5198874Z","2025-11-19 22:37:26.5198874Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",8664,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084033798144,18446633084033773568,140712899206080,0,199841267712,14376,1763591846519887500,199842856960,199842848768,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5199855Z","2025-11-19 22:37:26.5199855Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",8664,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084033912832,18446633084033888256,140712891545280,0,199841275904,8260,1763591846519985500,199843381248,199843373056,140712891545280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5201152Z","2025-11-19 22:37:26.5201152Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4340 sihost.exe",1696,,," 4340 sihost.exe",,,,,,,,,,,,,18446633084034056192,18446633084034031616,140712899206080,0,645640011776,7292,1763591846520115200,645644943360,645644935168,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5204931Z","2025-11-19 22:37:26.5204931Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4404 svchost.exe",4644,,," 4404 svchost.exe",,,,,,,,,,,,,18446633084034170880,18446633084034146304,140712865112144,98,679905755136,9140,1763591846520493100,679908737024,679908704256,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5211322Z","2025-11-19 22:37:26.5211322Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",14912,,," 6028 svchost.exe",,,,,,,,,,,,,18446633084034314240,18446633084034289664,140712899206080,5,661507424256,14032,1763591846521132200,661510422528,661510389760,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5222504Z","2025-11-19 22:37:26.5222504Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4404 svchost.exe",5524,,," 4404 svchost.exe",,,,,,,,,,,,,18446633084034371584,18446633084034347008,140712899206080,0,679905763328,1300,1763591846522250400,679909261312,679909228544,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5231511Z","2025-11-19 22:37:26.5231511Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591846523151100,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5234656Z","2025-11-19 22:37:26.5234656Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13020 WerFault.exe",11612,,,"13020 WerFault.exe",,,,,,,,,,,,,18446633084033167360,18446633084033142784,140712899206080,0,4297211904,11612,1763591846523465600,4297064448,4297056256,140712899206080,6532729,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5234671Z","2025-11-19 22:37:26.5234671Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13020 WerFault.exe",8392,,,"13020 WerFault.exe",,,,,,,,,,,,,18446633084032876544,18446633084032851968,140712899206080,0,4297203712,8392,1763591846523467100,4296540160,4296523776,140712899206080,8081892,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5234695Z","2025-11-19 22:37:26.5234695Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13020 WerFault.exe",9800,,,"13020 WerFault.exe",,,,,,,,,,,,,18446633084032847872,18446633084032823296,140712899206080,0,4297195520,9800,1763591846523469500,4296015872,4296007680,140712899206080,7302586,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5237811Z","2025-11-19 22:37:26.5237811Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",8260,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084032847872,18446633084032823296,140712865112144,0,199841284096,7648,1763591846523781100,199843905536,199843897344,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5240969Z","2025-11-19 22:37:26.5240969Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",8260,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084033167360,18446633084033142784,140712891292720,0,199841292288,4796,1763591846524096900,199844429824,199844421632,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5242561Z","2025-11-19 22:37:26.5242561Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,,,,,,,,,,,18446633084032704512,18446633084032679936,140702556693600,0,4297187328,14996,1763591846524256100,4295491584,4295450624,140702556693600,79585807,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5244263Z","2025-11-19 22:37:26.5244263Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",8260,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084032016384,18446633084031991808,140712891292720,0,199841300480,13628,1763591846524426300,199844954112,199844945920,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5244702Z","2025-11-19 22:37:26.5244702Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\WerFault.exe",,,,,,,,,,,,,,,,1763591846524470300,,,,,140702556684288,140702556684288,681036,647168,630084362,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5244830Z","2025-11-19 22:37:26.5244830Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\Faultrep.dll",,,,,,,,,,,,,,,,1763591846524483000,,,,,140712371552256,140712371552256,594974,548864,3149101438,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5244963Z","2025-11-19 22:37:26.5244963Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\CorePrivacySettingsStore.dll",,,,,,,,,,,,,,,,1763591846524496300,,,,,140712456290304,140712456290304,263379,196608,2978004593,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5245079Z","2025-11-19 22:37:26.5245079Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\DiagnosticDataSettings.dll",,,,,,,,,,,,,,,,1763591846524507900,,,,,140712462319616,140712462319616,108991,61440,3234151774,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5245284Z","2025-11-19 22:37:26.5245284Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\dbgcore.dll",,,,,,,,,,,,,,,,1763591846524528500,,,,,140712478244864,140712478244864,263772,245760,3120784319,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5245331Z","2025-11-19 22:37:26.5245331Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.7019_none_3e06ffa0e335b8a8\comctl32.dll",,,,,,,,,,,,,,,,1763591846524533100,,,,,140712659910656,140712659910656,2747780,2703360,4095768276,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5245438Z","2025-11-19 22:37:26.5245438Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\dbghelp.dll",,,,,,,,,,,,,,,,1763591846524543800,,,,,140712664104960,140712664104960,2282862,2367488,82455296,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5245526Z","2025-11-19 22:37:26.5245526Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\wer.dll",,,,,,,,,,,,,,,,1763591846524552600,,,,,140712805728256,140712805728256,993632,983040,1987637995,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5245607Z","2025-11-19 22:37:26.5245607Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591846524560700,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5245700Z","2025-11-19 22:37:26.5245700Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\ntmarta.dll",,,,,,,,,,,,,,,,1763591846524570000,,,,,140712831811584,140712831811584,265798,221184,3598506564,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5245911Z","2025-11-19 22:37:26.5245911Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\cryptsp.dll",,,,,,,,,,,,,,,,1763591846524591100,,,,,140712839217152,140712839217152,146168,110592,1658328178,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5246025Z","2025-11-19 22:37:26.5246025Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\cfgmgr32.dll",,,,,,,,,,,,,,,,1763591846524602500,,,,,140712845049856,140712845049856,385808,356352,1737777300,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5246124Z","2025-11-19 22:37:26.5246124Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\umpdc.dll",,,,,,,,,,,,,,,,1763591846524612400,,,,,140712848064512,140712848064512,98535,81920,1714427184,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5246222Z","2025-11-19 22:37:26.5246222Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\powrprof.dll",,,,,,,,,,,,,,,,1763591846524622200,,,,,140712848195584,140712848195584,457799,385024,2858637235,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5246318Z","2025-11-19 22:37:26.5246318Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\bcrypt.dll",,,,,,,,,,,,,,,,1763591846524631800,,,,,140712848654336,140712848654336,206048,172032,2893678010,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5246552Z","2025-11-19 22:37:26.5246552Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,,,,,,,1763591846524655200,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5246651Z","2025-11-19 22:37:26.5246651Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591846524665100,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5246738Z","2025-11-19 22:37:26.5246738Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591846524673800,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5246821Z","2025-11-19 22:37:26.5246821Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591846524682100,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5246903Z","2025-11-19 22:37:26.5246903Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591846524690300,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5247110Z","2025-11-19 22:37:26.5247110Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591846524711000,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5247221Z","2025-11-19 22:37:26.5247221Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591846524722100,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5247313Z","2025-11-19 22:37:26.5247313Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,,,,,,,1763591846524731300,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5247396Z","2025-11-19 22:37:26.5247396Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591846524739600,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5247465Z","2025-11-19 22:37:26.5247465Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,,,,,,,1763591846524746500,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5247538Z","2025-11-19 22:37:26.5247538Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591846524753800,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5247676Z","2025-11-19 22:37:26.5247676Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591846524767600,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5247735Z","2025-11-19 22:37:26.5247735Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591846524773600,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5247796Z","2025-11-19 22:37:26.5247796Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,,,,,,,1763591846524779600,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5247849Z","2025-11-19 22:37:26.5247849Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591846524784900,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5247902Z","2025-11-19 22:37:26.5247902Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591846524790200,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5247955Z","2025-11-19 22:37:26.5247955Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591846524795500,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5248036Z","2025-11-19 22:37:26.5248036Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"WerFault.exe",,,,,,,,,,,,,,,,1763591846524803600,,,,,,,,,,134080654472027581,,,,,,,6631,,,,,1810432,1847296,101743666,0,134080654472296792,64,0,1,5,1,0,0 +"2025-11-19 22:37:26.5251511Z","2025-11-19 22:37:26.5251511Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",14376,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084034457600,18446633084034433024,140712899206080,0,199841308672,13944,1763591846525151100,199845478400,199845470208,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5270224Z","2025-11-19 22:37:26.5270224Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",5288,,," 5784 svchost.exe",,,"C:\Windows\System32\Faultrep.dll",,,,,,,,,,,,,,,,1763591846527022400,,,,,140712371552256,140712371552256,594974,548864,3149101438,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5272308Z","2025-11-19 22:37:26.5272308Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",14376,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084032704512,18446633084032679936,140712899206080,0,199841316864,8372,1763591846527230900,199846002688,199845994496,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5279480Z","2025-11-19 22:37:26.5279480Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",5288,,," 5784 svchost.exe",,,"C:\Windows\System32\wer.dll",,,,,,,,,,,,,,,,1763591846527948000,,,,,140712805728256,140712805728256,993632,983040,1987637995,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5282052Z","2025-11-19 22:37:26.5282052Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",8260,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084032045056,18446633084032020480,140712899206080,0,199841325056,14436,1763591846528205200,199846526976,199846518784,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5284531Z","2025-11-19 22:37:26.5284531Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",8260,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084034629632,18446633084034605056,140712899206080,0,199841333248,11504,1763591846528453100,199847051264,199847043072,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5291882Z","2025-11-19 22:37:26.5291882Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",5288,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846529188300,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5292181Z","2025-11-19 22:37:26.5292181Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",14912,,," 2456 Memory Compression",,,,,,,,,,,,,18446633084034801664,18446633084034777088,18446735306729542320,0,0,9992,1763591846529218100,0,0,18446735306729542320,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5292346Z","2025-11-19 22:37:26.5292346Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",14912,,," 2456 Memory Compression",,,,,,,,,,,,,18446633084034973696,18446633084034949120,18446735306729542320,0,0,13288,1763591846529234700,0,0,18446735306729542320,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5292738Z","2025-11-19 22:37:26.5292738Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",14912,,," 2456 Memory Compression",,,,,,,,,,,,,18446633084035002368,18446633084034977792,18446735306728238208,0,0,12392,1763591846529273800,0,0,18446735306728238208,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5293277Z","2025-11-19 22:37:26.5293277Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",14912,,," 2456 Memory Compression",,,,,,,,,,,,,18446633084035031040,18446633084035006464,18446735306729822480,0,0,13828,1763591846529327700,0,0,18446735306729822480,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5295885Z","2025-11-19 22:37:26.5295885Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 6028 svchost.exe",14912,,,"14660 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe\CalculatorApp.exe",,,,,,,,,,,,,,,,1763591846529588500,,,,,,,0,,1758293941,134080654472346829,3,"0x","Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe","App",4340,106,6633,3,0,0,1,,,,,,,,,,,, +"2025-11-19 22:37:26.5298937Z","2025-11-19 22:37:26.5298937Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5784 svchost.exe",5288,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846529893700,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5305120Z","2025-11-19 22:37:26.5305120Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",14912,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084035059712,18446633084035035136,140700165242880,5,61841813504,11616,1763591846530512000,61843963904,61843959808,140700165242880,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5327190Z","2025-11-19 22:37:26.5327190Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",5288,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846532719000,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5328256Z","2025-11-19 22:37:26.5328256Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe\CalculatorApp.exe",,,,,,,,,,,,,,,,1763591846532825600,,,,,140700165210112,140700165210112,0,36864,1758293941,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5328516Z","2025-11-19 22:37:26.5328516Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591846532851600,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5334643Z","2025-11-19 22:37:26.5334643Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5784 svchost.exe",5288,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846533464400,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5343675Z","2025-11-19 22:37:26.5343675Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5184 explorer.exe",11800,,," 5184 explorer.exe",,,"C:\Windows\System32\Windows.StateRepositoryBroker.dll",,,,,,,,,,,,,,,,1763591846534367500,,,,,140712518615040,140712518615040,179235,143360,3561268012,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5358014Z","2025-11-19 22:37:26.5358014Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",5288,,," 5784 svchost.exe",,,"C:\Windows\System32\userenv.dll",,,,,,,,,,,,,,,,1763591846535801400,,,,,140712837054464,140712837054464,245008,176128,731547084,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5362097Z","2025-11-19 22:37:26.5362097Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",5288,,," 5784 svchost.exe",,,"C:\Windows\System32\profapi.dll",,,,,,,,,,,,,,,,1763591846536209700,,,,,140712848850944,140712848850944,229548,167936,2447194521,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5385751Z","2025-11-19 22:37:26.5385751Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",5288,,," 5784 svchost.exe",,,"C:\Windows\System32\sspicli.dll",,,,,,,,,,,,,,,,1763591846538575100,,,,,140712833384448,140712833384448,339222,299008,3030302172,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5393979Z","2025-11-19 22:37:26.5393979Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",6292,,," 5184 explorer.exe",,,,,,,,,,,,,18446633084032876544,18446633084032851968,140712891292720,0,15368192,10612,1763591846539397900,470351872,470294528,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5396692Z","2025-11-19 22:37:26.5396692Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 5784 svchost.exe",5288,,," 5252 WerFault.exe",,,"C:\Windows\System32\WerFault.exe",,,,,,,,,,,,,,,,1763591846539669200,,,,,,,681036,,630084362,134080654472445997,0,"0x","","",7284,6628,6634,3,0,0,1,,,,,,,,,,,, +"2025-11-19 22:37:26.5412000Z","2025-11-19 22:37:26.5412000Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5784 svchost.exe",5288,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084035321856,18446633084035297280,140702556693600,243,295361212416,14976,1763591846541200000,295359938560,295359930368,140702556693600,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5427716Z","2025-11-19 22:37:26.5427716Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\WerFault.exe",,,,,,,,,,,,,,,,1763591846542771600,,,,,140702556684288,140702556684288,681036,647168,630084362,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5427834Z","2025-11-19 22:37:26.5427834Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591846542783400,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5430938Z","2025-11-19 22:37:26.5430938Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591846543093800,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5432060Z","2025-11-19 22:37:26.5432060Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591846543206000,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5433814Z","2025-11-19 22:37:26.5433814Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591846543381400,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5434752Z","2025-11-19 22:37:26.5434752Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591846543475200,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5438262Z","2025-11-19 22:37:26.5438262Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1416 ApplicationFrameHost.exe",4796,,," 1416 ApplicationFrameHost.exe",,,"C:\Windows\System32\Windows.StateRepositoryPS.dll",,,,,,,,,,,,,,,,1763591846543826200,,,,,140712490369024,140712490369024,879719,802816,374042279,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5441461Z","2025-11-19 22:37:26.5441461Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1416 ApplicationFrameHost.exe",13628,,," 1416 ApplicationFrameHost.exe",,,"C:\Windows\System32\MrmCoreR.dll",,,,,,,,,,,,,,,,1763591846544146100,,,,,140712631926784,140712631926784,1191374,1146880,1078870765,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5448212Z","2025-11-19 22:37:26.5448212Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084035551232,18446633084035526656,140712899206080,0,61841821696,7992,1763591846544821300,61845012480,61845008384,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5448579Z","2025-11-19 22:37:26.5448579Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591846544857900,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5450078Z","2025-11-19 22:37:26.5450078Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084035579904,18446633084035555328,140712899206080,0,295361220608,12628,1763591846545007800,295360462848,295360454656,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5450421Z","2025-11-19 22:37:26.5450421Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe\CalculatorApp.dll",,,,,,,,,,,,,,,,1763591846545042100,,,,,140710075629568,140710075629568,0,6352896,1758293941,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5451022Z","2025-11-19 22:37:26.5451022Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5252 WerFault.exe",12628,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084035608576,18446633084035584000,140712899206080,0,295361228800,8368,1763591846545102200,295363411968,295363403776,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5451412Z","2025-11-19 22:37:26.5451412Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,,,,,,,1763591846545141200,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5452108Z","2025-11-19 22:37:26.5452108Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,,,,,,,1763591846545210800,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5452382Z","2025-11-19 22:37:26.5452382Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",7992,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084035637248,18446633084035612672,140712899206080,0,61841829888,4128,1763591846545238200,61846061056,61846056960,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5453483Z","2025-11-19 22:37:26.5453483Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591846545348300,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5453640Z","2025-11-19 22:37:26.5453640Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",8368,,," 5252 WerFault.exe",,,"C:\Windows\System32\cryptsp.dll",,,,,,,,,,,,,,,,1763591846545364000,,,,,140712839217152,140712839217152,146168,110592,1658328178,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5453953Z","2025-11-19 22:37:26.5453953Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591846545395300,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5454506Z","2025-11-19 22:37:26.5454506Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084035665920,18446633084035641344,140712899206080,0,61841838080,13260,1763591846545450600,61847109632,61847105536,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5455053Z","2025-11-19 22:37:26.5455053Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591846545505300,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5455108Z","2025-11-19 22:37:26.5455108Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1416 ApplicationFrameHost.exe",13628,,," 1416 ApplicationFrameHost.exe",,,"C:\Windows\System32\AppXDeploymentClient.dll",,,,,,,,,,,,,,,,1763591846545510800,,,,,140712740257792,140712740257792,1575781,1499136,2615972959,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5455989Z","2025-11-19 22:37:26.5455989Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",4128,,,"14660 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.2.2_2.2.28604.0_x64__8wekyb3d8bbwe\mrt100_app.dll",,,,,,,,,,,,,,,,1763591846545599000,,,,,140712281636864,140712281636864,491795,548864,1580779188,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5456988Z","2025-11-19 22:37:26.5456988Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",7992,,,"14660 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.2.2_2.2.29512.0_x64__8wekyb3d8bbwe\SharedLibrary.dll",,,,,,,,,,,,,,,,1763591846545698800,,,,,140710033162240,140710033162240,13461317,13422592,1605180014,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5457035Z","2025-11-19 22:37:26.5457035Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591846545703500,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5457195Z","2025-11-19 22:37:26.5457195Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1416 ApplicationFrameHost.exe",13628,,," 1416 ApplicationFrameHost.exe",,,"C:\Windows\System32\imagehlp.dll",,,,,,,,,,,,,,,,1763591846545719500,,,,,140712892760064,140712892760064,200866,131072,2156568970,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5457716Z","2025-11-19 22:37:26.5457716Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,,,,,,,1763591846545771600,,,,,140712851341312,140712851341312,1524912,1486848,1404855129,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5458407Z","2025-11-19 22:37:26.5458407Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591846545840700,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5458801Z","2025-11-19 22:37:26.5458801Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",7992,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\ole32.dll",,,,,,,,,,,,,,,,1763591846545880100,,,,,140712878473216,140712878473216,1689904,1667072,1018821057,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5459013Z","2025-11-19 22:37:26.5459013Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",13628,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084035694592,18446633084035670016,140712899206080,0,199841341440,11828,1763591846545901300,199847575552,199847567360,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5459688Z","2025-11-19 22:37:26.5459688Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591846545968800,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5460525Z","2025-11-19 22:37:26.5460525Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",7992,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591846546052500,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5460628Z","2025-11-19 22:37:26.5460628Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",4128,,,"14660 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe\clrcompression.dll",,,,,,,,,,,,,,,,1763591846546062800,,,,,140712633237504,140712633237504,70610,77824,1653667599,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5462188Z","2025-11-19 22:37:26.5462188Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",13260,,,"14660 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.33519.0_x64__8wekyb3d8bbwe\vcruntime140_app.dll",,,,,,,,,,,,,,,,1763591846546218800,,,,,140712297627648,140712297627648,155734,118784,1024347489,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5462454Z","2025-11-19 22:37:26.5462454Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",7992,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591846546245400,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5463071Z","2025-11-19 22:37:26.5463071Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",4796,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084035809280,18446633084035784704,140712891292720,0,199841349632,10832,1763591846546307100,199848099840,199848091648,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5463310Z","2025-11-19 22:37:26.5463310Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,,,,,,,1763591846546331000,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5464045Z","2025-11-19 22:37:26.5464045Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5252 WerFault.exe",8368,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084035780608,18446633084035756032,140712899206080,0,295361236992,13036,1763591846546404500,295363936256,295363928064,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5464303Z","2025-11-19 22:37:26.5464303Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",7992,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591846546430300,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5464807Z","2025-11-19 22:37:26.5464807Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,,,,,,,1763591846546480700,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5465145Z","2025-11-19 22:37:26.5465145Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",7992,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591846546514500,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5466119Z","2025-11-19 22:37:26.5466119Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",7992,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591846546611900,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5466387Z","2025-11-19 22:37:26.5466387Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591846546638700,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5467434Z","2025-11-19 22:37:26.5467434Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",7992,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591846546743400,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5468788Z","2025-11-19 22:37:26.5468788Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\DiagnosticDataSettings.dll",,,,,,,,,,,,,,,,1763591846546878800,,,,,140712462319616,140712462319616,108991,61440,3234151774,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5468834Z","2025-11-19 22:37:26.5468834Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",7992,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591846546883400,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5469678Z","2025-11-19 22:37:26.5469678Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",12628,,," 5252 WerFault.exe",,,"C:\Windows\System32\wer.dll",,,,,,,,,,,,,,,,1763591846546967800,,,,,140712805728256,140712805728256,993632,983040,1987637995,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5470229Z","2025-11-19 22:37:26.5470229Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",7992,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591846547022900,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5470365Z","2025-11-19 22:37:26.5470365Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",8368,,," 5252 WerFault.exe",,,"C:\Windows\System32\dbghelp.dll",,,,,,,,,,,,,,,,1763591846547036500,,,,,140712664104960,140712664104960,2282862,2367488,82455296,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5470447Z","2025-11-19 22:37:26.5470447Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\powrprof.dll",,,,,,,,,,,,,,,,1763591846547044700,,,,,140712848195584,140712848195584,457799,385024,2858637235,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5471589Z","2025-11-19 22:37:26.5471589Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",7992,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,,,,,,,1763591846547159000,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5472636Z","2025-11-19 22:37:26.5472636Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1416 ApplicationFrameHost.exe",13628,,," 1416 ApplicationFrameHost.exe",,,"C:\Windows\System32\imagehlp.dll",,,,,,,,,,,,,,,,1763591846547263600,,,,,140712892760064,140712892760064,200866,143360,2156568970,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5473171Z","2025-11-19 22:37:26.5473171Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",7992,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\normaliz.dll",,,,,,,,,,,,,,,,1763591846547317100,,,,,140712868773888,140712868773888,48733,32768,3139002400,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5474015Z","2025-11-19 22:37:26.5474015Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",7992,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\crypt32.dll",,,,,,,,,,,,,,,,1763591846547401500,,,,,140712849768448,140712849768448,1584869,1536000,3438168074,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5474632Z","2025-11-19 22:37:26.5474632Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\bcrypt.dll",,,,,,,,,,,,,,,,1763591846547463200,,,,,140712848654336,140712848654336,206048,172032,2893678010,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5475536Z","2025-11-19 22:37:26.5475536Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",13260,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\bcrypt.dll",,,,,,,,,,,,,,,,1763591846547553600,,,,,140712848654336,140712848654336,206048,172032,2893678010,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5475801Z","2025-11-19 22:37:26.5475801Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",8368,,," 5252 WerFault.exe",,,"C:\Windows\System32\cfgmgr32.dll",,,,,,,,,,,,,,,,1763591846547580100,,,,,140712845049856,140712845049856,385808,356352,1737777300,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5478180Z","2025-11-19 22:37:26.5478180Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1416 ApplicationFrameHost.exe",13628,,," 1416 ApplicationFrameHost.exe",,,"C:\Windows\System32\AppXDeploymentClient.dll",,,,,,,,,,,,,,,,1763591846547818000,,,,,140712740257792,140712740257792,1575781,1511424,2615972959,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5478669Z","2025-11-19 22:37:26.5478669Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\Faultrep.dll",,,,,,,,,,,,,,,,1763591846547866900,,,,,140712371552256,140712371552256,594974,548864,3149101438,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5479497Z","2025-11-19 22:37:26.5479497Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",4128,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\dpapi.dll",,,,,,,,,,,,,,,,1763591846547949700,,,,,140712845574144,140712845574144,42814,40960,2473566603,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5482159Z","2025-11-19 22:37:26.5482159Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",13036,,," 5252 WerFault.exe",,,"C:\Windows\System32\ntmarta.dll",,,,,,,,,,,,,,,,1763591846548215900,,,,,140712831811584,140712831811584,265798,221184,3598506564,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5486356Z","2025-11-19 22:37:26.5486356Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",12628,,," 5252 WerFault.exe",,,"C:\Windows\System32\dbgcore.dll",,,,,,,,,,,,,,,,1763591846548635600,,,,,140712478244864,140712478244864,263772,245760,3120784319,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5490612Z","2025-11-19 22:37:26.5490612Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\mrt100.dll",,,,,,,,,,,,,,,,1763591846549061200,,,,,140712698314752,140712698314752,102582,40960,1265422184,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5495929Z","2025-11-19 22:37:26.5495929Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084035751936,18446633084035727360,140712899206080,0,61841846272,11964,1763591846549592900,61848158208,61848154112,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5497433Z","2025-11-19 22:37:26.5497433Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591846549743300,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5500587Z","2025-11-19 22:37:26.5500587Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,,,,,,,1763591846550058700,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5507269Z","2025-11-19 22:37:26.5507269Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\rmclient.dll",,,,,,,,,,,,,,,,1763591846550726900,,,,,140712808808448,140712808808448,282526,221184,1891057501,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5507595Z","2025-11-19 22:37:26.5507595Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\umpdc.dll",,,,,,,,,,,,,,,,1763591846550759500,,,,,140712848064512,140712848064512,98535,81920,1714427184,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5510549Z","2025-11-19 22:37:26.5510549Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084035952640,18446633084035928064,140712281948464,0,61841854464,12508,1763591846551054900,61849206784,61849202688,140712281948464,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5515201Z","2025-11-19 22:37:26.5515201Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,,,,,,,1763591846551520100,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5526048Z","2025-11-19 22:37:26.5526048Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.7019_none_3e06ffa0e335b8a8\comctl32.dll",,,,,,,,,,,,,,,,1763591846552604800,,,,,140712659910656,140712659910656,2747780,2703360,4095768276,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5527731Z","2025-11-19 22:37:26.5527731Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591846552773100,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5529168Z","2025-11-19 22:37:26.5529168Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591846552916800,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5530617Z","2025-11-19 22:37:26.5530617Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591846553061700,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5532231Z","2025-11-19 22:37:26.5532231Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591846553223100,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5537087Z","2025-11-19 22:37:26.5537087Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1016 services.exe",6816,,," 6616 svchost.exe",,,"C:\Windows\System32\svchost.exe",,,,,,,,,,,,,,,,1763591846553708700,,,,,,,143552,,14788416,134080654472583582,0,"0x","","",1016,11,6635,1,1,0,0,,,,,,,,,,,, +"2025-11-19 22:37:26.5537621Z","2025-11-19 22:37:26.5537621Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,,,,,,,1763591846553762100,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5542305Z","2025-11-19 22:37:26.5542305Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",14436,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084036096000,18446633084036071424,140712899206080,0,199841357824,5004,1763591846554230500,199849148416,199849140224,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5542583Z","2025-11-19 22:37:26.5542583Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1016 services.exe",6816,,," 6616 svchost.exe",,,,,,,,,,,,,18446633084036009984,18446633084035985408,140696171073504,0,816038653952,5908,1763591846554258300,816037298176,816037281792,140696171073504,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5550967Z","2025-11-19 22:37:26.5550967Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",5908,,," 6616 svchost.exe",,,"C:\Windows\System32\svchost.exe",,,,,,,,,,,,,,,,1763591846555096800,,,,,140696171053056,140696171053056,143552,77824,14788416,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5551590Z","2025-11-19 22:37:26.5551590Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",5908,,," 6616 svchost.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591846555159000,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5561101Z","2025-11-19 22:37:26.5561101Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\uxtheme.dll",,,,,,,,,,,,,,,,1763591846556110100,,,,,140712802254848,140712802254848,696534,696320,1695798817,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5562230Z","2025-11-19 22:37:26.5562230Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\twinapi.appcore.dll",,,,,,,,,,,,,,,,1763591846556223000,,,,,140712720924672,140712720924672,2401519,2375680,2646458233,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5572355Z","2025-11-19 22:37:26.5572355Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\msctf.dll",,,,,,,,,,,,,,,,1763591846557235500,,,,,140712893022208,140712893022208,1455420,1433600,4155718050,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5583165Z","2025-11-19 22:37:26.5583165Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084036182016,18446633084036157440,140712865112144,0,61841862656,956,1763591846558316500,61850255360,61850247168,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5587337Z","2025-11-19 22:37:26.5587337Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11964,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084032503808,18446633084032479232,140712899206080,0,61841870848,11720,1763591846558733800,61851303936,61851299840,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5591317Z","2025-11-19 22:37:26.5591317Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\Windows.UI.Xaml.dll",,,,,,,,,,,,,,,,1763591846559131700,,,,,140712596865024,140712596865024,17882163,17858560,706442395,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5595566Z","2025-11-19 22:37:26.5595566Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",5908,,," 6616 svchost.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591846559556600,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5599738Z","2025-11-19 22:37:26.5599738Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846559973800,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5599850Z","2025-11-19 22:37:26.5599850Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\iertutil.dll",,,,,,,,,,,,,,,,1763591846559985000,,,,,140712642805760,140712642805760,2984761,2904064,3815768453,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5601623Z","2025-11-19 22:37:26.5601623Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",5908,,," 6616 svchost.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591846560162400,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5603646Z","2025-11-19 22:37:26.5603646Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",4128,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\netutils.dll",,,,,,,,,,,,,,,,1763591846560364600,,,,,140712825847808,140712825847808,80696,53248,865845000,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5605341Z","2025-11-19 22:37:26.5605341Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",7992,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\srvcli.dll",,,,,,,,,,,,,,,,1763591846560534100,,,,,140712668954624,140712668954624,181029,167936,239922031,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5605512Z","2025-11-19 22:37:26.5605512Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846560551200,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5606967Z","2025-11-19 22:37:26.5606967Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\CorePrivacySettingsStore.dll",,,,,,,,,,,,,,,,1763591846560696700,,,,,140712456290304,140712456290304,263379,196608,2978004593,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5628270Z","2025-11-19 22:37:26.5628270Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,,,,,,,1763591846562827000,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5639203Z","2025-11-19 22:37:26.5639203Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6616 svchost.exe",5908,,," 6616 svchost.exe",,,,,,,,,,,,,18446633084034744320,18446633084034719744,140712899206080,0,816038662144,12396,1763591846563920300,816040116224,816040083456,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5639954Z","2025-11-19 22:37:26.5639954Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6616 svchost.exe",12396,,," 6616 svchost.exe",,,,,,,,,,,,,18446633084031729664,18446633084031705088,140712899206080,0,816038670336,13720,1763591846563995400,816040640512,816040607744,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5640851Z","2025-11-19 22:37:26.5640851Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6616 svchost.exe",13720,,," 6616 svchost.exe",,,,,,,,,,,,,18446633084036268032,18446633084036243456,140712899206080,0,816038678528,10796,1763591846564085200,816041164800,816041132032,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5641175Z","2025-11-19 22:37:26.5641175Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\execmodelproxy.dll",,,,,,,,,,,,,,,,1763591846564117500,,,,,140712462647296,140712462647296,123398,81920,3588866498,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5642306Z","2025-11-19 22:37:26.5642306Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",5908,,," 6616 svchost.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591846564230600,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5642606Z","2025-11-19 22:37:26.5642606Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846564260600,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5643518Z","2025-11-19 22:37:26.5643518Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",12396,,," 6616 svchost.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591846564351800,,,,,2495699353600,2495699353600,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5644087Z","2025-11-19 22:37:26.5644087Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 6616 svchost.exe",12396,,," 6616 svchost.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591846564408700,,,,,2495699353600,2495699353600,1436013,1368064,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5644825Z","2025-11-19 22:37:26.5644825Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",13720,,," 6616 svchost.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591846564482600,,,,,2495700729856,2495700729856,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5645458Z","2025-11-19 22:37:26.5645458Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 6616 svchost.exe",13720,,," 6616 svchost.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591846564545800,,,,,2495700729856,2495700729856,1436013,1368064,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5650838Z","2025-11-19 22:37:26.5650838Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846565083800,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5651222Z","2025-11-19 22:37:26.5651222Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",8664,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084036325376,18446633084036300800,140712899206080,0,199841366016,4344,1763591846565122200,199849672704,199849664512,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5655740Z","2025-11-19 22:37:26.5655740Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",5908,,," 6616 svchost.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,,,,,,,1763591846565574000,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5657805Z","2025-11-19 22:37:26.5657805Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11964,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084035866624,18446633084035842048,140712899206080,0,61841879040,496,1763591846565780500,61852352512,61852348416,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5659128Z","2025-11-19 22:37:26.5659128Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",13720,,," 6616 svchost.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591846565912800,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5661966Z","2025-11-19 22:37:26.5661966Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11964,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\OneCoreUAPCommonProxyStub.dll",,,,,,,,,,,,,,,,1763591846566196600,,,,,140712713977856,140712713977856,6740758,6615040,2011948997,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5670887Z","2025-11-19 22:37:26.5670887Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",5908,,," 6616 svchost.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591846567088700,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5673494Z","2025-11-19 22:37:26.5673494Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2688 svchost.exe",14020,,," 2688 svchost.exe",,,,,,,,,,,,,18446633084036354048,18446633084036329472,140712899206080,13,461860601856,4036,1763591846567349400,461863124992,461863059456,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5674619Z","2025-11-19 22:37:26.5674619Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",10796,,," 6616 svchost.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591846567461900,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5682237Z","2025-11-19 22:37:26.5682237Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,,,,,,,1763591846568223800,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5685445Z","2025-11-19 22:37:26.5685445Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084036698112,18446633084036673536,140712891545280,0,61841887232,11644,1763591846568544500,61853401088,61853396992,140712891545280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5687278Z","2025-11-19 22:37:26.5687278Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",5908,,," 6616 svchost.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,,,,,,,1763591846568727800,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5690351Z","2025-11-19 22:37:26.5690351Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\Windows.UI.dll",,,,,,,,,,,,,,,,1763591846569035100,,,,,140712615346176,140712615346176,1414164,1376256,3301850593,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5691801Z","2025-11-19 22:37:26.5691801Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846569180100,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5699282Z","2025-11-19 22:37:26.5699282Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\CoreMessaging.dll",,,,,,,,,,,,,,,,1763591846569928200,,,,,140712796160000,140712796160000,1232710,1208320,2155847221,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5702098Z","2025-11-19 22:37:26.5702098Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",5908,,," 6616 svchost.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591846570209800,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5703114Z","2025-11-19 22:37:26.5703114Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846570311400,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5705948Z","2025-11-19 22:37:26.5705948Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",13720,,," 6616 svchost.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591846570594800,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5708784Z","2025-11-19 22:37:26.5708784Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",10796,,," 6616 svchost.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591846570878400,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5721072Z","2025-11-19 22:37:26.5721072Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",12396,,," 6616 svchost.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591846572107200,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5723892Z","2025-11-19 22:37:26.5723892Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",10796,,," 6616 svchost.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591846572389200,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5724418Z","2025-11-19 22:37:26.5724418Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\uxtheme.dll",,,,,,,,,,,,,,,,1763591846572441800,,,,,140712802254848,140712802254848,696534,696320,1695798817,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5725585Z","2025-11-19 22:37:26.5725585Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",12432,,," 5184 explorer.exe",,,,,,,,,,,,,18446633084036382720,18446633084036358144,140712891292720,0,15376384,5476,1763591846572558500,470876160,470818816,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5747335Z","2025-11-19 22:37:26.5747335Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\urlmon.dll",,,,,,,,,,,,,,,,1763591846574733500,,,,,140712669609984,140712669609984,1970671,1957888,260716450,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5747902Z","2025-11-19 22:37:26.5747902Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",5908,,," 6616 svchost.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591846574790200,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5748669Z","2025-11-19 22:37:26.5748669Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,,,,,,,1763591846574866900,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5749286Z","2025-11-19 22:37:26.5749286Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846574928600,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5750931Z","2025-11-19 22:37:26.5750931Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",13260,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\windows.storage.dll",,,,,,,,,,,,,,,,1763591846575093100,,,,,140712812412928,140712812412928,8877403,8769536,3667346596,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5755393Z","2025-11-19 22:37:26.5755393Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846575539300,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5758335Z","2025-11-19 22:37:26.5758335Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1016 services.exe",2816,,," 1016 services.exe",,,,,,,,,,,,,18446633084035379200,18446633084035354624,140712899206080,0,156998311936,13420,1763591846575833500,157000663040,157000630272,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5761292Z","2025-11-19 22:37:26.5761292Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 6616 svchost.exe",,,,,,,,,,,,,18446633084027592704,18446633084027568128,140712899206080,0,816038686720,14644,1763591846576129200,816041689088,816041656320,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5762722Z","2025-11-19 22:37:26.5762722Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6616 svchost.exe",5908,,," 6616 svchost.exe",,,,,,,,,,,,,18446633084036870144,18446633084036845568,140712863364608,0,816038694912,6360,1763591846576272200,816042213376,816042180608,140712863364608,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5766200Z","2025-11-19 22:37:26.5766200Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",6360,,," 6616 svchost.exe",,,"C:\Windows\System32\ClipSVC.dll",,,,,,,,,,,,,,,,1763591846576620000,,,,,140711799947264,140711799947264,995492,937984,2750693646,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5768886Z","2025-11-19 22:37:26.5768886Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",10796,,," 6616 svchost.exe",,,"C:\Windows\System32\cryptxml.dll",,,,,,,,,,,,,,,,1763591846576888600,,,,,140712699756544,140712699756544,221698,167936,777793652,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5769277Z","2025-11-19 22:37:26.5769277Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",12396,,," 6616 svchost.exe",,,"C:\Windows\System32\wldp.dll",,,,,,,,,,,,,,,,1763591846576927700,,,,,140712840134656,140712840134656,483686,413696,393104014,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5769914Z","2025-11-19 22:37:26.5769914Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",6360,,," 6616 svchost.exe",,,"C:\Windows\System32\cfgmgr32.dll",,,,,,,,,,,,,,,,1763591846576991400,,,,,140712845049856,140712845049856,385808,356352,1737777300,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5779044Z","2025-11-19 22:37:26.5779044Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",13720,,," 6616 svchost.exe",,,"C:\Windows\System32\webservices.dll",,,,,,,,,,,,,,,,1763591846577904400,,,,,140712626225152,140712626225152,1516689,1454080,24987314,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5780367Z","2025-11-19 22:37:26.5780367Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846578036700,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5785558Z","2025-11-19 22:37:26.5785558Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846578555800,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5785928Z","2025-11-19 22:37:26.5785928Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",12396,,," 6616 svchost.exe",,,"C:\Windows\System32\bcrypt.dll",,,,,,,,,,,,,,,,1763591846578592800,,,,,140712848654336,140712848654336,206048,172032,2893678010,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5790575Z","2025-11-19 22:37:26.5790575Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084036726784,18446633084036702208,140712600145104,0,61841895424,11252,1763591846579057600,61854449664,61854445568,140712600145104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5791074Z","2025-11-19 22:37:26.5791074Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084036841472,18446633084036816896,140712604173856,0,61841903616,12480,1763591846579107400,61855498240,61855494144,140712604173856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5795040Z","2025-11-19 22:37:26.5795040Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11252,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\dxgi.dll",,,,,,,,,,,,,,,,1763591846579504000,,,,,140712803631104,140712803631104,1320096,1282048,1861212996,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5797701Z","2025-11-19 22:37:26.5797701Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",4128,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\powrprof.dll",,,,,,,,,,,,,,,,1763591846579770100,,,,,140712848195584,140712848195584,457799,385024,2858637235,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5803771Z","2025-11-19 22:37:26.5803771Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11252,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\umpdc.dll",,,,,,,,,,,,,,,,1763591846580377100,,,,,140712848064512,140712848064512,98535,81920,1714427184,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5814009Z","2025-11-19 22:37:26.5814009Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11252,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\DXCore.dll",,,,,,,,,,,,,,,,1763591846581401000,,,,,140712805400576,140712805400576,331386,274432,2354081039,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5818322Z","2025-11-19 22:37:26.5818322Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11252,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\ResourcePolicyClient.dll",,,,,,,,,,,,,,,,1763591846581832200,,,,,140712809070592,140712809070592,104020,81920,2069163340,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5819795Z","2025-11-19 22:37:26.5819795Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6616 svchost.exe",14644,,," 6616 svchost.exe",,,,,,,,,,,,,18446633084037246976,18446633084037222400,140712899206080,31,816038703104,7752,1763591846581979500,816042737664,816042704896,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5822357Z","2025-11-19 22:37:26.5822357Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6616 svchost.exe",6360,,," 6616 svchost.exe",,,,,,,,,,,,,18446633084036870144,18446633084036845568,140712863364608,0,816038694912,6360,1763591846582235700,816042213376,816042180608,140712863364608,10158747,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5824665Z","2025-11-19 22:37:26.5824665Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",14644,,," 6616 svchost.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,,,,,,,1763591846582466500,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5828577Z","2025-11-19 22:37:26.5828577Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846582857700,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5833239Z","2025-11-19 22:37:26.5833239Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","14660 CalculatorApp.exe",11252,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\ResourcePolicyClient.dll",,,,,,,,,,,,,,,,1763591846583323900,,,,,140712809070592,140712809070592,104020,94208,2069163340,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5834574Z","2025-11-19 22:37:26.5834574Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846583457400,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5835698Z","2025-11-19 22:37:26.5835698Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11252,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\directxdatabasehelper.dll",,,,,,,,,,,,,,,,1763591846583569800,,,,,140712752709632,140712752709632,426573,405504,145563491,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5845291Z","2025-11-19 22:37:26.5845291Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11252,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\cfgmgr32.dll",,,,,,,,,,,,,,,,1763591846584529100,,,,,140712845049856,140712845049856,385808,356352,1737777300,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5850139Z","2025-11-19 22:37:26.5850139Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,,,,,,,1763591846585013900,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5864087Z","2025-11-19 22:37:26.5864087Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe\CalcViewModel.dll",,,,,,,,,,,,,,,,1763591846586408800,,,,,140711788806144,140711788806144,0,2224128,1758293703,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5867568Z","2025-11-19 22:37:26.5867568Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",4128,,,"14660 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.33519.0_x64__8wekyb3d8bbwe\concrt140_app.dll",,,,,,,,,,,,,,,,1763591846586756800,,,,,140712297758720,140712297758720,326544,303104,3173964004,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5867639Z","2025-11-19 22:37:26.5867639Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",13260,,,"14660 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.33519.0_x64__8wekyb3d8bbwe\vccorlib140_app.dll",,,,,,,,,,,,,,,,1763591846586763900,,,,,140712371159040,140712371159040,385886,335872,1316406955,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5868239Z","2025-11-19 22:37:26.5868239Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.33519.0_x64__8wekyb3d8bbwe\vcruntime140_1_app.dll",,,,,,,,,,,,,,,,1763591846586823900,,,,,140712543911936,140712543911936,99370,49152,606015248,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5868919Z","2025-11-19 22:37:26.5868919Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",7992,,,"14660 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.33519.0_x64__8wekyb3d8bbwe\msvcp140_app.dll",,,,,,,,,,,,,,,,1763591846586891900,,,,,140712297037824,140712297037824,626197,573440,3775341646,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5886424Z","2025-11-19 22:37:26.5886424Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11252,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\d3d11.dll",,,,,,,,,,,,,,,,1763591846588642400,,,,,140712786853888,140712786853888,2582658,2498560,2128032819,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5892768Z","2025-11-19 22:37:26.5892768Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\MrmCoreR.dll",,,,,,,,,,,,,,,,1763591846589276800,,,,,140712631926784,140712631926784,1191374,1146880,1078870765,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5899171Z","2025-11-19 22:37:26.5899171Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11252,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\d3d10warp.dll",,,,,,,,,,,,,,,,1763591846589917100,,,,,140712731869184,140712731869184,5958575,5943296,1147803111,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5903912Z","2025-11-19 22:37:26.5903912Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\Windows.StateRepositoryClient.dll",,,,,,,,,,,,,,,,1763591846590391300,,,,,140712696610816,140712696610816,303673,290816,424989122,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5921168Z","2025-11-19 22:37:26.5921168Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11252,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\d2d1.dll",,,,,,,,,,,,,,,,1763591846592116800,,,,,140712777744384,140712777744384,6610469,6537216,3013069957,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5926313Z","2025-11-19 22:37:26.5926313Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591846592631300,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5936153Z","2025-11-19 22:37:26.5936153Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11252,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\DWrite.dll",,,,,,,,,,,,,,,,1763591846593615300,,,,,140712784297984,140712784297984,2543119,2519040,1462185185,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5955621Z","2025-11-19 22:37:26.5955621Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\aepic.dll",,,,,,,,,,,,,,,,1763591846595562100,,,,,140712428109824,140712428109824,641436,577536,321124434,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5961071Z","2025-11-19 22:37:26.5961071Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\profapi.dll",,,,,,,,,,,,,,,,1763591846596107100,,,,,140712848850944,140712848850944,229548,167936,2447194521,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5966342Z","2025-11-19 22:37:26.5966342Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\AppXDeploymentClient.dll",,,,,,,,,,,,,,,,1763591846596634200,,,,,140712740257792,140712740257792,1575781,1499136,2615972959,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5967378Z","2025-11-19 22:37:26.5967378Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\imagehlp.dll",,,,,,,,,,,,,,,,1763591846596737800,,,,,140712892760064,140712892760064,200866,131072,2156568970,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5975316Z","2025-11-19 22:37:26.5975316Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\imagehlp.dll",,,,,,,,,,,,,,,,1763591846597531600,,,,,140712892760064,140712892760064,200866,143360,2156568970,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5975847Z","2025-11-19 22:37:26.5975847Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\AppXDeploymentClient.dll",,,,,,,,,,,,,,,,1763591846597584700,,,,,140712740257792,140712740257792,1575781,1511424,2615972959,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5988529Z","2025-11-19 22:37:26.5988529Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11252,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\TextShaping.dll",,,,,,,,,,,,,,,,1763591846598852900,,,,,140712585789440,140712585789440,770155,733184,2109619091,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5994904Z","2025-11-19 22:37:26.5994904Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\BCP47mrm.dll",,,,,,,,,,,,,,,,1763591846599490400,,,,,140712628322304,140712628322304,278903,212992,835504572,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6006887Z","2025-11-19 22:37:26.6006887Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",7752,,," 6616 svchost.exe",,,"C:\Windows\System32\winbrand.dll",,,,,,,,,,,,,,,,1763591846600688700,,,,,140712543649792,140712543649792,256572,225280,2043489911,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6008547Z","2025-11-19 22:37:26.6008547Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","14660 CalculatorApp.exe",11252,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084036726784,18446633084036702208,140712600145104,0,61841895424,11252,1763591846600854700,61854449664,61854420992,140712600145104,59786572,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6011225Z","2025-11-19 22:37:26.6011225Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\AppXDeploymentClient.dll",,,,,,,,,,,,,,,,1763591846601122500,,,,,140712740257792,140712740257792,1575781,1499136,2615972959,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6012220Z","2025-11-19 22:37:26.6012220Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\imagehlp.dll",,,,,,,,,,,,,,,,1763591846601222000,,,,,140712892760064,140712892760064,200866,131072,2156568970,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6019054Z","2025-11-19 22:37:26.6019054Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\imagehlp.dll",,,,,,,,,,,,,,,,1763591846601905400,,,,,140712892760064,140712892760064,200866,143360,2156568970,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6019518Z","2025-11-19 22:37:26.6019518Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\AppXDeploymentClient.dll",,,,,,,,,,,,,,,,1763591846601951800,,,,,140712740257792,140712740257792,1575781,1511424,2615972959,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6041470Z","2025-11-19 22:37:26.6041470Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 7916 svchost.exe",,,,,,,,,,,,,18446633084036726784,18446633084036702208,140712899206080,0,401963515904,13956,1763591846604147000,401965842432,401965809664,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6044711Z","2025-11-19 22:37:26.6044711Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 7916 svchost.exe",13956,,," 7916 svchost.exe",,,,,,,,,,,,,18446633084037013504,18446633084036988928,140712899206080,90,401963524096,14624,1763591846604471100,401966366720,401966333952,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6060394Z","2025-11-19 22:37:26.6060394Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2992 svchost.exe",8856,,," 2992 svchost.exe",,,,,,,,,,,,,18446633084036612096,18446633084036587520,140712899206080,186,170617462784,332,1763591846606039500,170619568128,170619535360,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6060619Z","2025-11-19 22:37:26.6060619Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3204 Taskmgr.exe",5876,,," 3204 Taskmgr.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,,,,,,,1763591846606061900,,,,,140712479096832,140712479096832,1613415,1552384,2231457550,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6061470Z","2025-11-19 22:37:26.6061470Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084037304320,18446633084037279744,140712632221632,0,61841911808,12900,1763591846606147000,61854449664,61854445568,140712632221632,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6063648Z","2025-11-19 22:37:26.6063648Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846606364800,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6065952Z","2025-11-19 22:37:26.6065952Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3204 Taskmgr.exe",5876,,," 3204 Taskmgr.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,,,,,,,1763591846606595200,,,,,140712479096832,140712479096832,1613415,1564672,2231457550,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6069040Z","2025-11-19 22:37:26.6069040Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846606904100,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6106366Z","2025-11-19 22:37:26.6106366Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.8_8.2501.31001.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.dll",,,,,,,,,,,,,,,,1763591846610636600,,,,,140710095028224,140710095028224,5866761,5873664,2056920596,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6129928Z","2025-11-19 22:37:26.6129928Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe\GraphControl.dll",,,,,,,,,,,,,,,,1763591846612992900,,,,,140711891632128,140711891632128,0,761856,1758293638,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6179798Z","2025-11-19 22:37:26.6179798Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2960 svchost.exe",4584,,," 2960 svchost.exe",,,,,,,,,,,,,18446633084037156864,18446633084037132288,140712899206080,287,403329839104,11740,1763591846617979800,403332661248,403332628480,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6188438Z","2025-11-19 22:37:26.6188438Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2960 svchost.exe",11740,,," 2960 svchost.exe",,,,,,,,,,,,,18446633084031815680,18446633084031791104,140712899206080,287,403329847296,13172,1763591846618843800,403333185536,403333152768,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6189176Z","2025-11-19 22:37:26.6189176Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2960 svchost.exe",11740,,," 2960 svchost.exe",,,,,,,,,,,,,18446633084037332992,18446633084037308416,140712891292720,287,403329855488,11772,1763591846618917600,403333709824,403333677056,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6193177Z","2025-11-19 22:37:26.6193177Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2992 svchost.exe",14440,,," 2992 svchost.exe",,,,,,,,,,,,,18446633084037476352,18446633084037451776,140712899206080,186,170617470976,11856,1763591846619317700,170620092416,170620059648,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6203665Z","2025-11-19 22:37:26.6203665Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\Windows.UI.Xaml.Controls.dll",,,,,,,,,,,,,,,,1763591846620366500,,,,,140712586575872,140712586575872,3327252,3313664,3689468694,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6255431Z","2025-11-19 22:37:26.6255431Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\msctf.dll",,,,,,,,,,,,,,,,1763591846625543100,,,,,140712893022208,140712893022208,1455420,1433600,4155718050,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6277330Z","2025-11-19 22:37:26.6277330Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11964,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\Windows.Shell.ServiceHostBuilder.dll",,,,,,,,,,,,,,,,1763591846627733000,,,,,140712531066880,140712531066880,142966,126976,3904637359,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6289816Z","2025-11-19 22:37:26.6289816Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11964,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\CoreUIComponents.dll",,,,,,,,,,,,,,,,1763591846628981600,,,,,140712742944768,140712742944768,3046501,3022848,801552868,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6354473Z","2025-11-19 22:37:26.6354473Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846635447300,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6362114Z","2025-11-19 22:37:26.6362114Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846636211400,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6369089Z","2025-11-19 22:37:26.6369089Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\InputHost.dll",,,,,,,,,,,,,,,,1763591846636909000,,,,,140712583757824,140712583757824,1989124,1970176,2937052880,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6372769Z","2025-11-19 22:37:26.6372769Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846637276900,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6379103Z","2025-11-19 22:37:26.6379103Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846637910300,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6381420Z","2025-11-19 22:37:26.6381420Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\cryptbase.dll",,,,,,,,,,,,,,,,1763591846638142000,,,,,140712839348224,140712839348224,63718,49152,3897879906,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6394566Z","2025-11-19 22:37:26.6394566Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846639456600,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6400935Z","2025-11-19 22:37:26.6400935Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846640093500,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6410045Z","2025-11-19 22:37:26.6410045Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\netapi32.dll",,,,,,,,,,,,,,,,1763591846641004500,,,,,140712696348672,140712696348672,171999,106496,898597876,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6412559Z","2025-11-19 22:37:26.6412559Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\dsreg.dll",,,,,,,,,,,,,,,,1763591846641255900,,,,,140712764768256,140712764768256,1520707,1466368,4143332483,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6414776Z","2025-11-19 22:37:26.6414776Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",8368,,," 5252 WerFault.exe",,,"C:\Windows\System32\userenv.dll",,,,,,,,,,,,,,,,1763591846641477600,,,,,140712837054464,140712837054464,245008,176128,731547084,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6418554Z","2025-11-19 22:37:26.6418554Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\crypt32.dll",,,,,,,,,,,,,,,,1763591846641855400,,,,,140712849768448,140712849768448,1584869,1536000,3438168074,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6422521Z","2025-11-19 22:37:26.6422521Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084036497408,18446633084036472832,140712899206080,0,295361245184,12560,1763591846642252100,295364460544,295364452352,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6428469Z","2025-11-19 22:37:26.6428469Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\profapi.dll",,,,,,,,,,,,,,,,1763591846642846900,,,,,140712848850944,140712848850944,229548,167936,2447194521,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6454813Z","2025-11-19 22:37:26.6454813Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846645481300,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6460449Z","2025-11-19 22:37:26.6460449Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846646044900,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6467946Z","2025-11-19 22:37:26.6467946Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3232 dllhost.exe",,,,,,,,,,,,,18446633084037763072,18446633084037738496,140712899206080,0,493780992000,10288,1763591846646794600,493783875584,493783842816,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6476504Z","2025-11-19 22:37:26.6476504Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\UiaManager.dll",,,,,,,,,,,,,,,,1763591846647650400,,,,,140712461205504,140712461205504,941078,897024,2628067039,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6483813Z","2025-11-19 22:37:26.6483813Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846648381300,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6491669Z","2025-11-19 22:37:26.6491669Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846649166900,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6496679Z","2025-11-19 22:37:26.6496679Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084037533696,18446633084037509120,140712891292720,0,61841920000,12588,1763591846649667900,61856546816,61856542720,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6502376Z","2025-11-19 22:37:26.6502376Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\WindowManagementAPI.dll",,,,,,,,,,,,,,,,1763591846650237600,,,,,140712738422784,140712738422784,1825044,1794048,1605274449,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6521536Z","2025-11-19 22:37:26.6521536Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846652153700,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6528598Z","2025-11-19 22:37:26.6528598Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4340 sihost.exe",4288,,," 4340 sihost.exe",,,,,,,,,,,,,18446633083999285248,18446633083999260672,140712891292720,0,645640036352,4748,1763591846652859800,645646516224,645646508032,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6529159Z","2025-11-19 22:37:26.6529159Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846652915900,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6562562Z","2025-11-19 22:37:26.6562562Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846656256200,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6570449Z","2025-11-19 22:37:26.6570449Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846657044900,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6571279Z","2025-11-19 22:37:26.6571279Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\Windows.UI.Core.TextInput.dll",,,,,,,,,,,,,,,,1763591846657127900,,,,,140712572354560,140712572354560,1511216,1499136,21441667,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6576227Z","2025-11-19 22:37:26.6576227Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\TextInputFramework.dll",,,,,,,,,,,,,,,,1763591846657622800,,,,,140712628846592,140712628846592,1374424,1339392,3535451269,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6596334Z","2025-11-19 22:37:26.6596334Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846659633400,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6602346Z","2025-11-19 22:37:26.6602346Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846660234700,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6624134Z","2025-11-19 22:37:26.6624134Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846662413400,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6632147Z","2025-11-19 22:37:26.6632147Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846663214700,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6670494Z","2025-11-19 22:37:26.6670494Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846667049400,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6683190Z","2025-11-19 22:37:26.6683190Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846668319000,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6707208Z","2025-11-19 22:37:26.6707208Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846670720800,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6714648Z","2025-11-19 22:37:26.6714648Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846671464800,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6724458Z","2025-11-19 22:37:26.6724458Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\Windows.UI.Immersive.dll",,,,,,,,,,,,,,,,1763591846672445800,,,,,140712595423232,140712595423232,1424120,1372160,1559948871,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6732346Z","2025-11-19 22:37:26.6732346Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846673234600,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6736820Z","2025-11-19 22:37:26.6736820Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\DataExchange.dll",,,,,,,,,,,,,,,,1763591846673682100,,,,,140712406614016,140712406614016,399312,368640,696309968,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6737187Z","2025-11-19 22:37:26.6737187Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846673718700,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6791641Z","2025-11-19 22:37:26.6791641Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",8500,,," 1040 svchost.exe",,,,,,,,,,,,,18446633084036870144,18446633084036845568,140712899206080,0,256031064064,12504,1763591846679164100,256038141952,256038109184,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6794671Z","2025-11-19 22:37:26.6794671Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084036669440,18446633084036644864,140712899206080,0,61841928192,11328,1763591846679467100,61857595392,61857591296,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6826487Z","2025-11-19 22:37:26.6826487Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\Windows.Storage.ApplicationData.dll",,,,,,,,,,,,,,,,1763591846682648800,,,,,140712299528192,140712299528192,453266,393216,843877859,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6832366Z","2025-11-19 22:37:26.6832366Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084037619712,18446633084037595136,140712865112144,0,61841936384,336,1763591846683236600,61858643968,61858635776,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6839927Z","2025-11-19 22:37:26.6839927Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8972 VBoxTray.exe",9020,,," 8972 VBoxTray.exe",,,,,,,,,,,,,18446633084036812800,18446633084036788224,140700131109808,0,471283204096,6380,1763591846683992700,471299260416,471299256320,140700131109808,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6842196Z","2025-11-19 22:37:26.6842196Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8972 VBoxTray.exe",6380,,," 8972 VBoxTray.exe",,,,,,,,,,,,,18446633084036812800,18446633084036788224,140700131109808,0,471283204096,6380,1763591846684219600,471299260416,471299252224,140700131109808,481308,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6984934Z","2025-11-19 22:37:26.6984934Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\psapi.dll",,,,,,,,,,,,,,,,1763591846698493400,,,,,140712898396160,140712898396160,102773,32768,992462114,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6990224Z","2025-11-19 22:37:26.6990224Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\version.dll",,,,,,,,,,,,,,,,1763591846699022400,,,,,140712753168384,140712753168384,72452,45056,2275202464,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7146538Z","2025-11-19 22:37:26.7146538Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084037562368,18446633084037537792,140712297841152,0,61841944576,9644,1763591846714653900,61859692544,61859688448,140712297841152,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7152683Z","2025-11-19 22:37:26.7152683Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\Windows.Globalization.dll",,,,,,,,,,,,,,,,1763591846715268300,,,,,140712593457152,140712593457152,1640332,1634304,3240919660,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7193732Z","2025-11-19 22:37:26.7193732Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\verifier.dll",,,,,,,,,,,,,,,,1763591846719373200,,,,,140712384724992,140712384724992,444365,466944,1438812236,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7199842Z","2025-11-19 22:37:26.7199842Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\verifier.dll",,,,,,,,,,,,,,,,1763591846719984200,,,,,140712384724992,140712384724992,444365,479232,1438812236,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7200159Z","2025-11-19 22:37:26.7200159Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\psapi.dll",,,,,,,,,,,,,,,,1763591846720015900,,,,,140712898396160,140712898396160,102773,45056,992462114,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7201002Z","2025-11-19 22:37:26.7201002Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\version.dll",,,,,,,,,,,,,,,,1763591846720100200,,,,,140712753168384,140712753168384,72452,57344,2275202464,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7222332Z","2025-11-19 22:37:26.7222332Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846722233200,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7228469Z","2025-11-19 22:37:26.7228469Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846722846900,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7251297Z","2025-11-19 22:37:26.7251297Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\windows.storage.dll",,,,,,,,,,,,,,,,1763591846725129700,,,,,140712812412928,140712812412928,8877403,8769536,3667346596,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7266237Z","2025-11-19 22:37:26.7266237Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\shlwapi.dll",,,,,,,,,,,,,,,,1763591846726623700,,,,,140712868839424,140712868839424,479562,421888,2142510382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7291634Z","2025-11-19 22:37:26.7291634Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846729163400,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7306677Z","2025-11-19 22:37:26.7306677Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846730667700,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7332830Z","2025-11-19 22:37:26.7332830Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846733283000,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7343499Z","2025-11-19 22:37:26.7343499Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846734350000,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7392655Z","2025-11-19 22:37:26.7392655Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\Windows.Globalization.Fontgroups.dll",,,,,,,,,,,,,,,,1763591846739265500,,,,,140712285044736,140712285044736,126310,86016,2401575024,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7397918Z","2025-11-19 22:37:26.7397918Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",7992,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\BCP47Langs.dll",,,,,,,,,,,,,,,,1763591846739791900,,,,,140712631468032,140712631468032,402331,385024,2065030180,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7412504Z","2025-11-19 22:37:26.7412504Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",336,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\fontgroupsoverride.dll",,,,,,,,,,,,,,,,1763591846741250400,,,,,140712536702976,140712536702976,84550,45056,3684684608,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7427338Z","2025-11-19 22:37:26.7427338Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 9692 PerfWatson2.exe",9752,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084037992448,18446633084037967872,140711612509856,0,1046354432000,13872,1763591846742733800,1046352232448,1046352216064,140711612509856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7476332Z","2025-11-19 22:37:26.7476332Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\dcomp.dll",,,,,,,,,,,,,,,,1763591846747633300,,,,,140712789409792,140712789409792,2309196,2240512,1200801128,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7480223Z","2025-11-19 22:37:26.7480223Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",7992,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\Microsoft.Internal.WarpPal.dll",,,,,,,,,,,,,,,,1763591846748022300,,,,,140712769683456,140712769683456,167600,102400,2132685858,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7497547Z","2025-11-19 22:37:26.7497547Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\Windows.Energy.dll",,,,,,,,,,,,,,,,1763591846749754700,,,,,140712294088704,140712294088704,340121,335872,1240800996,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7597159Z","2025-11-19 22:37:26.7597159Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084038049792,18446633084038025216,140712899206080,0,513414856704,1652,1763591846759716000,513420558336,513420525568,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7629745Z","2025-11-19 22:37:26.7629745Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846762974500,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7639048Z","2025-11-19 22:37:26.7639048Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846763904800,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7669394Z","2025-11-19 22:37:26.7669394Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846766939400,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7675500Z","2025-11-19 22:37:26.7675500Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846767550000,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7676165Z","2025-11-19 22:37:26.7676165Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\Windows.ApplicationModel.dll",,,,,,,,,,,,,,,,1763591846767616500,,,,,140712508391424,140712508391424,945679,876544,2857312343,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7682249Z","2025-11-19 22:37:26.7682249Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846768224900,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7683160Z","2025-11-19 22:37:26.7683160Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\Windows.Graphics.dll",,,,,,,,,,,,,,,,1763591846768316100,,,,,140712711225344,140712711225344,669723,593920,1068018205,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7686818Z","2025-11-19 22:37:26.7686818Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846768681800,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7695232Z","2025-11-19 22:37:26.7695232Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846769523200,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7699525Z","2025-11-19 22:37:26.7699525Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846769952500,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7708157Z","2025-11-19 22:37:26.7708157Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,,,,,,,1763591846770815700,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7718337Z","2025-11-19 22:37:26.7718337Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\netprofm.dll",,,,,,,,,,,,,,,,1763591846771833700,,,,,140712762802176,140712762802176,450621,450560,2204449876,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7736710Z","2025-11-19 22:37:26.7736710Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084038164480,18446633084038139904,140712865112144,0,295361253376,1248,1763591846773671100,295364984832,295364976640,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7738817Z","2025-11-19 22:37:26.7738817Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084038193152,18446633084038168576,140712899206080,0,295361261568,10204,1763591846773881700,295365509120,295365500928,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7740150Z","2025-11-19 22:37:26.7740150Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5252 WerFault.exe",10204,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084038221824,18446633084038197248,140712899206080,0,295361269760,8320,1763591846774015000,295366033408,295366025216,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7760840Z","2025-11-19 22:37:26.7760840Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\npmproxy.dll",,,,,,,,,,,,,,,,1763591846776084000,,,,,140712730820608,140712730820608,124253,102400,1533975845,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7785884Z","2025-11-19 22:37:26.7785884Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\netprofm.dll",,,,,,,,,,,,,,,,1763591846778588400,,,,,140712762802176,140712762802176,450621,462848,2204449876,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7786556Z","2025-11-19 22:37:26.7786556Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\npmproxy.dll",,,,,,,,,,,,,,,,1763591846778655700,,,,,140712730820608,140712730820608,124253,114688,1533975845,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7789758Z","2025-11-19 22:37:26.7789758Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\xmllite.dll",,,,,,,,,,,,,,,,1763591846778975800,,,,,140712684027904,140712684027904,342897,274432,974526834,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7804135Z","2025-11-19 22:37:26.7804135Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,,,,,,,1763591846780413500,,,,,140712426930176,140712426930176,1213372,1146880,2699219668,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7810252Z","2025-11-19 22:37:26.7810252Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846781025200,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7817359Z","2025-11-19 22:37:26.7817359Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846781735900,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7817975Z","2025-11-19 22:37:26.7817975Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,,,,,,,1763591846781797500,,,,,140712426930176,140712426930176,1213372,1159168,2699219668,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7824319Z","2025-11-19 22:37:26.7824319Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,,,,,,,1763591846782431900,,,,,140712426930176,140712426930176,1213372,1146880,2699219668,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7839217Z","2025-11-19 22:37:26.7839217Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\WinRtTracing.dll",,,,,,,,,,,,,,,,1763591846783921700,,,,,140712799240192,140712799240192,246648,212992,1391536235,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7848612Z","2025-11-19 22:37:26.7848612Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe\TraceLogging.dll",,,,,,,,,,,,,,,,1763591846784861200,,,,,140712633171968,140712633171968,0,49152,1758293586,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7933603Z","2025-11-19 22:37:26.7933603Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,,,,,,,1763591846793360300,,,,,140712531263488,140712531263488,1042724,999424,915912993,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7980583Z","2025-11-19 22:37:26.7980583Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,,,,,,,1763591846798058400,,,,,140712531263488,140712531263488,1042724,1011712,915912993,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7981935Z","2025-11-19 22:37:26.7981935Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,,,,,,,1763591846798193500,,,,,140712426930176,140712426930176,1213372,1159168,2699219668,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7985225Z","2025-11-19 22:37:26.7985225Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,,,,,,,1763591846798522500,,,,,140712531263488,140712531263488,1042724,999424,915912993,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7996185Z","2025-11-19 22:37:26.7996185Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\Windows.UI.Xaml.Phone.dll",,,,,,,,,,,,,,,,1763591846799618500,,,,,140712592146432,140712592146432,1295254,1273856,3672194386,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8273760Z","2025-11-19 22:37:26.8273760Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\MrmCoreR.dll",,,,,,,,,,,,,,,,1763591846827376000,,,,,140712631926784,140712631926784,1191374,1146880,1078870765,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8276243Z","2025-11-19 22:37:26.8276243Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\UserMgrProxy.dll",,,,,,,,,,,,,,,,1763591846827624300,,,,,140712724660224,140712724660224,390456,393216,1431596644,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8281259Z","2025-11-19 22:37:26.8281259Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\Windows.StateRepositoryClient.dll",,,,,,,,,,,,,,,,1763591846828125900,,,,,140712696610816,140712696610816,303673,290816,424989122,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8294137Z","2025-11-19 22:37:26.8294137Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\BCP47mrm.dll",,,,,,,,,,,,,,,,1763591846829413700,,,,,140712628322304,140712628322304,278903,212992,835504572,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8295620Z","2025-11-19 22:37:26.8295620Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\directmanipulation.dll",,,,,,,,,,,,,,,,1763591846829562000,,,,,140712583036928,140712583036928,714070,667648,3434535107,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8302231Z","2025-11-19 22:37:26.8302231Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084038135808,18446633084038111232,140712583404848,0,61841952768,5400,1763591846830223100,61860741120,61860737024,140712583404848,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8304318Z","2025-11-19 22:37:26.8304318Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\Windows.UI.dll",,,,,,,,,,,,,,,,1763591846830431800,,,,,140712615346176,140712615346176,1414164,1376256,3301850593,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8306661Z","2025-11-19 22:37:26.8306661Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11720,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084038279168,18446633084038254592,140712899206080,0,61841960960,8356,1763591846830666100,61861789696,61861785600,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8317076Z","2025-11-19 22:37:26.8317076Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\threadpoolwinrt.dll",,,,,,,,,,,,,,,,1763591846831707600,,,,,140712555839488,140712555839488,130107,90112,2299561022,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8318294Z","2025-11-19 22:37:26.8318294Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3812 calc.exe",14584,,," 3812 calc.exe",,,,,,,,,,,,,18446633084032331776,18446633084032307200,140712899206080,0,801455407104,14584,1763591846831829400,801457045504,801457037312,140712899206080,3186210,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8318295Z","2025-11-19 22:37:26.8318295Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3812 calc.exe",3100,,," 3812 calc.exe",,,,,,,,,,,,,18446633084033368064,18446633084033343488,140712899206080,0,801455448064,3100,1763591846831829600,801459666944,801459658752,140712899206080,817389,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8318300Z","2025-11-19 22:37:26.8318300Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3812 calc.exe",6196,,," 3812 calc.exe",,,,,,,,,,,,,18446633084032389120,18446633084032364544,140712899206080,0,801455415296,6196,1763591846831830000,801457569792,801457557504,140712899206080,7141150,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8318304Z","2025-11-19 22:37:26.8318304Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3812 calc.exe",6204,,," 3812 calc.exe",,,,,,,,,,,,,18446633084032417792,18446633084032393216,140712891545280,0,801455423488,6204,1763591846831830400,801458094080,801458061312,140712891545280,149400621,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8318384Z","2025-11-19 22:37:26.8318384Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3812 calc.exe",2088,,," 3812 calc.exe",,,,,,,,,,,,,18446633084033224704,18446633084033200128,140712865112144,0,801455431680,2088,1763591846831838400,801458618368,801458610176,140712865112144,228960,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8318411Z","2025-11-19 22:37:26.8318411Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3812 calc.exe",652,,," 3812 calc.exe",,,,,,,,,,,,,18446633084033310720,18446633084033286144,140712899206080,0,801455439872,652,1763591846831841100,801459142656,801459134464,140712899206080,531097,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8318477Z","2025-11-19 22:37:26.8318477Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3812 calc.exe",7976,,," 3812 calc.exe",,,,,,,,,,,,,18446633084032274432,18446633084032249856,140712899206080,0,801455398912,7976,1763591846831847700,801456521216,801456513024,140712899206080,4943957,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8320938Z","2025-11-19 22:37:26.8320938Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084032417792,18446633084032393216,140712899206080,0,61841969152,13376,1763591846832093800,61862838272,61862834176,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8329418Z","2025-11-19 22:37:26.8329418Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\WindowsCodecs.dll",,,,,,,,,,,,,,,,1763591846832941800,,,,,140712775385088,140712775385088,2352359,2293760,3466818398,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8332758Z","2025-11-19 22:37:26.8332758Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3812 calc.exe",10660,,," 3812 calc.exe",,,,,,,,,,,,,18446633084032245760,18446633084032221184,140696878126912,0,801455390720,10660,1763591846833275800,801453899776,801453879296,140696878126912,40536930,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8341599Z","2025-11-19 22:37:26.8341599Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\calc.exe",,,,,,,,,,,,,,,,1763591846834159900,,,,,140696878120960,140696878120960,90741,49152,4001445627,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8341708Z","2025-11-19 22:37:26.8341708Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\ieframe.dll",,,,,,,,,,,,,,,,1763591846834170800,,,,,140710222364672,140710222364672,7531896,7499776,575051316,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8341923Z","2025-11-19 22:37:26.8341923Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\mlang.dll",,,,,,,,,,,,,,,,1763591846834192300,,,,,140712293761024,140712293761024,318858,278528,3734874788,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8342112Z","2025-11-19 22:37:26.8342112Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\twinui.appcore.dll",,,,,,,,,,,,,,,,1763591846834211200,,,,,140712458059776,140712458059776,827472,806912,3228774028,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8342249Z","2025-11-19 22:37:26.8342249Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\edputil.dll",,,,,,,,,,,,,,,,1763591846834224900,,,,,140712471560192,140712471560192,178059,167936,3474529356,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8342332Z","2025-11-19 22:37:26.8342332Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,,,,,,,1763591846834233200,,,,,140712479096832,140712479096832,1613415,1552384,2231457550,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8342381Z","2025-11-19 22:37:26.8342381Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\Windows.UI.dll",,,,,,,,,,,,,,,,1763591846834238100,,,,,140712615346176,140712615346176,1414164,1376256,3301850593,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8342427Z","2025-11-19 22:37:26.8342427Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\BCP47mrm.dll",,,,,,,,,,,,,,,,1763591846834242700,,,,,140712628322304,140712628322304,278903,212992,835504572,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8342483Z","2025-11-19 22:37:26.8342483Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\MrmCoreR.dll",,,,,,,,,,,,,,,,1763591846834248300,,,,,140712631926784,140712631926784,1191374,1146880,1078870765,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8342557Z","2025-11-19 22:37:26.8342557Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\iertutil.dll",,,,,,,,,,,,,,,,1763591846834255700,,,,,140712642805760,140712642805760,2984761,2904064,3815768453,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8342591Z","2025-11-19 22:37:26.8342591Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.7019_none_3e06ffa0e335b8a8\comctl32.dll",,,,,,,,,,,,,,,,1763591846834259100,,,,,140712659910656,140712659910656,2747780,2703360,4095768276,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8342650Z","2025-11-19 22:37:26.8342650Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\srvcli.dll",,,,,,,,,,,,,,,,1763591846834265000,,,,,140712668954624,140712668954624,181029,167936,239922031,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8342711Z","2025-11-19 22:37:26.8342711Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\urlmon.dll",,,,,,,,,,,,,,,,1763591846834271100,,,,,140712669609984,140712669609984,1970671,1957888,260716450,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8342846Z","2025-11-19 22:37:26.8342846Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\wininet.dll",,,,,,,,,,,,,,,,1763591846834284600,,,,,140712675573760,140712675573760,2677835,2658304,2422963474,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8342927Z","2025-11-19 22:37:26.8342927Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,,,,,,,1763591846834292700,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8342974Z","2025-11-19 22:37:26.8342974Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\Windows.StateRepositoryClient.dll",,,,,,,,,,,,,,,,1763591846834297400,,,,,140712696610816,140712696610816,303673,290816,424989122,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8343045Z","2025-11-19 22:37:26.8343045Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\OneCoreUAPCommonProxyStub.dll",,,,,,,,,,,,,,,,1763591846834304500,,,,,140712713977856,140712713977856,6740758,6615040,2011948997,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8343116Z","2025-11-19 22:37:26.8343116Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\AppXDeploymentClient.dll",,,,,,,,,,,,,,,,1763591846834311600,,,,,140712740257792,140712740257792,1575781,1499136,2615972959,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8343190Z","2025-11-19 22:37:26.8343190Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\propsys.dll",,,,,,,,,,,,,,,,1763591846834319000,,,,,140712761491456,140712761491456,1123662,1060864,3228732737,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8343252Z","2025-11-19 22:37:26.8343252Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\secur32.dll",,,,,,,,,,,,,,,,1763591846834325200,,,,,140712800223232,140712800223232,112844,53248,632019051,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8343371Z","2025-11-19 22:37:26.8343371Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\uxtheme.dll",,,,,,,,,,,,,,,,1763591846834337100,,,,,140712802254848,140712802254848,696534,696320,1695798817,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8343517Z","2025-11-19 22:37:26.8343517Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\windows.storage.dll",,,,,,,,,,,,,,,,1763591846834351700,,,,,140712812412928,140712812412928,8877403,8769536,3667346596,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8343585Z","2025-11-19 22:37:26.8343585Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\netutils.dll",,,,,,,,,,,,,,,,1763591846834358600,,,,,140712825847808,140712825847808,80696,53248,865845000,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8343654Z","2025-11-19 22:37:26.8343654Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591846834365400,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8343871Z","2025-11-19 22:37:26.8343871Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\sspicli.dll",,,,,,,,,,,,,,,,1763591846834387100,,,,,140712833384448,140712833384448,339222,299008,3030302172,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8343929Z","2025-11-19 22:37:26.8343929Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\profapi.dll",,,,,,,,,,,,,,,,1763591846834392900,,,,,140712848850944,140712848850944,229548,167936,2447194521,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8344049Z","2025-11-19 22:37:26.8344049Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,,,,,,,1763591846834405000,,,,,140712851341312,140712851341312,1524912,1486848,1404855129,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8344127Z","2025-11-19 22:37:26.8344127Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,,,,,,,1763591846834412700,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8344187Z","2025-11-19 22:37:26.8344187Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591846834418700,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8344239Z","2025-11-19 22:37:26.8344239Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591846834423900,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8344298Z","2025-11-19 22:37:26.8344298Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591846834429800,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8344353Z","2025-11-19 22:37:26.8344353Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591846834435300,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8344426Z","2025-11-19 22:37:26.8344426Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591846834442600,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8344479Z","2025-11-19 22:37:26.8344479Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591846834447900,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8344535Z","2025-11-19 22:37:26.8344535Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,,,,,,,1763591846834453500,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8344592Z","2025-11-19 22:37:26.8344592Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\shlwapi.dll",,,,,,,,,,,,,,,,1763591846834459200,,,,,140712868839424,140712868839424,479562,421888,2142510382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8344711Z","2025-11-19 22:37:26.8344711Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,,,,,,,1763591846834471100,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8344776Z","2025-11-19 22:37:26.8344776Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591846834477600,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8344832Z","2025-11-19 22:37:26.8344832Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\ole32.dll",,,,,,,,,,,,,,,,1763591846834483200,,,,,140712878473216,140712878473216,1689904,1667072,1018821057,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8344890Z","2025-11-19 22:37:26.8344890Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,,,,,,,1763591846834489000,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8344947Z","2025-11-19 22:37:26.8344947Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591846834494700,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8345117Z","2025-11-19 22:37:26.8345117Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591846834511700,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8345179Z","2025-11-19 22:37:26.8345179Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,,,,,,,1763591846834517900,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8345292Z","2025-11-19 22:37:26.8345292Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,,,,,,,1763591846834529200,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8345359Z","2025-11-19 22:37:26.8345359Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591846834536000,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8345417Z","2025-11-19 22:37:26.8345417Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,,,,,,,1763591846834541700,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8345475Z","2025-11-19 22:37:26.8345475Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\imagehlp.dll",,,,,,,,,,,,,,,,1763591846834547500,,,,,140712892760064,140712892760064,200866,131072,2156568970,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8345531Z","2025-11-19 22:37:26.8345531Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591846834553100,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8345583Z","2025-11-19 22:37:26.8345583Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591846834558300,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8345648Z","2025-11-19 22:37:26.8345648Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591846834564800,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8345749Z","2025-11-19 22:37:26.8345749Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"calc.exe",,,,,,,,,,,,,,,,1763591846834574900,,,,,,,,,,134080654471607920,,,,,,,6629,,,,,3268608,3305472,213030484,0,134080654475331992,116,0,1,12,3,0,0 +"2025-11-19 22:37:26.9060086Z","2025-11-19 22:37:26.9060086Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1016 services.exe",6816,,,"12756 svchost.exe",,,"C:\Windows\System32\svchost.exe",,,,,,,,,,,,,,,,1763591846906008600,,,,,,,143552,,14788416,134080654476036389,0,"0x","","",1016,11,6636,1,1,0,0,,,,,,,,,,,, +"2025-11-19 22:37:26.9067020Z","2025-11-19 22:37:26.9067020Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1016 services.exe",6816,,,"12756 svchost.exe",,,,,,,,,,,,,18446633084032274432,18446633084032249856,140696171073504,0,111870410752,13856,1763591846906702000,111867592704,111867576320,140696171073504,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9075850Z","2025-11-19 22:37:26.9075850Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",13856,,,"12756 svchost.exe",,,"C:\Windows\System32\svchost.exe",,,,,,,,,,,,,,,,1763591846907585000,,,,,140696171053056,140696171053056,143552,77824,14788416,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9076055Z","2025-11-19 22:37:26.9076055Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",13856,,,"12756 svchost.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591846907605500,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9131307Z","2025-11-19 22:37:26.9131307Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",13856,,,"12756 svchost.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591846913130700,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9134922Z","2025-11-19 22:37:26.9134922Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",13856,,,"12756 svchost.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591846913492200,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9168346Z","2025-11-19 22:37:26.9168346Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","12756 svchost.exe",13856,,,"12756 svchost.exe",,,,,,,,,,,,,18446633084033310720,18446633084033286144,140712899206080,0,111870418944,7100,1763591846916834600,111868116992,111868084224,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9169070Z","2025-11-19 22:37:26.9169070Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","12756 svchost.exe",7100,,,"12756 svchost.exe",,,,,,,,,,,,,18446633084032389120,18446633084032364544,140712899206080,0,111870427136,4004,1763591846916907000,111871000576,111870967808,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9169866Z","2025-11-19 22:37:26.9169866Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","12756 svchost.exe",4004,,,"12756 svchost.exe",,,,,,,,,,,,,18446633084033368064,18446633084033343488,140712899206080,0,111870435328,3784,1763591846916986600,111871524864,111871492096,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9170807Z","2025-11-19 22:37:26.9170807Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",13856,,,"12756 svchost.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591846917080700,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9173408Z","2025-11-19 22:37:26.9173408Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",7100,,,"12756 svchost.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591846917340800,,,,,1342098243584,1342098243584,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9173915Z","2025-11-19 22:37:26.9173915Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","12756 svchost.exe",7100,,,"12756 svchost.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591846917391500,,,,,1342098243584,1342098243584,1436013,1368064,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9184903Z","2025-11-19 22:37:26.9184903Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",13856,,,"12756 svchost.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,,,,,,,1763591846918490300,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9187403Z","2025-11-19 22:37:26.9187403Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",7100,,,"12756 svchost.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591846918740300,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9199557Z","2025-11-19 22:37:26.9199557Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",13856,,,"12756 svchost.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591846919955700,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9201963Z","2025-11-19 22:37:26.9201963Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",3784,,,"12756 svchost.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591846920196300,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9206793Z","2025-11-19 22:37:26.9206793Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",13856,,,"12756 svchost.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,,,,,,,1763591846920679300,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9216635Z","2025-11-19 22:37:26.9216635Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",13856,,,"12756 svchost.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591846921663500,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9219277Z","2025-11-19 22:37:26.9219277Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",4004,,,"12756 svchost.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591846921927700,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9220195Z","2025-11-19 22:37:26.9220195Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",7100,,,"12756 svchost.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591846922019500,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9222714Z","2025-11-19 22:37:26.9222714Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",3784,,,"12756 svchost.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591846922271400,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9224957Z","2025-11-19 22:37:26.9224957Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",7100,,,"12756 svchost.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591846922495700,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9251239Z","2025-11-19 22:37:26.9251239Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",13856,,,"12756 svchost.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591846925123900,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9264172Z","2025-11-19 22:37:26.9264172Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"12756 svchost.exe",,,,,,,,,,,,,18446633084032331776,18446633084032307200,140712899206080,0,111870443520,12564,1763591846926417200,111872049152,111872016384,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9265408Z","2025-11-19 22:37:26.9265408Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","12756 svchost.exe",13856,,,"12756 svchost.exe",,,,,,,,,,,,,18446633084038365184,18446633084038340608,140712863364608,0,111870451712,4888,1763591846926540800,111872573440,111872540672,140712863364608,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9269983Z","2025-11-19 22:37:26.9269983Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",4888,,,"12756 svchost.exe",,,"C:\Windows\System32\AppXDeploymentServer.dll",,,,,,,,,,,,,,,,1763591846926998300,,,,,140710064095232,140710064095232,6176797,6193152,2731354284,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9272756Z","2025-11-19 22:37:26.9272756Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",7100,,,"12756 svchost.exe",,,"C:\Windows\System32\dbgcore.dll",,,,,,,,,,,,,,,,1763591846927275600,,,,,140712478244864,140712478244864,263772,245760,3120784319,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9273313Z","2025-11-19 22:37:26.9273313Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",3784,,,"12756 svchost.exe",,,"C:\Windows\System32\sspicli.dll",,,,,,,,,,,,,,,,1763591846927331300,,,,,140712833384448,140712833384448,339222,299008,3030302172,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9274382Z","2025-11-19 22:37:26.9274382Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",4004,,,"12756 svchost.exe",,,"C:\Windows\System32\cryptsp.dll",,,,,,,,,,,,,,,,1763591846927438200,,,,,140712839217152,140712839217152,146168,110592,1658328178,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9291663Z","2025-11-19 22:37:26.9291663Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",4888,,,"12756 svchost.exe",,,"C:\Windows\System32\StateRepository.Core.dll",,,,,,,,,,,,,,,,1763591846929166300,,,,,140712689729536,140712689729536,860235,815104,2968648981,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9296418Z","2025-11-19 22:37:26.9296418Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",4888,,,"12756 svchost.exe",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,,,,,,,1763591846929641800,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9301563Z","2025-11-19 22:37:26.9301563Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",4888,,,"12756 svchost.exe",,,"C:\Windows\System32\wevtapi.dll",,,,,,,,,,,,,,,,1763591846930156300,,,,,140712768372736,140712768372736,361437,339968,1592794036,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9305070Z","2025-11-19 22:37:26.9305070Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",4888,,,"12756 svchost.exe",,,"C:\Windows\System32\wer.dll",,,,,,,,,,,,,,,,1763591846930507000,,,,,140712805728256,140712805728256,993632,983040,1987637995,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9314972Z","2025-11-19 22:37:26.9314972Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","12756 svchost.exe",12564,,,"12756 svchost.exe",,,,,,,,,,,,,18446633084038479872,18446633084038455296,140712899206080,9,111870459904,13320,1763591846931497200,111873097728,111873064960,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9317954Z","2025-11-19 22:37:26.9317954Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",4888,,,"12756 svchost.exe",,,"C:\Windows\System32\wtsapi32.dll",,,,,,,,,,,,,,,,1763591846931795400,,,,,140712800288768,140712800288768,202021,172032,1311240630,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9320566Z","2025-11-19 22:37:26.9320566Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",3784,,,"12756 svchost.exe",,,"C:\Windows\System32\crypt32.dll",,,,,,,,,,,,,,,,1763591846932056600,,,,,140712849768448,140712849768448,1584869,1536000,3438168074,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9325878Z","2025-11-19 22:37:26.9325878Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",12564,,,"12756 svchost.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,,,,,,,1763591846932587800,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9330277Z","2025-11-19 22:37:26.9330277Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",4888,,,"12756 svchost.exe",,,"C:\Windows\System32\winsta.dll",,,,,,,,,,,,,,,,1763591846933027700,,,,,140712847343616,140712847343616,420786,405504,560940509,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9339612Z","2025-11-19 22:37:26.9339612Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","12756 svchost.exe",12564,,,"12756 svchost.exe",,,,,,,,,,,,,18446633084038623232,18446633084038598656,140712865112144,9,111870468096,1628,1763591846933961200,111873622016,111873589248,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9343316Z","2025-11-19 22:37:26.9343316Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","12756 svchost.exe",13320,,,"12756 svchost.exe",,,,,,,,,,,,,18446633084038651904,18446633084038627328,140712899206080,9,111868379136,500,1763591846934331600,111874146304,111874113536,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9367046Z","2025-11-19 22:37:26.9367046Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",12564,,,"12756 svchost.exe",,,"C:\Windows\System32\Windows.StateRepositoryPS.dll",,,,,,,,,,,,,,,,1763591846936704600,,,,,140712490369024,140712490369024,879719,802816,374042279,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9757802Z","2025-11-19 22:37:26.9757802Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11964,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084038680576,18446633084038656000,140712899206080,0,61841977344,9424,1763591846975780200,61863886848,61863882752,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9759165Z","2025-11-19 22:37:26.9759165Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1168 svchost.exe",13524,,," 1168 svchost.exe",,,,,,,,,,,,,18446633084038795264,18446633084038770688,140712899206080,157,641013497856,13336,1763591846975916500,641018626048,641018593280,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9761596Z","2025-11-19 22:37:26.9761596Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",9424,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084038823936,18446633084038799360,140712899206080,0,61841985536,13884,1763591846976159600,61864935424,61864931328,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9762962Z","2025-11-19 22:37:26.9762962Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",13884,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084038852608,18446633084038828032,140712899206080,0,61841993728,13192,1763591846976296200,61865984000,61865979904,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9764557Z","2025-11-19 22:37:26.9764557Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1168 svchost.exe",13336,,," 1168 svchost.exe",,,,,,,,,,,,,18446633084038909952,18446633084038885376,140712899206080,0,641013506048,1052,1763591846976455700,641019674624,641019641856,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9766712Z","2025-11-19 22:37:26.9766712Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\twinapi.dll",,,,,,,,,,,,,,,,1763591846976671200,,,,,140712415789056,140712415789056,924452,868352,2129603828,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9770786Z","2025-11-19 22:37:26.9770786Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\xmllite.dll",,,,,,,,,,,,,,,,1763591846977078600,,,,,140712684027904,140712684027904,342897,274432,974526834,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9808706Z","2025-11-19 22:37:26.9808706Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,,,,,,,1763591846980870600,,,,,140712531263488,140712531263488,1042724,1011712,915912993,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9813933Z","2025-11-19 22:37:26.9813933Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\twinapi.appcore.dll",,,,,,,,,,,,,,,,1763591846981393300,,,,,140712720924672,140712720924672,2401519,2375680,2646458233,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9821193Z","2025-11-19 22:37:26.9821193Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846982119300,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9842337Z","2025-11-19 22:37:26.9842337Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846984233700,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9845394Z","2025-11-19 22:37:26.9845394Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\twinapi.appcore.dll",,,,,,,,,,,,,,,,1763591846984539400,,,,,140712720924672,140712720924672,2401519,2387968,2646458233,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9856297Z","2025-11-19 22:37:26.9856297Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846985629700,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9861865Z","2025-11-19 22:37:26.9861865Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846986186500,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9882883Z","2025-11-19 22:37:26.9882883Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846988288300,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9887666Z","2025-11-19 22:37:26.9887666Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846988766600,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9906594Z","2025-11-19 22:37:26.9906594Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846990659400,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9910998Z","2025-11-19 22:37:26.9910998Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846991099800,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9921663Z","2025-11-19 22:37:26.9921663Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\netprofm.dll",,,,,,,,,,,,,,,,1763591846992166300,,,,,140712762802176,140712762802176,450621,450560,2204449876,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9951086Z","2025-11-19 22:37:26.9951086Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\npmproxy.dll",,,,,,,,,,,,,,,,1763591846995108600,,,,,140712730820608,140712730820608,124253,102400,1533975845,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9964262Z","2025-11-19 22:37:26.9964262Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\netprofm.dll",,,,,,,,,,,,,,,,1763591846996426200,,,,,140712762802176,140712762802176,450621,462848,2204449876,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9964693Z","2025-11-19 22:37:26.9964693Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\npmproxy.dll",,,,,,,,,,,,,,,,1763591846996469300,,,,,140712730820608,140712730820608,124253,114688,1533975845,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9967025Z","2025-11-19 22:37:26.9967025Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\rmclient.dll",,,,,,,,,,,,,,,,1763591846996702500,,,,,140712808808448,140712808808448,282526,221184,1891057501,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9977602Z","2025-11-19 22:37:26.9977602Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084037419008,18446633084037394432,140712806010720,0,295361277952,5544,1763591846997760200,295366557696,295366549504,140712806010720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9983833Z","2025-11-19 22:37:26.9983833Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\Windows.Security.Authentication.OnlineId.dll",,,,,,,,,,,,,,,,1763591846998383300,,,,,140712517107712,140712517107712,983040,942080,2052763288,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9989312Z","2025-11-19 22:37:26.9989312Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846998931200,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9993571Z","2025-11-19 22:37:26.9993571Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,,,,,,,1763591846999357100,,,,,140712851341312,140712851341312,1524912,1486848,1404855129,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9998434Z","2025-11-19 22:37:26.9998434Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846999843400,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0004491Z","2025-11-19 22:37:27.0004491Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",8320,,," 5252 WerFault.exe",,,"C:\Windows\System32\dpapi.dll",,,,,,,,,,,,,,,,1763591847000449100,,,,,140712845574144,140712845574144,42814,40960,2473566603,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0011253Z","2025-11-19 22:37:27.0011253Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\netprofm.dll",,,,,,,,,,,,,,,,1763591847001125300,,,,,140712762802176,140712762802176,450621,450560,2204449876,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0016801Z","2025-11-19 22:37:27.0016801Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",8320,,," 5252 WerFault.exe",,,"C:\Windows\System32\cryptbase.dll",,,,,,,,,,,,,,,,1763591847001680100,,,,,140712839348224,140712839348224,63718,49152,3897879906,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0027226Z","2025-11-19 22:37:27.0027226Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\OneCoreUAPCommonProxyStub.dll",,,,,,,,,,,,,,,,1763591847002722600,,,,,140712713977856,140712713977856,6740758,6615040,2011948997,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0034230Z","2025-11-19 22:37:27.0034230Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\npmproxy.dll",,,,,,,,,,,,,,,,1763591847003423000,,,,,140712730820608,140712730820608,124253,102400,1533975845,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0043199Z","2025-11-19 22:37:27.0043199Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1776 svchost.exe",9772,,," 1776 svchost.exe",,,,,,,,,,,,,18446633084039024640,18446633084039000064,140712899206080,122,699936964608,6052,1763591847004319900,699937587200,699937554432,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0049592Z","2025-11-19 22:37:27.0049592Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\netprofm.dll",,,,,,,,,,,,,,,,1763591847004959200,,,,,140712762802176,140712762802176,450621,462848,2204449876,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0050763Z","2025-11-19 22:37:27.0050763Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\Windows.Security.Authentication.OnlineId.dll",,,,,,,,,,,,,,,,1763591847005076300,,,,,140712517107712,140712517107712,983040,954368,2052763288,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0051265Z","2025-11-19 22:37:27.0051265Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\npmproxy.dll",,,,,,,,,,,,,,,,1763591847005126500,,,,,140712730820608,140712730820608,124253,114688,1533975845,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0052611Z","2025-11-19 22:37:27.0052611Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\OneCoreUAPCommonProxyStub.dll",,,,,,,,,,,,,,,,1763591847005261100,,,,,140712713977856,140712713977856,6740758,6627328,2011948997,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0053469Z","2025-11-19 22:37:27.0053469Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,,,,,,,1763591847005346900,,,,,140712851341312,140712851341312,1524912,1499136,1404855129,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0060299Z","2025-11-19 22:37:27.0060299Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\netprofm.dll",,,,,,,,,,,,,,,,1763591847006029900,,,,,140712762802176,140712762802176,450621,450560,2204449876,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0064637Z","2025-11-19 22:37:27.0064637Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,,,,,,,1763591847006463800,,,,,140712426930176,140712426930176,1213372,1146880,2699219668,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0072003Z","2025-11-19 22:37:27.0072003Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591847007200300,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0085599Z","2025-11-19 22:37:27.0085599Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",13192,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084039053312,18446633084039028736,140712899206080,0,61842001920,4980,1763591847008559900,61867032576,61867028480,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0088098Z","2025-11-19 22:37:27.0088098Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",4980,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084039081984,18446633084039057408,140712899206080,0,61842010112,4528,1763591847008809800,61868081152,61868077056,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0089567Z","2025-11-19 22:37:27.0089567Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",4528,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084039225344,18446633084039200768,140712899206080,0,61842018304,13000,1763591847008956800,61869129728,61869125632,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0094924Z","2025-11-19 22:37:27.0094924Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\npmproxy.dll",,,,,,,,,,,,,,,,1763591847009492500,,,,,140712730820608,140712730820608,124253,102400,1533975845,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0227855Z","2025-11-19 22:37:27.0227855Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,,,,,,,1763591847022785500,,,,,140712531263488,140712531263488,1042724,999424,915912993,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0294277Z","2025-11-19 22:37:27.0294277Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\netprofm.dll",,,,,,,,,,,,,,,,1763591847029427700,,,,,140712762802176,140712762802176,450621,462848,2204449876,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0295981Z","2025-11-19 22:37:27.0295981Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\npmproxy.dll",,,,,,,,,,,,,,,,1763591847029598100,,,,,140712730820608,140712730820608,124253,114688,1533975845,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0297779Z","2025-11-19 22:37:27.0297779Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,,,,,,,1763591847029777900,,,,,140712531263488,140712531263488,1042724,1011712,915912993,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0299214Z","2025-11-19 22:37:27.0299214Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591847029921400,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0299968Z","2025-11-19 22:37:27.0299968Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,,,,,,,1763591847029996800,,,,,140712426930176,140712426930176,1213372,1159168,2699219668,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0307998Z","2025-11-19 22:37:27.0307998Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,,,,,,,1763591847030799800,,,,,140712531263488,140712531263488,1042724,999424,915912993,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0340864Z","2025-11-19 22:37:27.0340864Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",8260,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084032188416,18446633084032163840,140712891292720,0,199841374208,6804,1763591847034086400,199851245568,199851237376,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0356784Z","2025-11-19 22:37:27.0356784Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1416 ApplicationFrameHost.exe",8260,,," 1416 ApplicationFrameHost.exe",,,"C:\Windows\System32\UIAnimation.dll",,,,,,,,,,,,,,,,1763591847035678400,,,,,140712712863744,140712712863744,393989,348160,2216247055,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0668663Z","2025-11-19 22:37:27.0668663Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3420 ctfmon.exe",8900,,," 3420 ctfmon.exe",,,,,,,,,,,,,18446633084037906432,18446633084037881856,140712865112144,0,619648745472,15352,1763591847066866300,619647205376,619647197184,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0685230Z","2025-11-19 22:37:27.0685230Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084038250496,18446633084038225920,140712899206080,0,61842026496,12060,1763591847068523000,61870178304,61870174208,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0731368Z","2025-11-19 22:37:27.0731368Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\userenv.dll",,,,,,,,,,,,,,,,1763591847073136800,,,,,140712837054464,140712837054464,245008,176128,731547084,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0735931Z","2025-11-19 22:37:27.0735931Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\profext.dll",,,,,,,,,,,,,,,,1763591847073593100,,,,,140712823488512,140712823488512,220952,200704,1125089802,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0828335Z","2025-11-19 22:37:27.0828335Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\rometadata.dll",,,,,,,,,,,,,,,,1763591847082833500,,,,,140712295006208,140712295006208,267714,233472,1750277957,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0834075Z","2025-11-19 22:37:27.0834075Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\WinMetadata\Windows.Foundation.winmd",,,,,,,,,,,,,,,,1763591847083407500,,,,,18014398509481984,2220526534656,134275,69632,1761294834,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0837519Z","2025-11-19 22:37:27.0837519Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\WinMetadata\Windows.UI.winmd",,,,,,,,,,,,,,,,1763591847083752000,,,,,18014398509481984,2220526665728,773504,737280,1761294835,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.1026755Z","2025-11-19 22:37:27.1026755Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6096 svchost.exe",4172,,," 6096 svchost.exe",,,,,,,,,,,,,18446633084032245760,18446633084032221184,140712899206080,25,338488852480,15324,1763591847102675500,338491867136,338491834368,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.1176652Z","2025-11-19 22:37:27.1176652Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6096 svchost.exe",4172,,," 6096 svchost.exe",,,,,,,,,,,,,18446633084033224704,18446633084033200128,140712865112144,25,338488860672,14108,1763591847117665200,338492391424,338492358656,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.1255393Z","2025-11-19 22:37:27.1255393Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2724 svchost.exe",14940,,," 2724 svchost.exe",,,,,,,,,,,,,18446633084039458816,18446633084039434240,140712899206080,232,89489063936,5900,1763591847125539300,89491767296,89491701760,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.1256608Z","2025-11-19 22:37:27.1256608Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2724 svchost.exe",14940,,," 2724 svchost.exe",,,,,,,,,,,,,18446633084039544832,18446633084039520256,140712899206080,232,89489072128,952,1763591847125660800,89492291584,89492258816,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.1267258Z","2025-11-19 22:37:27.1267258Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3256 svchost.exe",4788,,," 3256 svchost.exe",,,,,,,,,,,,,18446633084039630848,18446633084039606272,140712899206080,111,435930234880,3276,1763591847126725800,433794318336,433794285568,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2129195Z","2025-11-19 22:37:27.2129195Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1040 svchost.exe",4220,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\RuntimeBroker.exe",,,,,,,,,,,,,,,,1763591847212919500,,,,,,,148437,,1175682367,134080654479044376,3,"0x","Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe","runtimebroker07f4358a809ac99a64a67c1",1040,13,6637,3,0,0,1,,,,,,,,,,,, +"2025-11-19 22:37:27.2141117Z","2025-11-19 22:37:27.2141117Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",4220,,," 6764 RuntimeBroker.exe",,,,,,,,,,,,,18446633084037963776,18446633084037939200,140699399787184,40,848667435008,11572,1763591847214111700,848666886144,848666836992,140699399787184,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2161048Z","2025-11-19 22:37:27.2161048Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\RuntimeBroker.exe",,,,,,,,,,,,,,,,1763591847216104800,,,,,140699399749632,140699399749632,148437,126976,1175682367,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2161305Z","2025-11-19 22:37:27.2161305Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591847216130500,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2260181Z","2025-11-19 22:37:27.2260181Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591847226018100,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2262028Z","2025-11-19 22:37:27.2262028Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591847226202800,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2276559Z","2025-11-19 22:37:27.2276559Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591847227655900,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2277968Z","2025-11-19 22:37:27.2277968Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,,,,,,,,,,,18446633084039716864,18446633084039692288,140712899206080,0,848667443200,8364,1763591847227796800,848669704192,848669655040,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2278608Z","2025-11-19 22:37:27.2278608Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591847227860800,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2280363Z","2025-11-19 22:37:27.2280363Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,,,,,,,,,,,18446633084039831552,18446633084039806976,140712899206080,0,848667451392,11224,1763591847228036300,848670228480,848670179328,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2287033Z","2025-11-19 22:37:27.2287033Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,,,,,,,1763591847228703300,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2287940Z","2025-11-19 22:37:27.2287940Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591847228794000,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2298203Z","2025-11-19 22:37:27.2298203Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591847229820300,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2299335Z","2025-11-19 22:37:27.2299335Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591847229933500,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2302570Z","2025-11-19 22:37:27.2302570Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,,,,,,,1763591847230257000,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2306900Z","2025-11-19 22:37:27.2306900Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\powrprof.dll",,,,,,,,,,,,,,,,1763591847230690000,,,,,140712848195584,140712848195584,457799,385024,2858637235,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2310038Z","2025-11-19 22:37:27.2310038Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\umpdc.dll",,,,,,,,,,,,,,,,1763591847231003800,,,,,140712848064512,140712848064512,98535,81920,1714427184,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2312370Z","2025-11-19 22:37:27.2312370Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 6764 RuntimeBroker.exe",,,,,,,,,,,,,18446633084039860224,18446633084039835648,140712899206080,0,848667459584,6812,1763591847231237000,848670752768,848670703616,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2313547Z","2025-11-19 22:37:27.2313547Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 6764 RuntimeBroker.exe",,,,,,,,,,,,,18446633084040003584,18446633084039979008,140712899206080,0,848667467776,8708,1763591847231354700,848671277056,848671227904,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2315885Z","2025-11-19 22:37:27.2315885Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591847231588500,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2316863Z","2025-11-19 22:37:27.2316863Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591847231686300,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2317848Z","2025-11-19 22:37:27.2317848Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591847231784800,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2319174Z","2025-11-19 22:37:27.2319174Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591847231917400,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2320674Z","2025-11-19 22:37:27.2320674Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6764 RuntimeBroker.exe",11224,,," 6764 RuntimeBroker.exe",,,,,,,,,,,,,18446633084040060928,18446633084040036352,140712899206080,0,848667475968,13408,1763591847232067400,848671801344,848671752192,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2325139Z","2025-11-19 22:37:27.2325139Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,,,,,,,1763591847232513900,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2345618Z","2025-11-19 22:37:27.2345618Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591847234561800,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2353967Z","2025-11-19 22:37:27.2353967Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,,,,,,,1763591847235396700,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2361031Z","2025-11-19 22:37:27.2361031Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,,,,,,,,,,,18446633084040290304,18446633084040265728,140712865112144,0,848667484160,12020,1763591847236103100,848672325632,848672276480,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2386374Z","2025-11-19 22:37:27.2386374Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",6812,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\twinui.dll",,,,,,,,,,,,,,,,1763591847238637400,,,,,140712339046400,140712339046400,5239409,5242880,279122806,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2387872Z","2025-11-19 22:37:27.2387872Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",6812,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,,,,,,,1763591847238787200,,,,,140712851341312,140712851341312,1524912,1486848,1404855129,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2389686Z","2025-11-19 22:37:27.2389686Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",6812,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,,,,,,,1763591847238968600,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2391386Z","2025-11-19 22:37:27.2391386Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11224,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\mscms.dll",,,,,,,,,,,,,,,,1763591847239138600,,,,,140712711880704,140712711880704,859508,786432,1878966387,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2393067Z","2025-11-19 22:37:27.2393067Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",13408,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\gamemode.dll",,,,,,,,,,,,,,,,1763591847239306700,,,,,140712543387648,140712543387648,164324,114688,328629043,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2394969Z","2025-11-19 22:37:27.2394969Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",6812,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\windows.storage.dll",,,,,,,,,,,,,,,,1763591847239496900,,,,,140712812412928,140712812412928,8877403,8769536,3667346596,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2397690Z","2025-11-19 22:37:27.2397690Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",6812,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591847239769000,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2398445Z","2025-11-19 22:37:27.2398445Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,,,,,,,1763591847239844500,,,,,140712531263488,140712531263488,1042724,1011712,915912993,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2399540Z","2025-11-19 22:37:27.2399540Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11224,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\DXCore.dll",,,,,,,,,,,,,,,,1763591847239954000,,,,,140712805400576,140712805400576,331386,274432,2354081039,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2401949Z","2025-11-19 22:37:27.2401949Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\twinapi.appcore.dll",,,,,,,,,,,,,,,,1763591847240194900,,,,,140712720924672,140712720924672,2401519,2375680,2646458233,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2406771Z","2025-11-19 22:37:27.2406771Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591847240677100,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2413286Z","2025-11-19 22:37:27.2413286Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",6812,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,,,,,,,1763591847241328600,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2417460Z","2025-11-19 22:37:27.2417460Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591847241746000,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2418193Z","2025-11-19 22:37:27.2418193Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\twinapi.appcore.dll",,,,,,,,,,,,,,,,1763591847241819300,,,,,140712720924672,140712720924672,2401519,2387968,2646458233,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2424991Z","2025-11-19 22:37:27.2424991Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",6812,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\OneCoreUAPCommonProxyStub.dll",,,,,,,,,,,,,,,,1763591847242499100,,,,,140712713977856,140712713977856,6740758,6615040,2011948997,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2427968Z","2025-11-19 22:37:27.2427968Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591847242796800,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2432995Z","2025-11-19 22:37:27.2432995Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591847243299500,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2448516Z","2025-11-19 22:37:27.2448516Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",8708,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,,,,,,,1763591847244851600,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2453058Z","2025-11-19 22:37:27.2453058Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\winhttp.dll",,,,,,,,,,,,,,,,1763591847245305800,,,,,140712750350336,140712750350336,1261038,1212416,84984727,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2455120Z","2025-11-19 22:37:27.2455120Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6764 RuntimeBroker.exe",8708,,," 6764 RuntimeBroker.exe",,,,,,,,,,,,,18446633084040318976,18446633084040294400,140712865112144,0,848667492352,5996,1763591847245512000,848672849920,848672800768,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2460087Z","2025-11-19 22:37:27.2460087Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",5996,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\uxtheme.dll",,,,,,,,,,,,,,,,1763591847246008700,,,,,140712802254848,140712802254848,696534,696320,1695798817,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2461950Z","2025-11-19 22:37:27.2461950Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\ws2_32.dll",,,,,,,,,,,,,,,,1763591847246195000,,,,,140712881094656,140712881094656,513405,475136,3967481067,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2473895Z","2025-11-19 22:37:27.2473895Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5252 WerFault.exe",10204,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084040347648,18446633084040323072,140712899206080,0,295361286144,13268,1763591847247389500,295367081984,295367073792,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2475493Z","2025-11-19 22:37:27.2475493Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\mswsock.dll",,,,,,,,,,,,,,,,1763591847247549300,,,,,140712836333568,140712836333568,491870,438272,897307513,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2481688Z","2025-11-19 22:37:27.2481688Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\IPHLPAPI.DLL",,,,,,,,,,,,,,,,1763591847248168800,,,,,140712824012800,140712824012800,233044,212992,945822897,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2485373Z","2025-11-19 22:37:27.2485373Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\winnsi.dll",,,,,,,,,,,,,,,,1763591847248537300,,,,,140712802975744,140712802975744,95519,61440,2268955118,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2487306Z","2025-11-19 22:37:27.2487306Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\nsi.dll",,,,,,,,,,,,,,,,1763591847248730600,,,,,140712892956672,140712892956672,111648,40960,4223476491,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2489183Z","2025-11-19 22:37:27.2489183Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",5996,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\shlwapi.dll",,,,,,,,,,,,,,,,1763591847248918300,,,,,140712868839424,140712868839424,479562,421888,2142510382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2538985Z","2025-11-19 22:37:27.2538985Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\dhcpcsvc6.dll",,,,,,,,,,,,,,,,1763591847253898600,,,,,140712753233920,140712753233920,145503,122880,2114927498,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2540086Z","2025-11-19 22:37:27.2540086Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",8708,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\twinapi.appcore.dll",,,,,,,,,,,,,,,,1763591847254008700,,,,,140712720924672,140712720924672,2401519,2375680,2646458233,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2546360Z","2025-11-19 22:37:27.2546360Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\dhcpcsvc.dll",,,,,,,,,,,,,,,,1763591847254636100,,,,,140712746024960,140712746024960,184216,143360,916390222,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2557466Z","2025-11-19 22:37:27.2557466Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\webio.dll",,,,,,,,,,,,,,,,1763591847255746600,,,,,140712635531264,140712635531264,873482,827392,338769958,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2562648Z","2025-11-19 22:37:27.2562648Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",5996,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,,,,,,,1763591847256264800,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2567215Z","2025-11-19 22:37:27.2567215Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1660 svchost.exe",5636,,," 1660 svchost.exe",,,,,,,,,,,,,18446633084040376320,18446633084040351744,140712899206080,129,265908367360,8716,1763591847256721500,265905897472,265905864704,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2571899Z","2025-11-19 22:37:27.2571899Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",5996,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\ole32.dll",,,,,,,,,,,,,,,,1763591847257189900,,,,,140712878473216,140712878473216,1689904,1667072,1018821057,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2575332Z","2025-11-19 22:37:27.2575332Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\sspicli.dll",,,,,,,,,,,,,,,,1763591847257533200,,,,,140712833384448,140712833384448,339222,299008,3030302172,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2583450Z","2025-11-19 22:37:27.2583450Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",6812,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\cfgmgr32.dll",,,,,,,,,,,,,,,,1763591847258345000,,,,,140712845049856,140712845049856,385808,356352,1737777300,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2589399Z","2025-11-19 22:37:27.2589399Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6764 RuntimeBroker.exe",6812,,," 6764 RuntimeBroker.exe",,,,,,,,,,,,,18446633084040491008,18446633084040466432,140712899206080,0,848667500544,13508,1763591847258939900,848673374208,848673325056,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2590354Z","2025-11-19 22:37:27.2590354Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",5996,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\propsys.dll",,,,,,,,,,,,,,,,1763591847259035500,,,,,140712761491456,140712761491456,1123662,1060864,3228732737,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2616936Z","2025-11-19 22:37:27.2616936Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6764 RuntimeBroker.exe",5996,,," 6764 RuntimeBroker.exe",,,,,,,,,,,,,18446633084040548352,18446633084040523776,140712891292720,0,848667508736,2944,1763591847261693600,848673898496,848673849344,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2626803Z","2025-11-19 22:37:27.2626803Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",10204,,," 5252 WerFault.exe",,,"C:\Windows\System32\dnsapi.dll",,,,,,,,,,,,,,,,1763591847262680300,,,,,140712824274944,140712824274944,1293169,1228800,1381219389,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2635901Z","2025-11-19 22:37:27.2635901Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",10204,,," 5252 WerFault.exe",,,"C:\Windows\System32\rasadhlp.dll",,,,,,,,,,,,,,,,1763591847263590100,,,,,140712730755072,140712730755072,108990,45056,352477361,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2640959Z","2025-11-19 22:37:27.2640959Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",2944,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\Windows.StateRepositoryPS.dll",,,,,,,,,,,,,,,,1763591847264095900,,,,,140712490369024,140712490369024,879719,802816,374042279,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2662240Z","2025-11-19 22:37:27.2662240Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",5996,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,,,,,,,1763591847266224000,,,,,140712479096832,140712479096832,1613415,1552384,2231457550,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2694685Z","2025-11-19 22:37:27.2694685Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",5996,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\OneCoreCommonProxyStub.dll",,,,,,,,,,,,,,,,1763591847269468500,,,,,140712570257408,140712570257408,903222,823296,2010952444,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2703184Z","2025-11-19 22:37:27.2703184Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",13268,,," 5252 WerFault.exe",,,"C:\Windows\System32\FWPUCLNT.DLL",,,,,,,,,,,,,,,,1763591847270318400,,,,,140712731279360,140712731279360,561494,548864,3096342574,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2709280Z","2025-11-19 22:37:27.2709280Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",8708,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\iertutil.dll",,,,,,,,,,,,,,,,1763591847270928000,,,,,140712642805760,140712642805760,2984761,2904064,3815768453,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2711814Z","2025-11-19 22:37:27.2711814Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",13408,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\srvcli.dll",,,,,,,,,,,,,,,,1763591847271181400,,,,,140712668954624,140712668954624,181029,167936,239922031,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2712155Z","2025-11-19 22:37:27.2712155Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",8708,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\netutils.dll",,,,,,,,,,,,,,,,1763591847271215500,,,,,140712825847808,140712825847808,80696,53248,865845000,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2742630Z","2025-11-19 22:37:27.2742630Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",8708,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\Windows.Web.dll",,,,,,,,,,,,,,,,1763591847274263000,,,,,140712467955712,140712467955712,678716,638976,1581530023,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2756130Z","2025-11-19 22:37:27.2756130Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",12588,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\Windows.Web.dll",,,,,,,,,,,,,,,,1763591847275613000,,,,,140712467955712,140712467955712,678716,638976,1581530023,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2822816Z","2025-11-19 22:37:27.2822816Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",8708,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\profapi.dll",,,,,,,,,,,,,,,,1763591847282281600,,,,,140712848850944,140712848850944,229548,167936,2447194521,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2884083Z","2025-11-19 22:37:27.2884083Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",5996,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591847288408300,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2897291Z","2025-11-19 22:37:27.2897291Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",5996,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\bcrypt.dll",,,,,,,,,,,,,,,,1763591847289729100,,,,,140712848654336,140712848654336,206048,172032,2893678010,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2971150Z","2025-11-19 22:37:27.2971150Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",5996,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\ntmarta.dll",,,,,,,,,,,,,,,,1763591847297115000,,,,,140712831811584,140712831811584,265798,221184,3598506564,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.3047289Z","2025-11-19 22:37:27.3047289Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3204 Taskmgr.exe",5876,,," 3204 Taskmgr.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,,,,,,,1763591847304728900,,,,,140712479096832,140712479096832,1613415,1552384,2231457550,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.3053734Z","2025-11-19 22:37:27.3053734Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3204 Taskmgr.exe",5876,,," 3204 Taskmgr.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,,,,,,,1763591847305373400,,,,,140712479096832,140712479096832,1613415,1564672,2231457550,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.3163515Z","2025-11-19 22:37:27.3163515Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",13876,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084018688000,18446633084018663424,140711613062896,0,1046354382848,13876,1763591847316351500,1046401253376,1046401236992,140711613062896,2715087,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.3958270Z","2025-11-19 22:37:27.3958270Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",8320,,," 5252 WerFault.exe",,,"C:\Windows\System32\schannel.dll",,,,,,,,,,,,,,,,1763591847395827000,,,,,140712828731392,140712828731392,849052,802816,24806266,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.099873500Z","2025-11-19 22:37:27.4122768Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Attack done",,,,,,,,,,,,,,,,,1763591847412276800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4128045Z","2025-11-19 22:37:27.4128045Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591847412804500,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4131942Z","2025-11-19 22:37:27.4131942Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5604 attack-890.exe",8672,,," 5604 attack-890.exe",,,,,,,,,,,,,18446633084029718528,18446633084029693952,140712899206080,0,867488067584,8672,1763591847413194200,867491119104,867491106816,140712899206080,1934283,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4131969Z","2025-11-19 22:37:27.4131969Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5604 attack-890.exe",5960,,," 5604 attack-890.exe",,,,,,,,,,,,,18446633084029747200,18446633084029722624,140712899206080,0,867488059392,5960,1763591847413196900,867490070528,867490062336,140712899206080,2523090,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4132046Z","2025-11-19 22:37:27.4132046Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5604 attack-890.exe",12460,,," 5604 attack-890.exe",,,,,,,,,,,,,18446633084029460480,18446633084029435904,140712899206080,0,867488075776,12460,1763591847413204600,867492167680,867492155392,140712899206080,1586126,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4133776Z","2025-11-19 22:37:27.4133776Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,,,,,,,,,,,18446633084027822080,18446633084027797504,140695618865008,0,867488051200,3452,1763591847413377600,867486007296,867485986816,140695618865008,55165128,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4135007Z","2025-11-19 22:37:27.4135007Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Users\Public\Downloads\attack-890.exe",,,,,,,,,,,,,,,,1763591847413500700,,,,,140695618846720,140695618846720,0,53248,1763491559,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4135055Z","2025-11-19 22:37:27.4135055Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\msvcp140.dll",,,,,,,,,,,,,,,,1763591847413505500,,,,,140711213137920,140711213137920,570439,561152,1564323704,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4135084Z","2025-11-19 22:37:27.4135084Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\vcruntime140.dll",,,,,,,,,,,,,,,,1763591847413508400,,,,,140712353988608,140712353988608,146072,122880,254123393,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4135113Z","2025-11-19 22:37:27.4135113Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\vcruntime140_1.dll",,,,,,,,,,,,,,,,1763591847413511400,,,,,140712354119680,140712354119680,57827,49152,240324076,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4135253Z","2025-11-19 22:37:27.4135253Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\apphelp.dll",,,,,,,,,,,,,,,,1763591847413525300,,,,,140712800485376,140712800485376,675806,651264,4108425587,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4135311Z","2025-11-19 22:37:27.4135311Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591847413531100,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4135386Z","2025-11-19 22:37:27.4135386Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591847413538600,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4135538Z","2025-11-19 22:37:27.4135538Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591847413553800,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4135615Z","2025-11-19 22:37:27.4135615Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591847413561600,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4135675Z","2025-11-19 22:37:27.4135675Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591847413567500,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4135740Z","2025-11-19 22:37:27.4135740Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591847413574000,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4135805Z","2025-11-19 22:37:27.4135805Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591847413580500,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4135873Z","2025-11-19 22:37:27.4135873Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591847413587300,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4135935Z","2025-11-19 22:37:27.4135935Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591847413593500,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4136009Z","2025-11-19 22:37:27.4136009Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"attack-890.exe",,,,,,,,,,,,,,,,1763591847413600900,,,,,,,,,,134080654410040405,,,,,,,6624,,,,,974848,974848,61411560,0,134080654481010332,52,9,0,0,3,48,0 +"2025-11-19 22:37:27.4283262Z","2025-11-19 22:37:27.4283262Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",11288,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084024401920,18446633084024377344,140711613062896,0,1046354407424,11288,1763591847428326200,1046418030592,1046418014208,140711613062896,1935036,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.5078343Z","2025-11-19 22:37:27.5078343Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2572 svchost.exe",13832,,," 2572 svchost.exe",,,,,,,,,,,,,18446633084039372800,18446633084039348224,140712899206080,75,140319780864,11052,1763591847507834300,140320964608,140320931840,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.5256444Z","2025-11-19 22:37:27.5256444Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 4868 svchost.exe",,,,,,,,,,,,,18446633084031901696,18446633084031877120,140712899206080,0,47918891008,11596,1763591847525644400,47920971776,47920939008,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.5258154Z","2025-11-19 22:37:27.5258154Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4868 svchost.exe",11596,,," 4868 svchost.exe",,,,,,,,,,,,,18446633084024401920,18446633084024377344,140712899206080,0,47918899200,2940,1763591847525815400,47921496064,47921463296,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6226062Z","2025-11-19 22:37:27.6226062Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1016 services.exe",6816,,,"13800 svchost.exe",,,"C:\Windows\System32\svchost.exe",,,,,,,,,,,,,,,,1763591847622606300,,,,,,,143552,,14788416,134080654483059795,0,"0x","","",1016,11,6638,1,1,0,0,,,,,,,,,,,, +"2025-11-19 22:37:27.6232926Z","2025-11-19 22:37:27.6232926Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1016 services.exe",6816,,,"13800 svchost.exe",,,,,,,,,,,,,18446633084027822080,18446633084027797504,140696171073504,0,858544685056,15036,1763591847623292600,858547290112,858547273728,140696171073504,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6245554Z","2025-11-19 22:37:27.6245554Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,"C:\Windows\System32\svchost.exe",,,,,,,,,,,,,,,,1763591847624555400,,,,,140696171053056,140696171053056,143552,77824,14788416,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6245778Z","2025-11-19 22:37:27.6245778Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591847624577800,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6277064Z","2025-11-19 22:37:27.6277064Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591847627706400,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6278283Z","2025-11-19 22:37:27.6278283Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591847627828300,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6288348Z","2025-11-19 22:37:27.6288348Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591847628834800,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6289680Z","2025-11-19 22:37:27.6289680Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,,,,,,,,,,,18446633084029747200,18446633084029722624,140712899206080,0,858544693248,9704,1763591847628968000,858547814400,858547781632,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6297035Z","2025-11-19 22:37:27.6297035Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,,,,,,,1763591847629703500,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6297981Z","2025-11-19 22:37:27.6297981Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591847629798100,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6299477Z","2025-11-19 22:37:27.6299477Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,,,,,,,,,,,18446633084029460480,18446633084029435904,140712899206080,0,858544701440,5924,1763591847629947700,858548338688,858548305920,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6308177Z","2025-11-19 22:37:27.6308177Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591847630817700,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6309243Z","2025-11-19 22:37:27.6309243Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591847630924300,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6312752Z","2025-11-19 22:37:27.6312752Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,,,,,,,1763591847631275200,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6319242Z","2025-11-19 22:37:27.6319242Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591847631924200,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6320169Z","2025-11-19 22:37:27.6320169Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591847632016900,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6321329Z","2025-11-19 22:37:27.6321329Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591847632132900,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6322326Z","2025-11-19 22:37:27.6322326Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591847632232600,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6323211Z","2025-11-19 22:37:27.6323211Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591847632321100,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6324486Z","2025-11-19 22:37:27.6324486Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13800 svchost.exe",9704,,,"13800 svchost.exe",,,,,,,,,,,,,18446633084039282688,18446633084039258112,140712899206080,0,858544709632,10468,1763591847632448600,858548862976,858548830208,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6345273Z","2025-11-19 22:37:27.6345273Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591847634527300,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6355634Z","2025-11-19 22:37:27.6355634Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"13800 svchost.exe",,,,,,,,,,,,,18446633084040663040,18446633084040638464,140712899206080,0,858544717824,11472,1763591847635563500,858549387264,858549354496,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6356777Z","2025-11-19 22:37:27.6356777Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,,,,,,,,,,,18446633084040691712,18446633084040667136,140712863364608,0,858544726016,11168,1763591847635677700,858549911552,858549878784,140712863364608,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6360751Z","2025-11-19 22:37:27.6360751Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",11168,,,"13800 svchost.exe",,,"C:\Windows\System32\wdi.dll",,,,,,,,,,,,,,,,1763591847636075100,,,,,140712669413376,140712669413376,172159,126976,589396027,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6374195Z","2025-11-19 22:37:27.6374195Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",11472,,,"13800 svchost.exe",,,"C:\Windows\System32\pcadm.dll",,,,,,,,,,,,,,,,1763591847637419500,,,,,140712372469760,140712372469760,249405,204800,3376468140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6375213Z","2025-11-19 22:37:27.6375213Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",11472,,,"13800 svchost.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591847637521300,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6379013Z","2025-11-19 22:37:27.6379013Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",5924,,,"13800 svchost.exe",,,"C:\Windows\System32\pcacli.dll",,,,,,,,,,,,,,,,1763591847637901300,,,,,140712543977472,140712543977472,146563,102400,3048676746,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6379125Z","2025-11-19 22:37:27.6379125Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",11472,,,"13800 svchost.exe",,,"C:\Windows\System32\aepic.dll",,,,,,,,,,,,,,,,1763591847637912500,,,,,140712428109824,140712428109824,641436,577536,321124434,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6379262Z","2025-11-19 22:37:27.6379262Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",10468,,,"13800 svchost.exe",,,"C:\Windows\System32\wtsapi32.dll",,,,,,,,,,,,,,,,1763591847637926300,,,,,140712800288768,140712800288768,202021,172032,1311240630,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6381998Z","2025-11-19 22:37:27.6381998Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",10468,,,"13800 svchost.exe",,,"C:\Windows\System32\crypt32.dll",,,,,,,,,,,,,,,,1763591847638199800,,,,,140712849768448,140712849768448,1584869,1536000,3438168074,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6382168Z","2025-11-19 22:37:27.6382168Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",11472,,,"13800 svchost.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,,,,,,,1763591847638216800,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6384332Z","2025-11-19 22:37:27.6384332Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",9704,,,"13800 svchost.exe",,,"C:\Windows\System32\sspicli.dll",,,,,,,,,,,,,,,,1763591847638433200,,,,,140712833384448,140712833384448,339222,299008,3030302172,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6386389Z","2025-11-19 22:37:27.6386389Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",5924,,,"13800 svchost.exe",,,"C:\Windows\System32\mpr.dll",,,,,,,,,,,,,,,,1763591847638638900,,,,,140712737832960,140712737832960,203967,135168,2433114060,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6402040Z","2025-11-19 22:37:27.6402040Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13800 svchost.exe",11472,,,"13800 svchost.exe",,,,,,,,,,,,,18446633084040806400,18446633084040781824,140712899206080,0,858544734208,4768,1763591847640204000,858550435840,858550403072,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6406317Z","2025-11-19 22:37:27.6406317Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 5536 svchost.exe",,,,,,,,,,,,,18446633084040835072,18446633084040810496,140712899206080,0,151912235008,3836,1763591847640631700,151921360896,151921328128,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6447936Z","2025-11-19 22:37:27.6447936Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",8320,,," 5252 WerFault.exe",,,"C:\Windows\System32\ncrypt.dll",,,,,,,,,,,,,,,,1763591847644793600,,,,,140712841445376,140712841445376,272959,196608,3912253876,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6450798Z","2025-11-19 22:37:27.6450798Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",8320,,," 5252 WerFault.exe",,,"C:\Windows\System32\ntasn1.dll",,,,,,,,,,,,,,,,1763591847645079800,,,,,140712841117696,140712841117696,300816,258048,2667946327,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6454299Z","2025-11-19 22:37:27.6454299Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",8320,,," 5252 WerFault.exe",,,"C:\Windows\System32\ncryptsslp.dll",,,,,,,,,,,,,,,,1763591847645430000,,,,,140712682061824,140712682061824,310492,270336,4015176457,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6461082Z","2025-11-19 22:37:27.6461082Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",8320,,," 5252 WerFault.exe",,,"C:\Windows\System32\msasn1.dll",,,,,,,,,,,,,,,,1763591847646108200,,,,,140712839675904,140712839675904,150871,77824,2536054058,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6494965Z","2025-11-19 22:37:27.6494965Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",8320,,," 5252 WerFault.exe",,,"C:\Windows\System32\cryptnet.dll",,,,,,,,,,,,,,,,1763591847649496500,,,,,140712595161088,140712595161088,304772,241664,919073152,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6840379Z","2025-11-19 22:37:27.6840379Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13780 WmiPrvSE.exe",4420,,,"13780 WmiPrvSE.exe",,,,,,,,,,,,,18446633084016447488,18446633084016422912,140712899206080,0,157585104896,4420,1763591847684037900,157587341312,157587275776,140712899206080,4863993,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6840511Z","2025-11-19 22:37:27.6840511Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13780 WmiPrvSE.exe",6868,,,"13780 WmiPrvSE.exe",,,,,,,,,,,,,18446633084055474176,18446633084055449600,140712899206080,0,157585096704,6868,1763591847684051100,157586817024,157586751488,140712899206080,5062025,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.9160604Z","2025-11-19 22:37:27.9160604Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084037419008,18446633084037394432,140712806010720,0,295361277952,5544,1763591847916060400,295366557696,295366512640,140712806010720,887249451,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.9166947Z","2025-11-19 22:37:27.9166947Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591847916694700,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.9172748Z","2025-11-19 22:37:27.9172748Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591847917274800,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.9193515Z","2025-11-19 22:37:27.9193515Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591847919351500,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.9199738Z","2025-11-19 22:37:27.9199738Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591847919973800,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.9222210Z","2025-11-19 22:37:27.9222210Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591847922221000,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.9227097Z","2025-11-19 22:37:27.9227097Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591847922709700,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.9529632Z","2025-11-19 22:37:27.9529632Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",8500,,," 1040 svchost.exe",,,,,,,,,,,,,18446633084041007104,18446633084040982528,140712899206080,0,256031072256,13776,1763591847952963200,256038666240,256038633472,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.0426628Z","2025-11-19 22:37:28.0426628Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\rsaenh.dll",,,,,,,,,,,,,,,,1763591848042662900,,,,,140712829976576,140712829976576,300007,237568,1319378437,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.0449576Z","2025-11-19 22:37:28.0449576Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,,,,,,,1763591848044957600,,,,,140712426930176,140712426930176,1213372,1146880,2699219668,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.0455479Z","2025-11-19 22:37:28.0455479Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591848045547900,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.0461797Z","2025-11-19 22:37:28.0461797Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591848046179700,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.0462330Z","2025-11-19 22:37:28.0462330Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,,,,,,,1763591848046233000,,,,,140712426930176,140712426930176,1213372,1159168,2699219668,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.0467594Z","2025-11-19 22:37:28.0467594Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,,,,,,,1763591848046759400,,,,,140712426930176,140712426930176,1213372,1146880,2699219668,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.0594084Z","2025-11-19 22:37:28.0594084Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,,,,,,,1763591848059408400,,,,,140712531263488,140712531263488,1042724,999424,915912993,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.0633692Z","2025-11-19 22:37:28.0633692Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,,,,,,,1763591848063369200,,,,,140712531263488,140712531263488,1042724,1011712,915912993,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.0634911Z","2025-11-19 22:37:28.0634911Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,,,,,,,1763591848063491100,,,,,140712426930176,140712426930176,1213372,1159168,2699219668,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.0637733Z","2025-11-19 22:37:28.0637733Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,,,,,,,1763591848063773300,,,,,140712531263488,140712531263488,1042724,999424,915912993,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2095024Z","2025-11-19 22:37:28.2095024Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,,,,,,,1763591848209502400,,,,,140712531263488,140712531263488,1042724,1011712,915912993,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2099766Z","2025-11-19 22:37:28.2099766Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\twinapi.appcore.dll",,,,,,,,,,,,,,,,1763591848209976600,,,,,140712720924672,140712720924672,2401519,2375680,2646458233,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2105757Z","2025-11-19 22:37:28.2105757Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591848210575700,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2116702Z","2025-11-19 22:37:28.2116702Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591848211670200,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2117422Z","2025-11-19 22:37:28.2117422Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\twinapi.appcore.dll",,,,,,,,,,,,,,,,1763591848211742200,,,,,140712720924672,140712720924672,2401519,2387968,2646458233,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2233628Z","2025-11-19 22:37:28.2233628Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5252 WerFault.exe",12628,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084035579904,18446633084035555328,140712899206080,0,295361220608,12628,1763591848223362800,295360462848,295360454656,140712899206080,7179256,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2233643Z","2025-11-19 22:37:28.2233643Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5252 WerFault.exe",8368,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084035608576,18446633084035584000,140712899206080,0,295361228800,8368,1763591848223364300,295363411968,295363403776,140712899206080,8636748,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2233701Z","2025-11-19 22:37:28.2233701Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5252 WerFault.exe",12560,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084036497408,18446633084036472832,140712899206080,0,295361245184,12560,1763591848223370100,295364460544,295364452352,140712899206080,281768,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2233711Z","2025-11-19 22:37:28.2233711Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5252 WerFault.exe",13036,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084035780608,18446633084035756032,140712899206080,0,295361236992,13036,1763591848223371100,295363936256,295363928064,140712899206080,7774840,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2233814Z","2025-11-19 22:37:28.2233814Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5252 WerFault.exe",1248,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084038164480,18446633084038139904,140712865112144,0,295361253376,1248,1763591848223381400,295364984832,295364976640,140712865112144,408507,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2233838Z","2025-11-19 22:37:28.2233838Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5252 WerFault.exe",10204,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084038193152,18446633084038168576,140712899206080,0,295361261568,10204,1763591848223383800,295365509120,295365480448,140712899206080,7920068,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2233994Z","2025-11-19 22:37:28.2233994Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5252 WerFault.exe",8320,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084038221824,18446633084038197248,140712899206080,0,295361269760,8320,1763591848223399400,295366033408,295366012928,140712899206080,49276648,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2233996Z","2025-11-19 22:37:28.2233996Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5252 WerFault.exe",13268,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084040347648,18446633084040323072,140712899206080,0,295361286144,13268,1763591848223399600,295367081984,295367065600,140712899206080,10564243,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2249315Z","2025-11-19 22:37:28.2249315Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084035321856,18446633084035297280,140702556693600,0,295361212416,14976,1763591848224931500,295359938560,295359860736,140702556693600,2468929032,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2260320Z","2025-11-19 22:37:28.2260320Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\WerFault.exe",,,,,,,,,,,,,,,,1763591848226032000,,,,,140702556684288,140702556684288,681036,647168,630084362,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2260414Z","2025-11-19 22:37:28.2260414Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\Faultrep.dll",,,,,,,,,,,,,,,,1763591848226041400,,,,,140712371552256,140712371552256,594974,548864,3149101438,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2260490Z","2025-11-19 22:37:28.2260490Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\aepic.dll",,,,,,,,,,,,,,,,1763591848226049000,,,,,140712428109824,140712428109824,641436,577536,321124434,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2260663Z","2025-11-19 22:37:28.2260663Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\CorePrivacySettingsStore.dll",,,,,,,,,,,,,,,,1763591848226066300,,,,,140712456290304,140712456290304,263379,196608,2978004593,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2260755Z","2025-11-19 22:37:28.2260755Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\DiagnosticDataSettings.dll",,,,,,,,,,,,,,,,1763591848226075500,,,,,140712462319616,140712462319616,108991,61440,3234151774,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2260829Z","2025-11-19 22:37:28.2260829Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\dbgcore.dll",,,,,,,,,,,,,,,,1763591848226082900,,,,,140712478244864,140712478244864,263772,245760,3120784319,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2260902Z","2025-11-19 22:37:28.2260902Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\cryptnet.dll",,,,,,,,,,,,,,,,1763591848226090200,,,,,140712595161088,140712595161088,304772,241664,919073152,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2260971Z","2025-11-19 22:37:28.2260971Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\webio.dll",,,,,,,,,,,,,,,,1763591848226097100,,,,,140712635531264,140712635531264,873482,827392,338769958,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2261005Z","2025-11-19 22:37:28.2261005Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.7019_none_3e06ffa0e335b8a8\comctl32.dll",,,,,,,,,,,,,,,,1763591848226100500,,,,,140712659910656,140712659910656,2747780,2703360,4095768276,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2261070Z","2025-11-19 22:37:28.2261070Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\dbghelp.dll",,,,,,,,,,,,,,,,1763591848226107000,,,,,140712664104960,140712664104960,2282862,2367488,82455296,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2261137Z","2025-11-19 22:37:28.2261137Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\ncryptsslp.dll",,,,,,,,,,,,,,,,1763591848226113700,,,,,140712682061824,140712682061824,310492,270336,4015176457,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2261280Z","2025-11-19 22:37:28.2261280Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\xmllite.dll",,,,,,,,,,,,,,,,1763591848226128000,,,,,140712684027904,140712684027904,342897,274432,974526834,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2261345Z","2025-11-19 22:37:28.2261345Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\netapi32.dll",,,,,,,,,,,,,,,,1763591848226134500,,,,,140712696348672,140712696348672,171999,106496,898597876,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2261415Z","2025-11-19 22:37:28.2261415Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\rasadhlp.dll",,,,,,,,,,,,,,,,1763591848226141500,,,,,140712730755072,140712730755072,108990,45056,352477361,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2261478Z","2025-11-19 22:37:28.2261478Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\FWPUCLNT.DLL",,,,,,,,,,,,,,,,1763591848226147800,,,,,140712731279360,140712731279360,561494,548864,3096342574,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2261544Z","2025-11-19 22:37:28.2261544Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\dhcpcsvc.dll",,,,,,,,,,,,,,,,1763591848226154400,,,,,140712746024960,140712746024960,184216,143360,916390222,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2261596Z","2025-11-19 22:37:28.2261596Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\winhttp.dll",,,,,,,,,,,,,,,,1763591848226159600,,,,,140712750350336,140712750350336,1261038,1212416,84984727,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2261657Z","2025-11-19 22:37:28.2261657Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\dhcpcsvc6.dll",,,,,,,,,,,,,,,,1763591848226165700,,,,,140712753233920,140712753233920,145503,122880,2114927498,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2261716Z","2025-11-19 22:37:28.2261716Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\dsreg.dll",,,,,,,,,,,,,,,,1763591848226171600,,,,,140712764768256,140712764768256,1520707,1466368,4143332483,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2261851Z","2025-11-19 22:37:28.2261851Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\uxtheme.dll",,,,,,,,,,,,,,,,1763591848226185100,,,,,140712802254848,140712802254848,696534,696320,1695798817,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2261926Z","2025-11-19 22:37:28.2261926Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\winnsi.dll",,,,,,,,,,,,,,,,1763591848226192600,,,,,140712802975744,140712802975744,95519,61440,2268955118,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2261994Z","2025-11-19 22:37:28.2261994Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\wer.dll",,,,,,,,,,,,,,,,1763591848226199400,,,,,140712805728256,140712805728256,993632,983040,1987637995,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2262056Z","2025-11-19 22:37:28.2262056Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\rmclient.dll",,,,,,,,,,,,,,,,1763591848226205600,,,,,140712808808448,140712808808448,282526,221184,1891057501,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2262127Z","2025-11-19 22:37:28.2262127Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\windows.storage.dll",,,,,,,,,,,,,,,,1763591848226212700,,,,,140712812412928,140712812412928,8877403,8769536,3667346596,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2262183Z","2025-11-19 22:37:28.2262183Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\IPHLPAPI.DLL",,,,,,,,,,,,,,,,1763591848226218300,,,,,140712824012800,140712824012800,233044,212992,945822897,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2262248Z","2025-11-19 22:37:28.2262248Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\dnsapi.dll",,,,,,,,,,,,,,,,1763591848226224800,,,,,140712824274944,140712824274944,1293169,1228800,1381219389,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2262313Z","2025-11-19 22:37:28.2262313Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\schannel.dll",,,,,,,,,,,,,,,,1763591848226231300,,,,,140712828731392,140712828731392,849052,802816,24806266,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2262373Z","2025-11-19 22:37:28.2262373Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\rsaenh.dll",,,,,,,,,,,,,,,,1763591848226237300,,,,,140712829976576,140712829976576,300007,237568,1319378437,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2262514Z","2025-11-19 22:37:28.2262514Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591848226251400,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2262578Z","2025-11-19 22:37:28.2262578Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\ntmarta.dll",,,,,,,,,,,,,,,,1763591848226257800,,,,,140712831811584,140712831811584,265798,221184,3598506564,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2262643Z","2025-11-19 22:37:28.2262643Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\sspicli.dll",,,,,,,,,,,,,,,,1763591848226264300,,,,,140712833384448,140712833384448,339222,299008,3030302172,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2262707Z","2025-11-19 22:37:28.2262707Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\mswsock.dll",,,,,,,,,,,,,,,,1763591848226270700,,,,,140712836333568,140712836333568,491870,438272,897307513,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2262760Z","2025-11-19 22:37:28.2262760Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\userenv.dll",,,,,,,,,,,,,,,,1763591848226276000,,,,,140712837054464,140712837054464,245008,176128,731547084,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2262818Z","2025-11-19 22:37:28.2262818Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\cryptsp.dll",,,,,,,,,,,,,,,,1763591848226281800,,,,,140712839217152,140712839217152,146168,110592,1658328178,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2262876Z","2025-11-19 22:37:28.2262876Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\cryptbase.dll",,,,,,,,,,,,,,,,1763591848226287600,,,,,140712839348224,140712839348224,63718,49152,3897879906,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2262935Z","2025-11-19 22:37:28.2262935Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\msasn1.dll",,,,,,,,,,,,,,,,1763591848226293500,,,,,140712839675904,140712839675904,150871,77824,2536054058,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2262990Z","2025-11-19 22:37:28.2262990Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\ntasn1.dll",,,,,,,,,,,,,,,,1763591848226299000,,,,,140712841117696,140712841117696,300816,258048,2667946327,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2263115Z","2025-11-19 22:37:28.2263115Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\ncrypt.dll",,,,,,,,,,,,,,,,1763591848226311500,,,,,140712841445376,140712841445376,272959,196608,3912253876,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2263178Z","2025-11-19 22:37:28.2263178Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\cfgmgr32.dll",,,,,,,,,,,,,,,,1763591848226317800,,,,,140712845049856,140712845049856,385808,356352,1737777300,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2263247Z","2025-11-19 22:37:28.2263247Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\dpapi.dll",,,,,,,,,,,,,,,,1763591848226324700,,,,,140712845574144,140712845574144,42814,40960,2473566603,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2263302Z","2025-11-19 22:37:28.2263302Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\umpdc.dll",,,,,,,,,,,,,,,,1763591848226330200,,,,,140712848064512,140712848064512,98535,81920,1714427184,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2263358Z","2025-11-19 22:37:28.2263358Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\powrprof.dll",,,,,,,,,,,,,,,,1763591848226335800,,,,,140712848195584,140712848195584,457799,385024,2858637235,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2263414Z","2025-11-19 22:37:28.2263414Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\bcrypt.dll",,,,,,,,,,,,,,,,1763591848226341400,,,,,140712848654336,140712848654336,206048,172032,2893678010,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2263472Z","2025-11-19 22:37:28.2263472Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\profapi.dll",,,,,,,,,,,,,,,,1763591848226347200,,,,,140712848850944,140712848850944,229548,167936,2447194521,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2263531Z","2025-11-19 22:37:28.2263531Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\crypt32.dll",,,,,,,,,,,,,,,,1763591848226353100,,,,,140712849768448,140712849768448,1584869,1536000,3438168074,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2263591Z","2025-11-19 22:37:28.2263591Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,,,,,,,1763591848226359100,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2263730Z","2025-11-19 22:37:28.2263730Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591848226373000,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2263791Z","2025-11-19 22:37:28.2263791Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591848226379100,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2263858Z","2025-11-19 22:37:28.2263858Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591848226385800,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2263912Z","2025-11-19 22:37:28.2263912Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591848226391200,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2264090Z","2025-11-19 22:37:28.2264090Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591848226409000,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2264151Z","2025-11-19 22:37:28.2264151Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591848226415100,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2264211Z","2025-11-19 22:37:28.2264211Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,,,,,,,1763591848226421100,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2264338Z","2025-11-19 22:37:28.2264338Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\shlwapi.dll",,,,,,,,,,,,,,,,1763591848226433800,,,,,140712868839424,140712868839424,479562,421888,2142510382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2264398Z","2025-11-19 22:37:28.2264398Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591848226439800,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2264462Z","2025-11-19 22:37:28.2264462Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,,,,,,,1763591848226446200,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2264520Z","2025-11-19 22:37:28.2264520Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\ws2_32.dll",,,,,,,,,,,,,,,,1763591848226452000,,,,,140712881094656,140712881094656,513405,475136,3967481067,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2264578Z","2025-11-19 22:37:28.2264578Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591848226457800,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2264630Z","2025-11-19 22:37:28.2264630Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591848226463000,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2264687Z","2025-11-19 22:37:28.2264687Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,,,,,,,1763591848226468700,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2264744Z","2025-11-19 22:37:28.2264744Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,,,,,,,1763591848226474400,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2264800Z","2025-11-19 22:37:28.2264800Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591848226480000,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2264909Z","2025-11-19 22:37:28.2264909Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,,,,,,,1763591848226490900,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2264987Z","2025-11-19 22:37:28.2264987Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\nsi.dll",,,,,,,,,,,,,,,,1763591848226498700,,,,,140712892956672,140712892956672,111648,40960,4223476491,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2265073Z","2025-11-19 22:37:28.2265073Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\msctf.dll",,,,,,,,,,,,,,,,1763591848226507300,,,,,140712893022208,140712893022208,1455420,1433600,4155718050,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2265148Z","2025-11-19 22:37:28.2265148Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591848226514800,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2265371Z","2025-11-19 22:37:28.2265371Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591848226537100,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2265435Z","2025-11-19 22:37:28.2265435Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591848226543500,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2265618Z","2025-11-19 22:37:28.2265618Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"WerFault.exe",,,,,,,,,,,,,,,,1763591848226561800,,,,,,,,,,134080654472445997,,,,,,,6634,,,,,5734400,13971456,3457303163,0,134080654488973699,205,0,83,2286,3,406,81 +"2025-11-19 22:37:28.2299996Z","2025-11-19 22:37:28.2299996Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,,,,,,,,,,,18446633084031987712,18446633084031963136,2513113579520,0,705865949184,14412,1763591848229999600,705865449472,705865428992,2513113579520,45081055,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2302606Z","2025-11-19 22:37:28.2302606Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\whoami.exe",,,,,,,,,,,,,,,,1763591848230260600,,,,,140702344609792,140702344609792,160109,98304,3602411345,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2302692Z","2025-11-19 22:37:28.2302692Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\wkscli.dll",,,,,,,,,,,,,,,,1763591848230269200,,,,,140712738291712,140712738291712,170846,110592,1225555544,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2302764Z","2025-11-19 22:37:28.2302764Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\version.dll",,,,,,,,,,,,,,,,1763591848230276400,,,,,140712753168384,140712753168384,72452,45056,2275202464,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2302833Z","2025-11-19 22:37:28.2302833Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\apphelp.dll",,,,,,,,,,,,,,,,1763591848230283300,,,,,140712800485376,140712800485376,675806,651264,4108425587,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2302892Z","2025-11-19 22:37:28.2302892Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\netutils.dll",,,,,,,,,,,,,,,,1763591848230289200,,,,,140712825847808,140712825847808,80696,53248,865845000,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2303031Z","2025-11-19 22:37:28.2303031Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\authz.dll",,,,,,,,,,,,,,,,1763591848230303100,,,,,140712826241024,140712826241024,372179,327680,771731569,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2303108Z","2025-11-19 22:37:28.2303108Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\sspicli.dll",,,,,,,,,,,,,,,,1763591848230310800,,,,,140712833384448,140712833384448,339222,299008,3030302172,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2303160Z","2025-11-19 22:37:28.2303160Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591848230316000,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2303209Z","2025-11-19 22:37:28.2303209Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591848230320900,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2303256Z","2025-11-19 22:37:28.2303256Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591848230325600,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2303305Z","2025-11-19 22:37:28.2303305Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591848230330500,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2303347Z","2025-11-19 22:37:28.2303347Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591848230334700,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2303393Z","2025-11-19 22:37:28.2303393Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591848230339300,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2303441Z","2025-11-19 22:37:28.2303441Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591848230344100,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2303485Z","2025-11-19 22:37:28.2303485Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\ws2_32.dll",,,,,,,,,,,,,,,,1763591848230348500,,,,,140712881094656,140712881094656,513405,475136,3967481067,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2303531Z","2025-11-19 22:37:28.2303531Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591848230353100,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2303660Z","2025-11-19 22:37:28.2303660Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591848230366000,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2303718Z","2025-11-19 22:37:28.2303718Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,,,,,,,1763591848230371800,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2303766Z","2025-11-19 22:37:28.2303766Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591848230376600,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2303812Z","2025-11-19 22:37:28.2303812Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591848230381200,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2303855Z","2025-11-19 22:37:28.2303855Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591848230385500,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2303897Z","2025-11-19 22:37:28.2303897Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591848230389700,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2303954Z","2025-11-19 22:37:28.2303954Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"whoami.exe",,,,,,,,,,,,,,,,1763591848230395400,,,,,,,,,,134080654423385232,,,,,,,6628,,,,,1265664,1310720,56924383,3221225477,134080654489015372,83,0,1,3,3,0,0 +"2025-11-19 22:37:28.2307155Z","2025-11-19 22:37:28.2307155Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",3864,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028424192,18446633084028399616,140712899206080,0,696750415872,3864,1763591848230715500,696752537600,696752529408,140712899206080,11277899,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2307156Z","2025-11-19 22:37:28.2307156Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028022784,18446633084027998208,140702989817872,0,696750407680,5408,1763591848230715600,696748802048,696748781568,140702989817872,67845830,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2307184Z","2025-11-19 22:37:28.2307184Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",8232,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028223488,18446633084028198912,140712865112144,0,696750440448,8232,1763591848230718400,696755683328,696755675136,140712865112144,269699,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2307232Z","2025-11-19 22:37:28.2307232Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",12624,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028911616,18446633084028887040,140702989233856,0,696750473216,12624,1763591848230723200,696759877632,696759869440,140702989233856,1887132,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2307235Z","2025-11-19 22:37:28.2307235Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",14384,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028510208,18446633084028485632,140712899206080,0,696750432256,14384,1763591848230723500,696754634752,696754622464,140712899206080,8595642,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2307333Z","2025-11-19 22:37:28.2307333Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",9776,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084029231104,18446633084029206528,140702989404080,0,696750489600,9776,1763591848230733300,696761974784,696761962496,140702989404080,957334,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2307340Z","2025-11-19 22:37:28.2307340Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",12484,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028481536,18446633084028456960,140712899206080,0,696750424064,12484,1763591848230734000,696753586176,696753573888,140712899206080,10699281,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2307385Z","2025-11-19 22:37:28.2307385Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",1184,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084035321856,18446633084035297280,140702989086576,0,696750481408,1184,1763591848230738500,696760926208,696760918016,140702989086576,2934612,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2307426Z","2025-11-19 22:37:28.2307426Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",14248,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028538880,18446633084028514304,140712899206080,0,696750448640,14248,1763591848230742600,696756731904,696756690944,140712899206080,21428731,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2307493Z","2025-11-19 22:37:28.2307493Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",10496,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028596224,18446633084028571648,140712899206080,0,696750456832,10496,1763591848230749300,696757780480,696757751808,140712899206080,16702796,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2317641Z","2025-11-19 22:37:28.2317641Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084029116416,18446633084029091840,140702989217024,0,696750465024,8552,1763591848231764100,696758829056,696758800384,140702989217024,18009798,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2326527Z","2025-11-19 22:37:28.2326527Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\OpenConsole.exe",,,,,,,,,,,,,,,,1763591848232652700,,,,,140702989025280,140702989025280,1210794,1159168,1759975785,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2326672Z","2025-11-19 22:37:28.2326672Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\usp10.dll",,,,,,,,,,,,,,,,1763591848232667200,,,,,140711462174720,140711462174720,161304,102400,728066498,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2326761Z","2025-11-19 22:37:28.2326761Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\UIAutomationCore.dll",,,,,,,,,,,,,,,,1763591848232676100,,,,,140712432762880,140712432762880,4328257,4296704,2096711852,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2326830Z","2025-11-19 22:37:28.2326830Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\winmm.dll",,,,,,,,,,,,,,,,1763591848232683000,,,,,140712663842816,140712663842816,263815,217088,2106743460,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2326910Z","2025-11-19 22:37:28.2326910Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,,,,,,,1763591848232691000,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2327022Z","2025-11-19 22:37:28.2327022Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\PackagedCom\OpenConsoleProxy.dll",,,,,,,,,,,,,,,,1763591848232702200,,,,,140712723349504,140712723349504,51292,53248,1759975238,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2327106Z","2025-11-19 22:37:28.2327106Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\propsys.dll",,,,,,,,,,,,,,,,1763591848232710600,,,,,140712761491456,140712761491456,1123662,1060864,3228732737,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2327174Z","2025-11-19 22:37:28.2327174Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\D3DCompiler_47.dll",,,,,,,,,,,,,,,,1763591848232717400,,,,,140712769814528,140712769814528,4685395,4714496,796813953,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2327237Z","2025-11-19 22:37:28.2327237Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\d2d1.dll",,,,,,,,,,,,,,,,1763591848232723700,,,,,140712777744384,140712777744384,6610469,6537216,3013069957,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2327294Z","2025-11-19 22:37:28.2327294Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\DWrite.dll",,,,,,,,,,,,,,,,1763591848232729400,,,,,140712784297984,140712784297984,2543119,2519040,1462185185,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2327341Z","2025-11-19 22:37:28.2327341Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\d3d11.dll",,,,,,,,,,,,,,,,1763591848232734100,,,,,140712786853888,140712786853888,2582658,2498560,2128032819,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2327397Z","2025-11-19 22:37:28.2327397Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\uxtheme.dll",,,,,,,,,,,,,,,,1763591848232739700,,,,,140712802254848,140712802254848,696534,696320,1695798817,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2327454Z","2025-11-19 22:37:28.2327454Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\dxgi.dll",,,,,,,,,,,,,,,,1763591848232745400,,,,,140712803631104,140712803631104,1320096,1282048,1861212996,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2327519Z","2025-11-19 22:37:28.2327519Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\windows.storage.dll",,,,,,,,,,,,,,,,1763591848232751900,,,,,140712812412928,140712812412928,8877403,8769536,3667346596,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2327660Z","2025-11-19 22:37:28.2327660Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591848232766000,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2327719Z","2025-11-19 22:37:28.2327719Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\cryptsp.dll",,,,,,,,,,,,,,,,1763591848232771900,,,,,140712839217152,140712839217152,146168,110592,1658328178,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2327775Z","2025-11-19 22:37:28.2327775Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\umpdc.dll",,,,,,,,,,,,,,,,1763591848232777500,,,,,140712848064512,140712848064512,98535,81920,1714427184,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2327833Z","2025-11-19 22:37:28.2327833Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\powrprof.dll",,,,,,,,,,,,,,,,1763591848232783300,,,,,140712848195584,140712848195584,457799,385024,2858637235,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2327899Z","2025-11-19 22:37:28.2327899Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,,,,,,,1763591848232789900,,,,,140712851341312,140712851341312,1524912,1486848,1404855129,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2327955Z","2025-11-19 22:37:28.2327955Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,,,,,,,1763591848232795500,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2328001Z","2025-11-19 22:37:28.2328001Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591848232800100,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2328042Z","2025-11-19 22:37:28.2328042Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591848232804200,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2328085Z","2025-11-19 22:37:28.2328085Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591848232808500,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2328132Z","2025-11-19 22:37:28.2328132Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591848232813200,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2328254Z","2025-11-19 22:37:28.2328254Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591848232825400,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2328309Z","2025-11-19 22:37:28.2328309Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591848232830900,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2328359Z","2025-11-19 22:37:28.2328359Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,,,,,,,1763591848232835900,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2328415Z","2025-11-19 22:37:28.2328415Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,,,,,,,1763591848232841500,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2328461Z","2025-11-19 22:37:28.2328461Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591848232846100,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2328512Z","2025-11-19 22:37:28.2328512Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,,,,,,,1763591848232851200,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2328555Z","2025-11-19 22:37:28.2328555Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591848232855500,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2328593Z","2025-11-19 22:37:28.2328593Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591848232859300,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2328635Z","2025-11-19 22:37:28.2328635Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,,,,,,,1763591848232863500,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2328690Z","2025-11-19 22:37:28.2328690Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,,,,,,,1763591848232869000,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2328735Z","2025-11-19 22:37:28.2328735Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591848232873500,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2328866Z","2025-11-19 22:37:28.2328866Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,,,,,,,1763591848232886600,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2328921Z","2025-11-19 22:37:28.2328921Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591848232892100,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2328961Z","2025-11-19 22:37:28.2328961Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591848232896100,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2329003Z","2025-11-19 22:37:28.2329003Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591848232900300,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2329108Z","2025-11-19 22:37:28.2329108Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"OpenConsole.ex",,,,,,,,,,,,,,,,1763591848232910800,,,,,,,,,,134080654410427174,,,,,,,6626,,,,,2904064,2949120,170556274,0,134080654489038872,111,0,12,10,3,52,0 +"2025-11-19 22:37:28.2332799Z","2025-11-19 22:37:28.2332799Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13300 conhost.exe",6828,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028309504,18446633084028284928,140712899206080,0,689119428608,6828,1763591848233279900,689122574336,689122566144,140712899206080,96563,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2332863Z","2025-11-19 22:37:28.2332863Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13300 conhost.exe",14856,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028137472,18446633084028112896,140712899206080,0,689119420416,14856,1763591848233286300,689121525760,689121517568,140712899206080,553353,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2333040Z","2025-11-19 22:37:28.2333040Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13300 conhost.exe",3620,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028108800,18446633084028084224,140712865112144,0,689119412224,3620,1763591848233304000,689121001472,689120993280,140712865112144,120327,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2333088Z","2025-11-19 22:37:28.2333088Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13300 conhost.exe",10848,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084027535360,18446633084027510784,140712899206080,0,689119404032,10848,1763591848233308800,689120477184,689120468992,140712899206080,764586,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2333200Z","2025-11-19 22:37:28.2333200Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13300 conhost.exe",6452,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028252160,18446633084028227584,140696384580832,0,689119395840,6452,1763591848233320000,689122050048,689122021376,140696384580832,28729820,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2336004Z","2025-11-19 22:37:28.2336004Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084029374464,18446633084029349888,140696385038832,0,689119436800,4352,1763591848233600400,689123098624,689123086336,140696385038832,745725,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2340005Z","2025-11-19 22:37:28.2340005Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\Windows\System32\conhost.exe",,,,,,,,,,,,,,,,1763591848234000500,,,,,140696384438272,140696384438272,1035098,1028096,2671108986,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2340090Z","2025-11-19 22:37:28.2340090Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,,,,,,,1763591848234009000,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2340120Z","2025-11-19 22:37:28.2340120Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\PackagedCom\OpenConsoleProxy.dll",,,,,,,,,,,,,,,,1763591848234012000,,,,,140712723349504,140712723349504,51292,53248,1759975238,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2340177Z","2025-11-19 22:37:28.2340177Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591848234017700,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2340228Z","2025-11-19 22:37:28.2340228Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,,,,,,,1763591848234022800,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2340271Z","2025-11-19 22:37:28.2340271Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591848234027100,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2340313Z","2025-11-19 22:37:28.2340313Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591848234031300,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2340356Z","2025-11-19 22:37:28.2340356Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591848234035600,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2340403Z","2025-11-19 22:37:28.2340403Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591848234040300,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2340514Z","2025-11-19 22:37:28.2340514Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591848234051400,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2340576Z","2025-11-19 22:37:28.2340576Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591848234057600,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2340631Z","2025-11-19 22:37:28.2340631Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",6612,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029632512,18446633084029607936,140712373211440,0,932562563072,6612,1763591848234063100,932579377152,932579237888,140712373211440,6105737,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2340633Z","2025-11-19 22:37:28.2340633Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,,,,,,,1763591848234063300,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2340679Z","2025-11-19 22:37:28.2340679Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591848234067900,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2340723Z","2025-11-19 22:37:28.2340723Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,,,,,,,1763591848234072300,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2340926Z","2025-11-19 22:37:28.2340926Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591848234092600,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2340973Z","2025-11-19 22:37:28.2340973Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591848234097300,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2341016Z","2025-11-19 22:37:28.2341016Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,,,,,,,1763591848234101600,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2341131Z","2025-11-19 22:37:28.2341131Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,,,,,,,1763591848234113100,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2341189Z","2025-11-19 22:37:28.2341189Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591848234118900,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2341244Z","2025-11-19 22:37:28.2341244Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591848234124400,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2341291Z","2025-11-19 22:37:28.2341291Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591848234129100,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2341330Z","2025-11-19 22:37:28.2341330Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591848234133000,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2341385Z","2025-11-19 22:37:28.2341385Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"conhost.exe",,,,,,,,,,,,,,,,1763591848234138500,,,,,,,,,,134080654410205145,,,,,,,6625,,,,,1556480,1605632,60704691,109,134080654489052028,92,0,5,0,3,0,0 +"2025-11-19 22:37:28.2493114Z","2025-11-19 22:37:28.2493114Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",9352,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029317120,18446633084029292544,140712899206080,0,932562546688,9352,1763591848249311400,932577280000,932577267712,140712899206080,3968522,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493126Z","2025-11-19 22:37:28.2493126Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",13692,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028653568,18446633084028628992,140712865112144,0,932562554880,13692,1763591848249312600,932578328576,932578308096,140712865112144,8869104,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493138Z","2025-11-19 22:37:28.2493138Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",14632,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029947904,18446633084029923328,140712899206080,0,932562579456,14632,1763591848249313800,932581474304,932581453824,140712899206080,2144557027,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493139Z","2025-11-19 22:37:28.2493139Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",13488,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028854272,18446633084028829696,140712604173856,0,932562513920,13488,1763591848249313900,932574134272,932574130176,140712604173856,12990007,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493172Z","2025-11-19 22:37:28.2493172Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028624896,18446633084028600320,140702319920256,0,932562440192,2344,1763591848249317200,932564697088,932564606976,140702319920256,1455950499,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493206Z","2025-11-19 22:37:28.2493206Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",6260,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028882944,18446633084028858368,140712378637616,0,932562571264,6260,1763591848249320600,932580425728,932580397056,140712378637616,74326129,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493288Z","2025-11-19 22:37:28.2493288Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",13068,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084056907776,18446633084056883200,140712899206080,0,932562530304,13068,1763591848249328800,932575182848,932575174656,140712899206080,1442413,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493310Z","2025-11-19 22:37:28.2493310Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",4192,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029173760,18446633084029149184,140712632221632,0,932562522112,4192,1763591848249331000,932573085696,932573073408,140712632221632,3191112,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493327Z","2025-11-19 22:37:28.2493327Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",3424,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029546496,18446633084029521920,140712899206080,0,932562587648,3424,1763591848249332700,932582522880,932582510592,140712899206080,7336541,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493342Z","2025-11-19 22:37:28.2493342Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",14684,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028968960,18446633084028944384,140712899206080,0,932562595840,14684,1763591848249334200,932583571456,932583559168,140712899206080,3853099,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493343Z","2025-11-19 22:37:28.2493343Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",3272,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028682240,18446633084028657664,140712899206080,0,932562456576,3272,1763591848249334300,932566794240,932566781952,140712899206080,18018463,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493346Z","2025-11-19 22:37:28.2493346Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028710912,18446633084028686336,140712899206080,0,932562464768,12328,1763591848249334600,932567842816,932567830528,140712899206080,16404047,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493363Z","2025-11-19 22:37:28.2493363Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",6564,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084030005248,18446633084029980672,140712899206080,0,932562612224,6564,1763591848249336300,932585668608,932585660416,140712899206080,1315295,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493371Z","2025-11-19 22:37:28.2493371Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",12924,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084030033920,18446633084030009344,140712899206080,0,932562620416,12924,1763591848249337100,932586717184,932586708992,140712899206080,807962,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493410Z","2025-11-19 22:37:28.2493410Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",13344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029976576,18446633084029952000,140712899206080,0,932562604032,13344,1763591848249341000,932584620032,932584611840,140712899206080,1766050,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493421Z","2025-11-19 22:37:28.2493421Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",10628,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084010672128,18446633084010647552,140712899206080,0,932562472960,10628,1763591848249342100,932568891392,932568879104,140712899206080,4099788,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493446Z","2025-11-19 22:37:28.2493446Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",11164,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028739584,18446633084028715008,140712865112144,0,932562481152,11164,1763591848249344600,932569939968,932569931776,140712865112144,142205,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493466Z","2025-11-19 22:37:28.2493466Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",6140,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028080128,18446633084028055552,140712899206080,0,932562448384,6140,1763591848249346600,932565745664,932565729280,140712899206080,30190715,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493471Z","2025-11-19 22:37:28.2493471Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",13704,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084030062592,18446633084030038016,140712899206080,0,932562628608,13704,1763591848249347100,932587765760,932587761664,140712899206080,393419,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2494031Z","2025-11-19 22:37:28.2494031Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",11792,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029026304,18446633084029001728,140712891292720,0,932562497536,11792,1763591848249403100,932572037120,932572016640,140712891292720,10320952,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2494319Z","2025-11-19 22:37:28.2494319Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",9736,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028768256,18446633084028743680,140712899206080,0,932562489344,9736,1763591848249431900,932570988544,932570972160,140712899206080,8949073,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2494409Z","2025-11-19 22:37:28.2494409Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",4376,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084027793408,18446633084027768832,140712583404848,0,932562538496,4376,1763591848249440900,932576231424,932576223232,140712583404848,640863,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2560561Z","2025-11-19 22:37:28.2560561Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe",,,,,,,,,,,,,,,,1763591848256056100,,,,,140702319640576,140702319640576,738129,684032,1759975821,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2560635Z","2025-11-19 22:37:28.2560635Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.8_8.2501.31001.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.dll",,,,,,,,,,,,,,,,1763591848256063500,,,,,140710095028224,140710095028224,5866761,5873664,2056920596,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2560673Z","2025-11-19 22:37:28.2560673Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\ProgramData\Microsoft\VisualStudio\Setup\x64\Microsoft.VisualStudio.Setup.Configuration.Native.dll",,,,,,,,,,,,,,,,1763591848256067300,,,,,140711212089344,140711212089344,1007466,1015808,1726088073,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2560707Z","2025-11-19 22:37:28.2560707Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\TerminalApp.dll",,,,,,,,,,,,,,,,1763591848256070700,,,,,140711774912512,140711774912512,3444084,3444736,1759975751,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2560928Z","2025-11-19 22:37:28.2560928Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\msftedit.dll",,,,,,,,,,,,,,,,1763591848256092800,,,,,140712289107968,140712289107968,3297357,3305472,3878106343,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2561168Z","2025-11-19 22:37:28.2561168Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\ExplorerFrame.dll",,,,,,,,,,,,,,,,1763591848256116800,,,,,140712345862144,140712345862144,2919775,2867200,3427672670,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2561213Z","2025-11-19 22:37:28.2561213Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\TerminalConnection.dll",,,,,,,,,,,,,,,,1763591848256121300,,,,,140712372994048,140712372994048,522798,495616,1759975254,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2561296Z","2025-11-19 22:37:28.2561296Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\Microsoft.Terminal.Settings.Model.dll",,,,,,,,,,,,,,,,1763591848256129600,,,,,140712373518336,140712373518336,2281369,2252800,1759975487,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2561330Z","2025-11-19 22:37:28.2561330Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\Microsoft.Terminal.Control.dll",,,,,,,,,,,,,,,,1763591848256133000,,,,,140712378368000,140712378368000,1976337,1986560,1759975378,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2561422Z","2025-11-19 22:37:28.2561422Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\DataExchange.dll",,,,,,,,,,,,,,,,1763591848256142200,,,,,140712406614016,140712406614016,399312,368640,696309968,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2561507Z","2025-11-19 22:37:28.2561507Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\twinapi.dll",,,,,,,,,,,,,,,,1763591848256150700,,,,,140712415789056,140712415789056,924452,868352,2129603828,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2561594Z","2025-11-19 22:37:28.2561594Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\UIAutomationCore.dll",,,,,,,,,,,,,,,,1763591848256159400,,,,,140712432762880,140712432762880,4328257,4296704,2096711852,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2561754Z","2025-11-19 22:37:28.2561754Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\UiaManager.dll",,,,,,,,,,,,,,,,1763591848256175400,,,,,140712461205504,140712461205504,941078,897024,2628067039,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2561838Z","2025-11-19 22:37:28.2561838Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\AppExtension.dll",,,,,,,,,,,,,,,,1763591848256183800,,,,,140712467365888,140712467365888,337294,299008,1656953249,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2561925Z","2025-11-19 22:37:28.2561925Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.StateRepositoryPS.dll",,,,,,,,,,,,,,,,1763591848256192500,,,,,140712490369024,140712490369024,879719,802816,374042279,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2561999Z","2025-11-19 22:37:28.2561999Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.ApplicationModel.dll",,,,,,,,,,,,,,,,1763591848256199900,,,,,140712508391424,140712508391424,945679,876544,2857312343,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2562031Z","2025-11-19 22:37:28.2562031Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\Microsoft.Terminal.UI.dll",,,,,,,,,,,,,,,,1763591848256203100,,,,,140712537882624,140712537882624,255391,258048,1759975265,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2562104Z","2025-11-19 22:37:28.2562104Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\threadpoolwinrt.dll",,,,,,,,,,,,,,,,1763591848256210400,,,,,140712555839488,140712555839488,130107,90112,2299561022,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2562181Z","2025-11-19 22:37:28.2562181Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.UI.Core.TextInput.dll",,,,,,,,,,,,,,,,1763591848256218100,,,,,140712572354560,140712572354560,1511216,1499136,21441667,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2562329Z","2025-11-19 22:37:28.2562329Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\directmanipulation.dll",,,,,,,,,,,,,,,,1763591848256232900,,,,,140712583036928,140712583036928,714070,667648,3434535107,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2562400Z","2025-11-19 22:37:28.2562400Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\InputHost.dll",,,,,,,,,,,,,,,,1763591848256240000,,,,,140712583757824,140712583757824,1989124,1970176,2937052880,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2562470Z","2025-11-19 22:37:28.2562470Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\TextShaping.dll",,,,,,,,,,,,,,,,1763591848256247000,,,,,140712585789440,140712585789440,770155,733184,2109619091,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2562535Z","2025-11-19 22:37:28.2562535Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.UI.Xaml.Controls.dll",,,,,,,,,,,,,,,,1763591848256253500,,,,,140712586575872,140712586575872,3327252,3313664,3689468694,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2562613Z","2025-11-19 22:37:28.2562613Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.Globalization.dll",,,,,,,,,,,,,,,,1763591848256261300,,,,,140712593457152,140712593457152,1640332,1634304,3240919660,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2562695Z","2025-11-19 22:37:28.2562695Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.UI.Immersive.dll",,,,,,,,,,,,,,,,1763591848256269500,,,,,140712595423232,140712595423232,1424120,1372160,1559948871,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2562788Z","2025-11-19 22:37:28.2562788Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.UI.Xaml.dll",,,,,,,,,,,,,,,,1763591848256278900,,,,,140712596865024,140712596865024,17882163,17858560,706442395,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2562998Z","2025-11-19 22:37:28.2562998Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.UI.dll",,,,,,,,,,,,,,,,1763591848256299800,,,,,140712615346176,140712615346176,1414164,1376256,3301850593,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2563109Z","2025-11-19 22:37:28.2563109Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\globinputhost.dll",,,,,,,,,,,,,,,,1763591848256310900,,,,,140712627863552,140712627863552,263563,208896,1786968813,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2563179Z","2025-11-19 22:37:28.2563179Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\BCP47mrm.dll",,,,,,,,,,,,,,,,1763591848256317900,,,,,140712628322304,140712628322304,278903,212992,835504572,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2563247Z","2025-11-19 22:37:28.2563247Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\TextInputFramework.dll",,,,,,,,,,,,,,,,1763591848256324700,,,,,140712628846592,140712628846592,1374424,1339392,3535451269,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2563309Z","2025-11-19 22:37:28.2563309Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\BCP47Langs.dll",,,,,,,,,,,,,,,,1763591848256331000,,,,,140712631468032,140712631468032,402331,385024,2065030180,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2563375Z","2025-11-19 22:37:28.2563375Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\MrmCoreR.dll",,,,,,,,,,,,,,,,1763591848256337500,,,,,140712631926784,140712631926784,1191374,1146880,1078870765,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2563442Z","2025-11-19 22:37:28.2563442Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\iertutil.dll",,,,,,,,,,,,,,,,1763591848256344200,,,,,140712642805760,140712642805760,2984761,2904064,3815768453,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2563598Z","2025-11-19 22:37:28.2563598Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\winmm.dll",,,,,,,,,,,,,,,,1763591848256359800,,,,,140712663842816,140712663842816,263815,217088,2106743460,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2563654Z","2025-11-19 22:37:28.2563654Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\srvcli.dll",,,,,,,,,,,,,,,,1763591848256365400,,,,,140712668954624,140712668954624,181029,167936,239922031,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2563714Z","2025-11-19 22:37:28.2563714Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\urlmon.dll",,,,,,,,,,,,,,,,1763591848256371400,,,,,140712669609984,140712669609984,1970671,1957888,260716450,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2563784Z","2025-11-19 22:37:28.2563784Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\xmllite.dll",,,,,,,,,,,,,,,,1763591848256378400,,,,,140712684027904,140712684027904,342897,274432,974526834,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2563838Z","2025-11-19 22:37:28.2563838Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\icu.dll",,,,,,,,,,,,,,,,1763591848256383800,,,,,140712684617728,140712684617728,2775448,2744320,3611555297,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2563911Z","2025-11-19 22:37:28.2563911Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,,,,,,,1763591848256391100,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2563973Z","2025-11-19 22:37:28.2563973Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.StateRepositoryClient.dll",,,,,,,,,,,,,,,,1763591848256397300,,,,,140712696610816,140712696610816,303673,290816,424989122,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2564009Z","2025-11-19 22:37:28.2564009Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\TerminalThemeHelpers.dll",,,,,,,,,,,,,,,,1763591848256400900,,,,,140712700477440,140712700477440,93641,61440,1754949712,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2564149Z","2025-11-19 22:37:28.2564149Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.Graphics.dll",,,,,,,,,,,,,,,,1763591848256414900,,,,,140712711225344,140712711225344,669723,593920,1068018205,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2564236Z","2025-11-19 22:37:28.2564236Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\OneCoreUAPCommonProxyStub.dll",,,,,,,,,,,,,,,,1763591848256423700,,,,,140712713977856,140712713977856,6740758,6615040,2011948997,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2564308Z","2025-11-19 22:37:28.2564308Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\twinapi.appcore.dll",,,,,,,,,,,,,,,,1763591848256430800,,,,,140712720924672,140712720924672,2401519,2375680,2646458233,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2564341Z","2025-11-19 22:37:28.2564341Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\PackagedCom\OpenConsoleProxy.dll",,,,,,,,,,,,,,,,1763591848256434100,,,,,140712723349504,140712723349504,51292,53248,1759975238,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2564412Z","2025-11-19 22:37:28.2564412Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\d3d10warp.dll",,,,,,,,,,,,,,,,1763591848256441200,,,,,140712731869184,140712731869184,5958575,5943296,1147803111,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2564473Z","2025-11-19 22:37:28.2564473Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\WindowManagementAPI.dll",,,,,,,,,,,,,,,,1763591848256447300,,,,,140712738422784,140712738422784,1825044,1794048,1605274449,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2564542Z","2025-11-19 22:37:28.2564542Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\CoreUIComponents.dll",,,,,,,,,,,,,,,,1763591848256454200,,,,,140712742944768,140712742944768,3046501,3022848,801552868,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2564597Z","2025-11-19 22:37:28.2564597Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\winhttp.dll",,,,,,,,,,,,,,,,1763591848256459700,,,,,140712750350336,140712750350336,1261038,1212416,84984727,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2564660Z","2025-11-19 22:37:28.2564660Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\directxdatabasehelper.dll",,,,,,,,,,,,,,,,1763591848256466000,,,,,140712752709632,140712752709632,426573,405504,145563491,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2564803Z","2025-11-19 22:37:28.2564803Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Microsoft.Internal.WarpPal.dll",,,,,,,,,,,,,,,,1763591848256480300,,,,,140712769683456,140712769683456,167600,102400,2132685858,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2564871Z","2025-11-19 22:37:28.2564871Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\D3DCompiler_47.dll",,,,,,,,,,,,,,,,1763591848256487100,,,,,140712769814528,140712769814528,4685395,4714496,796813953,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2564933Z","2025-11-19 22:37:28.2564933Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\WindowsCodecs.dll",,,,,,,,,,,,,,,,1763591848256493300,,,,,140712775385088,140712775385088,2352359,2293760,3466818398,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2564987Z","2025-11-19 22:37:28.2564987Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\d2d1.dll",,,,,,,,,,,,,,,,1763591848256498700,,,,,140712777744384,140712777744384,6610469,6537216,3013069957,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2565040Z","2025-11-19 22:37:28.2565040Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\DWrite.dll",,,,,,,,,,,,,,,,1763591848256504000,,,,,140712784297984,140712784297984,2543119,2519040,1462185185,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2565089Z","2025-11-19 22:37:28.2565089Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\d3d11.dll",,,,,,,,,,,,,,,,1763591848256508900,,,,,140712786853888,140712786853888,2582658,2498560,2128032819,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2565143Z","2025-11-19 22:37:28.2565143Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\dcomp.dll",,,,,,,,,,,,,,,,1763591848256514400,,,,,140712789409792,140712789409792,2309196,2240512,1200801128,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2565205Z","2025-11-19 22:37:28.2565205Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\CoreMessaging.dll",,,,,,,,,,,,,,,,1763591848256520500,,,,,140712796160000,140712796160000,1232710,1208320,2155847221,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2565269Z","2025-11-19 22:37:28.2565269Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\uxtheme.dll",,,,,,,,,,,,,,,,1763591848256526900,,,,,140712802254848,140712802254848,696534,696320,1695798817,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2565393Z","2025-11-19 22:37:28.2565393Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\pfclient.dll",,,,,,,,,,,,,,,,1763591848256539400,,,,,140712803500032,140712803500032,92868,73728,3163590703,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2565450Z","2025-11-19 22:37:28.2565450Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\dxgi.dll",,,,,,,,,,,,,,,,1763591848256545000,,,,,140712803631104,140712803631104,1320096,1282048,1861212996,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2565509Z","2025-11-19 22:37:28.2565509Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\dwmapi.dll",,,,,,,,,,,,,,,,1763591848256550900,,,,,140712805072896,140712805072896,203843,196608,2709117439,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2565557Z","2025-11-19 22:37:28.2565557Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\DXCore.dll",,,,,,,,,,,,,,,,1763591848256555700,,,,,140712805400576,140712805400576,331386,274432,2354081039,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2565627Z","2025-11-19 22:37:28.2565627Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\windows.storage.dll",,,,,,,,,,,,,,,,1763591848256562700,,,,,140712812412928,140712812412928,8877403,8769536,3667346596,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2565689Z","2025-11-19 22:37:28.2565689Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\netutils.dll",,,,,,,,,,,,,,,,1763591848256568900,,,,,140712825847808,140712825847808,80696,53248,865845000,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2565757Z","2025-11-19 22:37:28.2565757Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591848256575700,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2565817Z","2025-11-19 22:37:28.2565817Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\ntmarta.dll",,,,,,,,,,,,,,,,1763591848256581700,,,,,140712831811584,140712831811584,265798,221184,3598506564,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2565880Z","2025-11-19 22:37:28.2565880Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\cryptsp.dll",,,,,,,,,,,,,,,,1763591848256588000,,,,,140712839217152,140712839217152,146168,110592,1658328178,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2565999Z","2025-11-19 22:37:28.2565999Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\cryptbase.dll",,,,,,,,,,,,,,,,1763591848256599900,,,,,140712839348224,140712839348224,63718,49152,3897879906,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2566062Z","2025-11-19 22:37:28.2566062Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\cfgmgr32.dll",,,,,,,,,,,,,,,,1763591848256606200,,,,,140712845049856,140712845049856,385808,356352,1737777300,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2566115Z","2025-11-19 22:37:28.2566115Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\sxs.dll",,,,,,,,,,,,,,,,1763591848256611500,,,,,140712846622720,140712846622720,697955,659456,3834976666,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2566268Z","2025-11-19 22:37:28.2566268Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\umpdc.dll",,,,,,,,,,,,,,,,1763591848256626800,,,,,140712848064512,140712848064512,98535,81920,1714427184,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2566328Z","2025-11-19 22:37:28.2566328Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\powrprof.dll",,,,,,,,,,,,,,,,1763591848256632800,,,,,140712848195584,140712848195584,457799,385024,2858637235,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2566384Z","2025-11-19 22:37:28.2566384Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\bcrypt.dll",,,,,,,,,,,,,,,,1763591848256638400,,,,,140712848654336,140712848654336,206048,172032,2893678010,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2566448Z","2025-11-19 22:37:28.2566448Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\profapi.dll",,,,,,,,,,,,,,,,1763591848256644800,,,,,140712848850944,140712848850944,229548,167936,2447194521,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2566515Z","2025-11-19 22:37:28.2566515Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,,,,,,,1763591848256651500,,,,,140712851341312,140712851341312,1524912,1486848,1404855129,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2566638Z","2025-11-19 22:37:28.2566638Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,,,,,,,1763591848256663800,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2566696Z","2025-11-19 22:37:28.2566696Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591848256669600,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2566745Z","2025-11-19 22:37:28.2566745Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591848256674500,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2566803Z","2025-11-19 22:37:28.2566803Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591848256680400,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2566864Z","2025-11-19 22:37:28.2566864Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591848256686400,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2566923Z","2025-11-19 22:37:28.2566923Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591848256692300,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2566983Z","2025-11-19 22:37:28.2566983Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591848256698300,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2567042Z","2025-11-19 22:37:28.2567042Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,,,,,,,1763591848256704200,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2567100Z","2025-11-19 22:37:28.2567100Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\shlwapi.dll",,,,,,,,,,,,,,,,1763591848256710000,,,,,140712868839424,140712868839424,479562,421888,2142510382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2567220Z","2025-11-19 22:37:28.2567220Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,,,,,,,1763591848256722000,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2567291Z","2025-11-19 22:37:28.2567291Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591848256729100,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2567347Z","2025-11-19 22:37:28.2567347Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\ole32.dll",,,,,,,,,,,,,,,,1763591848256734700,,,,,140712878473216,140712878473216,1689904,1667072,1018821057,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2567407Z","2025-11-19 22:37:28.2567407Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,,,,,,,1763591848256740700,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2567465Z","2025-11-19 22:37:28.2567465Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591848256746500,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2567511Z","2025-11-19 22:37:28.2567511Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591848256751100,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2567571Z","2025-11-19 22:37:28.2567571Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,,,,,,,1763591848256757100,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2567630Z","2025-11-19 22:37:28.2567630Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,,,,,,,1763591848256763000,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2567687Z","2025-11-19 22:37:28.2567687Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591848256768700,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2567746Z","2025-11-19 22:37:28.2567746Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,,,,,,,1763591848256774600,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2567874Z","2025-11-19 22:37:28.2567874Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\msctf.dll",,,,,,,,,,,,,,,,1763591848256787400,,,,,140712893022208,140712893022208,1455420,1433600,4155718050,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2567931Z","2025-11-19 22:37:28.2567931Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591848256793100,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2567987Z","2025-11-19 22:37:28.2567987Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591848256798700,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2568042Z","2025-11-19 22:37:28.2568042Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591848256804200,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2568176Z","2025-11-19 22:37:28.2568176Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"WindowsTermina",,,,,,,,,,,,,,,,1763591848256817600,,,,,,,,,,134080654410898354,,,,,,,6627,,,,,16748544,19189760,3883624426,0,134080654489267736,577,0,60,53,3,7,0 +"2025-11-19 22:37:28.2575230Z","2025-11-19 22:37:28.2575230Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",13872,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084037992448,18446633084037967872,140711612509856,0,1046354432000,13872,1763591848257523000,1046352232448,1046352216064,140711612509856,1922208,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4656761Z","2025-11-19 22:37:28.4656761Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 8476 ServiceHub.IdentityHost.exe",,,,,,,,,,,,,18446633084041035776,18446633084041011200,140712899206080,0,843735072768,3676,1763591848465676100,843738251264,843738247168,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4657535Z","2025-11-19 22:37:28.4657535Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"13072 vctip.exe",,,,,,,,,,,,,18446633084029317120,18446633084029292544,140712899206080,0,941791567872,9260,1763591848465753500,941796360192,941796352000,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4657851Z","2025-11-19 22:37:28.4657851Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1520 powershell.exe",,,,,,,,,,,,,18446633084027793408,18446633084027768832,140712899206080,0,931707506688,1888,1763591848465785100,931708534784,931708526592,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4658205Z","2025-11-19 22:37:28.4658205Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"12052 ServiceHub.TestWindowStoreHost.exe",,,,,,,,,,,,,18446633084055474176,18446633084055449600,140712899206080,0,17905557504,4840,1763591848465820500,17910726656,17910722560,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4658465Z","2025-11-19 22:37:28.4658465Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,18446633084016447488,18446633084016422912,140712899206080,0,46015684608,10824,1763591848465846500,46028292096,46028275712,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4658775Z","2025-11-19 22:37:28.4658775Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"10252 ServiceHub.IndexingService.exe",,,,,,,,,,,,,18446633084028854272,18446633084028829696,140712899206080,0,848613720064,13472,1763591848465877500,848617799680,848617795584,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4659003Z","2025-11-19 22:37:28.4659003Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"10648 ServiceHub.Host.dotnet.x64.exe",,,,,,,,,,,,,18446633084028624896,18446633084028600320,140712899206080,0,515211558912,1976,1763591848465900300,515216769024,515216764928,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4659380Z","2025-11-19 22:37:28.4659380Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"10200 ServiceHub.VSDetouredHost.exe",,,,,,,,,,,,,18446633084030062592,18446633084030038016,140712899206080,0,617597181952,3900,1763591848465938000,617601826816,617601822720,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4659602Z","2025-11-19 22:37:28.4659602Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9988 Microsoft.ServiceHub.Controller.exe",,,,,,,,,,,,,18446633084028739584,18446633084028715008,140712899206080,0,1049753075712,14992,1763591848465960200,1049757745152,1049757741056,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4704807Z","2025-11-19 22:37:28.4704807Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,18446633084028080128,18446633084028055552,140712899206080,0,46015692800,5212,1763591848470480700,46045069312,46045052928,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4905294Z","2025-11-19 22:37:28.4905294Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9280 Greenshot.exe",,,,,,,,,,,,,18446633084028682240,18446633084028657664,140712899206080,0,948118986752,12724,1763591848490529400,948123467776,948123463680,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:29.3932962Z","2025-11-19 22:37:29.3932962Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13072 vctip.exe",8676,,,"13072 vctip.exe",,,,,,,,,,,,,18446633084057079808,18446633084057055232,140712899206080,0,941791477760,8676,1763591849393296200,941795311616,941795303424,140712899206080,210478,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:29.3933765Z","2025-11-19 22:37:29.3933765Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13072 vctip.exe",6088,,,"13072 vctip.exe",,,,,,,,,,,,,18446633084057051136,18446633084057026560,140712899206080,0,941791469568,6088,1763591849393376500,941794263040,941794254848,140712899206080,1198365,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:29.4261435Z","2025-11-19 22:37:29.4261435Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5536 svchost.exe",3836,,," 5536 svchost.exe",,,"C:\Windows\System32\aepic.dll",,,,,,,,,,,,,,,,1763591849426143500,,,,,140712428109824,140712428109824,641436,577536,321124434,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:29.4274126Z","2025-11-19 22:37:29.4274126Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5536 svchost.exe",3836,,," 5536 svchost.exe",,,"C:\Windows\System32\aepic.dll",,,,,,,,,,,,,,,,1763591849427412600,,,,,140712428109824,140712428109824,641436,589824,321124434,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:29.6961056Z","2025-11-19 22:37:29.6961056Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 9920 ServiceHub.IntellicodeModelService.exe",9760,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,18446633084028108800,18446633084028084224,140711612509856,0,46015700992,1468,1763591849696105600,46012694528,46012678144,140711612509856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:29.8394671Z","2025-11-19 22:37:29.8394671Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","10648 ServiceHub.Host.dotnet.x64.exe",10688,,,"10648 ServiceHub.Host.dotnet.x64.exe",,,,,,,,,,,,,18446633084057079808,18446633084057055232,140711121663952,0,515211567104,9320,1763591849839467100,515218341888,515218337792,140711121663952,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:29.8397391Z","2025-11-19 22:37:29.8397391Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","10648 ServiceHub.Host.dotnet.x64.exe",9320,,,"10648 ServiceHub.Host.dotnet.x64.exe",,,,,,,,,,,,,18446633084028395520,18446633084028370944,140711121663952,0,515211575296,11464,1763591849839739100,515219914752,515219910656,140711121663952,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:29.9831575Z","2025-11-19 22:37:29.9831575Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5096 svchost.exe",15108,,," 5096 svchost.exe",,,,,,,,,,,,,18446633084056850432,18446633084056825856,140712865112144,199,667265712128,15108,1763591849983157500,667271823360,667271790592,140712865112144,285541,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:31.0497261Z","2025-11-19 22:37:31.0497261Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8004 svchost.exe",2300,,," 8004 svchost.exe",,,,,,,,,,,,,18446633084004868096,18446633084004843520,140712899206080,0,841719537664,2300,1763591851049726100,841721839616,841721806848,140712899206080,226697,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:31.2092051Z","2025-11-19 22:37:31.2092051Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9920 ServiceHub.IntellicodeModelService.exe",1468,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,18446633084028108800,18446633084028084224,140711612509856,0,46015700992,1468,1763591851209205100,46012694528,46012678144,140711612509856,929799,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:31.6880035Z","2025-11-19 22:37:31.6880035Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13084 MSBuild.exe",12948,,,"13084 MSBuild.exe",,,,,,,,,,,,,18446633084002254848,18446633084002230272,140712899206080,0,911121563648,12948,1763591851688003500,911130755072,911130738688,140712899206080,5634614,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:31.6915761Z","2025-11-19 22:37:31.6915761Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8972 VBoxTray.exe",9020,,," 8972 VBoxTray.exe",,,,,,,,,,,,,18446633084002254848,18446633084002230272,140700131109808,0,471283212288,10176,1763591851691576100,471299260416,471299256320,140700131109808,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:31.6918214Z","2025-11-19 22:37:31.6918214Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8972 VBoxTray.exe",10176,,," 8972 VBoxTray.exe",,,,,,,,,,,,,18446633084002254848,18446633084002230272,140700131109808,0,471283212288,10176,1763591851691821400,471299260416,471299252224,140700131109808,462825,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:32.0530558Z","2025-11-19 22:37:32.0530558Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 8004 svchost.exe",,,,,,,,,,,,,18446633084028538880,18446633084028514304,140712899206080,0,841719545856,11156,1763591852053055800,841721839616,841721806848,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:32.3222797Z","2025-11-19 22:37:32.3222797Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",10448,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084018716672,18446633084018692096,140711613062896,0,1046354366464,10448,1763591852322279700,1046367698944,1046367682560,140711613062896,941871,,,,,,,,,,,,,,,,,,,,,,,,,,,,, diff --git a/EDRi/dumps/Defender-vs-Injector-standard-events-Minimal.csv b/EDRi/dumps/Defender-vs-Injector-standard-events-Minimal.csv index 7110704..87b11e5 100644 --- a/EDRi/dumps/Defender-vs-Injector-standard-events-Minimal.csv +++ b/EDRi/dumps/Defender-vs-Injector-standard-events-Minimal.csv @@ -1,40 +1,39 @@ -timestamp_sys,timestamp_etw,src_type,provider_name,event_id,task_info,process_id,thread_id,ppid,pid,targetpid,targettid,message,filepath,cachename,result,vname,name,sigseq,sigsha,commandline,firstparam,secondparam,timestamp_ns,createtime,flags,imagechecksum,mandatorylabel,packagefullname,packagerelativeappid,parentprocessid,parentprocesssequencenumber,processsequencenumber,processtokenelevationtype,processtokeniselevated,securitymitigations,sessionid,timedatestamp,stackbase,stacklimit,startaddr,subprocesstag,tebbase,threadid,userstackbase,userstacklimit,win32startaddr,cycletime,commitcharge,commitpeak,cpucyclecount,exitcode,exittime,handlecount,hardfaultcount,readoperationcount,readtransferkilobytes,tokenelevationtype,writeoperationcount,writetransferkilobytes"2025-11-19 19:51:16.343730900Z","2025-11-19 19:51:16.3437374Z","myETW","EDRi-Provider",4242,"EDRiTask","12472 EDRi.exe",,,,,,"++ EDRi START MARKER ++",,,,,,,,,,,1763581876343737400,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.287575200Z","2025-11-19 19:51:17.3448096Z","myETW","EDRi-Provider",4242,"EDRiTask","12472 EDRi.exe",,,,,,"++ EDRi START MARKER ++",,,,,,,,,,,1763581877344809600,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.197740800Z","2025-11-19 19:51:18.3561017Z","myETW","EDRi-Provider",4242,"EDRiTask","12472 EDRi.exe",,,,,,"Before decrypting the attack exe from C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\attacks\Injector-standard.exe.enc",,,,,,,,,,,1763581878356101700,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.199912800Z","2025-11-19 19:51:18.3585127Z","myETW","EDRi-Provider",4242,"EDRiTask","12472 EDRi.exe",,,,,,"After decrypting the attack exe",,,,,,,,,,,1763581878358512700,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.108607600Z","2025-11-19 19:51:19.3681762Z","myETW","EDRi-Provider",4242,"EDRiTask","12472 EDRi.exe",,,,,,"Before starting the attack exe",,,,,,,,,,,1763581879368176200,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9763041Z","2025-11-19 19:51:20.9763041Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1040 svchost.exe",2280,,,"11956 smartscreen.exe",,,"C:\Windows\System32\smartscreen.exe",,,,,,,,,,1763581880976304100,134080554805558624,0,664452,"0x","","",1040,13,3391,3,0,0,1,419447766,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0413450Z","2025-11-19 19:51:21.0413450Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 5184 explorer.exe",5116,,," 3348 attack-589.exe",,,"C:\Users\Public\Downloads\attack-589.exe",,,,,,,,,,1763581881041345000,134080554806144016,0,0,"0x","","",5184,140,3392,3,0,0,1,1763491559,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0443828Z","2025-11-19 19:51:21.0443828Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",5116,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581881044382800,,,,,,,,,,,,,,,18446633084044398592,18446633084044374016,140695599400816,0,289797906432,11212,289800192000,289800187904,140695599400816,,,,,,,,,,,,, -"2025-11-19 19:51:21.0568214Z","2025-11-19 19:51:21.0568214Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 3348 attack-589.exe",11212,,," 3100 conhost.exe",,,"C:\Windows\System32\conhost.exe",,,,,,,,,,1763581881056821400,134080554806283315,0,1035098,"0x","","",3348,3392,3393,3,0,0,1,2671108986,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0581639Z","2025-11-19 19:51:21.0581639Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3348 attack-589.exe",11212,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881058163900,,,,,,,,,,,,,,,18446633084006535168,18446633084006510592,140696384751904,0,1013857710080,13484,1013860270080,1013860261888,140696384751904,,,,,,,,,,,,, -"2025-11-19 19:51:20.821877500Z","2025-11-19 19:51:21.2718203Z","myETW","EDRi-Provider",4242,"EDRiTask","12472 EDRi.exe",,,,,,"After starting the attack exe",,,,,,,,,,,1763581881271820300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4388601Z","2025-11-19 19:51:21.4388601Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581881438860100,,,,,,,,,,,,,,,18446633083996708864,18446633083996684288,140712899206080,0,289797914624,11468,289801240576,289801236480,140712899206080,,,,,,,,,,,,, -"2025-11-19 19:51:21.4393533Z","2025-11-19 19:51:21.4393533Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581881439353300,,,,,,,,,,,,,,,18446633084049022976,18446633084048998400,140712899206080,0,289797922816,3088,289802289152,289802285056,140712899206080,,,,,,,,,,,,, -"2025-11-19 19:51:21.4394810Z","2025-11-19 19:51:21.4394810Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3348 attack-589.exe",3088,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581881439481000,,,,,,,,,,,,,,,18446633084049080320,18446633084049055744,140712899206080,0,289797931008,12904,289803337728,289803333632,140712899206080,,,,,,,,,,,,, -"2025-11-19 19:51:20.974665800Z","2025-11-19 19:51:21.4415712Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Injector started with PID 3348",,,,,,,,,,,1763581881441571200,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.852182900Z","2025-11-19 19:51:22.4165908Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Running 'standard' config",,,,,,,,,,,1763581882416590800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.852392100Z","2025-11-19 19:51:22.4168223Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Before starting subprocess to inject to",,,,,,,,,,,1763581882416822300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.4176543Z","2025-11-19 19:51:22.4176543Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 3348 attack-589.exe",11212,,," 1436 whoami.exe",,,"C:\Windows\System32\whoami.exe",,,,,,,,,,1763581882417654300,134080554818530829,0,160109,"0x","","",3348,3392,3396,3,0,0,1,3602411345,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.4206852Z","2025-11-19 19:51:22.4206852Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3348 attack-589.exe",11212,,," 1436 whoami.exe",,,,,,,,,,,,,1763581882420685200,,,,,,,,,,,,,,,18446633084049825792,18446633084049801216,140702344617136,0,521061564416,12400,521063104512,521063096320,140702344617136,,,,,,,,,,,,, -"2025-11-19 19:51:21.858891900Z","2025-11-19 19:51:22.4240441Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"After starting subprocess with PID 1436",,,,,,,,,,,1763581882424044100,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.737817600Z","2025-11-19 19:51:23.4006311Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Before opening process handle",,,,,,,,,,,1763581883400631100,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.738077500Z","2025-11-19 19:51:23.4009294Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"After opening process handle",,,,,,,,,,,1763581883400929400,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.612812600Z","2025-11-19 19:51:24.3728485Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Before allocating memory for shellcode",,,,,,,,,,,1763581884372848500,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.613174800Z","2025-11-19 19:51:24.3732488Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"After allocating memory for shellcode at 000001FF40840000",,,,,,,,,,,1763581884373248800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.486948200Z","2025-11-19 19:51:25.3441106Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Before writing shellcode to process",,,,,,,,,,,1763581885344110600,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.487258200Z","2025-11-19 19:51:25.3444526Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"After writing shellcode to process at 000001FF40840000",,,,,,,,,,,1763581885344452600,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.362253700Z","2025-11-19 19:51:26.3166701Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Before changing memory protection to PAGE_EXECUTE_READ",,,,,,,,,,,1763581886316670100,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.362529500Z","2025-11-19 19:51:26.3169751Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"After changing memory protection to PAGE_EXECUTE_READ",,,,,,,,,,,1763581886316975100,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:26.296106600Z","2025-11-19 19:51:27.3019664Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Before reading memory to verify write",,,,,,,,,,,1763581887301966400,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:26.296340900Z","2025-11-19 19:51:27.3022001Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Before creating remote thread",,,,,,,,,,,1763581887302200100,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3024711Z","2025-11-19 19:51:27.3024711Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3348 attack-589.exe",11212,,," 1436 whoami.exe",,,,,,,,,,,,,1763581887302471100,,,,,,,,,,,,,,,18446633084051144704,18446633084051120128,2195810680832,0,521061572608,6380,521063628800,521063620608,2195810680832,,,,,,,,,,,,, -"2025-11-19 19:51:26.296634600Z","2025-11-19 19:51:27.3024967Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"After creating remote thread",,,,,,,,,,,1763581887302496700,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3158199Z","2025-11-19 19:51:27.3158199Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1436 whoami.exe",6380,,,"11148 calc.exe",,,"C:\Windows\System32\calc.exe",,,,,,,,,,1763581887315819900,134080554863097645,0,90741,"0x","","",1436,3396,3397,3,0,0,1,4001445627,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.261554400Z","2025-11-19 19:51:28.2771678Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Attack done",,,,,,,,,,,1763581888277167800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2782317Z","2025-11-19 19:51:28.2782317Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3348 attack-589.exe",3088,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581888278231700,,,,,,,,,,,,,,,18446633084049022976,18446633084048998400,140712899206080,0,289797922816,3088,289802289152,289802280960,140712899206080,2024057,,,,,,,,,,,, -"2025-11-19 19:51:28.2782317Z","2025-11-19 19:51:28.2782317Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3348 attack-589.exe",12904,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581888278231700,,,,,,,,,,,,,,,18446633084049080320,18446633084049055744,140712899206080,0,289797931008,12904,289803337728,289803329536,140712899206080,1558590,,,,,,,,,,,, -"2025-11-19 19:51:28.2782336Z","2025-11-19 19:51:28.2782336Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3348 attack-589.exe",11468,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581888278233700,,,,,,,,,,,,,,,18446633083996708864,18446633083996684288,140712899206080,0,289797914624,11468,289801240576,289801232384,140712899206080,3363869,,,,,,,,,,,, -"2025-11-19 19:51:28.2783990Z","2025-11-19 19:51:28.2783990Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581888278399000,,,,,,,,,,,,,,,18446633084044398592,18446633084044374016,140695599400816,0,289797906432,11212,289800192000,289800171520,140695599400816,64789380,,,,,,,,,,,, -"2025-11-19 19:51:28.2786366Z","2025-11-19 19:51:28.2786366Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"attack-589.exe",,,,,,,,,,1763581888278636600,134080554806144016,,,,,,,,3392,,,,,,,,,,,,,,,,958464,958464,72053875,0,134080554872628582,52,9,0,0,3,48,0 -"2025-11-19 19:51:29.1708754Z","2025-11-19 19:51:29.1708754Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"whoami.exe",,,,,,,,,,1763581889170875400,134080554818530829,,,,,,,,3396,,,,,,,,,,,,,,,,1257472,1302528,57157118,3221225477,134080554881460737,83,0,1,3,3,0,0 +timestamp_sys,timestamp_etw,src_type,provider_name,event_id,task_info,process_id,thread_id,ppid,pid,targetpid,targettid,message,filepath,cachename,result,vname,name,sigseq,sigsha,commandline,firstparam,secondparam,timestamp_ns,createtime,flags,imagechecksum,mandatorylabel,packagefullname,packagerelativeappid,parentprocessid,parentprocesssequencenumber,processsequencenumber,processtokenelevationtype,processtokeniselevated,securitymitigations,sessionid,timedatestamp,stackbase,stacklimit,startaddr,subprocesstag,tebbase,threadid,userstackbase,userstacklimit,win32startaddr,cycletime,commitcharge,commitpeak,cpucyclecount,exitcode,exittime,handlecount,hardfaultcount,readoperationcount,readtransferkilobytes,tokenelevationtype,writeoperationcount,writetransferkilobytes"2025-11-19 22:37:11.792165000Z","2025-11-19 22:37:11.7170068Z","myETW","EDRi-Provider",4242,"EDRiTask"," 7508 EDRi.exe",,,,,,"++ EDRi START MARKER ++",,,,,,,,,,,1763591831717006800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:16.175848500Z","2025-11-19 22:37:15.7424568Z","myETW","EDRi-Provider",4242,"EDRiTask"," 7508 EDRi.exe",,,,,,"Before decrypting the attack exe from C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\attacks\Injector-standard.exe.enc",,,,,,,,,,,1763591835742456800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:16.182157400Z","2025-11-19 22:37:15.7482493Z","myETW","EDRi-Provider",4242,"EDRiTask"," 7508 EDRi.exe",,,,,,"After decrypting the attack exe",,,,,,,,,,,1763591835748249300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:17.282796100Z","2025-11-19 22:37:16.7589463Z","myETW","EDRi-Provider",4242,"EDRiTask"," 7508 EDRi.exe",,,,,,"Before starting the attack exe",,,,,,,,,,,1763591836758946300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1091605Z","2025-11-19 22:37:20.1091605Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1040 svchost.exe",4480,,,"13388 smartscreen.exe",,,"C:\Windows\System32\smartscreen.exe",,,,,,,,,,1763591840109160500,134080654409311255,0,664452,"0x","","",1040,13,6623,3,0,0,1,419447766,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1761396Z","2025-11-19 22:37:20.1761396Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 5184 explorer.exe",15136,,," 5604 attack-890.exe",,,"C:\Users\Public\Downloads\attack-890.exe",,,,,,,,,,1763591840176139600,134080654410040405,0,0,"0x","","",5184,140,6624,3,0,0,1,1763491559,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1789263Z","2025-11-19 22:37:20.1789263Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",15136,,," 5604 attack-890.exe",,,,,,,,,,,,,1763591840178926300,,,,,,,,,,,,,,,18446633084027822080,18446633084027797504,140695618865008,0,867488051200,3452,867486007296,867486003200,140695618865008,,,,,,,,,,,,, +"2025-11-19 22:37:20.1912674Z","2025-11-19 22:37:20.1912674Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 5604 attack-890.exe",3452,,,"13300 conhost.exe",,,"C:\Windows\System32\conhost.exe",,,,,,,,,,1763591840191267400,134080654410205145,0,1035098,"0x","","",5604,6624,6625,3,0,0,1,2671108986,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1924430Z","2025-11-19 22:37:20.1924430Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5604 attack-890.exe",3452,,,"13300 conhost.exe",,,,,,,,,,,,,1763591840192443000,,,,,,,,,,,,,,,18446633084027535360,18446633084027510784,140696384751904,0,689119371264,4616,689120477184,689120468992,140696384751904,,,,,,,,,,,,, +"2025-11-19 22:37:20.5510805Z","2025-11-19 22:37:20.5510805Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,,,,,,,,,,,1763591840551080500,,,,,,,,,,,,,,,18446633084029747200,18446633084029722624,140712899206080,0,867488059392,5960,867490070528,867490066432,140712899206080,,,,,,,,,,,,, +"2025-11-19 22:37:20.5515459Z","2025-11-19 22:37:20.5515459Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5604 attack-890.exe",5960,,," 5604 attack-890.exe",,,,,,,,,,,,,1763591840551545900,,,,,,,,,,,,,,,18446633084029718528,18446633084029693952,140712899206080,0,867488067584,8672,867491119104,867491115008,140712899206080,,,,,,,,,,,,, +"2025-11-19 22:37:20.5516458Z","2025-11-19 22:37:20.5516458Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5604 attack-890.exe",8672,,," 5604 attack-890.exe",,,,,,,,,,,,,1763591840551645800,,,,,,,,,,,,,,,18446633084029460480,18446633084029435904,140712899206080,0,867488075776,12460,867492167680,867492163584,140712899206080,,,,,,,,,,,,, +"2025-11-19 22:37:21.377891300Z","2025-11-19 22:37:20.5537813Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Injector started with PID 5604",,,,,,,,,,,1763591840553781300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:21.477249300Z","2025-11-19 22:37:20.6551680Z","myETW","EDRi-Provider",4242,"EDRiTask"," 7508 EDRi.exe",,,,,,"After starting the attack exe",,,,,,,,,,,1763591840655168000,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.337559700Z","2025-11-19 22:37:21.5329408Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Running 'standard' config",,,,,,,,,,,1763591841532940800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.337798100Z","2025-11-19 22:37:21.5331820Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Before starting subprocess to inject to",,,,,,,,,,,1763591841533182000,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:21.5339696Z","2025-11-19 22:37:21.5339696Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 5604 attack-890.exe",3452,,," 7284 whoami.exe",,,"C:\Windows\System32\whoami.exe",,,,,,,,,,1763591841533969600,134080654423385232,0,160109,"0x","","",5604,6624,6628,3,0,0,1,3602411345,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:21.5373410Z","2025-11-19 22:37:21.5373410Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5604 attack-890.exe",3452,,," 7284 whoami.exe",,,,,,,,,,,,,1763591841537341000,,,,,,,,,,,,,,,18446633084031127552,18446633084031102976,140702344617136,0,705865940992,14048,705864925184,705864916992,140702344617136,,,,,,,,,,,,, +"2025-11-19 22:37:22.345203800Z","2025-11-19 22:37:21.5407378Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"After starting subprocess with PID 7284",,,,,,,,,,,1763591841540737800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:23.308564200Z","2025-11-19 22:37:22.5236651Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Before opening process handle",,,,,,,,,,,1763591842523665100,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:23.308868400Z","2025-11-19 22:37:22.5239746Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"After opening process handle",,,,,,,,,,,1763591842523974600,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:24.262849900Z","2025-11-19 22:37:23.4973313Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Before allocating memory for shellcode",,,,,,,,,,,1763591843497331300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:24.263130400Z","2025-11-19 22:37:23.4976143Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"After allocating memory for shellcode at 00000249213E0000",,,,,,,,,,,1763591843497614300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:25.227755400Z","2025-11-19 22:37:24.4818310Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Before writing shellcode to process",,,,,,,,,,,1763591844481831000,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:25.228060100Z","2025-11-19 22:37:24.4821409Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"After writing shellcode to process at 00000249213E0000",,,,,,,,,,,1763591844482140900,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.182844300Z","2025-11-19 22:37:25.4563155Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Before changing memory protection to PAGE_EXECUTE_READ",,,,,,,,,,,1763591845456315500,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.183142300Z","2025-11-19 22:37:25.4566185Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"After changing memory protection to PAGE_EXECUTE_READ",,,,,,,,,,,1763591845456618500,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.147034500Z","2025-11-19 22:37:26.4400898Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Before reading memory to verify write",,,,,,,,,,,1763591846440089800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.147308700Z","2025-11-19 22:37:26.4403653Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Before creating remote thread",,,,,,,,,,,1763591846440365300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4406187Z","2025-11-19 22:37:26.4406187Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5604 attack-890.exe",3452,,," 7284 whoami.exe",,,,,,,,,,,,,1763591846440618700,,,,,,,,,,,,,,,18446633084031987712,18446633084031963136,2513113579520,0,705865949184,14412,705865449472,705865441280,2513113579520,,,,,,,,,,,,, +"2025-11-19 22:37:27.147575800Z","2025-11-19 22:37:26.4406370Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"After creating remote thread",,,,,,,,,,,1763591846440637000,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4541760Z","2025-11-19 22:37:26.4541760Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 7284 whoami.exe",14412,,," 3812 calc.exe",,,"C:\Windows\System32\calc.exe",,,,,,,,,,1763591846454176000,134080654471607920,0,90741,"0x","","",7284,6628,6629,3,0,0,1,4001445627,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.099873500Z","2025-11-19 22:37:27.4122768Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Attack done",,,,,,,,,,,1763591847412276800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4131942Z","2025-11-19 22:37:27.4131942Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5604 attack-890.exe",8672,,," 5604 attack-890.exe",,,,,,,,,,,,,1763591847413194200,,,,,,,,,,,,,,,18446633084029718528,18446633084029693952,140712899206080,0,867488067584,8672,867491119104,867491106816,140712899206080,1934283,,,,,,,,,,,, +"2025-11-19 22:37:27.4131969Z","2025-11-19 22:37:27.4131969Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5604 attack-890.exe",5960,,," 5604 attack-890.exe",,,,,,,,,,,,,1763591847413196900,,,,,,,,,,,,,,,18446633084029747200,18446633084029722624,140712899206080,0,867488059392,5960,867490070528,867490062336,140712899206080,2523090,,,,,,,,,,,, +"2025-11-19 22:37:27.4132046Z","2025-11-19 22:37:27.4132046Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5604 attack-890.exe",12460,,," 5604 attack-890.exe",,,,,,,,,,,,,1763591847413204600,,,,,,,,,,,,,,,18446633084029460480,18446633084029435904,140712899206080,0,867488075776,12460,867492167680,867492155392,140712899206080,1586126,,,,,,,,,,,, +"2025-11-19 22:37:27.4133776Z","2025-11-19 22:37:27.4133776Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,,,,,,,,,,,1763591847413377600,,,,,,,,,,,,,,,18446633084027822080,18446633084027797504,140695618865008,0,867488051200,3452,867486007296,867485986816,140695618865008,55165128,,,,,,,,,,,, +"2025-11-19 22:37:27.4136009Z","2025-11-19 22:37:27.4136009Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"attack-890.exe",,,,,,,,,,1763591847413600900,134080654410040405,,,,,,,,6624,,,,,,,,,,,,,,,,974848,974848,61411560,0,134080654481010332,52,9,0,0,3,48,0 +"2025-11-19 22:37:28.2303954Z","2025-11-19 22:37:28.2303954Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"whoami.exe",,,,,,,,,,1763591848230395400,134080654423385232,,,,,,,,6628,,,,,,,,,,,,,,,,1265664,1310720,56924383,3221225477,134080654489015372,83,0,1,3,3,0,0 diff --git a/EDRi/dumps/Defender-vs-Injector-standard-events-Relevant.csv b/EDRi/dumps/Defender-vs-Injector-standard-events-Relevant.csv index 5e67aa3..fe6dd88 100644 --- a/EDRi/dumps/Defender-vs-Injector-standard-events-Relevant.csv +++ b/EDRi/dumps/Defender-vs-Injector-standard-events-Relevant.csv @@ -1,598 +1,580 @@ -timestamp_sys,timestamp_etw,src_type,provider_name,event_id,task_info,process_id,thread_id,ppid,pid,targetpid,targettid,message,filepath,cachename,result,vname,name,sigseq,sigsha,commandline,firstparam,secondparam,timestamp_ns,stackbase,stacklimit,startaddr,subprocesstag,tebbase,threadid,userstackbase,userstacklimit,win32startaddr,cycletime,commitcharge,commitpeak,cpucyclecount,createtime,exitcode,exittime,handlecount,hardfaultcount,processsequencenumber,readoperationcount,readtransferkilobytes,tokenelevationtype,writeoperationcount,writetransferkilobytes,flags,imagechecksum,mandatorylabel,packagefullname,packagerelativeappid,parentprocessid,parentprocesssequencenumber,processtokenelevationtype,processtokeniselevated,securitymitigations,sessionid,timedatestamp,defaultbase,imagebase,imagesize"2025-11-19 19:51:16.343730900Z","2025-11-19 19:51:16.3437374Z","myETW","EDRi-Provider",4242,"EDRiTask","12472 EDRi.exe",,,,,,"++ EDRi START MARKER ++",,,,,,,,,,,1763581876343737400,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.5865091Z","2025-11-19 19:51:16.5865091Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8972 VBoxTray.exe",9020,,," 8972 VBoxTray.exe",,,,,,,,,,,,,1763581876586509100,18446633084041842688,18446633084041818112,140700131109808,0,471284228096,9164,471286677504,471286673408,140700131109808,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.5868139Z","2025-11-19 19:51:16.5868139Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8972 VBoxTray.exe",9164,,," 8972 VBoxTray.exe",,,,,,,,,,,,,1763581876586813900,18446633084041842688,18446633084041818112,140700131109808,0,471284228096,9164,471286677504,471286669312,140700131109808,428122,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.6931597Z","2025-11-19 19:51:16.6931597Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"11648 RuntimeBroker.exe",,,,,,,,,,,,,1763581876693159700,18446633084041842688,18446633084041818112,140712899206080,0,503394820096,3896,503397220352,503397171200,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.6933880Z","2025-11-19 19:51:16.6933880Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11648 RuntimeBroker.exe",3896,,,"11648 RuntimeBroker.exe",,,,,,,,,,,,,1763581876693388000,18446633084040663040,18446633084040638464,140712899206080,0,503394828288,8592,503397744640,503397695488,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.7247840Z","2025-11-19 19:51:16.7247840Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 5664 OpenConsole.exe",,,,,,,,,,,,,1763581876724784000,18446633084041900032,18446633084041875456,140712899206080,0,304352927744,12896,304354426880,304354422784,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9633043Z","2025-11-19 19:51:16.9633043Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13120 ",540,,,"13120 ",,,,,,,,,,,,,1763581876963304300,18446633084052176896,18446633084052152320,140712865112144,0,619234459648,540,619238653952,619238604800,140712865112144,934326,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9633044Z","2025-11-19 19:51:16.9633044Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13120 ",8284,,,"13120 ",,,,,,,,,,,,,1763581876963304400,18446633084051488768,18446633084051464192,140712899206080,0,619236544512,8284,619238129664,619238080512,140712899206080,46624563,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9633055Z","2025-11-19 19:51:16.9633055Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13120 ",12604,,,"13120 ",,,,,,,,,,,,,1763581876963305500,18446633084053524480,18446633084053499904,140712899206080,0,619234476032,12604,619237605376,619237556224,140712899206080,736670,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9633063Z","2025-11-19 19:51:16.9633063Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13120 ",14864,,,"13120 ",,,,,,,,,,,,,1763581876963306300,18446633084043333632,18446633084043309056,140712899206080,0,619236519936,14864,619234000896,619233951744,140712899206080,3646014,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9633083Z","2025-11-19 19:51:16.9633083Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13120 ",15068,,,"13120 ",,,,,,,,,,,,,1763581876963308300,18446633084036870144,18446633084036845568,140699399787184,0,619236216832,15068,619233476608,619233427456,140699399787184,56130748,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9633298Z","2025-11-19 19:51:16.9633298Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13120 ",13920,,,"13120 ",,,,,,,,,,,,,1763581876963329800,18446633084041756672,18446633084041732096,140712865112144,0,619236282368,13920,619240226816,619240177664,140712865112144,120178560,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9634505Z","2025-11-19 19:51:16.9634505Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13120 ",1692,,,"13120 ",,,,,,,,,,,,,1763581876963450500,18446633084024516608,18446633084024492032,140712899206080,0,619234467840,1692,619237081088,619237031936,140712899206080,1102179,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9639407Z","2025-11-19 19:51:16.9639407Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5184 explorer.exe",3712,,," 5184 explorer.exe",,,,,,,,,,,,,1763581876963940700,18446633084022595584,18446633084022571008,140712891292720,0,15220736,3712,467664896,467607552,140712891292720,5481847,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9648012Z","2025-11-19 19:51:16.9648012Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop ","13120 ",1692,,,"13120 ",,,"RuntimeBroker.",,,,,,,,,,1763581876964801200,,,,,,,,,,,3215360,3645440,424320572,134080539436056425,0,134080554769450943,264,0,2861,12,26,3,4,12,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9791067Z","2025-11-19 19:51:16.9791067Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1416 ApplicationFrameHost.exe",11516,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,1763581876979106700,18446633084046409728,18446633084046385152,140712891292720,0,199841775616,11516,199843905536,199843897344,140712891292720,31722890,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9793344Z","2025-11-19 19:51:16.9793344Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4340 sihost.exe",13900,,," 4340 sihost.exe",,,,,,,,,,,,,1763581876979334400,18446633084023111680,18446633084023087104,140712891292720,0,645640536064,13900,645647040512,645647028224,140712891292720,5391318,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9950931Z","2025-11-19 19:51:16.9950931Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4340 sihost.exe",13260,,," 4340 sihost.exe",,,,,,,,,,,,,1763581876995093100,18446633084011245568,18446633084011220992,140712891292720,0,645640544256,13260,645647564800,645647548416,140712891292720,3404229,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9951060Z","2025-11-19 19:51:16.9951060Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1416 ApplicationFrameHost.exe",13876,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,1763581876995106000,18446633084045979648,18446633084045955072,140712891292720,0,199841767424,13876,199842332672,199842316288,140712891292720,181487517,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.0111136Z","2025-11-19 19:51:17.0111136Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1416 ApplicationFrameHost.exe",9424,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,1763581877011113600,18446633083987144704,18446633083987120128,140712891292720,0,199841759232,9424,199839318016,199839297536,140712891292720,65582250,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.0430380Z","2025-11-19 19:51:17.0430380Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5992 svchost.exe",13196,,," 5992 svchost.exe",,,,,,,,,,,,,1763581877043038000,18446633084053237760,18446633084053213184,140712899206080,0,477737390080,13196,477738565632,477738532864,140712899206080,8061896,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.0430460Z","2025-11-19 19:51:17.0430460Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5992 svchost.exe",13756,,," 5992 svchost.exe",,,,,,,,,,,,,1763581877043046100,18446633084028424192,18446633084028399616,140712899206080,0,477737398272,13756,477739089920,477739057152,140712899206080,6557245,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.2923207Z","2025-11-19 19:51:17.2923207Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6500 SearchHost.exe",14484,,," 6500 SearchHost.exe",,,,,,,,,,,,,1763581877292320700,18446633084058714112,18446633084058689536,140712449945792,0,1050565754880,14484,1050568294400,1050568228864,140712449945792,1580469,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.2924784Z","2025-11-19 19:51:17.2924784Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6500 SearchHost.exe",14300,,," 6500 SearchHost.exe",,,,,,,,,,,,,1763581877292478500,18446633084041756672,18446633084041732096,140712449945792,0,1050565763072,11380,1050568294400,1050568228864,140712449945792,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.2967529Z","2025-11-19 19:51:17.2967529Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6500 SearchHost.exe",11380,,," 6500 SearchHost.exe",,,,,,,,,,,,,1763581877296752900,18446633084041756672,18446633084041732096,140712449945792,0,1050565763072,11380,1050568294400,1050568228864,140712449945792,1074644,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.2968507Z","2025-11-19 19:51:17.2968507Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6500 SearchHost.exe",14300,,," 6500 SearchHost.exe",,,,,,,,,,,,,1763581877296850700,18446633084041756672,18446633084041732096,140712449945792,0,1050565771264,14416,1050568294400,1050568228864,140712449945792,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.287575200Z","2025-11-19 19:51:17.3448096Z","myETW","EDRi-Provider",4242,"EDRiTask","12472 EDRi.exe",,,,,,"++ EDRi START MARKER ++",,,,,,,,,,,1763581877344809600,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.5841062Z","2025-11-19 19:51:17.5841062Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9920 ServiceHub.IntellicodeModelService.exe",5860,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,1763581877584106200,18446633084005670912,18446633084005646336,140711612509856,0,46014308352,5860,46012694528,46012678144,140711612509856,774012,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.197740800Z","2025-11-19 19:51:18.3561017Z","myETW","EDRi-Provider",4242,"EDRiTask","12472 EDRi.exe",,,,,,"Before decrypting the attack exe from C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\attacks\Injector-standard.exe.enc",,,,,,,,,,,1763581878356101700,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.199912800Z","2025-11-19 19:51:18.3585127Z","myETW","EDRi-Provider",4242,"EDRiTask","12472 EDRi.exe",,,,,,"After decrypting the attack exe",,,,,,,,,,,1763581878358512700,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.3963495Z","2025-11-19 19:51:18.3963495Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3504 svchost.exe",12864,,," 3504 svchost.exe",,,,,,,,,,,,,1763581878396349500,18446633083987144704,18446633083987120128,140712899206080,38,949314420736,8740,949313404928,949313372160,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.4026822Z","2025-11-19 19:51:18.4026822Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3564 MsMpEng.exe",8704,,," 3564 MsMpEng.exe",,,,,,,,,,,,,1763581878402682200,18446633084043333632,18446633084043309056,140712865112144,247,273686036480,12944,273705598976,273705533440,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.4034668Z","2025-11-19 19:51:18.4034668Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1776 svchost.exe",2748,,," 1776 svchost.exe",,,,,,,,,,,,,1763581878403466800,18446633084042158080,18446633084042133504,140712899206080,122,699936538624,1248,699937587200,699937554432,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.4082367Z","2025-11-19 19:51:18.4082367Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2376 svchost.exe",2640,,," 2376 svchost.exe",,,,,,,,,,,,,1763581878408236700,18446633084042186752,18446633084042162176,140712899206080,248,36400259072,2884,36401315840,36401283072,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.4099234Z","2025-11-19 19:51:18.4099234Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2932 svchost.exe",5072,,," 2932 svchost.exe",,,,,,,,,,,,,1763581878409923400,18446633084045979648,18446633084045955072,140712899206080,49,212461367296,14528,212459651072,212459585536,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.4324897Z","2025-11-19 19:51:18.4324897Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3504 svchost.exe",12864,,," 3504 svchost.exe",,,,,,,,,,,,,1763581878432489700,18446633084042100736,18446633084042076160,140712678802768,38,949314428928,6532,949316747264,949316714496,140712678802768,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.7511985Z","2025-11-19 19:51:18.7511985Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1520 powershell.exe",4168,,," 1520 powershell.exe",,,,,,,,,,,,,1763581878751198500,18446633084042129408,18446633084042104832,140712899206080,0,931706306560,6084,931710107648,931710099456,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.7512011Z","2025-11-19 19:51:18.7512011Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8916 SecurityHealthService.exe",8952,,," 8916 SecurityHealthService.exe",,,,,,,,,,,,,1763581878751201100,18446633084042330112,18446633084042305536,140712899206080,167,33812795392,13648,33815003136,33814994944,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.0792892Z","2025-11-19 19:51:19.0792892Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 872 wininit.exe",5580,,," 872 wininit.exe",,,,,,,,,,,,,1763581879079289300,18446633084040691712,18446633084040667136,140712899206080,0,97764474880,5580,97765556224,97765498880,140712899206080,268944,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.108607600Z","2025-11-19 19:51:19.3681762Z","myETW","EDRi-Provider",4242,"EDRiTask","12472 EDRi.exe",,,,,,"Before starting the attack exe",,,,,,,,,,,1763581879368176200,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.3794628Z","2025-11-19 19:51:19.3794628Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8448 OneDrive.exe",8496,,," 8448 OneDrive.exe",,,,,,,,,,,,,1763581879379462800,18446633084042072064,18446633084042047488,140712859481984,0,70345129984,12656,70351060992,70351056896,140712859481984,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.3795497Z","2025-11-19 19:51:19.3795497Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8448 OneDrive.exe",8496,,," 8448 OneDrive.exe",,,,,,,,,,,,,1763581879379549700,18446633084040691712,18446633084040667136,140712859481984,0,70345138176,4244,70353158144,70353154048,140712859481984,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.5582180Z","2025-11-19 19:51:19.5582180Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1564 svchost.exe",320,,," 1564 svchost.exe",,,,,,,,,,,,,1763581879558218000,18446633083995705344,18446633083995680768,140712899206080,0,86741528576,320,86739845120,86739812352,140712899206080,348156,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.5582222Z","2025-11-19 19:51:19.5582222Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1676 svchost.exe",14356,,," 1676 svchost.exe",,,,,,,,,,,,,1763581879558222300,18446633084007567360,18446633084007542784,140712899206080,0,289651163136,14356,289649328128,289649295360,140712899206080,294971,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.5582251Z","2025-11-19 19:51:19.5582251Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1388 svchost.exe",7708,,," 1388 svchost.exe",,,,,,,,,,,,,1763581879558225100,18446633083995619328,18446633083995594752,140712899206080,0,867845017600,7708,867846062080,867846029312,140712899206080,442079,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.5582269Z","2025-11-19 19:51:19.5582269Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1796 svchost.exe",13672,,," 1796 svchost.exe",,,,,,,,,,,,,1763581879558226900,18446633084043304960,18446633084043280384,140712899206080,0,708991610880,13672,708990205952,708990173184,140712899206080,218022,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.5582272Z","2025-11-19 19:51:19.5582272Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1660 svchost.exe",10848,,," 1660 svchost.exe",,,,,,,,,,,,,1763581879558227200,18446633084006277120,18446633084006252544,140712899206080,0,265906405376,10848,265905373184,265905340416,140712899206080,567308,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.5582306Z","2025-11-19 19:51:19.5582306Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1580 svchost.exe",11172,,," 1580 svchost.exe",,,,,,,,,,,,,1763581879558230600,18446633083995676672,18446633083995652096,140712899206080,0,966821433344,11172,966823247872,966823215104,140712899206080,442078,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.6057562Z","2025-11-19 19:51:19.6057562Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13112 TimelineExplorer.exe",3660,,,"13112 TimelineExplorer.exe",,,,,,,,,,,,,1763581879605756200,18446633083995676672,18446633083995652096,140710065285584,0,1007263309824,6596,1007268921344,1007268917248,140710065285584,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.6062469Z","2025-11-19 19:51:19.6062469Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13112 TimelineExplorer.exe",6596,,,"13112 TimelineExplorer.exe",,,,,,,,,,,,,1763581879606246900,18446633083995705344,18446633083995680768,140710065285584,0,1007263318016,13176,1007270494208,1007270490112,140710065285584,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.6854481Z","2025-11-19 19:51:19.6854481Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2244 svchost.exe",10872,,," 2244 svchost.exe",,,,,,,,,,,,,1763581879685448100,18446633084007510016,18446633084007485440,140712899206080,0,927664201728,10872,927665225728,927665192960,140712899206080,271962,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.7168967Z","2025-11-19 19:51:19.7168967Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2384 svchost.exe",11224,,," 2384 svchost.exe",,,,,,,,,,,,,1763581879716896700,18446633084007280640,18446633084007256064,140712899206080,0,928822128640,11224,928820035584,928820002816,140712899206080,284409,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.7681200Z","2025-11-19 19:51:19.7681200Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3564 MsMpEng.exe",15092,,," 3564 MsMpEng.exe",,,,,,,,,,,,,1763581879768120000,18446633084007280640,18446633084007256064,140712850417280,247,273686044672,13280,273711366144,273711345664,140712850417280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.7962656Z","2025-11-19 19:51:19.7962656Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2572 svchost.exe",12492,,," 2572 svchost.exe",,,,,,,,,,,,,1763581879796265600,18446633083989929984,18446633083989905408,140712899206080,0,140318752768,12492,140317556736,140317523968,140712899206080,58596122,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.7962861Z","2025-11-19 19:51:19.7962861Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2580 svchost.exe",1592,,," 2580 svchost.exe",,,,,,,,,,,,,1763581879796286100,18446633084006535168,18446633084006510592,140712899206080,0,139709349888,1592,139707613184,139707580416,140712899206080,432271,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.8593797Z","2025-11-19 19:51:19.8593797Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2688 svchost.exe",15088,,," 2688 svchost.exe",,,,,,,,,,,,,1763581879859379700,18446633084017565696,18446633084017541120,140712899206080,0,461861052416,15088,461859520512,461859487744,140712899206080,3639602,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.8593858Z","2025-11-19 19:51:19.8593858Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2824 svchost.exe",14692,,," 2824 svchost.exe",,,,,,,,,,,,,1763581879859385800,18446633084007337984,18446633084007313408,140712899206080,0,912958394368,14692,912960520192,912960487424,140712899206080,190109,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.8593878Z","2025-11-19 19:51:19.8593878Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2924 svchost.exe",15280,,," 2924 svchost.exe",,,,,,,,,,,,,1763581879859387800,18446633084053037056,18446633084053012480,140712899206080,0,22795169792,15280,22796566528,22796533760,140712899206080,320242,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.9394117Z","2025-11-19 19:51:19.9394117Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2724 svchost.exe",13784,,," 2724 svchost.exe",,,,,,,,,,,,,1763581879939411700,18446633084007624704,18446633084007600128,140712899206080,0,89489293312,13784,89490718720,89490685952,140712899206080,388516,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.9713021Z","2025-11-19 19:51:19.9713021Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3316 svchost.exe",15048,,," 3316 svchost.exe",,,,,,,,,,,,,1763581879971302100,18446633084007768064,18446633084007743488,140712899206080,0,725981220864,15048,725982642176,725982609408,140712899206080,116932,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.9713034Z","2025-11-19 19:51:19.9713034Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3256 svchost.exe",14068,,," 3256 svchost.exe",,,,,,,,,,,,,1763581879971303400,18446633084007653376,18446633084007628800,140712899206080,0,435930497024,14068,433793794048,433793761280,140712899206080,313453,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.9713095Z","2025-11-19 19:51:19.9713095Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3456 svchost.exe",11540,,," 3456 svchost.exe",,,,,,,,,,,,,1763581879971309500,18446633084007858176,18446633084007833600,140712899206080,0,94398496768,11540,94400151552,94400118784,140712899206080,179170,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.9713146Z","2025-11-19 19:51:19.9713146Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3000 svchost.exe",11392,,," 3000 svchost.exe",,,,,,,,,,,,,1763581879971314600,18446633084019789824,18446633084019765248,140712899206080,0,1014020698112,11392,1014021750784,1014021718016,140712899206080,198407,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.9713249Z","2025-11-19 19:51:19.9713249Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3532 svchost.exe",8628,,," 3532 svchost.exe",,,,,,,,,,,,,1763581879971324900,18446633083996078080,18446633083996053504,140712899206080,0,761505017856,8628,761506299904,761506267136,140712899206080,396438,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.0667475Z","2025-11-19 19:51:20.0667475Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3608 svchost.exe",13932,,," 3608 svchost.exe",,,,,,,,,,,,,1763581880066747500,18446633084007944192,18446633084007919616,140712899206080,0,310404599808,13932,310406807552,310406774784,140712899206080,237636,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.0667560Z","2025-11-19 19:51:20.0667560Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3740 svchost.exe",11332,,," 3740 svchost.exe",,,,,,,,,,,,,1763581880066756000,18446633083981160448,18446633083981135872,140712899206080,0,100414373888,11332,100416356352,100416323584,140712899206080,504693,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.0827302Z","2025-11-19 19:51:20.0827302Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 872 wininit.exe",,,,,,,,,,,,,1763581880082730200,18446633083981160448,18446633083981135872,140712899206080,0,97764483072,1924,97765556224,97765498880,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.2250627Z","2025-11-19 19:51:20.2250627Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4192 svchost.exe",7568,,," 4192 svchost.exe",,,,,,,,,,,,,1763581880225062700,18446633083979362304,18446633083979337728,140712899206080,0,330479362048,7568,330476748800,330476716032,140712899206080,297987,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.5099571Z","2025-11-19 19:51:20.5099571Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","12740 svchost.exe",14676,,,"12740 svchost.exe",,,,,,,,,,,,,1763581880509957100,18446633084011245568,18446633084011220992,140712899206080,9,237559373824,8312,237558366208,237558333440,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.5732911Z","2025-11-19 19:51:20.5732911Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1388 svchost.exe",,,,,,,,,,,,,1763581880573291100,18446633084043304960,18446633084043280384,140712899206080,0,867845025792,11356,867846062080,867846029312,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.5733821Z","2025-11-19 19:51:20.5733821Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1564 svchost.exe",,,,,,,,,,,,,1763581880573382100,18446633083995619328,18446633083995594752,140712899206080,0,86741536768,13068,86739845120,86739812352,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.5734717Z","2025-11-19 19:51:20.5734717Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1676 svchost.exe",,,,,,,,,,,,,1763581880573471700,18446633084006277120,18446633084006252544,140712899206080,0,289651171328,9168,289649328128,289649295360,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.5735685Z","2025-11-19 19:51:20.5735685Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1796 svchost.exe",,,,,,,,,,,,,1763581880573568500,18446633084007567360,18446633084007542784,140712899206080,0,708991619072,8208,708990205952,708990173184,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.5736152Z","2025-11-19 19:51:20.5736152Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1660 svchost.exe",,,,,,,,,,,,,1763581880573615200,18446633084046409728,18446633084046385152,140712899206080,0,265906413568,13016,265905373184,265905340416,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.5737346Z","2025-11-19 19:51:20.5737346Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1580 svchost.exe",,,,,,,,,,,,,1763581880573734600,18446633084041408512,18446633084041383936,140712899206080,0,966821441536,500,966823247872,966823215104,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.7004875Z","2025-11-19 19:51:20.7004875Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 2244 svchost.exe",,,,,,,,,,,,,1763581880700487500,18446633084042616832,18446633084042592256,140712899206080,0,927664209920,5500,927665225728,927665192960,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.7323852Z","2025-11-19 19:51:20.7323852Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 2384 svchost.exe",,,,,,,,,,,,,1763581880732385200,18446633084042645504,18446633084042620928,140712899206080,0,928822153216,12408,928820035584,928820002816,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.7964031Z","2025-11-19 19:51:20.7964031Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 2572 svchost.exe",,,,,,,,,,,,,1763581880796403100,18446633084042702848,18446633084042678272,140712899206080,0,140318842880,1864,140317556736,140317523968,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.7965326Z","2025-11-19 19:51:20.7965326Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 2580 svchost.exe",,,,,,,,,,,,,1763581880796532600,18446633084042731520,18446633084042706944,140712899206080,0,139709366272,11504,139707613184,139707580416,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.8746075Z","2025-11-19 19:51:20.8746075Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 2688 svchost.exe",,,,,,,,,,,,,1763581880874607500,18446633084043046912,18446633084043022336,140712899206080,0,461861085184,12512,461859520512,461859487744,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.8747287Z","2025-11-19 19:51:20.8747287Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 2824 svchost.exe",,,,,,,,,,,,,1763581880874728700,18446633084007624704,18446633084007600128,140712899206080,0,912958402560,4252,912960520192,912960487424,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.8748579Z","2025-11-19 19:51:20.8748579Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 2924 svchost.exe",,,,,,,,,,,,,1763581880874857900,18446633084007510016,18446633084007485440,140712899206080,0,22795177984,10452,22796566528,22796533760,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9540010Z","2025-11-19 19:51:20.9540010Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 2724 svchost.exe",,,,,,,,,,,,,1763581880954001000,18446633084043075584,18446633084043051008,140712899206080,0,89489301504,7700,89490718720,89490685952,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9624111Z","2025-11-19 19:51:20.9624111Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",5020,,," 5184 explorer.exe",,,,,,,,,,,,,1763581880962411100,18446633084043362304,18446633084043337728,140712891545280,0,15286272,5116,467664896,467607552,140712891545280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9698780Z","2025-11-19 19:51:20.9698780Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4608 svchost.exe",11692,,," 4608 svchost.exe",,,,,,,,,,,,,1763581880969878000,18446633084008919040,18446633084008894464,140712899206080,0,287385964544,11692,287387942912,287387910144,140712899206080,352306,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9763041Z","2025-11-19 19:51:20.9763041Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1040 svchost.exe",2280,,,"11956 smartscreen.exe",,,"C:\Windows\System32\smartscreen.exe",,,,,,,,,,1763581880976304100,,,,,,,,,,,,,,134080554805558624,,,,,3391,,,,,,0,664452,"0x","","",1040,13,3,0,0,1,419447766,,, -"2025-11-19 19:51:20.9772717Z","2025-11-19 19:51:20.9772717Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",2280,,,"11956 smartscreen.exe",,,,,,,,,,,,,1763581880977271700,18446633084008919040,18446633084008894464,140696524147856,40,4299116544,12552,4295491584,4295483392,140696524147856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9789415Z","2025-11-19 19:51:20.9789415Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\smartscreen.exe",,,,,,,,,,1763581880978941500,,,,,,,,,,,,,,,,,,,,,,,,,,664452,,,,,,,,,,419447766,140696524029952,140696524029952,614400 -"2025-11-19 19:51:20.9789788Z","2025-11-19 19:51:20.9789788Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581880978978800,,,,,,,,,,,,,,,,,,,,,,,,,,2537167,,,,,,,,,,2626650689,140712898723840,140712898723840,2523136 -"2025-11-19 19:51:20.9823811Z","2025-11-19 19:51:20.9823811Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581880982381100,,,,,,,,,,,,,,,,,,,,,,,,,,885660,,,,,,,,,,2913437033,140712877621248,140712877621248,823296 -"2025-11-19 19:51:20.9825014Z","2025-11-19 19:51:20.9825014Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581880982501400,,,,,,,,,,,,,,,,,,,,,,,,,,4209945,,,,,,,,,,2980330054,140712854355968,140712854355968,4161536 -"2025-11-19 19:51:20.9836941Z","2025-11-19 19:51:20.9836941Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581880983694100,,,,,,,,,,,,,,,,,,,,,,,,,,1436013,,,,,,,,,,1441720767,140712859467776,140712859467776,1355776 -"2025-11-19 19:51:20.9837895Z","2025-11-19 19:51:20.9837895Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,,,,,,,,,,,1763581880983789500,18446633084042788864,18446633084042764288,140712899206080,0,4299124736,6108,4296015872,4296007680,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9838695Z","2025-11-19 19:51:20.9838695Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,1763581880983869500,,,,,,,,,,,,,,,,,,,,,,,,,,3798760,,,,,,,,,,2772520021,140712863924224,140712863924224,3715072 -"2025-11-19 19:51:20.9840834Z","2025-11-19 19:51:20.9840834Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581880984083400,,,,,,,,,,,,,,,,,,,,,,,,,,1193108,,,,,,,,,,4275633056,140712897216512,140712897216512,1146880 -"2025-11-19 19:51:20.9841934Z","2025-11-19 19:51:20.9841934Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,,,,,,,,,,,1763581880984193400,18446633084043190272,18446633084043165696,140712899206080,0,4299132928,6996,4296540160,4296531968,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9842740Z","2025-11-19 19:51:20.9842740Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,1763581880984274000,,,,,,,,,,,,,,,,,,,,,,,,,,1029623,,,,,,,,,,2858041650,140712891252736,140712891252736,991232 -"2025-11-19 19:51:20.9842847Z","2025-11-19 19:51:20.9842847Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,,,,,,,,,,,1763581880984284700,18446633084043247616,18446633084043223040,140712899206080,0,4299141120,204,4297064448,4297056256,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9844610Z","2025-11-19 19:51:20.9844610Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,1763581880984461000,,,,,,,,,,,,,,,,,,,,,,,,,,1923284,,,,,,,,,,675224942,140712888827904,140712888827904,1863680 -"2025-11-19 19:51:20.9846184Z","2025-11-19 19:51:20.9846184Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,1763581880984618400,,,,,,,,,,,,,,,,,,,,,,,,,,230350,,,,,,,,,,2551303736,140712858550272,140712858550272,159744 -"2025-11-19 19:51:20.9847528Z","2025-11-19 19:51:20.9847528Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,"C:\Windows\System32\smartscreen.dll",,,,,,,,,,1763581880984752800,,,,,,,,,,,,,,,,,,,,,,,,,,6028386,,,,,,,,,,1751620389,140712383414272,140712383414272,6057984 -"2025-11-19 19:51:20.9847585Z","2025-11-19 19:51:20.9847585Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,1763581880984758500,,,,,,,,,,,,,,,,,,,,,,,,,,230873,,,,,,,,,,527442843,140712882405376,140712882405376,176128 -"2025-11-19 19:51:20.9849421Z","2025-11-19 19:51:20.9849421Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581880984942100,,,,,,,,,,,,,,,,,,,,,,,,,,761372,,,,,,,,,,71854833,140712881618944,140712881618944,737280 -"2025-11-19 19:51:20.9849424Z","2025-11-19 19:51:20.9849424Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,1763581880984942400,,,,,,,,,,,,,,,,,,,,,,,,,,1243850,,,,,,,,,,792084382,140712861433856,140712861433856,1228800 -"2025-11-19 19:51:20.9851390Z","2025-11-19 19:51:20.9851390Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581880985139000,,,,,,,,,,,,,,,,,,,,,,,,,,700029,,,,,,,,,,3371602543,140712858746880,140712858746880,667648 -"2025-11-19 19:51:20.9851423Z","2025-11-19 19:51:20.9851423Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",204,,,"11956 smartscreen.exe",,,"C:\Windows\System32\winhttp.dll",,,,,,,,,,1763581880985142300,,,,,,,,,,,,,,,,,,,,,,,,,,1261038,,,,,,,,,,84984727,140712750350336,140712750350336,1212416 -"2025-11-19 19:51:20.9851960Z","2025-11-19 19:51:20.9851960Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581880985196000,,,,,,,,,,,,,,,,,,,,,,,,,,760295,,,,,,,,,,460960534,140712894529536,140712894529536,692224 -"2025-11-19 19:51:20.9854024Z","2025-11-19 19:51:20.9854024Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",204,,,"11956 smartscreen.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581880985402400,,,,,,,,,,,,,,,,,,,,,,,,,,716301,,,,,,,,,,3291623140,140712863203328,140712863203328,679936 -"2025-11-19 19:51:20.9854512Z","2025-11-19 19:51:20.9854512Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581880985451200,,,,,,,,,,,,,,,,,,,,,,,,,,716301,,,,,,,,,,3291623140,1646826618880,1646826618880,679936 -"2025-11-19 19:51:20.9854713Z","2025-11-19 19:51:20.9854713Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\crypt32.dll",,,,,,,,,,1763581880985471300,,,,,,,,,,,,,,,,,,,,,,,,,,1584869,,,,,,,,,,3438168074,140712849768448,140712849768448,1536000 -"2025-11-19 19:51:20.9855242Z","2025-11-19 19:51:20.9855242Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581880985524200,,,,,,,,,,,,,,,,,,,,,,,,,,716301,,,,,,,,,,3291623140,1646826618880,1646826618880,692224 -"2025-11-19 19:51:20.9856395Z","2025-11-19 19:51:20.9856395Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,"C:\Windows\System32\ws2_32.dll",,,,,,,,,,1763581880985639500,,,,,,,,,,,,,,,,,,,,,,,,,,513405,,,,,,,,,,3967481067,140712881094656,140712881094656,475136 -"2025-11-19 19:51:20.9856905Z","2025-11-19 19:51:20.9856905Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,1763581880985690500,,,,,,,,,,,,,,,,,,,,,,,,,,899838,,,,,,,,,,2878277657,140712880177152,140712880177152,880640 -"2025-11-19 19:51:20.9858908Z","2025-11-19 19:51:20.9858908Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",204,,,"11956 smartscreen.exe",,,"C:\Windows\System32\cryptsp.dll",,,,,,,,,,1763581880985890800,,,,,,,,,,,,,,,,,,,,,,,,,,146168,,,,,,,,,,1658328178,140712839217152,140712839217152,110592 -"2025-11-19 19:51:20.9859779Z","2025-11-19 19:51:20.9859779Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3316 svchost.exe",,,,,,,,,,,,,1763581880985977900,18446633084043276288,18446633084043251712,140712899206080,0,725981229056,5216,725982642176,725982609408,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9860302Z","2025-11-19 19:51:20.9860302Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,1763581880986030200,,,,,,,,,,,,,,,,,,,,,,,,,,7769948,,,,,,,,,,2341846616,140712869888000,140712869888000,7663616 -"2025-11-19 19:51:20.9860717Z","2025-11-19 19:51:20.9860717Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3256 svchost.exe",,,,,,,,,,,,,1763581880986071700,18446633084043390976,18446633084043366400,140712899206080,0,435930505216,13464,433793794048,433793761280,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9861764Z","2025-11-19 19:51:20.9861764Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3000 svchost.exe",,,,,,,,,,,,,1763581880986176400,18446633084043476992,18446633084043452416,140712899206080,0,1014020706304,13692,1014021750784,1014021718016,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9862140Z","2025-11-19 19:51:20.9862140Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3456 svchost.exe",,,,,,,,,,,,,1763581880986214000,18446633084043538432,18446633084043513856,140712899206080,0,94398504960,12164,94400151552,94400118784,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9863024Z","2025-11-19 19:51:20.9863024Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3532 svchost.exe",,,,,,,,,,,,,1763581880986302400,18446633084043997184,18446633084043972608,140712899206080,0,761505026048,6444,761506299904,761506267136,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9864111Z","2025-11-19 19:51:20.9864111Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",204,,,"11956 smartscreen.exe",,,"C:\Windows\System32\dnsapi.dll",,,,,,,,,,1763581880986411100,,,,,,,,,,,,,,,,,,,,,,,,,,1293169,,,,,,,,,,1381219389,140712824274944,140712824274944,1228800 -"2025-11-19 19:51:20.9864222Z","2025-11-19 19:51:20.9864222Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,1763581880986422200,,,,,,,,,,,,,,,,,,,,,,,,,,1524912,,,,,,,,,,1404855129,140712851341312,140712851341312,1486848 -"2025-11-19 19:51:20.9866834Z","2025-11-19 19:51:20.9866834Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,"C:\Windows\System32\wintrust.dll",,,,,,,,,,1763581880986683400,,,,,,,,,,,,,,,,,,,,,,,,,,590783,,,,,,,,,,452262045,140712860844032,140712860844032,520192 -"2025-11-19 19:51:20.9867955Z","2025-11-19 19:51:20.9867955Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",204,,,"11956 smartscreen.exe",,,"C:\Windows\System32\IPHLPAPI.DLL",,,,,,,,,,1763581880986795500,,,,,,,,,,,,,,,,,,,,,,,,,,233044,,,,,,,,,,945822897,140712824012800,140712824012800,212992 -"2025-11-19 19:51:20.9869651Z","2025-11-19 19:51:20.9869651Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,"C:\Windows\System32\ole32.dll",,,,,,,,,,1763581880986965100,,,,,,,,,,,,,,,,,,,,,,,,,,1689904,,,,,,,,,,1018821057,140712878473216,140712878473216,1667072 -"2025-11-19 19:51:20.9890552Z","2025-11-19 19:51:20.9890552Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\nsi.dll",,,,,,,,,,1763581880989055200,,,,,,,,,,,,,,,,,,,,,,,,,,111648,,,,,,,,,,4223476491,140712892956672,140712892956672,40960 -"2025-11-19 19:51:20.9896219Z","2025-11-19 19:51:20.9896219Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,1763581880989621900,,,,,,,,,,,,,,,,,,,,,,,,,,233556,,,,,,,,,,1625678811,140712882601984,140712882601984,200704 -"2025-11-19 19:51:20.9913559Z","2025-11-19 19:51:20.9913559Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\msasn1.dll",,,,,,,,,,1763581880991355900,,,,,,,,,,,,,,,,,,,,,,,,,,150871,,,,,,,,,,2536054058,140712839675904,140712839675904,77824 -"2025-11-19 19:51:20.9921028Z","2025-11-19 19:51:20.9921028Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,,,,,,,,,,,1763581880992102800,18446633084042960896,18446633084042936320,140712387241344,0,4299149312,5980,4299685888,4299677696,140712387241344,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9924315Z","2025-11-19 19:51:20.9924315Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",5980,,,"11956 smartscreen.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,1763581880992431500,,,,,,,,,,,,,,,,,,,,,,,,,,158678,,,,,,,,,,3554393863,140712830631936,140712830631936,110592 -"2025-11-19 19:51:20.9928273Z","2025-11-19 19:51:20.9928273Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,1763581880992827300,,,,,,,,,,,,,,,,,,,,,,,,,,741046,,,,,,,,,,2283238626,140712852848640,140712852848640,675840 -"2025-11-19 19:51:20.9932375Z","2025-11-19 19:51:20.9932375Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"11956 smartscreen.exe",,,,,,,,,,,,,1763581880993237500,18446633084044025856,18446633084044001280,140712899206080,0,4297064448,3708,4300210176,4300201984,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9935171Z","2025-11-19 19:51:20.9935171Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",3708,,,"11956 smartscreen.exe",,,"C:\Windows\System32\wtdsensor.dll",,,,,,,,,,1763581880993517100,,,,,,,,,,,,,,,,,,,,,,,,,,56489,,,,,,,,,,4237415889,140712681996288,140712681996288,45056 -"2025-11-19 19:51:20.9946637Z","2025-11-19 19:51:20.9946637Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,1763581880994663700,,,,,,,,,,,,,,,,,,,,,,,,,,783429,,,,,,,,,,2294669044,140712888041472,140712888041472,720896 -"2025-11-19 19:51:20.9955563Z","2025-11-19 19:51:20.9955563Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,,,,,,,,,,,1763581880995556300,18446633084044054528,18446633084044029952,140712865112144,0,4297072640,2328,4300734464,4300726272,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9958285Z","2025-11-19 19:51:20.9958285Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11956 smartscreen.exe",3708,,,"11956 smartscreen.exe",,,,,,,,,,,,,1763581880995828500,18446633084044197888,18446633084044173312,140712899206080,0,4297080832,4856,4301258752,4301250560,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9975541Z","2025-11-19 19:51:20.9975541Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11956 smartscreen.exe",3708,,,"11956 smartscreen.exe",,,,,,,,,,,,,1763581880997554100,18446633084044255232,18446633084044230656,140712899206080,0,4297089024,11364,4301783040,4301774848,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9987968Z","2025-11-19 19:51:20.9987968Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",3708,,,"11956 smartscreen.exe",,,"C:\Windows\System32\smartscreenps.dll",,,,,,,,,,1763581880998796800,,,,,,,,,,,,,,,,,,,,,,,,,,151429,,,,,,,,,,4089359051,140712623865856,140712623865856,122880 -"2025-11-19 19:51:21.0003864Z","2025-11-19 19:51:21.0003864Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",3708,,,"11956 smartscreen.exe",,,"C:\Windows\System32\Windows.Management.Workplace.dll",,,,,,,,,,1763581881000386400,,,,,,,,,,,,,,,,,,,,,,,,,,215437,,,,,,,,,,170946563,140712429879296,140712429879296,204800 -"2025-11-19 19:51:21.0012539Z","2025-11-19 19:51:21.0012539Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",3708,,,"11956 smartscreen.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581881001253900,,,,,,,,,,,,,,,,,,,,,,,,,,769657,,,,,,,,,,423353507,140712774598656,140712774598656,741376 -"2025-11-19 19:51:21.0017586Z","2025-11-19 19:51:21.0017586Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11956 smartscreen.exe",3708,,,"11956 smartscreen.exe",,,,,,,,,,,,,1763581881001758600,18446633084044283904,18446633084044259328,140712387241344,0,4297097216,9852,4302307328,4302299136,140712387241344,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0413450Z","2025-11-19 19:51:21.0413450Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 5184 explorer.exe",5116,,," 3348 attack-589.exe",,,"C:\Users\Public\Downloads\attack-589.exe",,,,,,,,,,1763581881041345000,,,,,,,,,,,,,,134080554806144016,,,,,3392,,,,,,0,0,"0x","","",5184,140,3,0,0,1,1763491559,,, -"2025-11-19 19:51:21.0443828Z","2025-11-19 19:51:21.0443828Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",5116,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581881044382800,18446633084044398592,18446633084044374016,140695599400816,0,289797906432,11212,289800192000,289800187904,140695599400816,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0471547Z","2025-11-19 19:51:21.0471547Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 5536 svchost.exe",,,,,,,,,,,,,1763581881047154700,18446633084043419648,18446633084043395072,140712899206080,0,151912587264,1300,151915069440,151915036672,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0473929Z","2025-11-19 19:51:21.0473929Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5536 svchost.exe",1300,,," 5536 svchost.exe",,,,,,,,,,,,,1763581881047392900,18446633084044513280,18446633084044488704,140712899206080,132,151912595456,7072,151915593728,151915560960,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0503483Z","2025-11-19 19:51:21.0503483Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5536 svchost.exe",11248,,," 5536 svchost.exe",,,,,,,,,,,,,1763581881050348300,18446633084043161600,18446633084043137024,140712899206080,0,151912603648,1620,151916118016,151916085248,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0504664Z","2025-11-19 19:51:21.0504664Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5536 svchost.exe",1620,,," 5536 svchost.exe",,,,,,,,,,,,,1763581881050466400,18446633084044455936,18446633084044431360,140712899206080,0,151912611840,8960,151920836608,151920803840,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0550224Z","2025-11-19 19:51:21.0550224Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Users\Public\Downloads\attack-589.exe",,,,,,,,,,1763581881055022400,,,,,,,,,,,,,,,,,,,,,,,,,,0,,,,,,,,,,1763491559,140695599382528,140695599382528,53248 -"2025-11-19 19:51:21.0550597Z","2025-11-19 19:51:21.0550597Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581881055059700,,,,,,,,,,,,,,,,,,,,,,,,,,2537167,,,,,,,,,,2626650689,140712898723840,140712898723840,2523136 -"2025-11-19 19:51:21.0557966Z","2025-11-19 19:51:21.0557966Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581881055796600,,,,,,,,,,,,,,,,,,,,,,,,,,885660,,,,,,,,,,2913437033,140712877621248,140712877621248,823296 -"2025-11-19 19:51:21.0559164Z","2025-11-19 19:51:21.0559164Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581881055916400,,,,,,,,,,,,,,,,,,,,,,,,,,4209945,,,,,,,,,,2980330054,140712854355968,140712854355968,4161536 -"2025-11-19 19:51:21.0568214Z","2025-11-19 19:51:21.0568214Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 3348 attack-589.exe",11212,,," 3100 conhost.exe",,,"C:\Windows\System32\conhost.exe",,,,,,,,,,1763581881056821400,,,,,,,,,,,,,,134080554806283315,,,,,3393,,,,,,0,1035098,"0x","","",3348,3392,3,0,0,1,2671108986,,, -"2025-11-19 19:51:21.0581639Z","2025-11-19 19:51:21.0581639Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3348 attack-589.exe",11212,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881058163900,18446633084006535168,18446633084006510592,140696384751904,0,1013857710080,13484,1013860270080,1013860261888,140696384751904,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0603778Z","2025-11-19 19:51:21.0603778Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3100 conhost.exe",13484,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881060377800,18446633084044943360,18446633084044918784,140712899206080,0,1013857718272,4844,1013860794368,1013860786176,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0604718Z","2025-11-19 19:51:21.0604718Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3100 conhost.exe",4844,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881060471800,18446633084044570624,18446633084044546048,140712899206080,0,1013857726464,11404,1013861318656,1013861310464,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0649429Z","2025-11-19 19:51:21.0649429Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3100 conhost.exe",13484,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881064942900,18446633084044627968,18446633084044603392,140696384580832,0,1013857734656,6724,1013861842944,1013861834752,140696384580832,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0650293Z","2025-11-19 19:51:21.0650293Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3100 conhost.exe",11404,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881065029300,18446633084044570624,18446633084044546048,140712899206080,0,1013857726464,11404,1013861318656,1013861310464,140712899206080,1647609,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0650435Z","2025-11-19 19:51:21.0650435Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3100 conhost.exe",4844,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881065043500,18446633084044943360,18446633084044918784,140712899206080,0,1013857718272,4844,1013860794368,1013860786176,140712899206080,754023,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0651883Z","2025-11-19 19:51:21.0651883Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3100 conhost.exe",13484,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881065188400,18446633084006535168,18446633084006510592,140696384751904,0,1013857710080,13484,1013860270080,1013860253696,140696384751904,23804713,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0654850Z","2025-11-19 19:51:21.0654850Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3100 conhost.exe",6724,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881065485000,18446633084006535168,18446633084006510592,140712899206080,0,1013857742848,4376,1013860270080,1013860261888,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0707449Z","2025-11-19 19:51:21.0707449Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3100 conhost.exe",6724,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881070744900,18446633084044943360,18446633084044918784,140712865112144,0,1013857751040,2976,1013860794368,1013860786176,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0709822Z","2025-11-19 19:51:21.0709822Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881070982200,18446633084044656640,18446633084044632064,140712899206080,0,1013857759232,9260,1013861318656,1013861310464,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0711453Z","2025-11-19 19:51:21.0711453Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3100 conhost.exe",9260,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881071145300,18446633084044828672,18446633084044804096,140712899206080,0,1013857767424,1400,1013862367232,1013862359040,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0809895Z","2025-11-19 19:51:21.0809895Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3608 svchost.exe",,,,,,,,,,,,,1763581881080989500,18446633084044972032,18446633084044947456,140712899206080,0,310404608000,2980,310406807552,310406774784,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0810351Z","2025-11-19 19:51:21.0810351Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3740 svchost.exe",,,,,,,,,,,,,1763581881081035100,18446633084045029376,18446633084045004800,140712899206080,0,100414390272,14328,100416356352,100416323584,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0819304Z","2025-11-19 19:51:21.0819304Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1040 svchost.exe",2280,,,"13828 OpenConsole.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\OpenConsole.exe",,,,,,,,,,1763581881081930400,,,,,,,,,,,,,,134080554806509408,,,,,3394,,,,,,3,1210794,"0x","Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe","App",1040,13,3,0,0,1,1759975785,,, -"2025-11-19 19:51:21.0828506Z","2025-11-19 19:51:21.0828506Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",2280,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881082850600,18446633084045201408,18446633084045176832,140702989817872,40,132813885440,4736,132815781888,132815777792,140702989817872,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0910041Z","2025-11-19 19:51:21.0910041Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881091004200,18446633084045402112,18446633084045377536,140712899206080,0,132813893632,14136,132816830464,132816826368,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0912384Z","2025-11-19 19:51:21.0912384Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881091238400,18446633084045430784,18446633084045406208,140712899206080,0,132813901824,12136,132817879040,132817874944,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0913292Z","2025-11-19 19:51:21.0913292Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13828 OpenConsole.exe",12136,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881091329200,18446633084045807616,18446633084045783040,140712899206080,0,132813910016,1824,132818927616,132818923520,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1063298Z","2025-11-19 19:51:21.1063298Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881106329800,18446633084045864960,18446633084045840384,140712865112144,0,132813918208,13020,132819976192,132819968000,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1065155Z","2025-11-19 19:51:21.1065155Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881106515500,18446633084045922304,18446633084045897728,140712899206080,0,132813926400,5064,132821024768,132821020672,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1066984Z","2025-11-19 19:51:21.1066984Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13828 OpenConsole.exe",5064,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881106698400,18446633084045950976,18446633084045926400,140712899206080,0,132813934592,2364,132822073344,132822069248,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1341345Z","2025-11-19 19:51:21.1341345Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1040 svchost.exe",2280,,," 2344 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe",,,,,,,,,,1763581881134134500,,,,,,,,,,,,,,134080554806979193,,,,,3395,,,,,,3,738129,"0x","Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe","App",1040,13,3,0,0,1,1759975821,,, -"2025-11-19 19:51:21.1352167Z","2025-11-19 19:51:21.1352167Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",2280,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881135216700,18446633084046352384,18446633084046327808,140702319920256,40,1068179636224,5964,1068177817600,1068177813504,140702319920256,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1487993Z","2025-11-19 19:51:21.1487993Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881148799300,18446633084046610432,18446633084046585856,140712899206080,0,1068179644416,11152,1068181225472,1068181221376,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1491777Z","2025-11-19 19:51:21.1491777Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881149177700,18446633084046667776,18446633084046643200,140712899206080,0,1068179652608,4348,1068182274048,1068182269952,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1499435Z","2025-11-19 19:51:21.1499435Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",4348,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881149943500,18446633084046725120,18446633084046700544,140712899206080,0,1068179660800,12024,1068183322624,1068183318528,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1630475Z","2025-11-19 19:51:21.1630475Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881163047500,18446633084042817536,18446633084042792960,140712899206080,0,1068179668992,14844,1068184371200,1068184367104,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1658291Z","2025-11-19 19:51:21.1658291Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881165829100,18446633084046983168,18446633084046958592,140712865112144,0,1068179677184,11108,1068185419776,1068185411584,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1661013Z","2025-11-19 19:51:21.1661013Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",14844,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881166101300,18446633084047183872,18446633084047159296,140712899206080,0,1068179685376,8404,1068186468352,1068186464256,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1916998Z","2025-11-19 19:51:21.1916998Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881191699800,18446633084045144064,18446633084045119488,140712891292720,0,1068179693568,6876,1068187516928,1068187512832,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1974505Z","2025-11-19 19:51:21.1974505Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3204 Taskmgr.exe",5876,,," 3204 Taskmgr.exe",,,,,,,,,,,,,1763581881197450500,18446633084047499264,18446633084047474688,140712891292720,0,552496058368,11128,552502034432,552502026240,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1977017Z","2025-11-19 19:51:21.1977017Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881197701700,18446633084047642624,18446633084047618048,140712600145104,0,1068179701760,13936,1068188565504,1068188561408,140712600145104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1977569Z","2025-11-19 19:51:21.1977569Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881197756900,18446633084047790080,18446633084047765504,140712604173856,0,1068179709952,10116,1068189614080,1068189609984,140712604173856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2126399Z","2025-11-19 19:51:21.2126399Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",13936,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881212639900,18446633084047642624,18446633084047618048,140712600145104,0,1068179701760,13936,1068188565504,1068188536832,140712600145104,46394848,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2137996Z","2025-11-19 19:51:21.2137996Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881213799600,18446633084047642624,18446633084047618048,140712632221632,0,1068179718144,14500,1068188565504,1068188561408,140712632221632,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2399243Z","2025-11-19 19:51:21.2399243Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 4192 svchost.exe",,,,,,,,,,,,,1763581881239924300,18446633084047818752,18446633084047794176,140712899206080,0,330479370240,10680,330476748800,330476716032,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.821877500Z","2025-11-19 19:51:21.2718203Z","myETW","EDRi-Provider",4242,"EDRiTask","12472 EDRi.exe",,,,,,"After starting the attack exe",,,,,,,,,,,1763581881271820300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3039247Z","2025-11-19 19:51:21.3039247Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4440 svchost.exe",15252,,," 4440 svchost.exe",,,,,,,,,,,,,1763581881303924700,18446633084039225344,18446633084039200768,140712899206080,0,985498337280,15252,985501007872,985500975104,140712899206080,3620366,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3351734Z","2025-11-19 19:51:21.3351734Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13828 OpenConsole.exe",2364,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881335173400,18446633084047904768,18446633084047880192,140702989217024,0,132813942784,5760,132823121920,132823117824,140702989217024,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3352289Z","2025-11-19 19:51:21.3352289Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13828 OpenConsole.exe",2364,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881335228900,18446633084039225344,18446633084039200768,140702989233856,0,132813950976,14196,132824170496,132824166400,140702989233856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3369403Z","2025-11-19 19:51:21.3369403Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3100 conhost.exe",6724,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881336940400,18446633084047990784,18446633084047966208,140696385038832,0,1013857775616,11136,1013862891520,1013862883328,140696385038832,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3414284Z","2025-11-19 19:51:21.3414284Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881341428400,18446633084048019456,18446633084047994880,140702989086576,0,132813959168,5520,132825219072,132825214976,140702989086576,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3429436Z","2025-11-19 19:51:21.3429436Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881342943600,18446633084044541952,18446633084044517376,140712583404848,0,1068179726336,11716,1068190662656,1068190658560,140712583404848,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3431486Z","2025-11-19 19:51:21.3431486Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881343148700,18446633084042874880,18446633084042850304,140702989404080,0,132813967360,12916,132826267648,132826263552,140702989404080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3435982Z","2025-11-19 19:51:21.3435982Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",14844,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881343598200,18446633084047876096,18446633084047851520,140712899206080,0,1068179734528,9740,1068191711232,1068191707136,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3840381Z","2025-11-19 19:51:21.3840381Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8448 OneDrive.exe",12656,,," 8448 OneDrive.exe",,,,,,,,,,,,,1763581881384038100,18446633084042072064,18446633084042047488,140712859481984,0,70345129984,12656,70351060992,70351048704,140712859481984,5254774,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3990087Z","2025-11-19 19:51:21.3990087Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4784 svchost.exe",10016,,," 4784 svchost.exe",,,,,,,,,,,,,1763581881399008700,18446633084049223680,18446633084049199104,140712899206080,0,476842119168,10016,476845178880,476845146112,140712899206080,233109,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3991102Z","2025-11-19 19:51:21.3991102Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4148 svchost.exe",14944,,," 4148 svchost.exe",,,,,,,,,,,,,1763581881399110200,18446633084008603648,18446633084008579072,140712899206080,0,934391029760,14944,934392889344,934392856576,140712899206080,547695,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3991392Z","2025-11-19 19:51:21.3991392Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4284 svchost.exe",12524,,," 4284 svchost.exe",,,,,,,,,,,,,1763581881399139300,18446633083996708864,18446633083996684288,140712899206080,0,216311418880,12524,216310611968,216310579200,140712899206080,609932,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4014776Z","2025-11-19 19:51:21.4014776Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881401477600,18446633084042072064,18446633084042047488,140712865112144,0,1068179742720,12568,1068192759808,1068192751616,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4298365Z","2025-11-19 19:51:21.4298365Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881429836500,18446633084042932224,18446633084042907648,140712371704112,0,1068179750912,4932,1068193808384,1068193804288,140712371704112,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4299053Z","2025-11-19 19:51:21.4299053Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881429905300,18446633084007337984,18446633084007313408,140712378178864,0,1068179759104,3968,1068194856960,1068194852864,140712378178864,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4330267Z","2025-11-19 19:51:21.4330267Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\apphelp.dll",,,,,,,,,,1763581881433026700,,,,,,,,,,,,,,,,,,,,,,,,,,675806,,,,,,,,,,4108425587,140712800485376,140712800485376,651264 -"2025-11-19 19:51:21.4330576Z","2025-11-19 19:51:21.4330576Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",3968,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881433057600,18446633084048162816,18446633084048138240,140712899206080,0,1068179767296,11960,1068195905536,1068195901440,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4385550Z","2025-11-19 19:51:21.4385550Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581881438555000,,,,,,,,,,,,,,,,,,,,,,,,,,761372,,,,,,,,,,71854833,140712881618944,140712881618944,737280 -"2025-11-19 19:51:21.4386944Z","2025-11-19 19:51:21.4386944Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581881438694400,,,,,,,,,,,,,,,,,,,,,,,,,,760295,,,,,,,,,,460960534,140712894529536,140712894529536,692224 -"2025-11-19 19:51:21.4388601Z","2025-11-19 19:51:21.4388601Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581881438860100,18446633083996708864,18446633083996684288,140712899206080,0,289797914624,11468,289801240576,289801236480,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4389513Z","2025-11-19 19:51:21.4389513Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581881438951300,,,,,,,,,,,,,,,,,,,,,,,,,,716301,,,,,,,,,,3291623140,140712863203328,140712863203328,679936 -"2025-11-19 19:51:21.4391936Z","2025-11-19 19:51:21.4391936Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581881439193600,,,,,,,,,,,,,,,,,,,,,,,,,,1193108,,,,,,,,,,4275633056,140712897216512,140712897216512,1146880 -"2025-11-19 19:51:21.4393533Z","2025-11-19 19:51:21.4393533Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581881439353300,18446633084049022976,18446633084048998400,140712899206080,0,289797922816,3088,289802289152,289802285056,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4394768Z","2025-11-19 19:51:21.4394768Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581881439476800,,,,,,,,,,,,,,,,,,,,,,,,,,1436013,,,,,,,,,,1441720767,140712859467776,140712859467776,1355776 -"2025-11-19 19:51:21.4394810Z","2025-11-19 19:51:21.4394810Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3348 attack-589.exe",3088,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581881439481000,18446633084049080320,18446633084049055744,140712899206080,0,289797931008,12904,289803337728,289803333632,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4397699Z","2025-11-19 19:51:21.4397699Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11468,,," 3348 attack-589.exe",,,"C:\Windows\System32\msvcp140.dll",,,,,,,,,,1763581881439769900,,,,,,,,,,,,,,,,,,,,,,,,,,570439,,,,,,,,,,1564323704,140711213137920,140711213137920,561152 -"2025-11-19 19:51:21.4397897Z","2025-11-19 19:51:21.4397897Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",3088,,," 3348 attack-589.exe",,,"C:\Windows\System32\vcruntime140_1.dll",,,,,,,,,,1763581881439789700,,,,,,,,,,,,,,,,,,,,,,,,,,57827,,,,,,,,,,240324076,140712354119680,140712354119680,49152 -"2025-11-19 19:51:21.4398073Z","2025-11-19 19:51:21.4398073Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",12904,,," 3348 attack-589.exe",,,"C:\Windows\System32\vcruntime140.dll",,,,,,,,,,1763581881439807300,,,,,,,,,,,,,,,,,,,,,,,,,,146072,,,,,,,,,,254123393,140712353988608,140712353988608,122880 -"2025-11-19 19:51:20.974665800Z","2025-11-19 19:51:21.4415712Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Injector started with PID 3348",,,,,,,,,,,1763581881441571200,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4676380Z","2025-11-19 19:51:21.4676380Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",9740,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881467638000,18446633084049252352,18446633084049227776,140712899206080,0,1068179775488,12140,1068196954112,1068196950016,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5095245Z","2025-11-19 19:51:21.5095245Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881509524500,18446633084044570624,18446633084044546048,140712899206080,0,1068179783680,3600,1068198002688,1068197998592,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5099019Z","2025-11-19 19:51:21.5099019Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",3600,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881509901900,18446633084046180352,18446633084046155776,140712899206080,0,1068179791872,11228,1068199051264,1068199047168,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5101012Z","2025-11-19 19:51:21.5101012Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",11228,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881510101200,18446633084049424384,18446633084049399808,140712899206080,0,1068179800064,1960,1068200099840,1068200095744,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5107492Z","2025-11-19 19:51:21.5107492Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",1960,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881510749200,18446633084049453056,18446633084049428480,140712899206080,0,1068179808256,12764,1068201148416,1068201144320,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5109197Z","2025-11-19 19:51:21.5109197Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",12764,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881510919700,18446633084049481728,18446633084049457152,140712899206080,0,1068179816448,14948,1068202196992,1068202192896,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5586241Z","2025-11-19 19:51:21.5586241Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3564 MsMpEng.exe",15224,,," 3564 MsMpEng.exe",,,,,,,,,,,,,1763581881558624100,18446633084048191488,18446633084048166912,140712899206080,247,273686052864,4152,273715036160,273714970624,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5586910Z","2025-11-19 19:51:21.5586910Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3564 MsMpEng.exe",15224,,," 3564 MsMpEng.exe",,,,,,,,,,,,,1763581881558691000,18446633084049653760,18446633084049629184,140712647800224,247,273686061056,6492,273715560448,273715494912,140712647800224,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5588912Z","2025-11-19 19:51:21.5588912Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3564 MsMpEng.exe",4152,,," 3564 MsMpEng.exe",,,,,,,,,,,,,1763581881558891200,18446633084049739776,18446633084049715200,140712899206080,0,273686069248,908,273716084736,273716019200,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5947441Z","2025-11-19 19:51:21.5947441Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3564 MsMpEng.exe",6492,,," 3564 MsMpEng.exe",,,,,,,,,,,,,1763581881594744200,18446633084049653760,18446633084049629184,140712647800224,247,273686061056,6492,273715560448,273715494912,140712647800224,444719,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5948825Z","2025-11-19 19:51:21.5948825Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3492 svchost.exe",5904,,," 3492 svchost.exe",,,,,,,,,,,,,1763581881594882500,18446633084049653760,18446633084049629184,140712850417280,51,390179405824,6828,390182469632,390182436864,140712850417280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5949276Z","2025-11-19 19:51:21.5949276Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8972 VBoxTray.exe",9020,,," 8972 VBoxTray.exe",,,,,,,,,,,,,1763581881594927600,18446633084049825792,18446633084049801216,140700131109808,0,471284236288,10404,471286677504,471286673408,140700131109808,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5952887Z","2025-11-19 19:51:21.5952887Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8972 VBoxTray.exe",10404,,," 8972 VBoxTray.exe",,,,,,,,,,,,,1763581881595288800,18446633084049825792,18446633084049801216,140700131109808,0,471284236288,10404,471286677504,471286669312,140700131109808,498282,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.7341752Z","2025-11-19 19:51:21.7341752Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5492 svchost.exe",14880,,," 5492 svchost.exe",,,,,,,,,,,,,1763581881734175200,18446633083981475840,18446633083981451264,140712899206080,0,915765288960,14880,915762446336,915762413568,140712899206080,296102,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.7983187Z","2025-11-19 19:51:21.7983187Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","12224 svchost.exe",9032,,,"12224 svchost.exe",,,,,,,,,,,,,1763581881798318700,18446633084060700672,18446633084060676096,140712899206080,0,706015498240,9032,706018803712,706018770944,140712899206080,8518314,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.7983803Z","2025-11-19 19:51:21.7983803Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","12224 svchost.exe",10960,,,"12224 svchost.exe",,,,,,,,,,,,,1763581881798380300,18446633084060872704,18446633084060848128,140712899206080,0,706015514624,10960,706019852288,706019819520,140712899206080,2446520,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.8777317Z","2025-11-19 19:51:21.8777317Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","12036 svchost.exe",9152,,,"12036 svchost.exe",,,,,,,,,,,,,1763581881877731700,18446633084061933568,18446633084061908992,140712899206080,0,457933398016,9152,457937780736,457937747968,140712899206080,1219109,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.8777978Z","2025-11-19 19:51:21.8777978Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","12036 svchost.exe",1972,,,"12036 svchost.exe",,,,,,,,,,,,,1763581881877797800,18446633084061589504,18446633084061564928,140712899206080,0,457933357056,1972,457935159296,457935126528,140712899206080,44750634,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.8778273Z","2025-11-19 19:51:21.8778273Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","12036 svchost.exe",6012,,,"12036 svchost.exe",,,,,,,,,,,,,1763581881877827300,18446633084061876224,18446633084061851648,140712899206080,0,457933389824,6012,457937256448,457937223680,140712899206080,909052,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.9736609Z","2025-11-19 19:51:21.9736609Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 4608 svchost.exe",,,,,,,,,,,,,1763581881973660900,18446633084061876224,18446633084061851648,140712899206080,0,287385972736,12852,287387942912,287387910144,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.0373099Z","2025-11-19 19:51:22.0373099Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 9692 PerfWatson2.exe",9752,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,1763581882037309900,18446633084061589504,18446633084061564928,140711612509856,0,1046353248256,8132,1046352232448,1046352216064,140711612509856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.0697083Z","2025-11-19 19:51:22.0697083Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6096 svchost.exe",11408,,," 6096 svchost.exe",,,,,,,,,,,,,1763581882069708300,18446633084055818240,18446633084055793664,140712899206080,0,338489364480,11408,338488393728,338488360960,140712899206080,684617,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.1476357Z","2025-11-19 19:51:22.1476357Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9388 devenv.exe",5524,,," 9388 devenv.exe",,,,,,,,,,,,,1763581882147635700,18446633084010299392,18446633084010274816,140711613062896,0,1033376530432,5524,1033400483840,1033400401920,140711613062896,847113123,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.1480054Z","2025-11-19 19:51:22.1480054Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9388 devenv.exe",8848,,," 9388 devenv.exe",,,,,,,,,,,,,1763581882148005400,18446633084060069888,18446633084060045312,140711613062896,0,1033376243712,8848,1033378988032,1033378902016,140711613062896,697768345,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.3061593Z","2025-11-19 19:51:22.3061593Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 4440 svchost.exe",,,,,,,,,,,,,1763581882306159300,18446633084060069888,18446633084060045312,140712899206080,0,985498419200,13764,985501007872,985500975104,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.4015320Z","2025-11-19 19:51:22.4015320Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 4784 svchost.exe",,,,,,,,,,,,,1763581882401532000,18446633084010299392,18446633084010274816,140712899206080,0,476842127360,6624,476845178880,476845146112,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.4016565Z","2025-11-19 19:51:22.4016565Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 4148 svchost.exe",,,,,,,,,,,,,1763581882401656500,18446633084060872704,18446633084060848128,140712899206080,0,934391037952,15288,934392889344,934392856576,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.4017245Z","2025-11-19 19:51:22.4017245Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 4284 svchost.exe",,,,,,,,,,,,,1763581882401724500,18446633084061933568,18446633084061908992,140712899206080,0,216311427072,4948,216310611968,216310579200,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.852182900Z","2025-11-19 19:51:22.4165908Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Running 'standard' config",,,,,,,,,,,1763581882416590800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.852392100Z","2025-11-19 19:51:22.4168223Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Before starting subprocess to inject to",,,,,,,,,,,1763581882416822300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.4176543Z","2025-11-19 19:51:22.4176543Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 3348 attack-589.exe",11212,,," 1436 whoami.exe",,,"C:\Windows\System32\whoami.exe",,,,,,,,,,1763581882417654300,,,,,,,,,,,,,,134080554818530829,,,,,3396,,,,,,0,160109,"0x","","",3348,3392,3,0,0,1,3602411345,,, -"2025-11-19 19:51:22.4206852Z","2025-11-19 19:51:22.4206852Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3348 attack-589.exe",11212,,," 1436 whoami.exe",,,,,,,,,,,,,1763581882420685200,18446633084049825792,18446633084049801216,140702344617136,0,521061564416,12400,521063104512,521063096320,140702344617136,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.858891900Z","2025-11-19 19:51:22.4240441Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"After starting subprocess with PID 1436",,,,,,,,,,,1763581882424044100,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.5270232Z","2025-11-19 19:51:22.5270232Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2564 svchost.exe",4464,,," 2564 svchost.exe",,,,,,,,,,,,,1763581882527023200,18446633084007137280,18446633084007112704,140712899206080,0,914261585920,4464,914258788352,914258755584,140712899206080,182942,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.5270233Z","2025-11-19 19:51:22.5270233Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6028 svchost.exe",3044,,," 6028 svchost.exe",,,,,,,,,,,,,1763581882527023300,18446633084008202240,18446633084008177664,140712899206080,0,661507956736,3044,661509373952,661509341184,140712899206080,585791,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.5270234Z","2025-11-19 19:51:22.5270234Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","12708 svchost.exe",7104,,,"12708 svchost.exe",,,,,,,,,,,,,1763581882527023400,18446633083981504512,18446633083981479936,140712899206080,0,305338654720,7104,305336352768,305336320000,140712899206080,235373,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.5270347Z","2025-11-19 19:51:22.5270347Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 7916 svchost.exe",5744,,," 7916 svchost.exe",,,,,,,,,,,,,1763581882527034700,18446633084004753408,18446633084004728832,140712899206080,0,401963933696,5744,401962827776,401962795008,140712899206080,435290,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.5586311Z","2025-11-19 19:51:22.5586311Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1356 CrossDeviceResume.exe",14964,,," 1356 CrossDeviceResume.exe",,,,,,,,,,,,,1763581882558631100,18446633083982278656,18446633083982254080,140712899206080,0,401574907904,14964,399433007104,399433003008,140712899206080,155784,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.7344771Z","2025-11-19 19:51:22.7344771Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 5492 svchost.exe",,,,,,,,,,,,,1763581882734477100,18446633084060700672,18446633084060676096,140712899206080,0,915765297152,2416,915762446336,915762413568,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.7967772Z","2025-11-19 19:51:22.7967772Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",6292,,," 5184 explorer.exe",,,,,,,,,,,,,1763581882796777200,18446633083982278656,18446633083982254080,140712899206080,0,15294464,13628,470876160,470818816,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.8136763Z","2025-11-19 19:51:22.8136763Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"12224 svchost.exe",,,,,,,,,,,,,1763581882813676300,18446633084048994304,18446633084048969728,140712899206080,0,706015555584,2892,706017230848,706017198080,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.8936636Z","2025-11-19 19:51:22.8936636Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"12036 svchost.exe",,,,,,,,,,,,,1763581882893663600,18446633084049969152,18446633084049944576,140712899206080,0,457933406208,2408,457931489280,457931456512,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.9405137Z","2025-11-19 19:51:22.9405137Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1744 svchost.exe",6132,,," 1744 svchost.exe",,,,,,,,,,,,,1763581882940513700,18446633083994210304,18446633083994185728,140712899206080,0,481879539712,6132,481878671360,481878638592,140712899206080,362866,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.9405682Z","2025-11-19 19:51:22.9405682Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1288 mmc.exe",10868,,," 1288 mmc.exe",,,,,,,,,,,,,1763581882940568200,18446633084007137280,18446633084007112704,140711612509856,0,7143424,14856,82575360,82493440,140711612509856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.0825789Z","2025-11-19 19:51:23.0825789Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 6096 svchost.exe",,,,,,,,,,,,,1763581883082578900,18446633083994210304,18446633083994185728,140712899206080,0,338489372672,15276,338488393728,338488360960,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.1468947Z","2025-11-19 19:51:23.1468947Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1520 powershell.exe",14016,,," 1520 powershell.exe",,,,,,,,,,,,,1763581883146894700,18446633084033425408,18446633084033400832,140711613062896,0,931706298368,14016,931709583360,931709571072,140711613062896,897359,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.1469567Z","2025-11-19 19:51:23.1469567Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1520 powershell.exe",7828,,," 1520 powershell.exe",,,,,,,,,,,,,1763581883146956700,18446633084032733184,18446633084032708608,140711613062896,0,931706281984,7828,931709059072,931709046784,140711613062896,2453686,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.2263639Z","2025-11-19 19:51:23.2263639Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8984 svchost.exe",12448,,," 8984 svchost.exe",,,,,,,,,,,,,1763581883226363900,18446633084008632320,18446633084008607744,140712899206080,0,213146189824,12448,213148762112,213148729344,140712899206080,610310,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.737817600Z","2025-11-19 19:51:23.4006311Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Before opening process handle",,,,,,,,,,,1763581883400631100,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.738077500Z","2025-11-19 19:51:23.4009294Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"After opening process handle",,,,,,,,,,,1763581883400929400,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.5280186Z","2025-11-19 19:51:23.5280186Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 6028 svchost.exe",,,,,,,,,,,,,1763581883528018700,18446633084050083840,18446633084050059264,140712899206080,0,661507964928,5984,661509373952,661509341184,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.5280753Z","2025-11-19 19:51:23.5280753Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 2564 svchost.exe",,,,,,,,,,,,,1763581883528075300,18446633084033425408,18446633084033400832,140712899206080,0,914261594112,8752,914258788352,914258755584,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.5282059Z","2025-11-19 19:51:23.5282059Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"12708 svchost.exe",,,,,,,,,,,,,1763581883528205900,18446633084050112512,18446633084050087936,140712899206080,0,305338662912,14960,305336352768,305336320000,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.5283076Z","2025-11-19 19:51:23.5283076Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 7916 svchost.exe",,,,,,,,,,,,,1763581883528307600,18446633084050141184,18446633084050116608,140712899206080,0,401963941888,14924,401962827776,401962795008,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.5439313Z","2025-11-19 19:51:23.5439313Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9832 svchost.exe",12936,,," 9832 svchost.exe",,,,,,,,,,,,,1763581883543931300,18446633084008488960,18446633084008464384,140712899206080,0,234793099264,12936,234792878080,234792845312,140712899206080,581642,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.5439491Z","2025-11-19 19:51:23.5439491Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9184 svchost.exe",10120,,," 9184 svchost.exe",,,,,,,,,,,,,1763581883543949100,18446633084007596032,18446633084007571456,140712899206080,0,580428570624,10120,580430856192,580430823424,140712899206080,265172,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.5441731Z","2025-11-19 19:51:23.5441731Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",8132,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,1763581883544173100,18446633084061589504,18446633084061564928,140711612509856,0,1046353248256,8132,1046352232448,1046352216064,140711612509856,1009010,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.5598467Z","2025-11-19 19:51:23.5598467Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1356 CrossDeviceResume.exe",,,,,,,,,,,,,1763581883559846700,18446633084061589504,18446633084061564928,140712899206080,0,401574932480,6020,399433007104,399433003008,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.8464387Z","2025-11-19 19:51:23.8464387Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6588 Widgets.exe",9292,,," 6588 Widgets.exe",,,,,,,,,,,,,1763581883846438700,18446633084009119744,18446633084009095168,140712899206080,0,120133607424,9292,120137449472,120137445376,140712899206080,571457,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.9424379Z","2025-11-19 19:51:23.9424379Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","11528 msedgewebview2.exe",11184,,,"11528 msedgewebview2.exe",,,,,,,,,,,,,1763581883942437900,18446633084001447936,18446633084001423360,140712899206080,0,473244606464,11184,473262194688,473262186496,140712899206080,36366232,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.9425488Z","2025-11-19 19:51:23.9425488Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1744 svchost.exe",,,,,,,,,,,,,1763581883942548800,18446633084009119744,18446633084009095168,140712899206080,0,481879547904,14720,481878671360,481878638592,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.0224211Z","2025-11-19 19:51:24.0224211Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6904 WidgetService.exe",5232,,," 6904 WidgetService.exe",,,,,,,,,,,,,1763581884022421100,18446633084009377792,18446633084009353216,140712899206080,0,274672095232,5232,274673434624,274673430528,140712899206080,283654,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.1338922Z","2025-11-19 19:51:24.1338922Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9324 msedgewebview2.exe",3756,,," 9324 msedgewebview2.exe",,,,,,,,,,,,,1763581884133892200,18446633084009492480,18446633084009467904,140712899206080,0,717035753472,3756,717054017536,717054013440,140712899206080,302513,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.2294186Z","2025-11-19 19:51:24.2294186Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 8984 svchost.exe",,,,,,,,,,,,,1763581884229418600,18446633084008488960,18446633084008464384,140712899206080,0,213146198016,11968,213148762112,213148729344,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.2770172Z","2025-11-19 19:51:24.2770172Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6500 SearchHost.exe",14416,,," 6500 SearchHost.exe",,,,,,,,,,,,,1763581884277017200,18446633084041756672,18446633084041732096,140712449945792,0,1050565771264,14416,1050568294400,1050568228864,140712449945792,1313034,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.2771868Z","2025-11-19 19:51:24.2771868Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6500 SearchHost.exe",11280,,," 6500 SearchHost.exe",,,,,,,,,,,,,1763581884277186800,18446633084041756672,18446633084041732096,140712449945792,0,1050565779456,14564,1050568294400,1050568228864,140712449945792,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.3409661Z","2025-11-19 19:51:24.3409661Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3540 svchost.exe",9968,,," 3540 svchost.exe",,,,,,,,,,,,,1763581884340966100,18446633084035059712,18446633084035035136,140711742624160,249,589657714688,9968,589661470720,589661437952,140711742624160,391728995,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.3409681Z","2025-11-19 19:51:24.3409681Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3540 svchost.exe",1184,,," 3540 svchost.exe",,,,,,,,,,,,,1763581884340968100,18446633084035031040,18446633084035006464,140711742624160,249,589657706496,1184,589660946432,589660913664,140711742624160,10633090708,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.612812600Z","2025-11-19 19:51:24.3728485Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Before allocating memory for shellcode",,,,,,,,,,,1763581884372848500,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.613174800Z","2025-11-19 19:51:24.3732488Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"After allocating memory for shellcode at 000001FF40840000",,,,,,,,,,,1763581884373248800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.4527822Z","2025-11-19 19:51:24.4527822Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6424 msedgewebview2.exe",9252,,," 6424 msedgewebview2.exe",,,,,,,,,,,,,1763581884452782200,18446633084056793088,18446633084056768512,140712899206080,0,795610513408,9252,795628011520,795628007424,140712899206080,13231797,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.4528000Z","2025-11-19 19:51:24.4528000Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1768 msedgewebview2.exe",7724,,," 1768 msedgewebview2.exe",,,,,,,,,,,,,1763581884452800000,18446633084009091072,18446633084009066496,140712899206080,0,1047163273216,7724,1047324000256,1047323996160,140712899206080,493756,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.5476392Z","2025-11-19 19:51:24.5476392Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9832 svchost.exe",,,,,,,,,,,,,1763581884547639200,18446633084050571264,18446633084050546688,140712899206080,0,234793107456,4980,234792878080,234792845312,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.5476971Z","2025-11-19 19:51:24.5476971Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9184 svchost.exe",,,,,,,,,,,,,1763581884547697100,18446633084009091072,18446633084009066496,140712899206080,0,580428578816,15320,580430856192,580430823424,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.8347452Z","2025-11-19 19:51:24.8347452Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3628 msedgewebview2.exe",2068,,," 3628 msedgewebview2.exe",,,,,,,,,,,,,1763581884834745200,18446633084009865216,18446633084009840640,140712899206080,0,1084563218432,2068,1084732997632,1084732993536,140712899206080,442456,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.8509683Z","2025-11-19 19:51:24.8509683Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 6588 Widgets.exe",,,,,,,,,,,,,1763581884850968300,18446633084009865216,18446633084009840640,140712899206080,0,120133615616,10764,120137449472,120137445376,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.9462310Z","2025-11-19 19:51:24.9462310Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"11528 msedgewebview2.exe",,,,,,,,,,,,,1763581884946231000,18446633084050599936,18446633084050575360,140712899206080,0,473244639232,14000,473262194688,473262190592,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.9464943Z","2025-11-19 19:51:24.9464943Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1288 mmc.exe",14856,,," 1288 mmc.exe",,,,,,,,,,,,,1763581884946494300,18446633084007137280,18446633084007112704,140711612509856,0,7143424,14856,82575360,82493440,140711612509856,1574057,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.0259698Z","2025-11-19 19:51:25.0259698Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 6904 WidgetService.exe",,,,,,,,,,,,,1763581885025969800,18446633084007137280,18446633084007112704,140712899206080,0,274672103424,12200,274673434624,274673430528,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.1377420Z","2025-11-19 19:51:25.1377420Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9324 msedgewebview2.exe",,,,,,,,,,,,,1763581885137742000,18446633083981475840,18446633083981451264,140712899206080,0,717035761664,1928,717054017536,717054013440,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.486948200Z","2025-11-19 19:51:25.3441106Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Before writing shellcode to process",,,,,,,,,,,1763581885344110600,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.487258200Z","2025-11-19 19:51:25.3444526Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"After writing shellcode to process at 000001FF40840000",,,,,,,,,,,1763581885344452600,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.4554544Z","2025-11-19 19:51:25.4554544Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1768 msedgewebview2.exe",,,,,,,,,,,,,1763581885455454400,18446633084050857984,18446633084050833408,140712899206080,0,1047163281408,12460,1047324000256,1047323996160,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.4555172Z","2025-11-19 19:51:25.4555172Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 6424 msedgewebview2.exe",,,,,,,,,,,,,1763581885455517200,18446633084051030016,18446633084051005440,140712899206080,0,795610558464,744,795628011520,795628007424,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.4882512Z","2025-11-19 19:51:25.4882512Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8268 svchost.exe",14888,,," 8268 svchost.exe",,,,,,,,,,,,,1763581885488251200,18446633083999670272,18446633083999645696,140712899206080,0,178507935744,14888,178510102528,178510069760,140712899206080,379840,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.8389195Z","2025-11-19 19:51:25.8389195Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3628 msedgewebview2.exe",,,,,,,,,,,,,1763581885838919500,18446633084050169856,18446633084050145280,140712899206080,0,1084563226624,2912,1084732997632,1084732993536,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.9987993Z","2025-11-19 19:51:25.9987993Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13112 TimelineExplorer.exe",13516,,,"13112 TimelineExplorer.exe",,,,,,,,,,,,,1763581885998799300,18446633083996135424,18446633083996110848,140712899206080,0,1007263227904,13516,1007289368576,1007289360384,140712899206080,343629,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.9989283Z","2025-11-19 19:51:25.9989283Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13112 TimelineExplorer.exe",10004,,,"13112 TimelineExplorer.exe",,,,,,,,,,,,,1763581885998928300,18446633084056133632,18446633084056109056,140712899206080,0,1007263203328,10004,1007284649984,1007284637696,140712899206080,1595177,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:26.0638848Z","2025-11-19 19:51:26.0638848Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5184 explorer.exe",5116,,," 5184 explorer.exe",,,,,,,,,,,,,1763581886063884800,18446633084043362304,18446633084043337728,140712891545280,0,15286272,5116,467664896,467607552,140712891545280,69722029,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:26.0786440Z","2025-11-19 19:51:26.0786440Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 9920 ServiceHub.IntellicodeModelService.exe",9760,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,1763581886078644000,18446633084043362304,18446633084043337728,140711612509856,0,46014316544,11908,46012694528,46012678144,140711612509856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.362253700Z","2025-11-19 19:51:26.3166701Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Before changing memory protection to PAGE_EXECUTE_READ",,,,,,,,,,,1763581886316670100,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.362529500Z","2025-11-19 19:51:26.3169751Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"After changing memory protection to PAGE_EXECUTE_READ",,,,,,,,,,,1763581886316975100,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:26.4924720Z","2025-11-19 19:51:26.4924720Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 8268 svchost.exe",,,,,,,,,,,,,1763581886492472000,18446633084051116032,18446633084051091456,140712899206080,0,178507943936,4236,178510102528,178510069760,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:26.6059639Z","2025-11-19 19:51:26.6059639Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8972 VBoxTray.exe",9020,,," 8972 VBoxTray.exe",,,,,,,,,,,,,1763581886605964000,18446633084051144704,18446633084051120128,140700131109808,0,471284244480,3136,471286677504,471286673408,140700131109808,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:26.6062393Z","2025-11-19 19:51:26.6062393Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8972 VBoxTray.exe",3136,,," 8972 VBoxTray.exe",,,,,,,,,,,,,1763581886606239300,18446633084051144704,18446633084051120128,140700131109808,0,471284244480,3136,471286677504,471286669312,140700131109808,649161,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:26.7793053Z","2025-11-19 19:51:26.7793053Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5184 explorer.exe",8788,,," 5184 explorer.exe",,,,,,,,,,,,,1763581886779305300,18446633084051058688,18446633084051034112,140712891292720,0,15097856,8788,214564864,214507520,140712891292720,14753796,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:26.296106600Z","2025-11-19 19:51:27.3019664Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Before reading memory to verify write",,,,,,,,,,,1763581887301966400,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:26.296340900Z","2025-11-19 19:51:27.3022001Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Before creating remote thread",,,,,,,,,,,1763581887302200100,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3024711Z","2025-11-19 19:51:27.3024711Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3348 attack-589.exe",11212,,," 1436 whoami.exe",,,,,,,,,,,,,1763581887302471100,18446633084051144704,18446633084051120128,2195810680832,0,521061572608,6380,521063628800,521063620608,2195810680832,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:26.296634600Z","2025-11-19 19:51:27.3024967Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"After creating remote thread",,,,,,,,,,,1763581887302496700,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3025746Z","2025-11-19 19:51:27.3025746Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\whoami.exe",,,,,,,,,,1763581887302574600,,,,,,,,,,,,,,,,,,,,,,,,,,160109,,,,,,,,,,3602411345,140702344609792,140702344609792,98304 -"2025-11-19 19:51:27.3026097Z","2025-11-19 19:51:27.3026097Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581887302609700,,,,,,,,,,,,,,,,,,,,,,,,,,2537167,,,,,,,,,,2626650689,140712898723840,140712898723840,2523136 -"2025-11-19 19:51:27.3056213Z","2025-11-19 19:51:27.3056213Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581887305621300,,,,,,,,,,,,,,,,,,,,,,,,,,885660,,,,,,,,,,2913437033,140712877621248,140712877621248,823296 -"2025-11-19 19:51:27.3057466Z","2025-11-19 19:51:27.3057466Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581887305746600,,,,,,,,,,,,,,,,,,,,,,,,,,4209945,,,,,,,,,,2980330054,140712854355968,140712854355968,4161536 -"2025-11-19 19:51:27.3071785Z","2025-11-19 19:51:27.3071785Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\apphelp.dll",,,,,,,,,,1763581887307178500,,,,,,,,,,,,,,,,,,,,,,,,,,675806,,,,,,,,,,4108425587,140712800485376,140712800485376,651264 -"2025-11-19 19:51:27.3090501Z","2025-11-19 19:51:27.3090501Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581887309050100,,,,,,,,,,,,,,,,,,,,,,,,,,761372,,,,,,,,,,71854833,140712881618944,140712881618944,737280 -"2025-11-19 19:51:27.3091555Z","2025-11-19 19:51:27.3091555Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581887309155600,,,,,,,,,,,,,,,,,,,,,,,,,,760295,,,,,,,,,,460960534,140712894529536,140712894529536,692224 -"2025-11-19 19:51:27.3092448Z","2025-11-19 19:51:27.3092448Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,,,,,,,,,,,1763581887309244800,18446633084051173376,18446633084051148800,140712899206080,0,521061580800,8880,521064153088,521064144896,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3093136Z","2025-11-19 19:51:27.3093136Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581887309313600,,,,,,,,,,,,,,,,,,,,,,,,,,716301,,,,,,,,,,3291623140,140712863203328,140712863203328,679936 -"2025-11-19 19:51:27.3095347Z","2025-11-19 19:51:27.3095347Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581887309534700,,,,,,,,,,,,,,,,,,,,,,,,,,1193108,,,,,,,,,,4275633056,140712897216512,140712897216512,1146880 -"2025-11-19 19:51:27.3096825Z","2025-11-19 19:51:27.3096825Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,1763581887309682500,,,,,,,,,,,,,,,,,,,,,,,,,,1923284,,,,,,,,,,675224942,140712888827904,140712888827904,1863680 -"2025-11-19 19:51:27.3096888Z","2025-11-19 19:51:27.3096888Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1436 whoami.exe",8880,,," 1436 whoami.exe",,,,,,,,,,,,,1763581887309688800,18446633084051230720,18446633084051206144,140712899206080,0,521061588992,12688,521064677376,521064669184,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3098080Z","2025-11-19 19:51:27.3098080Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3564 MsMpEng.exe",15224,,," 3564 MsMpEng.exe",,,,,,,,,,,,,1763581887309808100,18446633084051259392,18446633084051234816,140712899206080,247,273686077440,11372,273715560448,273715494912,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3099257Z","2025-11-19 19:51:27.3099257Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,1763581887309925700,,,,,,,,,,,,,,,,,,,,,,,,,,230350,,,,,,,,,,2551303736,140712858550272,140712858550272,159744 -"2025-11-19 19:51:27.3101194Z","2025-11-19 19:51:27.3101194Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,1763581887310119400,,,,,,,,,,,,,,,,,,,,,,,,,,230873,,,,,,,,,,527442843,140712882405376,140712882405376,176128 -"2025-11-19 19:51:27.3102504Z","2025-11-19 19:51:27.3102504Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,1763581887310250400,,,,,,,,,,,,,,,,,,,,,,,,,,1243850,,,,,,,,,,792084382,140712861433856,140712861433856,1228800 -"2025-11-19 19:51:27.3103899Z","2025-11-19 19:51:27.3103899Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581887310389900,,,,,,,,,,,,,,,,,,,,,,,,,,700029,,,,,,,,,,3371602543,140712858746880,140712858746880,667648 -"2025-11-19 19:51:27.3105193Z","2025-11-19 19:51:27.3105193Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581887310519300,,,,,,,,,,,,,,,,,,,,,,,,,,1436013,,,,,,,,,,1441720767,140712859467776,140712859467776,1355776 -"2025-11-19 19:51:27.3107041Z","2025-11-19 19:51:27.3107041Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,,,,,,,,,,,1763581887310704100,18446633084051288064,18446633084051263488,140712899206080,0,521061597184,1528,521065201664,521065193472,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3108191Z","2025-11-19 19:51:27.3108191Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\ws2_32.dll",,,,,,,,,,1763581887310819100,,,,,,,,,,,,,,,,,,,,,,,,,,513405,,,,,,,,,,3967481067,140712881094656,140712881094656,475136 -"2025-11-19 19:51:27.3111648Z","2025-11-19 19:51:27.3111648Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\wkscli.dll",,,,,,,,,,1763581887311164800,,,,,,,,,,,,,,,,,,,,,,,,,,170846,,,,,,,,,,1225555544,140712738291712,140712738291712,110592 -"2025-11-19 19:51:27.3111762Z","2025-11-19 19:51:27.3111762Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",1528,,," 1436 whoami.exe",,,"C:\Windows\System32\version.dll",,,,,,,,,,1763581887311176200,,,,,,,,,,,,,,,,,,,,,,,,,,72452,,,,,,,,,,2275202464,140712753168384,140712753168384,45056 -"2025-11-19 19:51:27.3111842Z","2025-11-19 19:51:27.3111842Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",12688,,," 1436 whoami.exe",,,"C:\Windows\System32\authz.dll",,,,,,,,,,1763581887311184200,,,,,,,,,,,,,,,,,,,,,,,,,,372179,,,,,,,,,,771731569,140712826241024,140712826241024,327680 -"2025-11-19 19:51:27.3111842Z","2025-11-19 19:51:27.3111842Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",8880,,," 1436 whoami.exe",,,"C:\Windows\System32\sspicli.dll",,,,,,,,,,1763581887311184200,,,,,,,,,,,,,,,,,,,,,,,,,,339222,,,,,,,,,,3030302172,140712833384448,140712833384448,299008 -"2025-11-19 19:51:27.3115813Z","2025-11-19 19:51:27.3115813Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\netutils.dll",,,,,,,,,,1763581887311581300,,,,,,,,,,,,,,,,,,,,,,,,,,80696,,,,,,,,,,865845000,140712825847808,140712825847808,53248 -"2025-11-19 19:51:27.3132484Z","2025-11-19 19:51:27.3132484Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,1763581887313248400,,,,,,,,,,,,,,,,,,,,,,,,,,233556,,,,,,,,,,1625678811,140712882601984,140712882601984,200704 -"2025-11-19 19:51:27.3158199Z","2025-11-19 19:51:27.3158199Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1436 whoami.exe",6380,,,"11148 calc.exe",,,"C:\Windows\System32\calc.exe",,,,,,,,,,1763581887315819900,,,,,,,,,,,,,,134080554863097645,,,,,3397,,,,,,0,90741,"0x","","",1436,3396,3,0,0,1,4001445627,,, -"2025-11-19 19:51:27.3177666Z","2025-11-19 19:51:27.3177666Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4372 vctip.exe",12540,,," 4372 vctip.exe",,,,,,,,,,,,,1763581887317766600,18446633084051431424,18446633084051406848,140711613062896,0,740355272704,8244,740356521984,740356513792,140711613062896,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3178282Z","2025-11-19 19:51:27.3178282Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4372 vctip.exe",12540,,," 4372 vctip.exe",,,,,,,,,,,,,1763581887317828200,18446633084051488768,18446633084051464192,140711612509856,0,740355280896,3948,740352917504,740352909312,140711612509856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3181875Z","2025-11-19 19:51:27.3181875Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4372 vctip.exe",8244,,," 4372 vctip.exe",,,,,,,,,,,,,1763581887318187500,18446633084051517440,18446633084051492864,140711613062896,0,740355289088,8128,740357570560,740357562368,140711613062896,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3182888Z","2025-11-19 19:51:27.3182888Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4372 vctip.exe",8244,,," 4372 vctip.exe",,,,,,,,,,,,,1763581887318288800,18446633084051546112,18446633084051521536,140711613062896,0,740355297280,6044,740358619136,740358610944,140711613062896,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3183397Z","2025-11-19 19:51:27.3183397Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1436 whoami.exe",6380,,,"11148 calc.exe",,,,,,,,,,,,,1763581887318339700,18446633084051058688,18446633084051034112,140696878126912,0,728547835904,4224,728545624064,728545615872,140696878126912,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3194990Z","2025-11-19 19:51:27.3194990Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4372 vctip.exe",8244,,," 4372 vctip.exe",,,,,,,,,,,,,1763581887319499000,18446633084051603456,18446633084051578880,140711613062896,0,740355305472,14984,740361764864,740361756672,140711613062896,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3250774Z","2025-11-19 19:51:27.3250774Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11148 calc.exe",4224,,,"11148 calc.exe",,,,,,,,,,,,,1763581887325077400,18446633084051718144,18446633084051693568,140712899206080,0,728547844096,5464,728546148352,728546140160,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3251688Z","2025-11-19 19:51:27.3251688Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11148 calc.exe",5464,,,"11148 calc.exe",,,,,,,,,,,,,1763581887325168800,18446633084051746816,18446633084051722240,140712899206080,0,728547852288,12924,728549031936,728549023744,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3258220Z","2025-11-19 19:51:27.3258220Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11148 calc.exe",5464,,,"11148 calc.exe",,,,,,,,,,,,,1763581887325822000,18446633084051804160,18446633084051779584,140712899206080,0,728547860480,14656,728549556224,728549548032,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3319762Z","2025-11-19 19:51:27.3319762Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11148 calc.exe",4224,,,"11148 calc.exe",,,,,,,,,,,,,1763581887331976200,18446633084051861504,18446633084051836928,140712891545280,0,728547868672,8768,728550080512,728550072320,140712891545280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3324057Z","2025-11-19 19:51:27.3324057Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1436 whoami.exe",12688,,," 1436 whoami.exe",,,,,,,,,,,,,1763581887332405700,18446633084051230720,18446633084051206144,140712899206080,0,521061588992,12688,521064677376,521064669184,140712899206080,4300456,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3324064Z","2025-11-19 19:51:27.3324064Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1436 whoami.exe",12400,,," 1436 whoami.exe",,,,,,,,,,,,,1763581887332406400,18446633084049825792,18446633084049801216,140702344617136,0,521061564416,12400,521063104512,521063096320,140702344617136,33571,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3324102Z","2025-11-19 19:51:27.3324102Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1436 whoami.exe",8880,,," 1436 whoami.exe",,,,,,,,,,,,,1763581887332410200,18446633084051173376,18446633084051148800,140712899206080,0,521061580800,8880,521064153088,521064144896,140712899206080,4289897,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3324118Z","2025-11-19 19:51:27.3324118Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1436 whoami.exe",1528,,," 1436 whoami.exe",,,,,,,,,,,,,1763581887332411800,18446633084051288064,18446633084051263488,140712899206080,0,521061597184,1528,521065201664,521065193472,140712899206080,2544210,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3353689Z","2025-11-19 19:51:27.3353689Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1016 services.exe",15196,,,"13688 svchost.exe",,,"C:\Windows\System32\svchost.exe",,,,,,,,,,1763581887335369000,,,,,,,,,,,,,,134080554863291166,,,,,3398,,,,,,0,143552,"0x","","",1016,11,1,1,0,0,14788416,,, -"2025-11-19 19:51:27.3360542Z","2025-11-19 19:51:27.3360542Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1016 services.exe",15196,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887336054200,18446633084051230720,18446633084051206144,140696171073504,0,780822601728,14412,780821725184,780821708800,140696171073504,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3416650Z","2025-11-19 19:51:27.3416650Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13688 svchost.exe",14412,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887341665000,18446633084049825792,18446633084049801216,140712899206080,0,780822609920,9652,780824739840,780824707072,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3436525Z","2025-11-19 19:51:27.3436525Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887343652500,18446633084051288064,18446633084051263488,140712899206080,0,780822618112,628,780825264128,780825231360,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3437598Z","2025-11-19 19:51:27.3437598Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13688 svchost.exe",14412,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887343759800,18446633084051173376,18446633084051148800,140712863364608,0,780822626304,12520,780825788416,780825755648,140712863364608,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3442471Z","2025-11-19 19:51:27.3442471Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13688 svchost.exe",9652,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887344247200,18446633084051918848,18446633084051894272,140712899206080,0,780822634496,6208,780826312704,780826279936,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3443117Z","2025-11-19 19:51:27.3443117Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13688 svchost.exe",6208,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887344311700,18446633084051976192,18446633084051951616,140712899206080,0,780822642688,14796,780826836992,780826804224,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3477126Z","2025-11-19 19:51:27.3477126Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13688 svchost.exe",12520,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887347712600,18446633084052119552,18446633084052094976,140709772859968,243,780822650880,1108,780827361280,780827328512,140709772859968,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3481994Z","2025-11-19 19:51:27.3481994Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13688 svchost.exe",12520,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887348199400,18446633084052148224,18446633084052123648,140709772762688,243,780822659072,15312,780827885568,780827852800,140709772762688,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3484052Z","2025-11-19 19:51:27.3484052Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13688 svchost.exe",12520,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887348405200,18446633084051173376,18446633084051148800,140712863364608,0,780822626304,12520,780825788416,780825755648,140712863364608,10191193,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3571880Z","2025-11-19 19:51:27.3571880Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start ","13688 svchost.exe",628,,," 3864 WerFault.exe",,,"C:\Windows\System32\WerFault.exe",,,,,,,,,,1763581887357188000,,,,,,,,,,,,,,134080554863507391,,,,,3399,,,,,,0,681036,"0x","","",13688,3398,1,1,0,0,630084362,,, -"2025-11-19 19:51:27.3587974Z","2025-11-19 19:51:27.3587974Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13688 svchost.exe",628,,," 3864 WerFault.exe",,,,,,,,,,,,,1763581887358797400,18446633084051173376,18446633084051148800,140702556693600,243,400613777408,2088,400611737600,400611729408,140702556693600,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3643485Z","2025-11-19 19:51:27.3643485Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,,,,,,,,,,,1763581887364348500,18446633084052176896,18446633084052152320,140712899206080,0,400613785600,7460,400612261888,400612253696,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3644418Z","2025-11-19 19:51:27.3644418Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3864 WerFault.exe",7460,,," 3864 WerFault.exe",,,,,,,,,,,,,1763581887364441800,18446633084052205568,18446633084052180992,140712899206080,0,400613793792,9616,400615276544,400615268352,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3649326Z","2025-11-19 19:51:27.3649326Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3864 WerFault.exe",9616,,," 3864 WerFault.exe",,,,,,,,,,,,,1763581887364932600,18446633084052320256,18446633084052295680,140712899206080,0,400613801984,15292,400615800832,400615792640,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3649542Z","2025-11-19 19:51:27.3649542Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11148 calc.exe",8768,,,"11148 calc.exe",,,,,,,,,,,,,1763581887364954200,18446633084052348928,18446633084052324352,140712865112144,0,728547876864,13680,728550604800,728550596608,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3651576Z","2025-11-19 19:51:27.3651576Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"11148 calc.exe",,,,,,,,,,,,,1763581887365157600,18446633084052377600,18446633084052353024,140712899206080,0,728547885056,4656,728551129088,728551120896,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3652972Z","2025-11-19 19:51:27.3652972Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11148 calc.exe",4656,,,"11148 calc.exe",,,,,,,,,,,,,1763581887365297200,18446633084052406272,18446633084052381696,140712899206080,0,728547893248,11220,728551653376,728551645184,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3655048Z","2025-11-19 19:51:27.3655048Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",4600,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,1763581887365504800,18446633084039716864,18446633084039692288,140711613062896,0,1046353240064,4600,1046401253376,1046401236992,140711613062896,1088976,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3662762Z","2025-11-19 19:51:27.3662762Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887366276200,18446633084039716864,18446633084039692288,140712899206080,0,780822667264,13720,780825788416,780825755648,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3812649Z","2025-11-19 19:51:27.3812649Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",14368,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,1763581887381264900,18446633084052434944,18446633084052410368,140712891545280,0,199839866880,11156,199839318016,199839309824,140712891545280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3823710Z","2025-11-19 19:51:27.3823710Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3532 svchost.exe",,,,,,,,,,,,,1763581887382371000,18446633084052578304,18446633084052553728,140712899206080,0,761505034240,3332,761506824192,761506791424,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3824362Z","2025-11-19 19:51:27.3824362Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4404 svchost.exe",12560,,," 4404 svchost.exe",,,,,,,,,,,,,1763581887382436200,18446633084052750336,18446633084052725760,140712865112144,98,679905837056,13712,679909261312,679909228544,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3862869Z","2025-11-19 19:51:27.3862869Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3864 WerFault.exe",9616,,," 3864 WerFault.exe",,,,,,,,,,,,,1763581887386286900,18446633084052205568,18446633084052180992,140712899206080,0,400613793792,9616,400615276544,400615264256,140712899206080,6645135,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3862920Z","2025-11-19 19:51:27.3862920Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3864 WerFault.exe",15292,,," 3864 WerFault.exe",,,,,,,,,,,,,1763581887386292000,18446633084052320256,18446633084052295680,140712899206080,0,400613801984,15292,400615800832,400615792640,140712899206080,7320318,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3863070Z","2025-11-19 19:51:27.3863070Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3864 WerFault.exe",7460,,," 3864 WerFault.exe",,,,,,,,,,,,,1763581887386307000,18446633084052176896,18446633084052152320,140712899206080,0,400613785600,7460,400612261888,400612253696,140712899206080,8436825,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3868922Z","2025-11-19 19:51:27.3868922Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,,,,,,,,,,,1763581887386892200,18446633084051173376,18446633084051148800,140702556693600,0,400613777408,2088,400611737600,400611696640,140702556693600,88862289,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3874280Z","2025-11-19 19:51:27.3874280Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"WerFault.exe",,,,,,,,,,1763581887387428000,,,,,,,,,,,1851392,1888256,113864608,134080554863507391,0,134080554863803366,64,0,3399,1,5,1,0,0,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3884600Z","2025-11-19 19:51:27.3884600Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",11156,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,1763581887388460000,18446633084052320256,18446633084052295680,140712891292720,0,199839875072,10204,199842332672,199842324480,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3891231Z","2025-11-19 19:51:27.3891231Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",11156,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,1763581887389123100,18446633084051173376,18446633084051148800,140712891292720,0,199839883264,1424,199843381248,199843373056,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3897882Z","2025-11-19 19:51:27.3897882Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",15228,,," 2456 Memory Compression",,,,,,,,,,,,,1763581887389788300,18446633084052205568,18446633084052180992,18446735306729542320,0,0,11548,0,0,18446735306729542320,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3898079Z","2025-11-19 19:51:27.3898079Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",15228,,," 2456 Memory Compression",,,,,,,,,,,,,1763581887389807900,18446633084052807680,18446633084052783104,18446735306729542320,0,0,636,0,0,18446735306729542320,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3898424Z","2025-11-19 19:51:27.3898424Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",15228,,," 2456 Memory Compression",,,,,,,,,,,,,1763581887389842400,18446633084052922368,18446633084052897792,18446735306728238208,0,0,13072,0,0,18446735306728238208,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3898960Z","2025-11-19 19:51:27.3898960Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",15228,,," 2456 Memory Compression",,,,,,,,,,,,,1763581887389896000,18446633084053008384,18446633084052983808,18446735306729822480,0,0,13508,0,0,18446735306729822480,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3902495Z","2025-11-19 19:51:27.3902495Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 6028 svchost.exe",15228,,,"13736 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe\CalculatorApp.exe",,,,,,,,,,1763581887390249500,,,,,,,,,,,,,,134080554863834658,,,,,3401,,,,,,3,0,"0x","Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe","App",4340,106,3,0,0,1,1758293941,,, -"2025-11-19 19:51:27.3906927Z","2025-11-19 19:51:27.3906927Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4404 svchost.exe",11720,,," 4404 svchost.exe",,,,,,,,,,,,,1763581887390692700,18446633084053065728,18446633084053041152,140712899206080,0,679905845248,14572,679909785600,679909752832,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3912189Z","2025-11-19 19:51:27.3912189Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",15228,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887391218900,18446633084050886656,18446633084050862080,140700165242880,5,320273809408,6548,320276004864,320276000768,140700165242880,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3959109Z","2025-11-19 19:51:27.3959109Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887395910900,18446633084053323776,18446633084053299200,140712899206080,0,320273817600,14660,320277053440,320277049344,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3977969Z","2025-11-19 19:51:27.3977969Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",14660,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887397796900,18446633084053237760,18446633084053213184,140712899206080,0,320273825792,6780,320278102016,320278097920,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3980521Z","2025-11-19 19:51:27.3980521Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887398052100,18446633084053610496,18446633084053585920,140712899206080,0,320273833984,8620,320279150592,320279146496,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4011829Z","2025-11-19 19:51:27.4011829Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start ","13688 svchost.exe",628,,," 3676 WerFault.exe",,,"C:\Windows\System32\WerFault.exe",,,,,,,,,,1763581887401182900,,,,,,,,,,,,,,134080554863942943,,,,,3402,,,,,,0,681036,"0x","","",1436,3396,3,0,0,1,630084362,,, -"2025-11-19 19:51:27.4030141Z","2025-11-19 19:51:27.4030141Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13688 svchost.exe",628,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581887403014100,18446633084051374080,18446633084051349504,140702556693600,243,859767218176,14180,859767832576,859767824384,140702556693600,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4032996Z","2025-11-19 19:51:27.4032996Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",6292,,," 5184 explorer.exe",,,,,,,,,,,,,1763581887403299600,18446633084053667840,18446633084053643264,140712891292720,0,15302656,6204,214564864,214507520,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4037373Z","2025-11-19 19:51:27.4037373Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887403737300,18446633084053696512,18446633084053671936,140712899206080,0,320273842176,9360,320280199168,320280195072,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4056941Z","2025-11-19 19:51:27.4056941Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887405694100,18446633084053839872,18446633084053815296,140711792263472,0,320273850368,10884,320281247744,320281243648,140711792263472,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4068904Z","2025-11-19 19:51:27.4068904Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581887406890400,18446633084053581824,18446633084053557248,140712899206080,0,859767226368,13460,859768356864,859768348672,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4069840Z","2025-11-19 19:51:27.4069840Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3676 WerFault.exe",13460,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581887406984000,18446633084053868544,18446633084053843968,140712899206080,0,859767234560,8356,859768881152,859768872960,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4073300Z","2025-11-19 19:51:27.4073300Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581887407330100,18446633084053897216,18446633084053872640,140712899206080,0,859767242752,11036,859769405440,859769397248,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4077531Z","2025-11-19 19:51:27.4077531Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",10204,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,1763581887407753100,18446633084053925888,18446633084053901312,140712899206080,0,199839891456,4732,199843905536,199843897344,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4109892Z","2025-11-19 19:51:27.4109892Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",1424,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,1763581887410989200,18446633084053954560,18446633084053929984,140712891292720,0,199839899648,13520,199847051264,199847043072,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4122533Z","2025-11-19 19:51:27.4122533Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887412253300,18446633084053409792,18446633084053385216,140712865112144,0,320273858560,14384,320282296320,320282288128,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4125886Z","2025-11-19 19:51:27.4125886Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",9360,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887412588700,18446633084053983232,18446633084053958656,140712899206080,0,320273866752,14544,320283344896,320283340800,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4222062Z","2025-11-19 19:51:27.4222062Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887422206200,18446633084054126592,18446633084054102016,140712891545280,0,320273874944,7540,320284393472,320284389376,140712891545280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4302869Z","2025-11-19 19:51:27.4302869Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887430286900,18446633084053524480,18446633084053499904,140712600145104,0,320273883136,8000,320285442048,320285437952,140712600145104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4303353Z","2025-11-19 19:51:27.4303353Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887430335300,18446633084054011904,18446633084053987328,140712604173856,0,320273891328,4596,320286490624,320286486528,140712604173856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4487221Z","2025-11-19 19:51:27.4487221Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887448722100,18446633084054241280,18446633084054216704,140712899206080,0,780822675456,5172,780828409856,780828377088,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4535033Z","2025-11-19 19:51:27.4535033Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13736 CalculatorApp.exe",8000,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887453503300,18446633084053524480,18446633084053499904,140712600145104,0,320273883136,8000,320285442048,320285413376,140712600145104,59889936,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4549744Z","2025-11-19 19:51:27.4549744Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 7916 svchost.exe",,,,,,,,,,,,,1763581887454974400,18446633084054040576,18446633084054016000,140712899206080,0,401963950080,5540,401965842432,401965809664,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4551451Z","2025-11-19 19:51:27.4551451Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 7916 svchost.exe",5540,,," 7916 svchost.exe",,,,,,,,,,,,,1763581887455145100,18446633084054212608,18446633084054188032,140712899206080,90,401963958272,1484,401966366720,401966333952,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4578509Z","2025-11-19 19:51:27.4578509Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",6292,,," 5184 explorer.exe",,,,,,,,,,,,,1763581887457850900,18446633084053037056,18446633084053012480,140712891292720,0,15310848,3032,467664896,467607552,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4594189Z","2025-11-19 19:51:27.4594189Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887459418900,18446633084053524480,18446633084053499904,140712632221632,0,320273899520,11208,320285442048,320285437952,140712632221632,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4806572Z","2025-11-19 19:51:27.4806572Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2992 svchost.exe",14592,,," 2992 svchost.exe",,,,,,,,,,,,,1763581887480657200,18446633084053639168,18446633084053614592,140712899206080,186,170617987072,6428,170619043840,170619011072,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4833157Z","2025-11-19 19:51:27.4833157Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2960 svchost.exe",13820,,," 2960 svchost.exe",,,,,,,,,,,,,1763581887483315700,18446633084054470656,18446633084054446080,140712891292720,287,403329781760,2140,403332661248,403332628480,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4880926Z","2025-11-19 19:51:27.4880926Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2992 svchost.exe",4396,,," 2992 svchost.exe",,,,,,,,,,,,,1763581887488092600,18446633084054441984,18446633084054417408,140712899206080,186,170615898112,13424,170620092416,170620059648,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4993768Z","2025-11-19 19:51:27.4993768Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581887499376800,18446633084054069248,18446633084054044672,140712899206080,0,859767250944,456,859769929728,859769921536,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5036392Z","2025-11-19 19:51:27.5036392Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887503639200,18446633084054880256,18446633084054855680,140712891292720,0,320273907712,14028,320287539200,320287535104,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5074843Z","2025-11-19 19:51:27.5074843Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4340 sihost.exe",4288,,," 4340 sihost.exe",,,,,,,,,,,,,1763581887507484300,18446633084054736896,18446633084054712320,140712891292720,0,645640560640,12684,645647040512,645647032320,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5249959Z","2025-11-19 19:51:27.5249959Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",8472,,," 1040 svchost.exe",,,,,,,,,,,,,1763581887524995900,18446633084054822912,18446633084054798336,140712899206080,0,256030941184,13368,256038141952,256038109184,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5251521Z","2025-11-19 19:51:27.5251521Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",14544,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887525152100,18446633084054851584,18446633084054827008,140712899206080,0,320273915904,8232,320288587776,320288583680,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5301687Z","2025-11-19 19:51:27.5301687Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887530168700,18446633084054183936,18446633084054159360,140712865112144,0,320273924096,12316,320289636352,320289628160,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5490372Z","2025-11-19 19:51:27.5490372Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",8232,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887549037200,18446633084053782528,18446633084053757952,140712899206080,0,320273932288,4792,320290684928,320290680832,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5528390Z","2025-11-19 19:51:27.5528390Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887552839000,18446633084054298624,18446633084054274048,140712297841152,0,320273940480,1904,320291733504,320291729408,140712297841152,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5890217Z","2025-11-19 19:51:27.5890217Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9920 ServiceHub.IntellicodeModelService.exe",11908,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,1763581887589021700,18446633084043362304,18446633084043337728,140711612509856,0,46014316544,11908,46012694528,46012678144,140711612509856,1303981,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6078731Z","2025-11-19 19:51:27.6078731Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581887607873100,18446633084043362304,18446633084043337728,140712865112144,0,859767259136,7032,859770454016,859770445824,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6081019Z","2025-11-19 19:51:27.6081019Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581887608101900,18446633084054708224,18446633084054683648,140712899206080,0,859767267328,3716,859770978304,859770970112,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6082851Z","2025-11-19 19:51:27.6082851Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3676 WerFault.exe",3716,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581887608285100,18446633084054908928,18446633084054884352,140712899206080,0,859767275520,12996,859771502592,859771494400,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6552156Z","2025-11-19 19:51:27.6552156Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887655215600,18446633084054966272,18446633084054941696,140712583404848,0,320273948672,4172,320292782080,320292777984,140712583404848,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6556590Z","2025-11-19 19:51:27.6556590Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",8232,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887655659000,18446633084055023616,18446633084054999040,140712899206080,0,320273956864,11028,320293830656,320293826560,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6564440Z","2025-11-19 19:51:27.6564440Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","11148 calc.exe",8768,,,"11148 calc.exe",,,,,,,,,,,,,1763581887656444000,18446633084051861504,18446633084051836928,140712891545280,0,728547868672,8768,728550080512,728550047744,140712891545280,153309545,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6564444Z","2025-11-19 19:51:27.6564444Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","11148 calc.exe",13680,,,"11148 calc.exe",,,,,,,,,,,,,1763581887656444400,18446633084052348928,18446633084052324352,140712865112144,0,728547876864,13680,728550604800,728550596608,140712865112144,185583,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6564455Z","2025-11-19 19:51:27.6564455Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","11148 calc.exe",11220,,,"11148 calc.exe",,,,,,,,,,,,,1763581887656445500,18446633084052406272,18446633084052381696,140712899206080,0,728547893248,11220,728551653376,728551645184,140712899206080,861901,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6564455Z","2025-11-19 19:51:27.6564455Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","11148 calc.exe",4656,,,"11148 calc.exe",,,,,,,,,,,,,1763581887656445500,18446633084052377600,18446633084052353024,140712899206080,0,728547885056,4656,728551129088,728551120896,140712899206080,508465,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6564713Z","2025-11-19 19:51:27.6564713Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","11148 calc.exe",14656,,,"11148 calc.exe",,,,,,,,,,,,,1763581887656471300,18446633084051804160,18446633084051779584,140712899206080,0,728547860480,14656,728549556224,728549548032,140712899206080,2722632,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6564795Z","2025-11-19 19:51:27.6564795Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","11148 calc.exe",12924,,,"11148 calc.exe",,,,,,,,,,,,,1763581887656479500,18446633084051746816,18446633084051722240,140712899206080,0,728547852288,12924,728549031936,728549023744,140712899206080,4240860,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6564840Z","2025-11-19 19:51:27.6564840Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","11148 calc.exe",5464,,,"11148 calc.exe",,,,,,,,,,,,,1763581887656484000,18446633084051718144,18446633084051693568,140712899206080,0,728547844096,5464,728546148352,728546136064,140712899206080,6521410,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6571683Z","2025-11-19 19:51:27.6571683Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887657168300,18446633084051861504,18446633084051836928,140712899206080,0,320273965056,13636,320294879232,320294875136,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6578769Z","2025-11-19 19:51:27.6578769Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","11148 calc.exe",4224,,,"11148 calc.exe",,,,,,,,,,,,,1763581887657876900,18446633084051058688,18446633084051034112,140696878126912,0,728547835904,4224,728545624064,728545603584,140696878126912,36933534,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6592157Z","2025-11-19 19:51:27.6592157Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop ","11148 calc.exe",4224,,,"11148 calc.exe",,,"calc.exe",,,,,,,,,,1763581887659215700,,,,,,,,,,,3203072,3239936,214335219,134080554863097645,0,134080554866492537,116,0,3397,1,12,3,0,0,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.7973948Z","2025-11-19 19:51:27.7973948Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",9360,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887797394800,18446633084050915328,18446633084050890752,140712899206080,0,320273973248,13212,320295927808,320295923712,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.7978389Z","2025-11-19 19:51:27.7978389Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",13212,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887797838900,18446633084051058688,18446633084051034112,140712899206080,0,320273981440,2940,320296976384,320296972288,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.7980763Z","2025-11-19 19:51:27.7980763Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",2940,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887798076300,18446633084051746816,18446633084051722240,140712899206080,0,320273989632,6112,320298024960,320298020864,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.7982318Z","2025-11-19 19:51:27.7982318Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1168 svchost.exe",9264,,," 1168 svchost.exe",,,,,,,,,,,,,1763581887798231800,18446633084051718144,18446633084051693568,140712899206080,157,641014476800,8364,641021247488,641021214720,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8197198Z","2025-11-19 19:51:27.8197198Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",6112,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887819719900,18446633084052377600,18446633084052353024,140712899206080,0,320273997824,14224,320299073536,320299069440,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8199462Z","2025-11-19 19:51:27.8199462Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",14224,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887819946200,18446633084052348928,18446633084052324352,140712899206080,0,320274006016,13984,320300122112,320300118016,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8347693Z","2025-11-19 19:51:27.8347693Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",11156,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,1763581887834769300,18446633084054269952,18446633084054245376,140712891292720,0,199839907840,11824,199852294144,199852285952,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8471695Z","2025-11-19 19:51:27.8471695Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2960 svchost.exe",14536,,," 2960 svchost.exe",,,,,,,,,,,,,1763581887847169500,18446633084051804160,18446633084051779584,140712899206080,287,403329789952,4884,403333185536,403333152768,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8573941Z","2025-11-19 19:51:27.8573941Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1040 svchost.exe",13300,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\RuntimeBroker.exe",,,,,,,,,,1763581887857394100,,,,,,,,,,,,,,134080554868459116,,,,,3403,,,,,,3,148437,"0x","Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe","runtimebroker07f4358a809ac99a64a67c1",1040,13,3,0,0,1,1175682367,,, -"2025-11-19 19:51:27.8582768Z","2025-11-19 19:51:27.8582768Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",13300,,," 5316 RuntimeBroker.exe",,,,,,,,,,,,,1763581887858276800,18446633084055273472,18446633084055248896,140699399787184,40,1098350678016,7040,1098352427008,1098352377856,140699399787184,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8666770Z","2025-11-19 19:51:27.8666770Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,,,,,,,,,,,1763581887866677000,18446633084055330816,18446633084055306240,140712899206080,0,1098350686208,9964,1098352951296,1098352902144,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8677378Z","2025-11-19 19:51:27.8677378Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,,,,,,,,,,,1763581887867737800,18446633084054499328,18446633084054474752,140712899206080,0,1098350694400,13000,1098353475584,1098353426432,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8701475Z","2025-11-19 19:51:27.8701475Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 5316 RuntimeBroker.exe",,,,,,,,,,,,,1763581887870147500,18446633084055187456,18446633084055162880,140712899206080,0,1098350702592,13676,1098353999872,1098353950720,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8702475Z","2025-11-19 19:51:27.8702475Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 5316 RuntimeBroker.exe",,,,,,,,,,,,,1763581887870247500,18446633084055359488,18446633084055334912,140712899206080,0,1098350710784,2076,1098354524160,1098354475008,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8710273Z","2025-11-19 19:51:27.8710273Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5316 RuntimeBroker.exe",13000,,," 5316 RuntimeBroker.exe",,,,,,,,,,,,,1763581887871027300,18446633084055388160,18446633084055363584,140712899206080,0,1098350718976,15148,1098355048448,1098354999296,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8753174Z","2025-11-19 19:51:27.8753174Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,,,,,,,,,,,1763581887875317400,18446633084055416832,18446633084055392256,140712865112144,0,1098350727168,5804,1098355572736,1098355523584,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8776426Z","2025-11-19 19:51:27.8776426Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581887877642600,18446633084055445504,18446633084055420928,140712806010720,0,859767283712,4060,859772026880,859772018688,140712806010720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8781009Z","2025-11-19 19:51:27.8781009Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5316 RuntimeBroker.exe",2076,,," 5316 RuntimeBroker.exe",,,,,,,,,,,,,1763581887878100900,18446633084055474176,18446633084055449600,140712899206080,0,1098350735360,12556,1098356097024,1098356047872,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8799559Z","2025-11-19 19:51:27.8799559Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",13636,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887879955900,18446633084055502848,18446633084055478272,140712899206080,0,320274014208,14648,320301170688,320301166592,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8855369Z","2025-11-19 19:51:27.8855369Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5316 RuntimeBroker.exe",12556,,," 5316 RuntimeBroker.exe",,,,,,,,,,,,,1763581887885536900,18446633084054413312,18446633084054388736,140712865112144,0,1098350743552,9412,1098356621312,1098356572160,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8976135Z","2025-11-19 19:51:27.8976135Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5316 RuntimeBroker.exe",9412,,," 5316 RuntimeBroker.exe",,,,,,,,,,,,,1763581887897613500,18446633084052406272,18446633084052381696,140712891292720,0,1098350751744,2008,1098357145600,1098357096448,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9230450Z","2025-11-19 19:51:27.9230450Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6096 svchost.exe",8040,,," 6096 svchost.exe",,,,,,,,,,,,,1763581887923045000,18446633084055560192,18446633084055535616,140712899206080,25,338489380864,8508,338491342848,338491310080,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9502687Z","2025-11-19 19:51:27.9502687Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2724 svchost.exe",3692,,," 2724 svchost.exe",,,,,,,,,,,,,1763581887950268700,18446633084056133632,18446633084056109056,140712899206080,232,89489309696,7980,89491243008,89491177472,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9503755Z","2025-11-19 19:51:27.9503755Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2724 svchost.exe",3692,,," 2724 svchost.exe",,,,,,,,,,,,,1763581887950375500,18446633084053151744,18446633084053127168,140712899206080,232,89489317888,14444,89492291584,89492258816,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1387808Z","2025-11-19 19:51:28.1387808Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3676 WerFault.exe",3716,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581888138780800,18446633084055674880,18446633084055650304,140712899206080,0,859767291904,1844,859772551168,859772542976,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2219561Z","2025-11-19 19:51:28.2219561Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",14224,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581888221956100,18446633084055703552,18446633084055678976,140712899206080,0,320274022400,8572,320302219264,320302215168,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.261554400Z","2025-11-19 19:51:28.2771678Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Attack done",,,,,,,,,,,1763581888277167800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2777846Z","2025-11-19 19:51:28.2777846Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,1763581888277784600,,,,,,,,,,,,,,,,,,,,,,,,,,158678,,,,,,,,,,3554393863,140712830631936,140712830631936,110592 -"2025-11-19 19:51:28.2782317Z","2025-11-19 19:51:28.2782317Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3348 attack-589.exe",3088,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581888278231700,18446633084049022976,18446633084048998400,140712899206080,0,289797922816,3088,289802289152,289802280960,140712899206080,2024057,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2782317Z","2025-11-19 19:51:28.2782317Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3348 attack-589.exe",12904,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581888278231700,18446633084049080320,18446633084049055744,140712899206080,0,289797931008,12904,289803337728,289803329536,140712899206080,1558590,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2782336Z","2025-11-19 19:51:28.2782336Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3348 attack-589.exe",11468,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581888278233700,18446633083996708864,18446633083996684288,140712899206080,0,289797914624,11468,289801240576,289801232384,140712899206080,3363869,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2783990Z","2025-11-19 19:51:28.2783990Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581888278399000,18446633084044398592,18446633084044374016,140695599400816,0,289797906432,11212,289800192000,289800171520,140695599400816,64789380,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2785133Z","2025-11-19 19:51:28.2785133Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Users\Public\Downloads\attack-589.exe",,,,,,,,,,1763581888278513300,,,,,,,,,,,,,,,,,,,,,,,,,,0,,,,,,,,,,1763491559,140695599382528,140695599382528,53248 -"2025-11-19 19:51:28.2785202Z","2025-11-19 19:51:28.2785202Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\msvcp140.dll",,,,,,,,,,1763581888278520200,,,,,,,,,,,,,,,,,,,,,,,,,,570439,,,,,,,,,,1564323704,140711213137920,140711213137920,561152 -"2025-11-19 19:51:28.2785241Z","2025-11-19 19:51:28.2785241Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\vcruntime140.dll",,,,,,,,,,1763581888278524100,,,,,,,,,,,,,,,,,,,,,,,,,,146072,,,,,,,,,,254123393,140712353988608,140712353988608,122880 -"2025-11-19 19:51:28.2785276Z","2025-11-19 19:51:28.2785276Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\vcruntime140_1.dll",,,,,,,,,,1763581888278527600,,,,,,,,,,,,,,,,,,,,,,,,,,57827,,,,,,,,,,240324076,140712354119680,140712354119680,49152 -"2025-11-19 19:51:28.2785509Z","2025-11-19 19:51:28.2785509Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\apphelp.dll",,,,,,,,,,1763581888278550900,,,,,,,,,,,,,,,,,,,,,,,,,,675806,,,,,,,,,,4108425587,140712800485376,140712800485376,651264 -"2025-11-19 19:51:28.2785585Z","2025-11-19 19:51:28.2785585Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,1763581888278558500,,,,,,,,,,,,,,,,,,,,,,,,,,158678,,,,,,,,,,3554393863,140712830631936,140712830631936,110592 -"2025-11-19 19:51:28.2785670Z","2025-11-19 19:51:28.2785670Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581888278567000,,,,,,,,,,,,,,,,,,,,,,,,,,4209945,,,,,,,,,,2980330054,140712854355968,140712854355968,4161536 -"2025-11-19 19:51:28.2785759Z","2025-11-19 19:51:28.2785759Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581888278575900,,,,,,,,,,,,,,,,,,,,,,,,,,1436013,,,,,,,,,,1441720767,140712859467776,140712859467776,1355776 -"2025-11-19 19:51:28.2785835Z","2025-11-19 19:51:28.2785835Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581888278583500,,,,,,,,,,,,,,,,,,,,,,,,,,716301,,,,,,,,,,3291623140,140712863203328,140712863203328,679936 -"2025-11-19 19:51:28.2785901Z","2025-11-19 19:51:28.2785901Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581888278590100,,,,,,,,,,,,,,,,,,,,,,,,,,885660,,,,,,,,,,2913437033,140712877621248,140712877621248,823296 -"2025-11-19 19:51:28.2786055Z","2025-11-19 19:51:28.2786055Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581888278605500,,,,,,,,,,,,,,,,,,,,,,,,,,761372,,,,,,,,,,71854833,140712881618944,140712881618944,737280 -"2025-11-19 19:51:28.2786133Z","2025-11-19 19:51:28.2786133Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581888278613300,,,,,,,,,,,,,,,,,,,,,,,,,,760295,,,,,,,,,,460960534,140712894529536,140712894529536,692224 -"2025-11-19 19:51:28.2786208Z","2025-11-19 19:51:28.2786208Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581888278620800,,,,,,,,,,,,,,,,,,,,,,,,,,1193108,,,,,,,,,,4275633056,140712897216512,140712897216512,1146880 -"2025-11-19 19:51:28.2786279Z","2025-11-19 19:51:28.2786279Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581888278627900,,,,,,,,,,,,,,,,,,,,,,,,,,2537167,,,,,,,,,,2626650689,140712898723840,140712898723840,2523136 -"2025-11-19 19:51:28.2786366Z","2025-11-19 19:51:28.2786366Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"attack-589.exe",,,,,,,,,,1763581888278636600,,,,,,,,,,,958464,958464,72053875,134080554806144016,0,134080554872628582,52,9,3392,0,0,3,48,0,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.3902746Z","2025-11-19 19:51:28.3902746Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1288 mmc.exe",,,,,,,,,,,,,1763581888390274600,18446633084049080320,18446633084049055744,140712899206080,0,7151616,8412,548274176,548192256,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.3904146Z","2025-11-19 19:51:28.3904146Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4868 svchost.exe",6388,,," 4868 svchost.exe",,,,,,,,,,,,,1763581888390414600,18446633083996708864,18446633083996684288,140712899206080,0,47919407104,14244,47921496064,47921463296,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.3905737Z","2025-11-19 19:51:28.3905737Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1288 mmc.exe",8412,,," 1288 mmc.exe",,,,,,,,,,,,,1763581888390573700,18446633084049022976,18446633084048998400,140712899206080,0,7159808,7028,548798464,548716544,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.4693653Z","2025-11-19 19:51:28.4693653Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 4192 svchost.exe",,,,,,,,,,,,,1763581888469365300,18446633084055875584,18446633084055851008,140712899206080,0,330479378432,15260,330477273088,330477240320,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.4695259Z","2025-11-19 19:51:28.4695259Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4192 svchost.exe",15260,,," 4192 svchost.exe",,,,,,,,,,,,,1763581888469525900,18446633084055904256,18446633084055879680,140712899206080,0,330479386624,11272,330480222208,330480189440,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.4698578Z","2025-11-19 19:51:28.4698578Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5536 svchost.exe",7072,,," 5536 svchost.exe",,,,,,,,,,,,,1763581888469857800,18446633084055932928,18446633084055908352,140712899206080,132,151912620032,13504,151921360896,151921328128,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.8201829Z","2025-11-19 19:51:28.8201829Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4372 vctip.exe",3948,,," 4372 vctip.exe",,,,,,,,,,,,,1763581888820182900,18446633084051488768,18446633084051464192,140711612509856,0,740355280896,3948,740352917504,740352909312,140711612509856,820035,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.8211588Z","2025-11-19 19:51:28.8211588Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581888821158800,18446633084055445504,18446633084055420928,140712806010720,0,859767283712,4060,859772026880,859771981824,140712806010720,967555353,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1636841Z","2025-11-19 19:51:29.1636841Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3676 WerFault.exe",13460,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581889163684100,18446633084053581824,18446633084053557248,140712899206080,0,859767226368,13460,859768356864,859768344576,140712899206080,11957619,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1636865Z","2025-11-19 19:51:29.1636865Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3676 WerFault.exe",8356,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581889163686500,18446633084053868544,18446633084053843968,140712899206080,0,859767234560,8356,859768881152,859768868864,140712899206080,7043082,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1636930Z","2025-11-19 19:51:29.1636930Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3676 WerFault.exe",11036,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581889163693000,18446633084053897216,18446633084053872640,140712899206080,0,859767242752,11036,859769405440,859769397248,140712899206080,9124852,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1636935Z","2025-11-19 19:51:29.1636935Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3676 WerFault.exe",7032,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581889163693500,18446633084043362304,18446633084043337728,140712865112144,0,859767259136,7032,859770454016,859770445824,140712865112144,363244,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1636952Z","2025-11-19 19:51:29.1636952Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3676 WerFault.exe",456,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581889163695300,18446633084054069248,18446633084054044672,140712899206080,0,859767250944,456,859769929728,859769921536,140712899206080,310812,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1637012Z","2025-11-19 19:51:29.1637012Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3676 WerFault.exe",3716,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581889163701200,18446633084054708224,18446633084054683648,140712899206080,0,859767267328,3716,859770978304,859770953728,140712899206080,52584328,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1637054Z","2025-11-19 19:51:29.1637054Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3676 WerFault.exe",1844,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581889163705400,18446633084055674880,18446633084055650304,140712899206080,0,859767291904,1844,859772551168,859772522496,140712899206080,16559079,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1637161Z","2025-11-19 19:51:29.1637161Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3676 WerFault.exe",12996,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581889163716100,18446633084054908928,18446633084054884352,140712899206080,0,859767275520,12996,859771502592,859771482112,140712899206080,7689979,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1651994Z","2025-11-19 19:51:29.1651994Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581889165199400,18446633084051374080,18446633084051349504,140702556693600,0,859767218176,14180,859767832576,859767754752,140702556693600,2657930717,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1669895Z","2025-11-19 19:51:29.1669895Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"WerFault.exe",,,,,,,,,,1763581889166989600,,,,,,,,,,,4272128,14024704,3739576266,134080554863942943,0,134080554881418238,203,0,3402,85,2343,3,406,81,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1675068Z","2025-11-19 19:51:29.1675068Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1660 svchost.exe",11196,,," 1660 svchost.exe",,,,,,,,,,,,,1763581889167506900,18446633084053581824,18446633084053557248,140712899206080,0,265906421760,7712,265905897472,265905864704,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1704217Z","2025-11-19 19:51:29.1704217Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,,,,,,,,,,,1763581889170421700,18446633084051144704,18446633084051120128,2195810680832,0,521061572608,6380,521063628800,521063608320,2195810680832,45706462,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1706933Z","2025-11-19 19:51:29.1706933Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\whoami.exe",,,,,,,,,,1763581889170693300,,,,,,,,,,,,,,,,,,,,,,,,,,160109,,,,,,,,,,3602411345,140702344609792,140702344609792,98304 -"2025-11-19 19:51:29.1707129Z","2025-11-19 19:51:29.1707129Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\wkscli.dll",,,,,,,,,,1763581889170712900,,,,,,,,,,,,,,,,,,,,,,,,,,170846,,,,,,,,,,1225555544,140712738291712,140712738291712,110592 -"2025-11-19 19:51:29.1707242Z","2025-11-19 19:51:29.1707242Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\version.dll",,,,,,,,,,1763581889170724200,,,,,,,,,,,,,,,,,,,,,,,,,,72452,,,,,,,,,,2275202464,140712753168384,140712753168384,45056 -"2025-11-19 19:51:29.1707328Z","2025-11-19 19:51:29.1707328Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\apphelp.dll",,,,,,,,,,1763581889170732800,,,,,,,,,,,,,,,,,,,,,,,,,,675806,,,,,,,,,,4108425587,140712800485376,140712800485376,651264 -"2025-11-19 19:51:29.1707405Z","2025-11-19 19:51:29.1707405Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\netutils.dll",,,,,,,,,,1763581889170740500,,,,,,,,,,,,,,,,,,,,,,,,,,80696,,,,,,,,,,865845000,140712825847808,140712825847808,53248 -"2025-11-19 19:51:29.1707478Z","2025-11-19 19:51:29.1707478Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\authz.dll",,,,,,,,,,1763581889170747800,,,,,,,,,,,,,,,,,,,,,,,,,,372179,,,,,,,,,,771731569,140712826241024,140712826241024,327680 -"2025-11-19 19:51:29.1707558Z","2025-11-19 19:51:29.1707558Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\sspicli.dll",,,,,,,,,,1763581889170755800,,,,,,,,,,,,,,,,,,,,,,,,,,339222,,,,,,,,,,3030302172,140712833384448,140712833384448,299008 -"2025-11-19 19:51:29.1707624Z","2025-11-19 19:51:29.1707624Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581889170762400,,,,,,,,,,,,,,,,,,,,,,,,,,4209945,,,,,,,,,,2980330054,140712854355968,140712854355968,4161536 -"2025-11-19 19:51:29.1707770Z","2025-11-19 19:51:29.1707770Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,1763581889170777100,,,,,,,,,,,,,,,,,,,,,,,,,,230350,,,,,,,,,,2551303736,140712858550272,140712858550272,159744 -"2025-11-19 19:51:29.1707839Z","2025-11-19 19:51:29.1707839Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581889170783900,,,,,,,,,,,,,,,,,,,,,,,,,,700029,,,,,,,,,,3371602543,140712858746880,140712858746880,667648 -"2025-11-19 19:51:29.1707901Z","2025-11-19 19:51:29.1707901Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581889170790100,,,,,,,,,,,,,,,,,,,,,,,,,,1436013,,,,,,,,,,1441720767,140712859467776,140712859467776,1355776 -"2025-11-19 19:51:29.1707963Z","2025-11-19 19:51:29.1707963Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,1763581889170796400,,,,,,,,,,,,,,,,,,,,,,,,,,1243850,,,,,,,,,,792084382,140712861433856,140712861433856,1228800 -"2025-11-19 19:51:29.1708021Z","2025-11-19 19:51:29.1708021Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581889170802200,,,,,,,,,,,,,,,,,,,,,,,,,,716301,,,,,,,,,,3291623140,140712863203328,140712863203328,679936 -"2025-11-19 19:51:29.1708087Z","2025-11-19 19:51:29.1708087Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581889170808700,,,,,,,,,,,,,,,,,,,,,,,,,,885660,,,,,,,,,,2913437033,140712877621248,140712877621248,823296 -"2025-11-19 19:51:29.1708158Z","2025-11-19 19:51:29.1708158Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\ws2_32.dll",,,,,,,,,,1763581889170815800,,,,,,,,,,,,,,,,,,,,,,,,,,513405,,,,,,,,,,3967481067,140712881094656,140712881094656,475136 -"2025-11-19 19:51:29.1708219Z","2025-11-19 19:51:29.1708219Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581889170821900,,,,,,,,,,,,,,,,,,,,,,,,,,761372,,,,,,,,,,71854833,140712881618944,140712881618944,737280 -"2025-11-19 19:51:29.1708353Z","2025-11-19 19:51:29.1708353Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,1763581889170835300,,,,,,,,,,,,,,,,,,,,,,,,,,230873,,,,,,,,,,527442843,140712882405376,140712882405376,176128 -"2025-11-19 19:51:29.1708422Z","2025-11-19 19:51:29.1708422Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,1763581889170842200,,,,,,,,,,,,,,,,,,,,,,,,,,233556,,,,,,,,,,1625678811,140712882601984,140712882601984,200704 -"2025-11-19 19:51:29.1708492Z","2025-11-19 19:51:29.1708492Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,1763581889170849200,,,,,,,,,,,,,,,,,,,,,,,,,,1923284,,,,,,,,,,675224942,140712888827904,140712888827904,1863680 -"2025-11-19 19:51:29.1708555Z","2025-11-19 19:51:29.1708555Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581889170855500,,,,,,,,,,,,,,,,,,,,,,,,,,760295,,,,,,,,,,460960534,140712894529536,140712894529536,692224 -"2025-11-19 19:51:29.1708613Z","2025-11-19 19:51:29.1708613Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581889170861300,,,,,,,,,,,,,,,,,,,,,,,,,,1193108,,,,,,,,,,4275633056,140712897216512,140712897216512,1146880 -"2025-11-19 19:51:29.1708672Z","2025-11-19 19:51:29.1708672Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581889170867200,,,,,,,,,,,,,,,,,,,,,,,,,,2537167,,,,,,,,,,2626650689,140712898723840,140712898723840,2523136 -"2025-11-19 19:51:29.1708754Z","2025-11-19 19:51:29.1708754Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"whoami.exe",,,,,,,,,,1763581889170875400,,,,,,,,,,,1257472,1302528,57157118,134080554818530829,3221225477,134080554881460737,83,0,3396,1,3,3,0,0,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1712017Z","2025-11-19 19:51:29.1712017Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",14196,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889171201700,18446633084039225344,18446633084039200768,140702989233856,0,132813950976,14196,132824170496,132824162304,140702989233856,1237595,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1712021Z","2025-11-19 19:51:29.1712021Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",5064,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889171202100,18446633084045922304,18446633084045897728,140712899206080,0,132813926400,5064,132821024768,132821016576,140712899206080,512990,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1712022Z","2025-11-19 19:51:29.1712022Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",13020,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889171202200,18446633084045864960,18446633084045840384,140712865112144,0,132813918208,13020,132819976192,132819968000,140712865112144,214628,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1712025Z","2025-11-19 19:51:29.1712025Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",5520,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889171202500,18446633084017422336,18446633084017397760,140702989086576,0,132813959168,5520,132825219072,132825210880,140702989086576,4438889,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1712026Z","2025-11-19 19:51:29.1712026Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889171202600,18446633084045201408,18446633084045176832,140702989817872,0,132813885440,4736,132815781888,132815761408,140702989817872,67793028,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1712036Z","2025-11-19 19:51:29.1712036Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",12136,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889171203600,18446633084045430784,18446633084045406208,140712899206080,0,132813901824,12136,132817879040,132817870848,140712899206080,12037587,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1712126Z","2025-11-19 19:51:29.1712126Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",12916,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889171212600,18446633084042874880,18446633084042850304,140702989404080,0,132813967360,12916,132826267648,132826255360,140702989404080,1037678,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1712275Z","2025-11-19 19:51:29.1712275Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",14136,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889171227500,18446633084045402112,18446633084045377536,140712899206080,0,132813893632,14136,132816830464,132816822272,140712899206080,8912478,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1712302Z","2025-11-19 19:51:29.1712302Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",2364,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889171230200,18446633084045950976,18446633084045926400,140712899206080,0,132813934592,2364,132822073344,132822032384,140712899206080,41279257,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1712388Z","2025-11-19 19:51:29.1712388Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",1824,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889171238800,18446633084045807616,18446633084045783040,140712899206080,0,132813910016,1824,132818927616,132818915328,140712899206080,9551452,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1723363Z","2025-11-19 19:51:29.1723363Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889172336300,18446633084047904768,18446633084047880192,140702989217024,0,132813942784,5760,132823121920,132823093248,140702989217024,23273616,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1735274Z","2025-11-19 19:51:29.1735274Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"OpenConsole.ex",,,,,,,,,,1763581889173527400,,,,,,,,,,,2887680,2940928,176179930,134080554806509408,0,134080554881486007,111,0,3394,12,7,3,52,0,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1738607Z","2025-11-19 19:51:29.1738607Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3100 conhost.exe",1400,,," 3100 conhost.exe",,,,,,,,,,,,,1763581889173860700,18446633084044828672,18446633084044804096,140712899206080,0,1013857767424,1400,1013862367232,1013862359040,140712899206080,175021,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1738641Z","2025-11-19 19:51:29.1738641Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3100 conhost.exe",9260,,," 3100 conhost.exe",,,,,,,,,,,,,1763581889173864100,18446633084044656640,18446633084044632064,140712899206080,0,1013857759232,9260,1013861318656,1013861310464,140712899206080,523176,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1738680Z","2025-11-19 19:51:29.1738680Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3100 conhost.exe",2976,,," 3100 conhost.exe",,,,,,,,,,,,,1763581889173868000,18446633084044943360,18446633084044918784,140712865112144,0,1013857751040,2976,1013860794368,1013860786176,140712865112144,139564,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1738783Z","2025-11-19 19:51:29.1738783Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3100 conhost.exe",6724,,," 3100 conhost.exe",,,,,,,,,,,,,1763581889173878300,18446633084044627968,18446633084044603392,140696384580832,0,1013857734656,6724,1013861842944,1013861818368,140696384580832,33378427,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1738825Z","2025-11-19 19:51:29.1738825Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3100 conhost.exe",4376,,," 3100 conhost.exe",,,,,,,,,,,,,1763581889173882500,18446633084006535168,18446633084006510592,140712899206080,0,1013857742848,4376,1013860270080,1013860261888,140712899206080,858507,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1741667Z","2025-11-19 19:51:29.1741667Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,,,,,,,,,,,1763581889174166700,18446633084047990784,18446633084047966208,140696385038832,0,1013857775616,11136,1013862891520,1013862879232,140696385038832,732523,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1746376Z","2025-11-19 19:51:29.1746376Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",4932,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889174637600,18446633084042932224,18446633084042907648,140712371704112,0,1068179750912,4932,1068193808384,1068193669120,140712371704112,6957459,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1746466Z","2025-11-19 19:51:29.1746466Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"conhost.exe",,,,,,,,,,1763581889174646600,,,,,,,,,,,1503232,1552384,66220850,134080554806283315,109,134080554881498658,93,0,3393,5,0,3,0,0,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1871394Z","2025-11-19 19:51:29.1871394Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",6876,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187139500,18446633084045144064,18446633084045119488,140712891292720,0,1068179693568,6876,1068187516928,1068187496448,140712891292720,12018349,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1871396Z","2025-11-19 19:51:29.1871396Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",14948,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187139600,18446633084049481728,18446633084049457152,140712899206080,0,1068179816448,14948,1068202196992,1068202188800,140712899206080,346270,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1871397Z","2025-11-19 19:51:29.1871397Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187139700,18446633084046352384,18446633084046327808,140702319920256,0,1068179636224,5964,1068177817600,1068177727488,140702319920256,1443654158,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1871409Z","2025-11-19 19:51:29.1871409Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",11716,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187140900,18446633084044541952,18446633084044517376,140712583404848,0,1068179726336,11716,1068190662656,1068190654464,140712583404848,1102557,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1871452Z","2025-11-19 19:51:29.1871452Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",3968,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187145200,18446633084007337984,18446633084007313408,140712378178864,0,1068179759104,3968,1068194856960,1068194828288,140712378178864,69473835,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1871491Z","2025-11-19 19:51:29.1871491Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",8404,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187149200,18446633084047183872,18446633084047159296,140712899206080,0,1068179685376,8404,1068186468352,1068186451968,140712899206080,8231254,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1871524Z","2025-11-19 19:51:29.1871524Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",9740,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187152400,18446633084047876096,18446633084047851520,140712899206080,0,1068179734528,9740,1068191711232,1068191694848,140712899206080,7053264,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1871535Z","2025-11-19 19:51:29.1871535Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",11228,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187153500,18446633084046180352,18446633084046155776,140712899206080,0,1068179791872,11228,1068199051264,1068199043072,140712899206080,1385833,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1871773Z","2025-11-19 19:51:29.1871773Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",12764,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187177300,18446633084049453056,18446633084049428480,140712899206080,0,1068179808256,12764,1068201148416,1068201140224,140712899206080,780050,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1872444Z","2025-11-19 19:51:29.1872444Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",1960,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187244400,18446633084049424384,18446633084049399808,140712899206080,0,1068179800064,1960,1068200099840,1068200091648,140712899206080,1114250,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1872641Z","2025-11-19 19:51:29.1872641Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",3600,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187264100,18446633084044570624,18446633084044546048,140712899206080,0,1068179783680,3600,1068198002688,1068197990400,140712899206080,4580339,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1872760Z","2025-11-19 19:51:29.1872760Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",12568,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187276000,18446633084042072064,18446633084042047488,140712865112144,0,1068179742720,12568,1068192759808,1068192739328,140712865112144,7322583,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1872767Z","2025-11-19 19:51:29.1872767Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",12140,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187276700,18446633084049252352,18446633084049227776,140712899206080,0,1068179775488,12140,1068196954112,1068196945920,140712899206080,3097568,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1872895Z","2025-11-19 19:51:29.1872895Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",14500,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187289500,18446633084047642624,18446633084047618048,140712632221632,0,1068179718144,14500,1068188565504,1068188553216,140712632221632,3940609,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1873052Z","2025-11-19 19:51:29.1873052Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",14844,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187305200,18446633084042817536,18446633084042792960,140712899206080,0,1068179668992,14844,1068184371200,1068184358912,140712899206080,6994044,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1873232Z","2025-11-19 19:51:29.1873232Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",12024,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187323200,18446633084046725120,18446633084046700544,140712899206080,0,1068179660800,12024,1068183322624,1068183314432,140712899206080,26231986,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1873245Z","2025-11-19 19:51:29.1873245Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",4348,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187324500,18446633084046667776,18446633084046643200,140712899206080,0,1068179652608,4348,1068182274048,1068182261760,140712899206080,20408407,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1873476Z","2025-11-19 19:51:29.1873476Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",11152,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187347600,18446633084046610432,18446633084046585856,140712899206080,0,1068179644416,11152,1068181225472,1068181209088,140712899206080,21606025,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1873670Z","2025-11-19 19:51:29.1873670Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",11960,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187367000,18446633084048162816,18446633084048138240,140712899206080,0,1068179767296,11960,1068195905536,1068195885056,140712899206080,1970379630,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1873893Z","2025-11-19 19:51:29.1873893Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",11108,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187389300,18446633084046983168,18446633084046958592,140712865112144,0,1068179677184,11108,1068185419776,1068185411584,140712865112144,197276,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1878454Z","2025-11-19 19:51:29.1878454Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187845400,18446633084047790080,18446633084047765504,140712604173856,0,1068179709952,10116,1068189614080,1068189605888,140712604173856,13884359,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1949230Z","2025-11-19 19:51:29.1949230Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"WindowsTermina",,,,,,,,,,1763581889194923100,,,,,,,,,,,16732160,19222528,3702983350,134080554806979193,0,134080554881691430,577,0,3395,60,52,3,7,0,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.2994897Z","2025-11-19 19:51:29.2994897Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6220 svchost.exe",1512,,," 6220 svchost.exe",,,,,,,,,,,,,1763581889299489800,18446633084047761408,18446633084047736832,140712865112144,278,101940486144,1512,101943607296,101943574528,140712865112144,4277070,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.3321791Z","2025-11-19 19:51:29.3321791Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 8476 ServiceHub.IdentityHost.exe",,,,,,,,,,,,,1763581889332179100,18446633084047761408,18446633084047736832,140712899206080,0,843736039424,14488,843738251264,843738247168,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.3322610Z","2025-11-19 19:51:29.3322610Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1956 MSBuild.exe",,,,,,,,,,,,,1763581889332261100,18446633084055846912,18446633084055822336,140712899206080,0,641477595136,11260,641487339520,641487323136,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.3323015Z","2025-11-19 19:51:29.3323015Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 4372 vctip.exe",,,,,,,,,,,,,1763581889332301600,18446633084048019456,18446633084047994880,140712899206080,0,740355313664,12168,740362813440,740362805248,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.3323369Z","2025-11-19 19:51:29.3323369Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"12052 ServiceHub.TestWindowStoreHost.exe",,,,,,,,,,,,,1763581889332336900,18446633084017422336,18446633084017397760,140712899206080,0,17906528256,14160,17910726656,17910722560,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.3323724Z","2025-11-19 19:51:29.3323724Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,1763581889332372400,18446633084042932224,18446633084042907648,140712899206080,0,46014324736,13904,46028292096,46028275712,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.3324120Z","2025-11-19 19:51:29.3324120Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"10252 ServiceHub.IndexingService.exe",,,,,,,,,,,,,1763581889332412000,18446633084039225344,18446633084039200768,140712899206080,0,848612728832,13908,848617799680,848617795584,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.3324467Z","2025-11-19 19:51:29.3324467Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"10648 ServiceHub.Host.dotnet.x64.exe",,,,,,,,,,,,,1763581889332446700,18446633084045807616,18446633084045783040,140712899206080,0,515212726272,7132,515219914752,515219910656,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.3324957Z","2025-11-19 19:51:29.3324957Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"10200 ServiceHub.VSDetouredHost.exe",,,,,,,,,,,,,1763581889332495700,18446633084044943360,18446633084044918784,140712899206080,0,617596755968,7544,617601826816,617601822720,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.3325408Z","2025-11-19 19:51:29.3325408Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9988 Microsoft.ServiceHub.Controller.exe",,,,,,,,,,,,,1763581889332540800,18446633084046180352,18446633084046155776,140712899206080,0,1049753657344,10460,1049757745152,1049757741056,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.3325713Z","2025-11-19 19:51:29.3325713Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9280 Greenshot.exe",,,,,,,,,,,,,1763581889332571300,18446633084049481728,18446633084049457152,140712899206080,0,948118790144,1372,948122419200,948122415104,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:31.6121866Z","2025-11-19 19:51:31.6121866Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8972 VBoxTray.exe",9020,,," 8972 VBoxTray.exe",,,,,,,,,,,,,1763581891612186600,18446633084053868544,18446633084053843968,140700131109808,0,471284252672,11456,471286677504,471286673408,140700131109808,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:31.6124072Z","2025-11-19 19:51:31.6124072Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8972 VBoxTray.exe",11456,,," 8972 VBoxTray.exe",,,,,,,,,,,,,1763581891612407200,18446633084053868544,18446633084053843968,140700131109808,0,471284252672,11456,471286677504,471286669312,140700131109808,433403,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:32.3106101Z","2025-11-19 19:51:32.3106101Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",15084,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,1763581892310610100,18446633084039487488,18446633084039462912,140711613062896,0,1046353207296,15084,1046367698944,1046367674368,140711613062896,4399662,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:32.3106424Z","2025-11-19 19:51:32.3106424Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",12628,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,1763581892310642400,18446633084005355520,18446633084005330944,140711613062896,0,1046353223680,12628,1046388670464,1046388654080,140711613062896,853227,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:32.3427056Z","2025-11-19 19:51:32.3427056Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",11644,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,1763581892342705600,18446633084038852608,18446633084038828032,140711613062896,0,1046353231872,11644,1046392864768,1046392844288,140711613062896,653688,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:32.3427596Z","2025-11-19 19:51:32.3427596Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",14980,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,1763581892342759600,18446633084038365184,18446633084038340608,140711613062896,0,1046353215488,14980,1046371893248,1046371876864,140711613062896,958462,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:33.3438855Z","2025-11-19 19:51:33.3438855Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4832 WmiPrvSE.exe",12044,,," 4832 WmiPrvSE.exe",,,,,,,,,,,,,1763581893343885500,18446633084035751936,18446633084035727360,140712899206080,0,525413761024,12044,525414694912,525414629376,140712899206080,1823386,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:33.3438935Z","2025-11-19 19:51:33.3438935Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4832 WmiPrvSE.exe",13316,,," 4832 WmiPrvSE.exe",,,,,,,,,,,,,1763581893343893500,18446633084035637248,18446633084035612672,140712899206080,0,525413744640,13316,525411221504,525411155968,140712899206080,5525225,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +timestamp_sys,timestamp_etw,src_type,provider_name,event_id,task_info,process_id,thread_id,ppid,pid,targetpid,targettid,message,filepath,cachename,result,vname,name,sigseq,sigsha,commandline,firstparam,secondparam,stackbase,stacklimit,startaddr,subprocesstag,tebbase,threadid,timestamp_ns,userstackbase,userstacklimit,win32startaddr,cycletime,createtime,flags,imagechecksum,mandatorylabel,packagefullname,packagerelativeappid,parentprocessid,parentprocesssequencenumber,processsequencenumber,processtokenelevationtype,processtokeniselevated,securitymitigations,sessionid,timedatestamp,defaultbase,imagebase,imagesize,commitcharge,commitpeak,cpucyclecount,exitcode,exittime,handlecount,hardfaultcount,readoperationcount,readtransferkilobytes,tokenelevationtype,writeoperationcount,writetransferkilobytes"2025-11-19 22:37:11.1915649Z","2025-11-19 22:37:11.1915649Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 6096 svchost.exe",,,,,,,,,,,,,18446633084024459264,18446633084024434688,140712899206080,0,338488844288,636,1763591831191564900,338488393728,338488360960,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.1916937Z","2025-11-19 22:37:11.1916937Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9920 ServiceHub.IntellicodeModelService.exe",12960,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,18446633083978407936,18446633083978383360,140711612509856,0,46015668224,12960,1763591831191693700,46012694528,46012678144,140711612509856,862657,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.2048364Z","2025-11-19 22:37:11.2048364Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",4060,,," 5184 explorer.exe",,,,,,,,,,,,,18446633084024315904,18446633084024291328,140712899206080,0,15343616,1708,1763591831204836400,515375104,515317760,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.3509174Z","2025-11-19 22:37:11.3509174Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8984 svchost.exe",11892,,," 8984 svchost.exe",,,,,,,,,,,,,18446633084049739776,18446633084049715200,140712899206080,0,213147869184,11892,1763591831350917400,213148762112,213148729344,140712899206080,303269,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.5426966Z","2025-11-19 22:37:11.5426966Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"11648 RuntimeBroker.exe",,,,,,,,,,,,,18446633084049739776,18446633084049715200,140712899206080,0,503394197504,7460,1763591831542696600,503396696064,503396646912,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.6406757Z","2025-11-19 22:37:11.6406757Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8972 VBoxTray.exe",9020,,," 8972 VBoxTray.exe",,,,,,,,,,,,,18446633084024516608,18446633084024492032,140700131109808,0,471283179520,1480,1763591831640675700,471299260416,471299256320,140700131109808,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.6409261Z","2025-11-19 22:37:11.6409261Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8972 VBoxTray.exe",1480,,," 8972 VBoxTray.exe",,,,,,,,,,,,,18446633084024516608,18446633084024492032,140700131109808,0,471283179520,1480,1763591831640926100,471299260416,471299252224,140700131109808,560897,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.792165000Z","2025-11-19 22:37:11.7170068Z","myETW","EDRi-Provider",4242,"EDRiTask"," 7508 EDRi.exe",,,,,,"++ EDRi START MARKER ++",,,,,,,,,,,,,,,,,1763591831717006800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.7170149Z","2025-11-19 22:37:11.7170149Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9832 svchost.exe",11208,,," 9832 svchost.exe",,,,,,,,,,,,,18446633084050743296,18446633084050718720,140712899206080,0,234794704896,11208,1763591831717014900,234792878080,234792845312,140712899206080,383989,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.9502056Z","2025-11-19 22:37:11.9502056Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",2956,,," 5184 explorer.exe",,,,,,,,,,,,,18446633084024545280,18446633084024520704,140712899206080,0,15351808,13348,1763591831950205600,515899392,515842048,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:12.2126523Z","2025-11-19 22:37:12.2126523Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 9692 PerfWatson2.exe",12736,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084023541760,18446633084023517184,140711613062896,0,1046354399232,11240,1763591832212652300,1046413836288,1046413819904,140711613062896,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:12.3065571Z","2025-11-19 22:37:12.3065571Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","11904 msedgewebview2.exe",8860,,,"11904 msedgewebview2.exe",,,,,,,,,,,,,18446633083980414976,18446633083980390400,140712899206080,0,667618459648,8860,1763591832306557100,665728319488,665728315392,140712899206080,357587,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:12.3133629Z","2025-11-19 22:37:12.3133629Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 9692 PerfWatson2.exe",12616,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084024401920,18446633084024377344,140711613062896,0,1046354407424,11288,1763591832313362900,1046418030592,1046418014208,140711613062896,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:12.3544946Z","2025-11-19 22:37:12.3544946Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9324 msedgewebview2.exe",4216,,," 9324 msedgewebview2.exe",,,,,,,,,,,,,18446633083980595200,18446633083980570624,140712899206080,0,717037178880,4216,1763591832354494600,717054017536,717054013440,140712899206080,351927,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:12.3545599Z","2025-11-19 22:37:12.3545599Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 8984 svchost.exe",,,,,,,,,,,,,18446633084024057856,18446633084024033280,140712899206080,0,213147877376,276,1763591832354559900,213148762112,213148729344,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:12.5148249Z","2025-11-19 22:37:12.5148249Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9388 devenv.exe",12204,,," 9388 devenv.exe",,,,,,,,,,,,,18446633083985420288,18446633083985395712,140711613062896,0,1033377087488,12204,1763591832514824900,1033415163904,1033415143424,140711613062896,125044070,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:12.7208620Z","2025-11-19 22:37:12.7208620Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9832 svchost.exe",,,,,,,,,,,,,18446633083980414976,18446633083980390400,140712899206080,0,234794721280,11672,1763591832720862100,234792878080,234792845312,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:12.9904828Z","2025-11-19 22:37:12.9904828Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 7884 msedgewebview2.exe",5984,,," 7884 msedgewebview2.exe",,,,,,,,,,,,,18446633083980652544,18446633083980627968,140712899206080,0,139211661312,5984,1763591832990482800,139246698496,139246694400,140712899206080,266303,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:12.9904834Z","2025-11-19 22:37:12.9904834Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 7956 msedgewebview2.exe",504,,," 7956 msedgewebview2.exe",,,,,,,,,,,,,18446633084048707584,18446633084048683008,140712899206080,0,334435393536,504,1763591832990483400,334462189568,334462181376,140712899206080,245557,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.2297646Z","2025-11-19 22:37:13.2297646Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",2776,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084047761408,18446633084047736832,140711612509856,0,1046354391040,2776,1763591833229764600,1046352232448,1046352216064,140711612509856,1727953,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.2614302Z","2025-11-19 22:37:13.2614302Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13084 MSBuild.exe",2512,,,"13084 MSBuild.exe",,,,,,,,,,,,,18446633084004839424,18446633084004814848,140711613062896,0,911121752064,2512,1763591833261430200,911223029760,911223013376,140711613062896,1215338,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.2614809Z","2025-11-19 22:37:13.2614809Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13084 MSBuild.exe",12292,,,"13084 MSBuild.exe",,,,,,,,,,,,,18446633084004552704,18446633084004528128,140711613062896,0,911121727488,12292,1763591833261480900,911210446848,911210430464,140711613062896,2454817,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3089749Z","2025-11-19 22:37:13.3089749Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13084 MSBuild.exe",1488,,,"13084 MSBuild.exe",,,,,,,,,,,,,18446633084004638720,18446633084004614144,140711613062896,0,911121735680,1488,1763591833308974900,911214641152,911214624768,140711613062896,3342749,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3090104Z","2025-11-19 22:37:13.3090104Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13084 MSBuild.exe",14060,,,"13084 MSBuild.exe",,,,,,,,,,,,,18446633084004495360,18446633084004470784,140711613062896,0,911121719296,14060,1763591833309010400,911206252544,911206236160,140711613062896,2587216,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3090477Z","2025-11-19 22:37:13.3090477Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13084 MSBuild.exe",12864,,,"13084 MSBuild.exe",,,,,,,,,,,,,18446633084003921920,18446633084003897344,140711613062896,0,911121661952,12864,1763591833309047700,911176892416,911176876032,140711613062896,7149828,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3090782Z","2025-11-19 22:37:13.3090782Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"11904 msedgewebview2.exe",,,,,,,,,,,,,18446633084004552704,18446633084004528128,140712899206080,0,667618467840,7748,1763591833309078300,665728319488,665728315392,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3091086Z","2025-11-19 22:37:13.3091086Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13084 MSBuild.exe",9556,,,"13084 MSBuild.exe",,,,,,,,,,,,,18446633084004810752,18446633084004786176,140711613062896,0,911121743872,9556,1763591833309108600,911218835456,911218819072,140711613062896,1270411,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3091215Z","2025-11-19 22:37:13.3091215Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13084 MSBuild.exe",4244,,,"13084 MSBuild.exe",,,,,,,,,,,,,18446633084003979264,18446633084003954688,140711613062896,0,911121670144,4244,1763591833309121500,911181086720,911181066240,140711613062896,4226150,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3091312Z","2025-11-19 22:37:13.3091312Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","10648 ServiceHub.Host.dotnet.x64.exe",9652,,,"10648 ServiceHub.Host.dotnet.x64.exe",,,,,,,,,,,,,18446633083986194432,18446633083986169856,140711121663952,0,515211550720,9652,1763591833309131200,515230924800,515230879744,140711121663952,150560519,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3091350Z","2025-11-19 22:37:13.3091350Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13084 MSBuild.exe",13796,,,"13084 MSBuild.exe",,,,,,,,,,,,,18446633084004380672,18446633084004356096,140711613062896,0,911121711104,13796,1763591833309135000,911202058240,911202041856,140711613062896,3047023,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3091895Z","2025-11-19 22:37:13.3091895Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","10252 ServiceHub.IndexingService.exe",2196,,,"10252 ServiceHub.IndexingService.exe",,,,,,,,,,,,,18446633083984613376,18446633083984588800,140711121663952,0,848613646336,2196,1763591833309189500,848619372544,848619352064,140711121663952,39058301,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3092519Z","2025-11-19 22:37:13.3092519Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","10252 ServiceHub.IndexingService.exe",12808,,,"10252 ServiceHub.IndexingService.exe",,,,,,,,,,,,,18446633083985076224,18446633083985051648,140711121663952,0,848613662720,12808,1763591833309251900,848627761152,848627744768,140711121663952,23238547,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3093391Z","2025-11-19 22:37:13.3093391Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","10252 ServiceHub.IndexingService.exe",3892,,,"10252 ServiceHub.IndexingService.exe",,,,,,,,,,,,,18446633083986423808,18446633083986399232,140711121663952,0,848613687296,3892,1763591833309339100,848635625472,848635600896,140711121663952,49327209,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3567871Z","2025-11-19 22:37:13.3567871Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9324 msedgewebview2.exe",,,,,,,,,,,,,18446633084004638720,18446633084004614144,140712899206080,0,717037187072,8800,1763591833356787100,717054017536,717054013440,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.7697452Z","2025-11-19 22:37:13.7697452Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8268 svchost.exe",7544,,," 8268 svchost.exe",,,,,,,,,,,,,18446633084022276096,18446633084022251520,140712899206080,0,178507522048,7544,1763591833769745200,178510102528,178510069760,140712899206080,191618,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.9920204Z","2025-11-19 22:37:13.9920204Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 7884 msedgewebview2.exe",,,,,,,,,,,,,18446633083985420288,18446633083985395712,140712899206080,0,139211669504,5744,1763591833992020400,139246698496,139246694400,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.9921417Z","2025-11-19 22:37:13.9921417Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 7956 msedgewebview2.exe",,,,,,,,,,,,,18446633084025638912,18446633084025614336,140712899206080,0,334435401728,12716,1763591833992141700,334462189568,334462185472,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:14.0077231Z","2025-11-19 22:37:14.0077231Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5884 SearchProtocolHost.exe",14676,,," 5884 SearchProtocolHost.exe",,,,,,,,,,,,,18446633084009955328,18446633084009930752,140712899206080,0,100230639616,14676,1763591834007723100,100232331264,100232298496,140712899206080,4036415,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:14.0077232Z","2025-11-19 22:37:14.0077232Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5884 SearchProtocolHost.exe",8420,,," 5884 SearchProtocolHost.exe",,,,,,,,,,,,,18446633084010127360,18446633084010102784,140712899206080,0,100230647808,8420,1763591834007723200,100232855552,100232822784,140712899206080,1875060,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:14.0077273Z","2025-11-19 22:37:14.0077273Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5884 SearchProtocolHost.exe",7836,,," 5884 SearchProtocolHost.exe",,,,,,,,,,,,,18446633083987718144,18446633083987693568,140712899206080,0,100230656000,7836,1763591834007727300,100233379840,100233347072,140712899206080,74308,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:14.7714898Z","2025-11-19 22:37:14.7714898Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8916 SecurityHealthService.exe",2640,,," 8916 SecurityHealthService.exe",,,,,,,,,,,,,18446633083981217792,18446633083981193216,140712899206080,0,33814335488,2640,1763591834771489900,33812054016,33812045824,140712899206080,256119,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:14.7715058Z","2025-11-19 22:37:14.7715058Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 8268 svchost.exe",,,,,,,,,,,,,18446633084010127360,18446633084010102784,140712899206080,0,178507530240,4892,1763591834771505800,178510102528,178510069760,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:15.2004649Z","2025-11-19 22:37:15.2004649Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 700 lsass.exe",3660,,," 700 lsass.exe",,,,,,,,,,,,,18446633084010872832,18446633084010848256,140712850417280,0,81706889216,3660,1763591835200464900,81709760512,81709740032,140712850417280,513746,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:16.175848500Z","2025-11-19 22:37:15.7424568Z","myETW","EDRi-Provider",4242,"EDRiTask"," 7508 EDRi.exe",,,,,,"Before decrypting the attack exe from C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\attacks\Injector-standard.exe.enc",,,,,,,,,,,,,,,,,1763591835742456800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:16.182157400Z","2025-11-19 22:37:15.7482493Z","myETW","EDRi-Provider",4242,"EDRiTask"," 7508 EDRi.exe",,,,,,"After decrypting the attack exe",,,,,,,,,,,,,,,,,1763591835748249300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:15.7731036Z","2025-11-19 22:37:15.7731036Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 8916 SecurityHealthService.exe",,,,,,,,,,,,,18446633083980652544,18446633083980627968,140712899206080,0,33814343680,12872,1763591835773103700,33812054016,33812045824,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:16.1094589Z","2025-11-19 22:37:16.1094589Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 9692 PerfWatson2.exe",9752,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084025667584,18446633084025643008,140711612509856,0,1046354415616,1060,1763591836109458900,1046352232448,1046352216064,140711612509856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:16.6517984Z","2025-11-19 22:37:16.6517984Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8972 VBoxTray.exe",9020,,," 8972 VBoxTray.exe",,,,,,,,,,,,,18446633084025724928,18446633084025700352,140700131109808,0,471283187712,6728,1763591836651798400,471299260416,471299256320,140700131109808,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:16.6520139Z","2025-11-19 22:37:16.6520139Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8972 VBoxTray.exe",6728,,," 8972 VBoxTray.exe",,,,,,,,,,,,,18446633084025724928,18446633084025700352,140700131109808,0,471283187712,6728,1763591836652013900,471299260416,471299252224,140700131109808,456412,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:17.282796100Z","2025-11-19 22:37:16.7589463Z","myETW","EDRi-Provider",4242,"EDRiTask"," 7508 EDRi.exe",,,,,,"Before starting the attack exe",,,,,,,,,,,,,,,,,1763591836758946300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:17.4750774Z","2025-11-19 22:37:17.4750774Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1520 powershell.exe",2068,,," 1520 powershell.exe",,,,,,,,,,,,,18446633084010586112,18446633084010561536,140711613062896,0,931707432960,2068,1763591837475077400,931708534784,931708522496,140711613062896,2147777,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:17.4751035Z","2025-11-19 22:37:17.4751035Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1520 powershell.exe",13452,,," 1520 powershell.exe",,,,,,,,,,,,,18446633084010672128,18446633084010647552,140711613062896,0,931707449344,13452,1763591837475103500,931709059072,931709046784,140711613062896,1240989,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:17.4751539Z","2025-11-19 22:37:17.4751539Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1520 powershell.exe",7756,,," 1520 powershell.exe",,,,,,,,,,,,,18446633084000100352,18446633084000075776,140711613062896,0,931707490304,7756,1763591837475153900,931710107648,931710091264,140711613062896,1639311,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:17.4752016Z","2025-11-19 22:37:17.4752016Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1520 powershell.exe",9588,,," 1520 powershell.exe",,,,,,,,,,,,,18446633083999985664,18446633083999961088,140711613062896,0,931707482112,9588,1763591837475201600,931709583360,931709571072,140711613062896,1332647,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:17.6179244Z","2025-11-19 22:37:17.6179244Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",1060,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084025667584,18446633084025643008,140711612509856,0,1046354415616,1060,1763591837617924400,1046352232448,1046352216064,140711612509856,1229672,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:18.1080912Z","2025-11-19 22:37:18.1080912Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2376 svchost.exe",10840,,," 2376 svchost.exe",,,,,,,,,,,,,18446633084000100352,18446633084000075776,140712899206080,0,36399751168,5764,1763591838108091200,36401315840,36401283072,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:18.1082195Z","2025-11-19 22:37:18.1082195Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2376 svchost.exe",5764,,," 2376 svchost.exe",,,,,,,,,,,,,18446633084010586112,18446633084010561536,140712899206080,248,36399759360,7176,1763591838108219500,36401840128,36401807360,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:18.1091428Z","2025-11-19 22:37:18.1091428Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2932 svchost.exe",6236,,," 2932 svchost.exe",,,,,,,,,,,,,18446633084026470400,18446633084026445824,140712899206080,49,212462006272,4884,1763591838109142800,212464566272,212464500736,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:18.1100127Z","2025-11-19 22:37:18.1100127Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2376 svchost.exe",5764,,," 2376 svchost.exe",,,,,,,,,,,,,18446633084026499072,18446633084026474496,140712899206080,248,36399767552,3700,1763591838110012700,36402364416,36402331648,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:18.1100995Z","2025-11-19 22:37:18.1100995Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2376 svchost.exe",3700,,," 2376 svchost.exe",,,,,,,,,,,,,18446633084026585088,18446633084026560512,140712899206080,0,36399775744,8648,1763591838110099500,36402888704,36402855936,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:18.1101842Z","2025-11-19 22:37:18.1101842Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2376 svchost.exe",8648,,," 2376 svchost.exe",,,,,,,,,,,,,18446633084026613760,18446633084026589184,140712899206080,0,36399783936,12324,1763591838110184200,36403412992,36403380224,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:18.1102113Z","2025-11-19 22:37:18.1102113Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2080 svchost.exe",11748,,," 2080 svchost.exe",,,,,,,,,,,,,18446633084026675200,18446633084026650624,140712899206080,57,246078193664,4500,1763591838110211300,246081912832,246081880064,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:18.8842832Z","2025-11-19 22:37:18.8842832Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3540 svchost.exe",1372,,," 3540 svchost.exe",,,,,,,,,,,,,18446633084056907776,18446633084056883200,140711742624160,249,589657747456,1372,1763591838884283200,589660946432,589660913664,140711742624160,10493143486,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:18.8843028Z","2025-11-19 22:37:18.8843028Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3540 svchost.exe",2056,,," 3540 svchost.exe",,,,,,,,,,,,,18446633084013084672,18446633084013060096,140711742624160,249,589657755648,2056,1763591838884302800,589661470720,589661437952,140711742624160,413754083,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:18.9486568Z","2025-11-19 22:37:18.9486568Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8448 OneDrive.exe",14752,,," 8448 OneDrive.exe",,,,,,,,,,,,,18446633083984125952,18446633083984101376,140712859481984,0,70346272768,14752,1763591838948656800,70353158144,70353149952,140712859481984,764961,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:19.6822614Z","2025-11-19 22:37:19.6822614Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 9920 ServiceHub.IntellicodeModelService.exe",9760,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,18446633084027449344,18446633084027424768,140711612509856,0,46015676416,4196,1763591839682261400,46012694528,46012678144,140711612509856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:19.8417299Z","2025-11-19 22:37:19.8417299Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","10648 ServiceHub.Host.dotnet.x64.exe",7644,,,"10648 ServiceHub.Host.dotnet.x64.exe",,,,,,,,,,,,,18446633083985477632,18446633083985453056,140711121663952,0,515211534336,7644,1763591839841729900,515226206208,515226185728,140711121663952,242289127,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:19.8417852Z","2025-11-19 22:37:19.8417852Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","10648 ServiceHub.Host.dotnet.x64.exe",13156,,,"10648 ServiceHub.Host.dotnet.x64.exe",,,,,,,,,,,,,18446633084058513408,18446633084058488832,140711121663952,0,515213594624,13156,1763591839841785200,515234070528,515234017280,140711121663952,314582142,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.0924127Z","2025-11-19 22:37:20.0924127Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",5020,,," 5184 explorer.exe",,,,,,,,,,,,,18446633084027592704,18446633084027568128,140712891545280,0,15360000,15136,1763591840092412700,470351872,470294528,140712891545280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1091605Z","2025-11-19 22:37:20.1091605Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1040 svchost.exe",4480,,,"13388 smartscreen.exe",,,"C:\Windows\System32\smartscreen.exe",,,,,,,,,,,,,,,,1763591840109160500,,,,,134080654409311255,0,664452,"0x","","",1040,13,6623,3,0,0,1,419447766,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1098332Z","2025-11-19 22:37:20.1098332Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",4480,,,"13388 smartscreen.exe",,,,,,,,,,,,,18446633083984125952,18446633083984101376,140696524147856,40,184868757504,12744,1763591840109833200,184867422208,184867414016,140696524147856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1113626Z","2025-11-19 22:37:20.1113626Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\smartscreen.exe",,,,,,,,,,,,,,,,1763591840111362600,,,,,,,664452,,,,,,,,,,,419447766,140696524029952,140696524029952,614400,,,,,,,,,,,, +"2025-11-19 22:37:20.1113736Z","2025-11-19 22:37:20.1113736Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591840111373600,,,,,,,2537167,,,,,,,,,,,2626650689,140712898723840,140712898723840,2523136,,,,,,,,,,,, +"2025-11-19 22:37:20.1148161Z","2025-11-19 22:37:20.1148161Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591840114816100,,,,,,,885660,,,,,,,,,,,2913437033,140712877621248,140712877621248,823296,,,,,,,,,,,, +"2025-11-19 22:37:20.1149453Z","2025-11-19 22:37:20.1149453Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591840114945300,,,,,,,4209945,,,,,,,,,,,2980330054,140712854355968,140712854355968,4161536,,,,,,,,,,,, +"2025-11-19 22:37:20.1160739Z","2025-11-19 22:37:20.1160739Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591840116073900,,,,,,,1436013,,,,,,,,,,,1441720767,140712859467776,140712859467776,1355776,,,,,,,,,,,, +"2025-11-19 22:37:20.1161632Z","2025-11-19 22:37:20.1161632Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,,,,,,,,,,,18446633084027420672,18446633084027396096,140712899206080,0,184868765696,7684,1763591840116163200,184867946496,184867938304,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1162258Z","2025-11-19 22:37:20.1162258Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,,,,,,,1763591840116225800,,,,,,,3798760,,,,,,,,,,,2772520021,140712863924224,140712863924224,3715072,,,,,,,,,,,, +"2025-11-19 22:37:20.1163609Z","2025-11-19 22:37:20.1163609Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591840116360900,,,,,,,1193108,,,,,,,,,,,4275633056,140712897216512,140712897216512,1146880,,,,,,,,,,,, +"2025-11-19 22:37:20.1164719Z","2025-11-19 22:37:20.1164719Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,,,,,,,,,,,18446633084058513408,18446633084058488832,140712899206080,0,184868773888,3956,1763591840116471900,184870764544,184870756352,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1165504Z","2025-11-19 22:37:20.1165504Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,,,,,,,,,,,18446633083985477632,18446633083985453056,140712899206080,0,184868782080,11600,1763591840116550400,184871288832,184871280640,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1165516Z","2025-11-19 22:37:20.1165516Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,,,,,,,1763591840116551600,,,,,,,1029623,,,,,,,,,,,2858041650,140712891252736,140712891252736,991232,,,,,,,,,,,, +"2025-11-19 22:37:20.1167496Z","2025-11-19 22:37:20.1167496Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591840116749600,,,,,,,1923284,,,,,,,,,,,675224942,140712888827904,140712888827904,1863680,,,,,,,,,,,, +"2025-11-19 22:37:20.1169151Z","2025-11-19 22:37:20.1169151Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591840116915100,,,,,,,230350,,,,,,,,,,,2551303736,140712858550272,140712858550272,159744,,,,,,,,,,,, +"2025-11-19 22:37:20.1170578Z","2025-11-19 22:37:20.1170578Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,"C:\Windows\System32\smartscreen.dll",,,,,,,,,,,,,,,,1763591840117057800,,,,,,,6028386,,,,,,,,,,,1751620389,140711778385920,140711778385920,6057984,,,,,,,,,,,, +"2025-11-19 22:37:20.1170667Z","2025-11-19 22:37:20.1170667Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591840117066700,,,,,,,230873,,,,,,,,,,,527442843,140712882405376,140712882405376,176128,,,,,,,,,,,, +"2025-11-19 22:37:20.1172650Z","2025-11-19 22:37:20.1172650Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591840117265000,,,,,,,761372,,,,,,,,,,,71854833,140712881618944,140712881618944,737280,,,,,,,,,,,, +"2025-11-19 22:37:20.1172844Z","2025-11-19 22:37:20.1172844Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591840117284400,,,,,,,1243850,,,,,,,,,,,792084382,140712861433856,140712861433856,1228800,,,,,,,,,,,, +"2025-11-19 22:37:20.1174617Z","2025-11-19 22:37:20.1174617Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",7684,,,"13388 smartscreen.exe",,,"C:\Windows\System32\winhttp.dll",,,,,,,,,,,,,,,,1763591840117461700,,,,,,,1261038,,,,,,,,,,,84984727,140712750350336,140712750350336,1212416,,,,,,,,,,,, +"2025-11-19 22:37:20.1174902Z","2025-11-19 22:37:20.1174902Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591840117490200,,,,,,,760295,,,,,,,,,,,460960534,140712894529536,140712894529536,692224,,,,,,,,,,,, +"2025-11-19 22:37:20.1175715Z","2025-11-19 22:37:20.1175715Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591840117571500,,,,,,,700029,,,,,,,,,,,3371602543,140712858746880,140712858746880,667648,,,,,,,,,,,, +"2025-11-19 22:37:20.1177224Z","2025-11-19 22:37:20.1177224Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",7684,,,"13388 smartscreen.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591840117722400,,,,,,,716301,,,,,,,,,,,3291623140,140712863203328,140712863203328,679936,,,,,,,,,,,, +"2025-11-19 22:37:20.1177989Z","2025-11-19 22:37:20.1177989Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591840117798900,,,,,,,716301,,,,,,,,,,,3291623140,2261897052160,2261897052160,679936,,,,,,,,,,,, +"2025-11-19 22:37:20.1178688Z","2025-11-19 22:37:20.1178688Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\crypt32.dll",,,,,,,,,,,,,,,,1763591840117868800,,,,,,,1584869,,,,,,,,,,,3438168074,140712849768448,140712849768448,1536000,,,,,,,,,,,, +"2025-11-19 22:37:20.1178750Z","2025-11-19 22:37:20.1178750Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591840117875000,,,,,,,716301,,,,,,,,,,,3291623140,2261897052160,2261897052160,692224,,,,,,,,,,,, +"2025-11-19 22:37:20.1180529Z","2025-11-19 22:37:20.1180529Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,"C:\Windows\System32\ws2_32.dll",,,,,,,,,,,,,,,,1763591840118052900,,,,,,,513405,,,,,,,,,,,3967481067,140712881094656,140712881094656,475136,,,,,,,,,,,, +"2025-11-19 22:37:20.1180716Z","2025-11-19 22:37:20.1180716Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,,,,,,,1763591840118071600,,,,,,,899838,,,,,,,,,,,2878277657,140712880177152,140712880177152,880640,,,,,,,,,,,, +"2025-11-19 22:37:20.1183282Z","2025-11-19 22:37:20.1183282Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",7684,,,"13388 smartscreen.exe",,,"C:\Windows\System32\cryptsp.dll",,,,,,,,,,,,,,,,1763591840118328200,,,,,,,146168,,,,,,,,,,,1658328178,140712839217152,140712839217152,110592,,,,,,,,,,,, +"2025-11-19 22:37:20.1184654Z","2025-11-19 22:37:20.1184654Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,,,,,,,1763591840118465400,,,,,,,7769948,,,,,,,,,,,2341846616,140712869888000,140712869888000,7663616,,,,,,,,,,,, +"2025-11-19 22:37:20.1186873Z","2025-11-19 22:37:20.1186873Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",7684,,,"13388 smartscreen.exe",,,"C:\Windows\System32\dnsapi.dll",,,,,,,,,,,,,,,,1763591840118687300,,,,,,,1293169,,,,,,,,,,,1381219389,140712824274944,140712824274944,1228800,,,,,,,,,,,, +"2025-11-19 22:37:20.1187105Z","2025-11-19 22:37:20.1187105Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,,,,,,,1763591840118710500,,,,,,,1524912,,,,,,,,,,,1404855129,140712851341312,140712851341312,1486848,,,,,,,,,,,, +"2025-11-19 22:37:20.1189211Z","2025-11-19 22:37:20.1189211Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,"C:\Windows\System32\wintrust.dll",,,,,,,,,,,,,,,,1763591840118921100,,,,,,,590783,,,,,,,,,,,452262045,140712860844032,140712860844032,520192,,,,,,,,,,,, +"2025-11-19 22:37:20.1190908Z","2025-11-19 22:37:20.1190908Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",11600,,,"13388 smartscreen.exe",,,"C:\Windows\System32\IPHLPAPI.DLL",,,,,,,,,,,,,,,,1763591840119090800,,,,,,,233044,,,,,,,,,,,945822897,140712824012800,140712824012800,212992,,,,,,,,,,,, +"2025-11-19 22:37:20.1191038Z","2025-11-19 22:37:20.1191038Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,"C:\Windows\System32\ole32.dll",,,,,,,,,,,,,,,,1763591840119103800,,,,,,,1689904,,,,,,,,,,,1018821057,140712878473216,140712878473216,1667072,,,,,,,,,,,, +"2025-11-19 22:37:20.1211887Z","2025-11-19 22:37:20.1211887Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\nsi.dll",,,,,,,,,,,,,,,,1763591840121188700,,,,,,,111648,,,,,,,,,,,4223476491,140712892956672,140712892956672,40960,,,,,,,,,,,, +"2025-11-19 22:37:20.1217296Z","2025-11-19 22:37:20.1217296Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,,,,,,,1763591840121729600,,,,,,,233556,,,,,,,,,,,1625678811,140712882601984,140712882601984,200704,,,,,,,,,,,, +"2025-11-19 22:37:20.1234427Z","2025-11-19 22:37:20.1234427Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\msasn1.dll",,,,,,,,,,,,,,,,1763591840123442700,,,,,,,150871,,,,,,,,,,,2536054058,140712839675904,140712839675904,77824,,,,,,,,,,,, +"2025-11-19 22:37:20.1241762Z","2025-11-19 22:37:20.1241762Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,,,,,,,,,,,18446633084027277312,18446633084027252736,140711782212992,0,184868790272,3760,1763591840124176200,184871813120,184871804928,140711782212992,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1244097Z","2025-11-19 22:37:20.1244097Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",3760,,,"13388 smartscreen.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591840124409700,,,,,,,158678,,,,,,,,,,,3554393863,140712830631936,140712830631936,110592,,,,,,,,,,,, +"2025-11-19 22:37:20.1247167Z","2025-11-19 22:37:20.1247167Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,,,,,,,1763591840124716700,,,,,,,741046,,,,,,,,,,,2283238626,140712852848640,140712852848640,675840,,,,,,,,,,,, +"2025-11-19 22:37:20.1250862Z","2025-11-19 22:37:20.1250862Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"13388 smartscreen.exe",,,,,,,,,,,,,18446633084027650048,18446633084027625472,140712899206080,0,184868798464,14596,1763591840125086200,184872337408,184872329216,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1253125Z","2025-11-19 22:37:20.1253125Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",14596,,,"13388 smartscreen.exe",,,"C:\Windows\System32\wtdsensor.dll",,,,,,,,,,,,,,,,1763591840125312500,,,,,,,56489,,,,,,,,,,,4237415889,140712681996288,140712681996288,45056,,,,,,,,,,,, +"2025-11-19 22:37:20.1267405Z","2025-11-19 22:37:20.1267405Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,,,,,,,1763591840126740500,,,,,,,783429,,,,,,,,,,,2294669044,140712888041472,140712888041472,720896,,,,,,,,,,,, +"2025-11-19 22:37:20.1275908Z","2025-11-19 22:37:20.1275908Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,,,,,,,,,,,18446633084013084672,18446633084013060096,140712865112144,0,184868806656,13360,1763591840127590800,184872861696,184872853504,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1278602Z","2025-11-19 22:37:20.1278602Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13388 smartscreen.exe",14596,,,"13388 smartscreen.exe",,,,,,,,,,,,,18446633084027764736,18446633084027740160,140712899206080,0,184868814848,6860,1763591840127860200,184873385984,184873377792,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1303812Z","2025-11-19 22:37:20.1303812Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",14596,,,"13388 smartscreen.exe",,,"C:\Windows\System32\smartscreenps.dll",,,,,,,,,,,,,,,,1763591840130381200,,,,,,,151429,,,,,,,,,,,4089359051,140712623865856,140712623865856,122880,,,,,,,,,,,, +"2025-11-19 22:37:20.1319012Z","2025-11-19 22:37:20.1319012Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",14596,,,"13388 smartscreen.exe",,,"C:\Windows\System32\Windows.Management.Workplace.dll",,,,,,,,,,,,,,,,1763591840131901200,,,,,,,215437,,,,,,,,,,,170946563,140712429879296,140712429879296,204800,,,,,,,,,,,, +"2025-11-19 22:37:20.1326328Z","2025-11-19 22:37:20.1326328Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",14596,,,"13388 smartscreen.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591840132632800,,,,,,,769657,,,,,,,,,,,423353507,140712774598656,140712774598656,741376,,,,,,,,,,,, +"2025-11-19 22:37:20.1331654Z","2025-11-19 22:37:20.1331654Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13388 smartscreen.exe",14596,,,"13388 smartscreen.exe",,,,,,,,,,,,,18446633084027478016,18446633084027453440,140711782212992,0,184868823040,11928,1763591840133165400,184873910272,184873902080,140711782212992,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1334794Z","2025-11-19 22:37:20.1334794Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13388 smartscreen.exe",6860,,,"13388 smartscreen.exe",,,,,,,,,,,,,18446633084027736064,18446633084027711488,140712899206080,0,184868831232,8216,1763591840133479400,184874434560,184874426368,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1761396Z","2025-11-19 22:37:20.1761396Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 5184 explorer.exe",15136,,," 5604 attack-890.exe",,,"C:\Users\Public\Downloads\attack-890.exe",,,,,,,,,,,,,,,,1763591840176139600,,,,,134080654410040405,0,0,"0x","","",5184,140,6624,3,0,0,1,1763491559,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1789263Z","2025-11-19 22:37:20.1789263Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",15136,,," 5604 attack-890.exe",,,,,,,,,,,,,18446633084027822080,18446633084027797504,140695618865008,0,867488051200,3452,1763591840178926300,867486007296,867486003200,140695618865008,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1817085Z","2025-11-19 22:37:20.1817085Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5536 svchost.exe",13256,,," 5536 svchost.exe",,,,,,,,,,,,,18446633084027908096,18446633084027883520,140712899206080,132,151912210432,14100,1763591840181708500,151915593728,151915560960,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1844108Z","2025-11-19 22:37:20.1844108Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5536 svchost.exe",13256,,," 5536 svchost.exe",,,,,,,,,,,,,18446633084027879424,18446633084027854848,140712899206080,132,151912218624,2184,1763591840184410800,151916118016,151916085248,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1844961Z","2025-11-19 22:37:20.1844961Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5536 svchost.exe",2184,,," 5536 svchost.exe",,,,,,,,,,,,,18446633084027994112,18446633084027969536,140712899206080,0,151912226816,9180,1763591840184496100,151920836608,151920803840,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1893585Z","2025-11-19 22:37:20.1893585Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Users\Public\Downloads\attack-890.exe",,,,,,,,,,,,,,,,1763591840189358600,,,,,,,0,,,,,,,,,,,1763491559,140695618846720,140695618846720,53248,,,,,,,,,,,, +"2025-11-19 22:37:20.1893886Z","2025-11-19 22:37:20.1893886Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591840189388600,,,,,,,2537167,,,,,,,,,,,2626650689,140712898723840,140712898723840,2523136,,,,,,,,,,,, +"2025-11-19 22:37:20.1901610Z","2025-11-19 22:37:20.1901610Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591840190161000,,,,,,,885660,,,,,,,,,,,2913437033,140712877621248,140712877621248,823296,,,,,,,,,,,, +"2025-11-19 22:37:20.1902585Z","2025-11-19 22:37:20.1902585Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591840190258500,,,,,,,4209945,,,,,,,,,,,2980330054,140712854355968,140712854355968,4161536,,,,,,,,,,,, +"2025-11-19 22:37:20.1912674Z","2025-11-19 22:37:20.1912674Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 5604 attack-890.exe",3452,,,"13300 conhost.exe",,,"C:\Windows\System32\conhost.exe",,,,,,,,,,,,,,,,1763591840191267400,,,,,134080654410205145,0,1035098,"0x","","",5604,6624,6625,3,0,0,1,2671108986,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1924430Z","2025-11-19 22:37:20.1924430Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5604 attack-890.exe",3452,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084027535360,18446633084027510784,140696384751904,0,689119371264,4616,1763591840192443000,689120477184,689120468992,140696384751904,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1947313Z","2025-11-19 22:37:20.1947313Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13300 conhost.exe",4616,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028108800,18446633084028084224,140712899206080,0,689119379456,12308,1763591840194731300,689121001472,689120993280,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1948066Z","2025-11-19 22:37:20.1948066Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13300 conhost.exe",12308,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028137472,18446633084028112896,140712899206080,0,689119387648,3500,1763591840194806600,689121525760,689121517568,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1989205Z","2025-11-19 22:37:20.1989205Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13300 conhost.exe",4616,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028252160,18446633084028227584,140696384580832,0,689119395840,6452,1763591840198920500,689122050048,689122041856,140696384580832,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1990028Z","2025-11-19 22:37:20.1990028Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13300 conhost.exe",3500,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028137472,18446633084028112896,140712899206080,0,689119387648,3500,1763591840199002800,689121525760,689121517568,140712899206080,1810182,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1990139Z","2025-11-19 22:37:20.1990139Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13300 conhost.exe",12308,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028108800,18446633084028084224,140712899206080,0,689119379456,12308,1763591840199013900,689121001472,689120993280,140712899206080,569572,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1991188Z","2025-11-19 22:37:20.1991188Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13300 conhost.exe",4616,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084027535360,18446633084027510784,140696384751904,0,689119371264,4616,1763591840199118900,689120477184,689120460800,140696384751904,22444533,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1994019Z","2025-11-19 22:37:20.1994019Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13300 conhost.exe",6452,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084027535360,18446633084027510784,140712899206080,0,689119404032,10848,1763591840199401900,689120477184,689120468992,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2042774Z","2025-11-19 22:37:20.2042774Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13300 conhost.exe",6452,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028108800,18446633084028084224,140712865112144,0,689119412224,3620,1763591840204277400,689121001472,689120993280,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2044792Z","2025-11-19 22:37:20.2044792Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028137472,18446633084028112896,140712899206080,0,689119420416,14856,1763591840204479200,689121525760,689121517568,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2046406Z","2025-11-19 22:37:20.2046406Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13300 conhost.exe",14856,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028309504,18446633084028284928,140712899206080,0,689119428608,6828,1763591840204640600,689122574336,689122566144,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2084663Z","2025-11-19 22:37:20.2084663Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2992 svchost.exe",8856,,," 2992 svchost.exe",,,,,,,,,,,,,18446633084028338176,18446633084028313600,140712899206080,186,170617454592,14440,1763591840208466300,170615767040,170615734272,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2118325Z","2025-11-19 22:37:20.2118325Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1040 svchost.exe",4480,,," 632 OpenConsole.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\OpenConsole.exe",,,,,,,,,,,,,,,,1763591840211832500,,,,,134080654410427174,3,1210794,"0x","Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe","App",1040,13,6626,3,0,0,1,1759975785,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2124452Z","2025-11-19 22:37:20.2124452Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",4480,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028022784,18446633084027998208,140702989817872,40,696750407680,5408,1763591840212445200,696748802048,696748797952,140702989817872,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2146117Z","2025-11-19 22:37:20.2146117Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1040 svchost.exe",,,,,,,,,,,,,18446633084028366848,18446633084028342272,140712899206080,0,256031023104,9432,1763591840214611700,256033947648,256033914880,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2198977Z","2025-11-19 22:37:20.2198977Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028424192,18446633084028399616,140712899206080,0,696750415872,3864,1763591840219897700,696752537600,696752533504,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2201168Z","2025-11-19 22:37:20.2201168Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028481536,18446633084028456960,140712899206080,0,696750424064,12484,1763591840220116800,696753586176,696753582080,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2202127Z","2025-11-19 22:37:20.2202127Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 632 OpenConsole.exe",12484,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028510208,18446633084028485632,140712899206080,0,696750432256,14384,1763591840220212700,696754634752,696754630656,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2353969Z","2025-11-19 22:37:20.2353969Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028223488,18446633084028198912,140712865112144,0,696750440448,8232,1763591840235396900,696755683328,696755675136,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2356120Z","2025-11-19 22:37:20.2356120Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028538880,18446633084028514304,140712899206080,0,696750448640,14248,1763591840235612000,696756731904,696756727808,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2357894Z","2025-11-19 22:37:20.2357894Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 632 OpenConsole.exe",14248,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028596224,18446633084028571648,140712899206080,0,696750456832,10496,1763591840235789400,696757780480,696757776384,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2599092Z","2025-11-19 22:37:20.2599092Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1040 svchost.exe",4480,,,"13248 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe",,,,,,,,,,,,,,,,1763591840259909200,,,,,134080654410898354,3,738129,"0x","Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe","App",1040,13,6627,3,0,0,1,1759975821,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2605834Z","2025-11-19 22:37:20.2605834Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",4480,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028624896,18446633084028600320,140702319920256,40,932562440192,2344,1763591840260583400,932564697088,932564692992,140702319920256,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2738132Z","2025-11-19 22:37:20.2738132Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028080128,18446633084028055552,140712899206080,0,932562448384,6140,1763591840273813200,932565745664,932565741568,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2742321Z","2025-11-19 22:37:20.2742321Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028682240,18446633084028657664,140712899206080,0,932562456576,3272,1763591840274232100,932566794240,932566790144,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2752392Z","2025-11-19 22:37:20.2752392Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",3272,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028710912,18446633084028686336,140712899206080,0,932562464768,12328,1763591840275239200,932567842816,932567838720,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2876075Z","2025-11-19 22:37:20.2876075Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084010672128,18446633084010647552,140712899206080,0,932562472960,10628,1763591840287607500,932568891392,932568887296,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2899172Z","2025-11-19 22:37:20.2899172Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028739584,18446633084028715008,140712865112144,0,932562481152,11164,1763591840289917200,932569939968,932569931776,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2901850Z","2025-11-19 22:37:20.2901850Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",10628,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028768256,18446633084028743680,140712899206080,0,932562489344,9736,1763591840290185100,932570988544,932570984448,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3093537Z","2025-11-19 22:37:20.3093537Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3204 Taskmgr.exe",5876,,," 3204 Taskmgr.exe",,,,,,,,,,,,,18446633084027248640,18446633084027224064,140712891292720,0,552496762880,15292,1763591840309353700,552499937280,552499929088,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3148892Z","2025-11-19 22:37:20.3148892Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4340 sihost.exe",10460,,," 4340 sihost.exe",,,,,,,,,,,,,18446633084028825600,18446633084028801024,140712899206080,0,645639995392,13916,1763591840314889200,645642321920,645642313728,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3153193Z","2025-11-19 22:37:20.3153193Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029026304,18446633084029001728,140712891292720,0,932562497536,11792,1763591840315319300,932572037120,932572033024,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3206848Z","2025-11-19 22:37:20.3206848Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029173760,18446633084029149184,140712600145104,0,932562505728,7808,1763591840320684800,932573085696,932573081600,140712600145104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3207124Z","2025-11-19 22:37:20.3207124Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028854272,18446633084028829696,140712604173856,0,932562513920,13488,1763591840320712400,932574134272,932574130176,140712604173856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3350748Z","2025-11-19 22:37:20.3350748Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",7808,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029173760,18446633084029149184,140712600145104,0,932562505728,7808,1763591840335074800,932573085696,932573057024,140712600145104,47684873,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3353558Z","2025-11-19 22:37:20.3353558Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029173760,18446633084029149184,140712632221632,0,932562522112,4192,1763591840335355800,932573085696,932573081600,140712632221632,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4409754Z","2025-11-19 22:37:20.4409754Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 632 OpenConsole.exe",14248,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084029116416,18446633084029091840,140702989217024,0,696750465024,8552,1763591840440975400,696758829056,696758824960,140702989217024,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4410144Z","2025-11-19 22:37:20.4410144Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 632 OpenConsole.exe",14248,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028911616,18446633084028887040,140702989233856,0,696750473216,12624,1763591840441014400,696759877632,696759873536,140702989233856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4411382Z","2025-11-19 22:37:20.4411382Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084056907776,18446633084056883200,140712899206080,0,932562530304,13068,1763591840441138200,932575182848,932575178752,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4421089Z","2025-11-19 22:37:20.4421089Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13300 conhost.exe",6452,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084029374464,18446633084029349888,140696385038832,0,689119436800,4352,1763591840442108900,689123098624,689123090432,140696385038832,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4439257Z","2025-11-19 22:37:20.4439257Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028395520,18446633084028370944,140702989086576,0,696750481408,1184,1763591840443925700,696760926208,696760922112,140702989086576,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4452004Z","2025-11-19 22:37:20.4452004Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084029231104,18446633084029206528,140702989404080,0,696750489600,9776,1763591840445200400,696761974784,696761970688,140702989404080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4464556Z","2025-11-19 22:37:20.4464556Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084027793408,18446633084027768832,140712583404848,0,932562538496,4376,1763591840446455600,932576231424,932576227328,140712583404848,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4469069Z","2025-11-19 22:37:20.4469069Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",13068,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029317120,18446633084029292544,140712899206080,0,932562546688,9352,1763591840446906900,932577280000,932577275904,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4800926Z","2025-11-19 22:37:20.4800926Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9388 devenv.exe",6884,,," 9388 devenv.exe",,,,,,,,,,,,,18446633083996995584,18446633083996971008,140712899206080,0,1033377136640,6884,1763591840480092600,1033431941120,1033431932928,140712899206080,158801,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5057422Z","2025-11-19 22:37:20.5057422Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028653568,18446633084028628992,140712865112144,0,932562554880,13692,1763591840505742200,932578328576,932578320384,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5442487Z","2025-11-19 22:37:20.5442487Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029632512,18446633084029607936,140712373211440,0,932562563072,6612,1763591840544248700,932579377152,932579373056,140712373211440,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5443223Z","2025-11-19 22:37:20.5443223Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028882944,18446633084028858368,140712378637616,0,932562571264,6260,1763591840544322300,932580425728,932580421632,140712378637616,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5475582Z","2025-11-19 22:37:20.5475582Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\apphelp.dll",,,,,,,,,,,,,,,,1763591840547558200,,,,,,,675806,,,,,,,,,,,4108425587,140712800485376,140712800485376,651264,,,,,,,,,,,, +"2025-11-19 22:37:20.5478450Z","2025-11-19 22:37:20.5478450Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",6260,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029947904,18446633084029923328,140712899206080,0,932562579456,14632,1763591840547845000,932581474304,932581470208,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5508273Z","2025-11-19 22:37:20.5508273Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591840550827300,,,,,,,761372,,,,,,,,,,,71854833,140712881618944,140712881618944,737280,,,,,,,,,,,, +"2025-11-19 22:37:20.5509553Z","2025-11-19 22:37:20.5509553Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591840550955300,,,,,,,760295,,,,,,,,,,,460960534,140712894529536,140712894529536,692224,,,,,,,,,,,, +"2025-11-19 22:37:20.5510805Z","2025-11-19 22:37:20.5510805Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,,,,,,,,,,,18446633084029747200,18446633084029722624,140712899206080,0,867488059392,5960,1763591840551080500,867490070528,867490066432,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5511743Z","2025-11-19 22:37:20.5511743Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591840551174300,,,,,,,716301,,,,,,,,,,,3291623140,140712863203328,140712863203328,679936,,,,,,,,,,,, +"2025-11-19 22:37:20.5513846Z","2025-11-19 22:37:20.5513846Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591840551384600,,,,,,,1193108,,,,,,,,,,,4275633056,140712897216512,140712897216512,1146880,,,,,,,,,,,, +"2025-11-19 22:37:20.5515459Z","2025-11-19 22:37:20.5515459Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5604 attack-890.exe",5960,,," 5604 attack-890.exe",,,,,,,,,,,,,18446633084029718528,18446633084029693952,140712899206080,0,867488067584,8672,1763591840551545900,867491119104,867491115008,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5515805Z","2025-11-19 22:37:20.5515805Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591840551580500,,,,,,,1436013,,,,,,,,,,,1441720767,140712859467776,140712859467776,1355776,,,,,,,,,,,, +"2025-11-19 22:37:20.5516458Z","2025-11-19 22:37:20.5516458Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5604 attack-890.exe",8672,,," 5604 attack-890.exe",,,,,,,,,,,,,18446633084029460480,18446633084029435904,140712899206080,0,867488075776,12460,1763591840551645800,867492167680,867492163584,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5518883Z","2025-11-19 22:37:20.5518883Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",8672,,," 5604 attack-890.exe",,,"C:\Windows\System32\msvcp140.dll",,,,,,,,,,,,,,,,1763591840551888300,,,,,,,570439,,,,,,,,,,,1564323704,140711213137920,140711213137920,561152,,,,,,,,,,,, +"2025-11-19 22:37:20.5518888Z","2025-11-19 22:37:20.5518888Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",12460,,," 5604 attack-890.exe",,,"C:\Windows\System32\vcruntime140.dll",,,,,,,,,,,,,,,,1763591840551888800,,,,,,,146072,,,,,,,,,,,254123393,140712353988608,140712353988608,122880,,,,,,,,,,,, +"2025-11-19 22:37:20.5518982Z","2025-11-19 22:37:20.5518982Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\vcruntime140_1.dll",,,,,,,,,,,,,,,,1763591840551898200,,,,,,,57827,,,,,,,,,,,240324076,140712354119680,140712354119680,49152,,,,,,,,,,,, +"2025-11-19 22:37:21.377891300Z","2025-11-19 22:37:20.5537813Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Injector started with PID 5604",,,,,,,,,,,,,,,,,1763591840553781300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.6045242Z","2025-11-19 22:37:20.6045242Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",10628,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029546496,18446633084029521920,140712899206080,0,932562587648,3424,1763591840604524200,932582522880,932582518784,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.6242698Z","2025-11-19 22:37:20.6242698Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028968960,18446633084028944384,140712899206080,0,932562595840,14684,1763591840624269800,932583571456,932583567360,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.6245269Z","2025-11-19 22:37:20.6245269Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",14684,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029976576,18446633084029952000,140712899206080,0,932562604032,13344,1763591840624526900,932584620032,932584615936,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.6247078Z","2025-11-19 22:37:20.6247078Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",13344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084030005248,18446633084029980672,140712899206080,0,932562612224,6564,1763591840624707800,932585668608,932585664512,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.6252373Z","2025-11-19 22:37:20.6252373Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",6564,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084030033920,18446633084030009344,140712899206080,0,932562620416,12924,1763591840625237300,932586717184,932586713088,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.6254041Z","2025-11-19 22:37:20.6254041Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",12924,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084030062592,18446633084030038016,140712899206080,0,932562628608,13704,1763591840625404100,932587765760,932587761664,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:21.477249300Z","2025-11-19 22:37:20.6551680Z","myETW","EDRi-Provider",4242,"EDRiTask"," 7508 EDRi.exe",,,,,,"After starting the attack exe",,,,,,,,,,,,,,,,,1763591840655168000,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.6886346Z","2025-11-19 22:37:20.6886346Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4392 MsMpEng.exe",5064,,," 4392 MsMpEng.exe",,,,,,,,,,,,,18446633084030177280,18446633084030152704,140712899206080,247,389820030976,14760,1763591840688634600,389842731008,389842665472,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.6886949Z","2025-11-19 22:37:20.6886949Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4392 MsMpEng.exe",5064,,," 4392 MsMpEng.exe",,,,,,,,,,,,,18446633084030205952,18446633084030181376,140712647800224,247,389820039168,8032,1763591840688695000,389849022464,389848956928,140712647800224,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.6889335Z","2025-11-19 22:37:20.6889335Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4392 MsMpEng.exe",14760,,," 4392 MsMpEng.exe",,,,,,,,,,,,,18446633084030263296,18446633084030238720,140712899206080,0,389820047360,4232,1763591840688933500,389849546752,389849481216,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.7236916Z","2025-11-19 22:37:20.7236916Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4392 MsMpEng.exe",8032,,," 4392 MsMpEng.exe",,,,,,,,,,,,,18446633084030205952,18446633084030181376,140712647800224,247,389820039168,8032,1763591840723691600,389849022464,389848956928,140712647800224,428874,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.7244852Z","2025-11-19 22:37:20.7244852Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3492 svchost.exe",5904,,," 3492 svchost.exe",,,,,,,,,,,,,18446633084030492672,18446633084030468096,140712850417280,51,390180667392,11232,1763591840724485200,390182993920,390182961152,140712850417280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.8298783Z","2025-11-19 22:37:20.8298783Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 9692 PerfWatson2.exe",9752,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084030607360,18446633084030582784,140711612509856,0,1046354423808,12036,1763591840829878300,1046352232448,1046352216064,140711612509856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:21.1973315Z","2025-11-19 22:37:21.1973315Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9920 ServiceHub.IntellicodeModelService.exe",4196,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,18446633084027449344,18446633084027424768,140711612509856,0,46015676416,4196,1763591841197331500,46012694528,46012678144,140711612509856,1084450,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.337559700Z","2025-11-19 22:37:21.5329408Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Running 'standard' config",,,,,,,,,,,,,,,,,1763591841532940800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.337798100Z","2025-11-19 22:37:21.5331820Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Before starting subprocess to inject to",,,,,,,,,,,,,,,,,1763591841533182000,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:21.5339696Z","2025-11-19 22:37:21.5339696Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 5604 attack-890.exe",3452,,," 7284 whoami.exe",,,"C:\Windows\System32\whoami.exe",,,,,,,,,,,,,,,,1763591841533969600,,,,,134080654423385232,0,160109,"0x","","",5604,6624,6628,3,0,0,1,3602411345,,,,,,,,,,,,,,, +"2025-11-19 22:37:21.5373410Z","2025-11-19 22:37:21.5373410Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5604 attack-890.exe",3452,,," 7284 whoami.exe",,,,,,,,,,,,,18446633084031127552,18446633084031102976,140702344617136,0,705865940992,14048,1763591841537341000,705864925184,705864916992,140702344617136,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.345203800Z","2025-11-19 22:37:21.5407378Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"After starting subprocess with PID 7284",,,,,,,,,,,,,,,,,1763591841540737800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:21.6656904Z","2025-11-19 22:37:21.6656904Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8972 VBoxTray.exe",9020,,," 8972 VBoxTray.exe",,,,,,,,,,,,,18446633084031156224,18446633084031131648,140700131109808,0,471283195904,13812,1763591841665690400,471299260416,471299256320,140700131109808,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:21.6659145Z","2025-11-19 22:37:21.6659145Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8972 VBoxTray.exe",13812,,," 8972 VBoxTray.exe",,,,,,,,,,,,,18446633084031156224,18446633084031131648,140700131109808,0,471283195904,13812,1763591841665914500,471299260416,471299252224,140700131109808,462070,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:21.7818665Z","2025-11-19 22:37:21.7818665Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5884 SearchProtocolHost.exe",2628,,," 5884 SearchProtocolHost.exe",,,,,,,,,,,,,18446633084030406656,18446633084030382080,140712899206080,0,100230713344,14588,1763591841781866500,100232331264,100232298496,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.1405740Z","2025-11-19 22:37:22.1405740Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","12492 vcpkgsrv.exe",5660,,,"12492 vcpkgsrv.exe",,,,,,,,,,,,,18446633083994841088,18446633083994816512,1996775712,0,2646016,5660,1763591842140574000,82115456,82083840,1996775712,8294629,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.1405740Z","2025-11-19 22:37:22.1405740Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","12492 vcpkgsrv.exe",11756,,,"12492 vcpkgsrv.exe",,,,,,,,,,,,,18446633083994554368,18446633083994529792,1996775712,0,2678784,11756,1763591842140574000,82639744,82608128,1996775712,7370867,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.1405831Z","2025-11-19 22:37:22.1405831Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","12492 vcpkgsrv.exe",12180,,,"12492 vcpkgsrv.exe",,,,,,,,,,,,,18446633083994812416,18446633083994787840,1996775712,0,2662400,12180,1763591842140583100,82377600,82345984,1996775712,6546307,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.1562316Z","2025-11-19 22:37:22.1562316Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6836 vcpkgsrv.exe",7868,,," 6836 vcpkgsrv.exe",,,,,,,,,,,,,18446633083994869760,18446633083994845184,1996775712,0,3006464,7868,1763591842156231600,92011392,91979776,1996775712,9602384,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.1562444Z","2025-11-19 22:37:22.1562444Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6836 vcpkgsrv.exe",9036,,," 6836 vcpkgsrv.exe",,,,,,,,,,,,,18446633083993722880,18446633083993698304,1996775712,0,2990080,9036,1763591842156244400,87554944,87523328,1996775712,7058542,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.1562554Z","2025-11-19 22:37:22.1562554Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6836 vcpkgsrv.exe",5384,,," 6836 vcpkgsrv.exe",,,,,,,,,,,,,18446633083994296320,18446633083994271744,1996775712,0,2973696,5384,1763591842156255400,81066880,81035264,1996775712,4502262,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.3316961Z","2025-11-19 22:37:22.3316961Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",12036,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084030607360,18446633084030582784,140711612509856,0,1046354423808,12036,1763591842331696100,1046352232448,1046352216064,140711612509856,931306,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:23.308564200Z","2025-11-19 22:37:22.5236651Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Before opening process handle",,,,,,,,,,,,,,,,,1763591842523665100,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:23.308868400Z","2025-11-19 22:37:22.5239746Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"After opening process handle",,,,,,,,,,,,,,,,,1763591842523974600,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.8295591Z","2025-11-19 22:37:22.8295591Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 9388 devenv.exe",9392,,," 9388 devenv.exe",,,,,,,,,,,,,18446633084031385600,18446633084031361024,140711613062896,0,1033377177600,7724,1763591842829559100,1033415163904,1033415155712,140711613062896,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.8335220Z","2025-11-19 22:37:22.8335220Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9388 devenv.exe",7724,,," 9388 devenv.exe",,,,,,,,,,,,,18446633084031385600,18446633084031361024,140711613062896,0,1033377177600,7724,1763591842833522000,1033415163904,1033415143424,140711613062896,14353592,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:24.262849900Z","2025-11-19 22:37:23.4973313Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Before allocating memory for shellcode",,,,,,,,,,,,,,,,,1763591843497331300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:24.263130400Z","2025-11-19 22:37:23.4976143Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"After allocating memory for shellcode at 00000249213E0000",,,,,,,,,,,,,,,,,1763591843497614300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:25.227755400Z","2025-11-19 22:37:24.4818310Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Before writing shellcode to process",,,,,,,,,,,,,,,,,1763591844481831000,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:25.228060100Z","2025-11-19 22:37:24.4821409Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"After writing shellcode to process at 00000249213E0000",,,,,,,,,,,,,,,,,1763591844482140900,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:25.2014730Z","2025-11-19 22:37:25.2014730Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5184 explorer.exe",15136,,," 5184 explorer.exe",,,,,,,,,,,,,18446633084027592704,18446633084027568128,140712891545280,0,15360000,15136,1763591845201473000,470351872,470294528,140712891545280,63346597,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:25.3923641Z","2025-11-19 22:37:25.3923641Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","10404 NisSrv.exe",4312,,,"10404 NisSrv.exe",,,,,,,,,,,,,18446633083999313920,18446633083999289344,140712899206080,0,792924913664,4312,1763591845392364100,792924389376,792924323840,140712899206080,494887,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:25.3923667Z","2025-11-19 22:37:25.3923667Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3604 dllhost.exe",11476,,," 3604 dllhost.exe",,,,,,,,,,,,,18446633083999285248,18446633083999260672,140712899206080,0,256852123648,11476,1763591845392366700,256853934080,256853901312,140712899206080,241408,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.182844300Z","2025-11-19 22:37:25.4563155Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Before changing memory protection to PAGE_EXECUTE_READ",,,,,,,,,,,,,,,,,1763591845456315500,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.183142300Z","2025-11-19 22:37:25.4566185Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"After changing memory protection to PAGE_EXECUTE_READ",,,,,,,,,,,,,,,,,1763591845456618500,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:25.6312786Z","2025-11-19 22:37:25.6312786Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3232 dllhost.exe",8960,,," 3232 dllhost.exe",,,,,,,,,,,,,18446633084035751936,18446633084035727360,140712899206080,0,493780983808,8960,1763591845631278600,493783875584,493783842816,140712899206080,221416,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4082033Z","2025-11-19 22:37:26.4082033Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"10404 NisSrv.exe",,,,,,,,,,,,,18446633083999313920,18446633083999289344,140712899206080,0,792924921856,6856,1763591846408203300,792924389376,792924323840,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4083766Z","2025-11-19 22:37:26.4083766Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3604 dllhost.exe",,,,,,,,,,,,,18446633084031959040,18446633084031934464,140712899206080,0,256852131840,8832,1763591846408376600,256853934080,256853901312,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.147034500Z","2025-11-19 22:37:26.4400898Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Before reading memory to verify write",,,,,,,,,,,,,,,,,1763591846440089800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.147308700Z","2025-11-19 22:37:26.4403653Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Before creating remote thread",,,,,,,,,,,,,,,,,1763591846440365300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4406187Z","2025-11-19 22:37:26.4406187Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5604 attack-890.exe",3452,,," 7284 whoami.exe",,,,,,,,,,,,,18446633084031987712,18446633084031963136,2513113579520,0,705865949184,14412,1763591846440618700,705865449472,705865441280,2513113579520,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.147575800Z","2025-11-19 22:37:26.4406370Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"After creating remote thread",,,,,,,,,,,,,,,,,1763591846440637000,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4407225Z","2025-11-19 22:37:26.4407225Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\whoami.exe",,,,,,,,,,,,,,,,1763591846440722500,,,,,,,160109,,,,,,,,,,,3602411345,140702344609792,140702344609792,98304,,,,,,,,,,,, +"2025-11-19 22:37:26.4407621Z","2025-11-19 22:37:26.4407621Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591846440762100,,,,,,,2537167,,,,,,,,,,,2626650689,140712898723840,140712898723840,2523136,,,,,,,,,,,, +"2025-11-19 22:37:26.4441987Z","2025-11-19 22:37:26.4441987Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591846444198700,,,,,,,885660,,,,,,,,,,,2913437033,140712877621248,140712877621248,823296,,,,,,,,,,,, +"2025-11-19 22:37:26.4443217Z","2025-11-19 22:37:26.4443217Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591846444321700,,,,,,,4209945,,,,,,,,,,,2980330054,140712854355968,140712854355968,4161536,,,,,,,,,,,, +"2025-11-19 22:37:26.4457000Z","2025-11-19 22:37:26.4457000Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\apphelp.dll",,,,,,,,,,,,,,,,1763591846445700000,,,,,,,675806,,,,,,,,,,,4108425587,140712800485376,140712800485376,651264,,,,,,,,,,,, +"2025-11-19 22:37:26.4474777Z","2025-11-19 22:37:26.4474777Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591846447477700,,,,,,,761372,,,,,,,,,,,71854833,140712881618944,140712881618944,737280,,,,,,,,,,,, +"2025-11-19 22:37:26.4475785Z","2025-11-19 22:37:26.4475785Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591846447578500,,,,,,,760295,,,,,,,,,,,460960534,140712894529536,140712894529536,692224,,,,,,,,,,,, +"2025-11-19 22:37:26.4476640Z","2025-11-19 22:37:26.4476640Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,,,,,,,,,,,18446633084032073728,18446633084032049152,140712899206080,0,705865957376,2340,1763591846447664000,705868333056,705868324864,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4477295Z","2025-11-19 22:37:26.4477295Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591846447729500,,,,,,,716301,,,,,,,,,,,3291623140,140712863203328,140712863203328,679936,,,,,,,,,,,, +"2025-11-19 22:37:26.4479501Z","2025-11-19 22:37:26.4479501Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591846447950100,,,,,,,1193108,,,,,,,,,,,4275633056,140712897216512,140712897216512,1146880,,,,,,,,,,,, +"2025-11-19 22:37:26.4481009Z","2025-11-19 22:37:26.4481009Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 7284 whoami.exe",2340,,," 7284 whoami.exe",,,,,,,,,,,,,18446633084032102400,18446633084032077824,140712899206080,0,705865965568,10456,1763591846448100900,705868857344,705868849152,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4481023Z","2025-11-19 22:37:26.4481023Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591846448102300,,,,,,,1923284,,,,,,,,,,,675224942,140712888827904,140712888827904,1863680,,,,,,,,,,,, +"2025-11-19 22:37:26.4483317Z","2025-11-19 22:37:26.4483317Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591846448331700,,,,,,,230350,,,,,,,,,,,2551303736,140712858550272,140712858550272,159744,,,,,,,,,,,, +"2025-11-19 22:37:26.4484701Z","2025-11-19 22:37:26.4484701Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591846448470100,,,,,,,230873,,,,,,,,,,,527442843,140712882405376,140712882405376,176128,,,,,,,,,,,, +"2025-11-19 22:37:26.4485775Z","2025-11-19 22:37:26.4485775Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591846448577500,,,,,,,1243850,,,,,,,,,,,792084382,140712861433856,140712861433856,1228800,,,,,,,,,,,, +"2025-11-19 22:37:26.4486883Z","2025-11-19 22:37:26.4486883Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591846448688300,,,,,,,700029,,,,,,,,,,,3371602543,140712858746880,140712858746880,667648,,,,,,,,,,,, +"2025-11-19 22:37:26.4487781Z","2025-11-19 22:37:26.4487781Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591846448778100,,,,,,,1436013,,,,,,,,,,,1441720767,140712859467776,140712859467776,1355776,,,,,,,,,,,, +"2025-11-19 22:37:26.4489528Z","2025-11-19 22:37:26.4489528Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 7284 whoami.exe",10456,,," 7284 whoami.exe",,,,,,,,,,,,,18446633084032131072,18446633084032106496,140712899206080,0,705865973760,14716,1763591846448952800,705869381632,705869373440,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4489859Z","2025-11-19 22:37:26.4489859Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\ws2_32.dll",,,,,,,,,,,,,,,,1763591846448985900,,,,,,,513405,,,,,,,,,,,3967481067,140712881094656,140712881094656,475136,,,,,,,,,,,, +"2025-11-19 22:37:26.4490753Z","2025-11-19 22:37:26.4490753Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4392 MsMpEng.exe",4916,,," 4392 MsMpEng.exe",,,,,,,,,,,,,18446633084032159744,18446633084032135168,140712899206080,0,389820055552,1844,1763591846449075300,389849022464,389848956928,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4493466Z","2025-11-19 22:37:26.4493466Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",10456,,," 7284 whoami.exe",,,"C:\Windows\System32\version.dll",,,,,,,,,,,,,,,,1763591846449346600,,,,,,,72452,,,,,,,,,,,2275202464,140712753168384,140712753168384,45056,,,,,,,,,,,, +"2025-11-19 22:37:26.4493531Z","2025-11-19 22:37:26.4493531Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14716,,," 7284 whoami.exe",,,"C:\Windows\System32\authz.dll",,,,,,,,,,,,,,,,1763591846449353100,,,,,,,372179,,,,,,,,,,,771731569,140712826241024,140712826241024,327680,,,,,,,,,,,, +"2025-11-19 22:37:26.4493680Z","2025-11-19 22:37:26.4493680Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\wkscli.dll",,,,,,,,,,,,,,,,1763591846449368000,,,,,,,170846,,,,,,,,,,,1225555544,140712738291712,140712738291712,110592,,,,,,,,,,,, +"2025-11-19 22:37:26.4494965Z","2025-11-19 22:37:26.4494965Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",2340,,," 7284 whoami.exe",,,"C:\Windows\System32\sspicli.dll",,,,,,,,,,,,,,,,1763591846449496500,,,,,,,339222,,,,,,,,,,,3030302172,140712833384448,140712833384448,299008,,,,,,,,,,,, +"2025-11-19 22:37:26.4498152Z","2025-11-19 22:37:26.4498152Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",10456,,," 7284 whoami.exe",,,"C:\Windows\System32\netutils.dll",,,,,,,,,,,,,,,,1763591846449815200,,,,,,,80696,,,,,,,,,,,865845000,140712825847808,140712825847808,53248,,,,,,,,,,,, +"2025-11-19 22:37:26.4515038Z","2025-11-19 22:37:26.4515038Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,,,,,,,1763591846451503800,,,,,,,233556,,,,,,,,,,,1625678811,140712882601984,140712882601984,200704,,,,,,,,,,,, +"2025-11-19 22:37:26.4541760Z","2025-11-19 22:37:26.4541760Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 7284 whoami.exe",14412,,," 3812 calc.exe",,,"C:\Windows\System32\calc.exe",,,,,,,,,,,,,,,,1763591846454176000,,,,,134080654471607920,0,90741,"0x","","",7284,6628,6629,3,0,0,1,4001445627,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4568912Z","2025-11-19 22:37:26.4568912Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 7284 whoami.exe",14412,,," 3812 calc.exe",,,,,,,,,,,,,18446633084032245760,18446633084032221184,140696878126912,0,801455390720,10660,1763591846456891200,801453899776,801453891584,140696878126912,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4644282Z","2025-11-19 22:37:26.4644282Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3812 calc.exe",10660,,," 3812 calc.exe",,,,,,,,,,,,,18446633084032274432,18446633084032249856,140712899206080,0,801455398912,7976,1763591846464428200,801456521216,801456513024,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4645279Z","2025-11-19 22:37:26.4645279Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3812 calc.exe",7976,,," 3812 calc.exe",,,,,,,,,,,,,18446633084032331776,18446633084032307200,140712899206080,0,801455407104,14584,1763591846464527900,801457045504,801457037312,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4650967Z","2025-11-19 22:37:26.4650967Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3812 calc.exe",14584,,," 3812 calc.exe",,,,,,,,,,,,,18446633084032389120,18446633084032364544,140712899206080,0,801455415296,6196,1763591846465096700,801457569792,801457561600,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4718323Z","2025-11-19 22:37:26.4718323Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3812 calc.exe",10660,,," 3812 calc.exe",,,,,,,,,,,,,18446633084032417792,18446633084032393216,140712891545280,0,801455423488,6204,1763591846471832300,801458094080,801458085888,140712891545280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4722524Z","2025-11-19 22:37:26.4722524Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 7284 whoami.exe",14716,,," 7284 whoami.exe",,,,,,,,,,,,,18446633084032131072,18446633084032106496,140712899206080,0,705865973760,14716,1763591846472252400,705869381632,705869373440,140712899206080,2406535,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4722566Z","2025-11-19 22:37:26.4722566Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 7284 whoami.exe",2340,,," 7284 whoami.exe",,,,,,,,,,,,,18446633084032073728,18446633084032049152,140712899206080,0,705865957376,2340,1763591846472256600,705868333056,705868320768,140712899206080,4734616,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4722886Z","2025-11-19 22:37:26.4722886Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 7284 whoami.exe",10456,,," 7284 whoami.exe",,,,,,,,,,,,,18446633084032102400,18446633084032077824,140712899206080,0,705865965568,10456,1763591846472288600,705868857344,705868849152,140712899206080,4410225,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4723088Z","2025-11-19 22:37:26.4723088Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 7284 whoami.exe",14048,,," 7284 whoami.exe",,,,,,,,,,,,,18446633084031127552,18446633084031102976,140702344617136,0,705865940992,14048,1763591846472308800,705864925184,705864916992,140702344617136,41492,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4728396Z","2025-11-19 22:37:26.4728396Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 700 lsass.exe",1344,,," 700 lsass.exe",,,,,,,,,,,,,18446633084031127552,18446633084031102976,140712899206080,0,81706905600,12956,1763591846472839600,81709760512,81709711360,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4748159Z","2025-11-19 22:37:26.4748159Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1016 services.exe",2816,,," 5784 svchost.exe",,,"C:\Windows\System32\svchost.exe",,,,,,,,,,,,,,,,1763591846474815900,,,,,134080654471810362,0,143552,"0x","","",1016,11,6630,1,1,0,0,14788416,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4754583Z","2025-11-19 22:37:26.4754583Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1016 services.exe",2816,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084032217088,18446633084032192512,140696171073504,0,513414782976,14348,1763591846475458300,513413939200,513413922816,140696171073504,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4816419Z","2025-11-19 22:37:26.4816419Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5784 svchost.exe",14348,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084032102400,18446633084032077824,140712899206080,0,513414791168,12200,1763591846481641900,513416888320,513416855552,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4835328Z","2025-11-19 22:37:26.4835328Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1016 services.exe",,,,,,,,,,,,,18446633084032073728,18446633084032049152,140712899206080,0,156998295552,6816,1763591846483532800,156996403200,156996370432,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4837740Z","2025-11-19 22:37:26.4837740Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084032131072,18446633084032106496,140712899206080,0,513414799360,5288,1763591846483774000,513417412608,513417379840,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4839041Z","2025-11-19 22:37:26.4839041Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5784 svchost.exe",14348,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084032503808,18446633084032479232,140712863364608,0,513414807552,8604,1763591846483904100,513417936896,513417904128,140712863364608,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4844347Z","2025-11-19 22:37:26.4844347Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5784 svchost.exe",12200,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084032532480,18446633084032507904,140712899206080,0,513414815744,2748,1763591846484434700,513418461184,513418428416,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4845003Z","2025-11-19 22:37:26.4845003Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5784 svchost.exe",2748,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084032589824,18446633084032565248,140712899206080,0,513414823936,8772,1763591846484500300,513418985472,513418952704,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4877533Z","2025-11-19 22:37:26.4877533Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5784 svchost.exe",8604,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084032618496,18446633084032593920,140712378178112,243,513414832128,3068,1763591846487753300,513419509760,513419476992,140712378178112,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4882101Z","2025-11-19 22:37:26.4882101Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5784 svchost.exe",8604,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084032675840,18446633084032651264,140712378080832,243,513414840320,14092,1763591846488210100,513420034048,513420001280,140712378080832,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4883853Z","2025-11-19 22:37:26.4883853Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5784 svchost.exe",8604,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084032503808,18446633084032479232,140712863364608,0,513414807552,8604,1763591846488385300,513417936896,513417904128,140712863364608,9893579,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4969809Z","2025-11-19 22:37:26.4969809Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 5784 svchost.exe",5288,,,"13020 WerFault.exe",,,"C:\Windows\System32\WerFault.exe",,,,,,,,,,,,,,,,1763591846496980900,,,,,134080654472027581,0,681036,"0x","","",5784,6630,6631,1,1,0,0,630084362,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4984170Z","2025-11-19 22:37:26.4984170Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5784 svchost.exe",5288,,,"13020 WerFault.exe",,,,,,,,,,,,,18446633084032704512,18446633084032679936,140702556693600,243,4297187328,14996,1763591846498417000,4295491584,4295483392,140702556693600,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5034888Z","2025-11-19 22:37:26.5034888Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",13052,,," 1040 svchost.exe",,,,,,,,,,,,,18446633084032733184,18446633084032708608,140712899206080,0,256031031296,8500,1763591846503488800,256034471936,256034439168,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5037125Z","2025-11-19 22:37:26.5037125Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",8500,,," 1040 svchost.exe",,,,,,,,,,,,,18446633084032790528,18446633084032765952,140712899206080,0,256031047680,12540,1763591846503712500,256035520512,256035487744,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5037392Z","2025-11-19 22:37:26.5037392Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1016 services.exe",2816,,," 1016 services.exe",,,,,,,,,,,,,18446633084032819200,18446633084032794624,140712899206080,0,156998303744,11304,1763591846503739200,156999614464,156999581696,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5038480Z","2025-11-19 22:37:26.5038480Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,,,,,,,,,,,18446633084032847872,18446633084032823296,140712899206080,0,4297195520,9800,1763591846503848000,4296015872,4296007680,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5039283Z","2025-11-19 22:37:26.5039283Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13020 WerFault.exe",9800,,,"13020 WerFault.exe",,,,,,,,,,,,,18446633084032876544,18446633084032851968,140712899206080,0,4297203712,8392,1763591846503928300,4296540160,4296531968,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5042908Z","2025-11-19 22:37:26.5042908Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084032966656,18446633084032942080,140712899206080,0,513414848512,14268,1763591846504290800,513417936896,513417904128,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5044925Z","2025-11-19 22:37:26.5044925Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13020 WerFault.exe",8392,,,"13020 WerFault.exe",,,,,,,,,,,,,18446633084033167360,18446633084033142784,140712899206080,0,4297211904,11612,1763591846504492500,4297064448,4297056256,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5050066Z","2025-11-19 22:37:26.5050066Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3812 calc.exe",6204,,," 3812 calc.exe",,,,,,,,,,,,,18446633084033224704,18446633084033200128,140712865112144,0,801455431680,2088,1763591846505006600,801458618368,801458610176,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5052250Z","2025-11-19 22:37:26.5052250Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3812 calc.exe",,,,,,,,,,,,,18446633084033310720,18446633084033286144,140712899206080,0,801455439872,652,1763591846505225000,801459142656,801459134464,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5053978Z","2025-11-19 22:37:26.5053978Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3812 calc.exe",652,,," 3812 calc.exe",,,,,,,,,,,,,18446633084033368064,18446633084033343488,140712899206080,0,801455448064,3100,1763591846505397800,801459666944,801459658752,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5152530Z","2025-11-19 22:37:26.5152530Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1984 svchost.exe",12532,,," 1984 svchost.exe",,,,,,,,,,,,,18446633084033511424,18446633084033486848,140712899206080,210,1068662685696,5024,1763591846515253000,1068666191872,1068666159104,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5170650Z","2025-11-19 22:37:26.5170650Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",9432,,," 1040 svchost.exe",,,,,,,,,,,,,18446633084033568768,18446633084033544192,140712899206080,0,256031055872,4220,1763591846517065000,256037617664,256037584896,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5171078Z","2025-11-19 22:37:26.5171078Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2228 svchost.exe",14732,,," 2228 svchost.exe",,,,,,,,,,,,,18446633084033626112,18446633084033601536,140712899206080,191,717848268800,12692,1763591846517107800,717850935296,717850902528,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5196294Z","2025-11-19 22:37:26.5196294Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084033712128,18446633084033687552,140712899206080,0,199841259520,8664,1763591846519629400,199839318016,199839309824,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5198874Z","2025-11-19 22:37:26.5198874Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",8664,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084033798144,18446633084033773568,140712899206080,0,199841267712,14376,1763591846519887500,199842856960,199842848768,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5199855Z","2025-11-19 22:37:26.5199855Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",8664,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084033912832,18446633084033888256,140712891545280,0,199841275904,8260,1763591846519985500,199843381248,199843373056,140712891545280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5201152Z","2025-11-19 22:37:26.5201152Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4340 sihost.exe",1696,,," 4340 sihost.exe",,,,,,,,,,,,,18446633084034056192,18446633084034031616,140712899206080,0,645640011776,7292,1763591846520115200,645644943360,645644935168,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5204931Z","2025-11-19 22:37:26.5204931Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4404 svchost.exe",4644,,," 4404 svchost.exe",,,,,,,,,,,,,18446633084034170880,18446633084034146304,140712865112144,98,679905755136,9140,1763591846520493100,679908737024,679908704256,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5211322Z","2025-11-19 22:37:26.5211322Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",14912,,," 6028 svchost.exe",,,,,,,,,,,,,18446633084034314240,18446633084034289664,140712899206080,5,661507424256,14032,1763591846521132200,661510422528,661510389760,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5222504Z","2025-11-19 22:37:26.5222504Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4404 svchost.exe",5524,,," 4404 svchost.exe",,,,,,,,,,,,,18446633084034371584,18446633084034347008,140712899206080,0,679905763328,1300,1763591846522250400,679909261312,679909228544,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5234656Z","2025-11-19 22:37:26.5234656Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13020 WerFault.exe",11612,,,"13020 WerFault.exe",,,,,,,,,,,,,18446633084033167360,18446633084033142784,140712899206080,0,4297211904,11612,1763591846523465600,4297064448,4297056256,140712899206080,6532729,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5234671Z","2025-11-19 22:37:26.5234671Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13020 WerFault.exe",8392,,,"13020 WerFault.exe",,,,,,,,,,,,,18446633084032876544,18446633084032851968,140712899206080,0,4297203712,8392,1763591846523467100,4296540160,4296523776,140712899206080,8081892,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5234695Z","2025-11-19 22:37:26.5234695Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13020 WerFault.exe",9800,,,"13020 WerFault.exe",,,,,,,,,,,,,18446633084032847872,18446633084032823296,140712899206080,0,4297195520,9800,1763591846523469500,4296015872,4296007680,140712899206080,7302586,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5237811Z","2025-11-19 22:37:26.5237811Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",8260,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084032847872,18446633084032823296,140712865112144,0,199841284096,7648,1763591846523781100,199843905536,199843897344,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5240969Z","2025-11-19 22:37:26.5240969Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",8260,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084033167360,18446633084033142784,140712891292720,0,199841292288,4796,1763591846524096900,199844429824,199844421632,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5242561Z","2025-11-19 22:37:26.5242561Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,,,,,,,,,,,18446633084032704512,18446633084032679936,140702556693600,0,4297187328,14996,1763591846524256100,4295491584,4295450624,140702556693600,79585807,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5244263Z","2025-11-19 22:37:26.5244263Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",8260,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084032016384,18446633084031991808,140712891292720,0,199841300480,13628,1763591846524426300,199844954112,199844945920,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5248036Z","2025-11-19 22:37:26.5248036Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"WerFault.exe",,,,,,,,,,,,,,,,1763591846524803600,,,,,134080654472027581,,,,,,,,6631,,,,,,,,,1810432,1847296,101743666,0,134080654472296792,64,0,1,5,1,0,0 +"2025-11-19 22:37:26.5251511Z","2025-11-19 22:37:26.5251511Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",14376,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084034457600,18446633084034433024,140712899206080,0,199841308672,13944,1763591846525151100,199845478400,199845470208,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5272308Z","2025-11-19 22:37:26.5272308Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",14376,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084032704512,18446633084032679936,140712899206080,0,199841316864,8372,1763591846527230900,199846002688,199845994496,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5282052Z","2025-11-19 22:37:26.5282052Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",8260,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084032045056,18446633084032020480,140712899206080,0,199841325056,14436,1763591846528205200,199846526976,199846518784,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5284531Z","2025-11-19 22:37:26.5284531Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",8260,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084034629632,18446633084034605056,140712899206080,0,199841333248,11504,1763591846528453100,199847051264,199847043072,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5292181Z","2025-11-19 22:37:26.5292181Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",14912,,," 2456 Memory Compression",,,,,,,,,,,,,18446633084034801664,18446633084034777088,18446735306729542320,0,0,9992,1763591846529218100,0,0,18446735306729542320,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5292346Z","2025-11-19 22:37:26.5292346Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",14912,,," 2456 Memory Compression",,,,,,,,,,,,,18446633084034973696,18446633084034949120,18446735306729542320,0,0,13288,1763591846529234700,0,0,18446735306729542320,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5292738Z","2025-11-19 22:37:26.5292738Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",14912,,," 2456 Memory Compression",,,,,,,,,,,,,18446633084035002368,18446633084034977792,18446735306728238208,0,0,12392,1763591846529273800,0,0,18446735306728238208,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5293277Z","2025-11-19 22:37:26.5293277Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",14912,,," 2456 Memory Compression",,,,,,,,,,,,,18446633084035031040,18446633084035006464,18446735306729822480,0,0,13828,1763591846529327700,0,0,18446735306729822480,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5295885Z","2025-11-19 22:37:26.5295885Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 6028 svchost.exe",14912,,,"14660 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe\CalculatorApp.exe",,,,,,,,,,,,,,,,1763591846529588500,,,,,134080654472346829,3,0,"0x","Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe","App",4340,106,6633,3,0,0,1,1758293941,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5305120Z","2025-11-19 22:37:26.5305120Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",14912,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084035059712,18446633084035035136,140700165242880,5,61841813504,11616,1763591846530512000,61843963904,61843959808,140700165242880,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5393979Z","2025-11-19 22:37:26.5393979Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",6292,,," 5184 explorer.exe",,,,,,,,,,,,,18446633084032876544,18446633084032851968,140712891292720,0,15368192,10612,1763591846539397900,470351872,470294528,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5396692Z","2025-11-19 22:37:26.5396692Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 5784 svchost.exe",5288,,," 5252 WerFault.exe",,,"C:\Windows\System32\WerFault.exe",,,,,,,,,,,,,,,,1763591846539669200,,,,,134080654472445997,0,681036,"0x","","",7284,6628,6634,3,0,0,1,630084362,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5412000Z","2025-11-19 22:37:26.5412000Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5784 svchost.exe",5288,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084035321856,18446633084035297280,140702556693600,243,295361212416,14976,1763591846541200000,295359938560,295359930368,140702556693600,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5448212Z","2025-11-19 22:37:26.5448212Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084035551232,18446633084035526656,140712899206080,0,61841821696,7992,1763591846544821300,61845012480,61845008384,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5450078Z","2025-11-19 22:37:26.5450078Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084035579904,18446633084035555328,140712899206080,0,295361220608,12628,1763591846545007800,295360462848,295360454656,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5451022Z","2025-11-19 22:37:26.5451022Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5252 WerFault.exe",12628,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084035608576,18446633084035584000,140712899206080,0,295361228800,8368,1763591846545102200,295363411968,295363403776,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5452382Z","2025-11-19 22:37:26.5452382Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",7992,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084035637248,18446633084035612672,140712899206080,0,61841829888,4128,1763591846545238200,61846061056,61846056960,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5454506Z","2025-11-19 22:37:26.5454506Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084035665920,18446633084035641344,140712899206080,0,61841838080,13260,1763591846545450600,61847109632,61847105536,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5459013Z","2025-11-19 22:37:26.5459013Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",13628,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084035694592,18446633084035670016,140712899206080,0,199841341440,11828,1763591846545901300,199847575552,199847567360,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5463071Z","2025-11-19 22:37:26.5463071Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",4796,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084035809280,18446633084035784704,140712891292720,0,199841349632,10832,1763591846546307100,199848099840,199848091648,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5464045Z","2025-11-19 22:37:26.5464045Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5252 WerFault.exe",8368,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084035780608,18446633084035756032,140712899206080,0,295361236992,13036,1763591846546404500,295363936256,295363928064,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5495929Z","2025-11-19 22:37:26.5495929Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084035751936,18446633084035727360,140712899206080,0,61841846272,11964,1763591846549592900,61848158208,61848154112,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5510549Z","2025-11-19 22:37:26.5510549Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084035952640,18446633084035928064,140712281948464,0,61841854464,12508,1763591846551054900,61849206784,61849202688,140712281948464,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5537087Z","2025-11-19 22:37:26.5537087Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1016 services.exe",6816,,," 6616 svchost.exe",,,"C:\Windows\System32\svchost.exe",,,,,,,,,,,,,,,,1763591846553708700,,,,,134080654472583582,0,143552,"0x","","",1016,11,6635,1,1,0,0,14788416,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5542305Z","2025-11-19 22:37:26.5542305Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",14436,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084036096000,18446633084036071424,140712899206080,0,199841357824,5004,1763591846554230500,199849148416,199849140224,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5542583Z","2025-11-19 22:37:26.5542583Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1016 services.exe",6816,,," 6616 svchost.exe",,,,,,,,,,,,,18446633084036009984,18446633084035985408,140696171073504,0,816038653952,5908,1763591846554258300,816037298176,816037281792,140696171073504,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5583165Z","2025-11-19 22:37:26.5583165Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084036182016,18446633084036157440,140712865112144,0,61841862656,956,1763591846558316500,61850255360,61850247168,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5587337Z","2025-11-19 22:37:26.5587337Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11964,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084032503808,18446633084032479232,140712899206080,0,61841870848,11720,1763591846558733800,61851303936,61851299840,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5639203Z","2025-11-19 22:37:26.5639203Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6616 svchost.exe",5908,,," 6616 svchost.exe",,,,,,,,,,,,,18446633084034744320,18446633084034719744,140712899206080,0,816038662144,12396,1763591846563920300,816040116224,816040083456,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5639954Z","2025-11-19 22:37:26.5639954Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6616 svchost.exe",12396,,," 6616 svchost.exe",,,,,,,,,,,,,18446633084031729664,18446633084031705088,140712899206080,0,816038670336,13720,1763591846563995400,816040640512,816040607744,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5640851Z","2025-11-19 22:37:26.5640851Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6616 svchost.exe",13720,,," 6616 svchost.exe",,,,,,,,,,,,,18446633084036268032,18446633084036243456,140712899206080,0,816038678528,10796,1763591846564085200,816041164800,816041132032,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5651222Z","2025-11-19 22:37:26.5651222Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",8664,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084036325376,18446633084036300800,140712899206080,0,199841366016,4344,1763591846565122200,199849672704,199849664512,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5657805Z","2025-11-19 22:37:26.5657805Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11964,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084035866624,18446633084035842048,140712899206080,0,61841879040,496,1763591846565780500,61852352512,61852348416,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5673494Z","2025-11-19 22:37:26.5673494Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2688 svchost.exe",14020,,," 2688 svchost.exe",,,,,,,,,,,,,18446633084036354048,18446633084036329472,140712899206080,13,461860601856,4036,1763591846567349400,461863124992,461863059456,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5685445Z","2025-11-19 22:37:26.5685445Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084036698112,18446633084036673536,140712891545280,0,61841887232,11644,1763591846568544500,61853401088,61853396992,140712891545280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5725585Z","2025-11-19 22:37:26.5725585Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",12432,,," 5184 explorer.exe",,,,,,,,,,,,,18446633084036382720,18446633084036358144,140712891292720,0,15376384,5476,1763591846572558500,470876160,470818816,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5758335Z","2025-11-19 22:37:26.5758335Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1016 services.exe",2816,,," 1016 services.exe",,,,,,,,,,,,,18446633084035379200,18446633084035354624,140712899206080,0,156998311936,13420,1763591846575833500,157000663040,157000630272,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5761292Z","2025-11-19 22:37:26.5761292Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 6616 svchost.exe",,,,,,,,,,,,,18446633084027592704,18446633084027568128,140712899206080,0,816038686720,14644,1763591846576129200,816041689088,816041656320,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5762722Z","2025-11-19 22:37:26.5762722Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6616 svchost.exe",5908,,," 6616 svchost.exe",,,,,,,,,,,,,18446633084036870144,18446633084036845568,140712863364608,0,816038694912,6360,1763591846576272200,816042213376,816042180608,140712863364608,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5790575Z","2025-11-19 22:37:26.5790575Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084036726784,18446633084036702208,140712600145104,0,61841895424,11252,1763591846579057600,61854449664,61854445568,140712600145104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5791074Z","2025-11-19 22:37:26.5791074Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084036841472,18446633084036816896,140712604173856,0,61841903616,12480,1763591846579107400,61855498240,61855494144,140712604173856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5819795Z","2025-11-19 22:37:26.5819795Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6616 svchost.exe",14644,,," 6616 svchost.exe",,,,,,,,,,,,,18446633084037246976,18446633084037222400,140712899206080,31,816038703104,7752,1763591846581979500,816042737664,816042704896,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5822357Z","2025-11-19 22:37:26.5822357Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6616 svchost.exe",6360,,," 6616 svchost.exe",,,,,,,,,,,,,18446633084036870144,18446633084036845568,140712863364608,0,816038694912,6360,1763591846582235700,816042213376,816042180608,140712863364608,10158747,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6008547Z","2025-11-19 22:37:26.6008547Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","14660 CalculatorApp.exe",11252,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084036726784,18446633084036702208,140712600145104,0,61841895424,11252,1763591846600854700,61854449664,61854420992,140712600145104,59786572,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6041470Z","2025-11-19 22:37:26.6041470Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 7916 svchost.exe",,,,,,,,,,,,,18446633084036726784,18446633084036702208,140712899206080,0,401963515904,13956,1763591846604147000,401965842432,401965809664,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6044711Z","2025-11-19 22:37:26.6044711Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 7916 svchost.exe",13956,,," 7916 svchost.exe",,,,,,,,,,,,,18446633084037013504,18446633084036988928,140712899206080,90,401963524096,14624,1763591846604471100,401966366720,401966333952,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6060394Z","2025-11-19 22:37:26.6060394Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2992 svchost.exe",8856,,," 2992 svchost.exe",,,,,,,,,,,,,18446633084036612096,18446633084036587520,140712899206080,186,170617462784,332,1763591846606039500,170619568128,170619535360,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6061470Z","2025-11-19 22:37:26.6061470Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084037304320,18446633084037279744,140712632221632,0,61841911808,12900,1763591846606147000,61854449664,61854445568,140712632221632,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6179798Z","2025-11-19 22:37:26.6179798Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2960 svchost.exe",4584,,," 2960 svchost.exe",,,,,,,,,,,,,18446633084037156864,18446633084037132288,140712899206080,287,403329839104,11740,1763591846617979800,403332661248,403332628480,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6188438Z","2025-11-19 22:37:26.6188438Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2960 svchost.exe",11740,,," 2960 svchost.exe",,,,,,,,,,,,,18446633084031815680,18446633084031791104,140712899206080,287,403329847296,13172,1763591846618843800,403333185536,403333152768,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6189176Z","2025-11-19 22:37:26.6189176Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2960 svchost.exe",11740,,," 2960 svchost.exe",,,,,,,,,,,,,18446633084037332992,18446633084037308416,140712891292720,287,403329855488,11772,1763591846618917600,403333709824,403333677056,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6193177Z","2025-11-19 22:37:26.6193177Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2992 svchost.exe",14440,,," 2992 svchost.exe",,,,,,,,,,,,,18446633084037476352,18446633084037451776,140712899206080,186,170617470976,11856,1763591846619317700,170620092416,170620059648,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6422521Z","2025-11-19 22:37:26.6422521Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084036497408,18446633084036472832,140712899206080,0,295361245184,12560,1763591846642252100,295364460544,295364452352,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6467946Z","2025-11-19 22:37:26.6467946Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3232 dllhost.exe",,,,,,,,,,,,,18446633084037763072,18446633084037738496,140712899206080,0,493780992000,10288,1763591846646794600,493783875584,493783842816,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6496679Z","2025-11-19 22:37:26.6496679Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084037533696,18446633084037509120,140712891292720,0,61841920000,12588,1763591846649667900,61856546816,61856542720,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6528598Z","2025-11-19 22:37:26.6528598Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4340 sihost.exe",4288,,," 4340 sihost.exe",,,,,,,,,,,,,18446633083999285248,18446633083999260672,140712891292720,0,645640036352,4748,1763591846652859800,645646516224,645646508032,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6791641Z","2025-11-19 22:37:26.6791641Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",8500,,," 1040 svchost.exe",,,,,,,,,,,,,18446633084036870144,18446633084036845568,140712899206080,0,256031064064,12504,1763591846679164100,256038141952,256038109184,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6794671Z","2025-11-19 22:37:26.6794671Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084036669440,18446633084036644864,140712899206080,0,61841928192,11328,1763591846679467100,61857595392,61857591296,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6832366Z","2025-11-19 22:37:26.6832366Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084037619712,18446633084037595136,140712865112144,0,61841936384,336,1763591846683236600,61858643968,61858635776,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6839927Z","2025-11-19 22:37:26.6839927Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8972 VBoxTray.exe",9020,,," 8972 VBoxTray.exe",,,,,,,,,,,,,18446633084036812800,18446633084036788224,140700131109808,0,471283204096,6380,1763591846683992700,471299260416,471299256320,140700131109808,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6842196Z","2025-11-19 22:37:26.6842196Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8972 VBoxTray.exe",6380,,," 8972 VBoxTray.exe",,,,,,,,,,,,,18446633084036812800,18446633084036788224,140700131109808,0,471283204096,6380,1763591846684219600,471299260416,471299252224,140700131109808,481308,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7146538Z","2025-11-19 22:37:26.7146538Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084037562368,18446633084037537792,140712297841152,0,61841944576,9644,1763591846714653900,61859692544,61859688448,140712297841152,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7427338Z","2025-11-19 22:37:26.7427338Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 9692 PerfWatson2.exe",9752,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084037992448,18446633084037967872,140711612509856,0,1046354432000,13872,1763591846742733800,1046352232448,1046352216064,140711612509856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7597159Z","2025-11-19 22:37:26.7597159Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084038049792,18446633084038025216,140712899206080,0,513414856704,1652,1763591846759716000,513420558336,513420525568,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7736710Z","2025-11-19 22:37:26.7736710Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084038164480,18446633084038139904,140712865112144,0,295361253376,1248,1763591846773671100,295364984832,295364976640,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7738817Z","2025-11-19 22:37:26.7738817Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084038193152,18446633084038168576,140712899206080,0,295361261568,10204,1763591846773881700,295365509120,295365500928,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7740150Z","2025-11-19 22:37:26.7740150Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5252 WerFault.exe",10204,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084038221824,18446633084038197248,140712899206080,0,295361269760,8320,1763591846774015000,295366033408,295366025216,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8302231Z","2025-11-19 22:37:26.8302231Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084038135808,18446633084038111232,140712583404848,0,61841952768,5400,1763591846830223100,61860741120,61860737024,140712583404848,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8306661Z","2025-11-19 22:37:26.8306661Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11720,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084038279168,18446633084038254592,140712899206080,0,61841960960,8356,1763591846830666100,61861789696,61861785600,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8318294Z","2025-11-19 22:37:26.8318294Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3812 calc.exe",14584,,," 3812 calc.exe",,,,,,,,,,,,,18446633084032331776,18446633084032307200,140712899206080,0,801455407104,14584,1763591846831829400,801457045504,801457037312,140712899206080,3186210,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8318295Z","2025-11-19 22:37:26.8318295Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3812 calc.exe",3100,,," 3812 calc.exe",,,,,,,,,,,,,18446633084033368064,18446633084033343488,140712899206080,0,801455448064,3100,1763591846831829600,801459666944,801459658752,140712899206080,817389,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8318300Z","2025-11-19 22:37:26.8318300Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3812 calc.exe",6196,,," 3812 calc.exe",,,,,,,,,,,,,18446633084032389120,18446633084032364544,140712899206080,0,801455415296,6196,1763591846831830000,801457569792,801457557504,140712899206080,7141150,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8318304Z","2025-11-19 22:37:26.8318304Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3812 calc.exe",6204,,," 3812 calc.exe",,,,,,,,,,,,,18446633084032417792,18446633084032393216,140712891545280,0,801455423488,6204,1763591846831830400,801458094080,801458061312,140712891545280,149400621,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8318384Z","2025-11-19 22:37:26.8318384Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3812 calc.exe",2088,,," 3812 calc.exe",,,,,,,,,,,,,18446633084033224704,18446633084033200128,140712865112144,0,801455431680,2088,1763591846831838400,801458618368,801458610176,140712865112144,228960,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8318411Z","2025-11-19 22:37:26.8318411Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3812 calc.exe",652,,," 3812 calc.exe",,,,,,,,,,,,,18446633084033310720,18446633084033286144,140712899206080,0,801455439872,652,1763591846831841100,801459142656,801459134464,140712899206080,531097,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8318477Z","2025-11-19 22:37:26.8318477Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3812 calc.exe",7976,,," 3812 calc.exe",,,,,,,,,,,,,18446633084032274432,18446633084032249856,140712899206080,0,801455398912,7976,1763591846831847700,801456521216,801456513024,140712899206080,4943957,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8320938Z","2025-11-19 22:37:26.8320938Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084032417792,18446633084032393216,140712899206080,0,61841969152,13376,1763591846832093800,61862838272,61862834176,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8332758Z","2025-11-19 22:37:26.8332758Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3812 calc.exe",10660,,," 3812 calc.exe",,,,,,,,,,,,,18446633084032245760,18446633084032221184,140696878126912,0,801455390720,10660,1763591846833275800,801453899776,801453879296,140696878126912,40536930,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8345749Z","2025-11-19 22:37:26.8345749Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"calc.exe",,,,,,,,,,,,,,,,1763591846834574900,,,,,134080654471607920,,,,,,,,6629,,,,,,,,,3268608,3305472,213030484,0,134080654475331992,116,0,1,12,3,0,0 +"2025-11-19 22:37:26.9060086Z","2025-11-19 22:37:26.9060086Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1016 services.exe",6816,,,"12756 svchost.exe",,,"C:\Windows\System32\svchost.exe",,,,,,,,,,,,,,,,1763591846906008600,,,,,134080654476036389,0,143552,"0x","","",1016,11,6636,1,1,0,0,14788416,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9067020Z","2025-11-19 22:37:26.9067020Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1016 services.exe",6816,,,"12756 svchost.exe",,,,,,,,,,,,,18446633084032274432,18446633084032249856,140696171073504,0,111870410752,13856,1763591846906702000,111867592704,111867576320,140696171073504,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9168346Z","2025-11-19 22:37:26.9168346Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","12756 svchost.exe",13856,,,"12756 svchost.exe",,,,,,,,,,,,,18446633084033310720,18446633084033286144,140712899206080,0,111870418944,7100,1763591846916834600,111868116992,111868084224,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9169070Z","2025-11-19 22:37:26.9169070Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","12756 svchost.exe",7100,,,"12756 svchost.exe",,,,,,,,,,,,,18446633084032389120,18446633084032364544,140712899206080,0,111870427136,4004,1763591846916907000,111871000576,111870967808,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9169866Z","2025-11-19 22:37:26.9169866Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","12756 svchost.exe",4004,,,"12756 svchost.exe",,,,,,,,,,,,,18446633084033368064,18446633084033343488,140712899206080,0,111870435328,3784,1763591846916986600,111871524864,111871492096,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9264172Z","2025-11-19 22:37:26.9264172Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"12756 svchost.exe",,,,,,,,,,,,,18446633084032331776,18446633084032307200,140712899206080,0,111870443520,12564,1763591846926417200,111872049152,111872016384,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9265408Z","2025-11-19 22:37:26.9265408Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","12756 svchost.exe",13856,,,"12756 svchost.exe",,,,,,,,,,,,,18446633084038365184,18446633084038340608,140712863364608,0,111870451712,4888,1763591846926540800,111872573440,111872540672,140712863364608,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9314972Z","2025-11-19 22:37:26.9314972Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","12756 svchost.exe",12564,,,"12756 svchost.exe",,,,,,,,,,,,,18446633084038479872,18446633084038455296,140712899206080,9,111870459904,13320,1763591846931497200,111873097728,111873064960,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9339612Z","2025-11-19 22:37:26.9339612Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","12756 svchost.exe",12564,,,"12756 svchost.exe",,,,,,,,,,,,,18446633084038623232,18446633084038598656,140712865112144,9,111870468096,1628,1763591846933961200,111873622016,111873589248,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9343316Z","2025-11-19 22:37:26.9343316Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","12756 svchost.exe",13320,,,"12756 svchost.exe",,,,,,,,,,,,,18446633084038651904,18446633084038627328,140712899206080,9,111868379136,500,1763591846934331600,111874146304,111874113536,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9757802Z","2025-11-19 22:37:26.9757802Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11964,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084038680576,18446633084038656000,140712899206080,0,61841977344,9424,1763591846975780200,61863886848,61863882752,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9759165Z","2025-11-19 22:37:26.9759165Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1168 svchost.exe",13524,,," 1168 svchost.exe",,,,,,,,,,,,,18446633084038795264,18446633084038770688,140712899206080,157,641013497856,13336,1763591846975916500,641018626048,641018593280,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9761596Z","2025-11-19 22:37:26.9761596Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",9424,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084038823936,18446633084038799360,140712899206080,0,61841985536,13884,1763591846976159600,61864935424,61864931328,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9762962Z","2025-11-19 22:37:26.9762962Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",13884,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084038852608,18446633084038828032,140712899206080,0,61841993728,13192,1763591846976296200,61865984000,61865979904,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9764557Z","2025-11-19 22:37:26.9764557Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1168 svchost.exe",13336,,," 1168 svchost.exe",,,,,,,,,,,,,18446633084038909952,18446633084038885376,140712899206080,0,641013506048,1052,1763591846976455700,641019674624,641019641856,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9977602Z","2025-11-19 22:37:26.9977602Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084037419008,18446633084037394432,140712806010720,0,295361277952,5544,1763591846997760200,295366557696,295366549504,140712806010720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0043199Z","2025-11-19 22:37:27.0043199Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1776 svchost.exe",9772,,," 1776 svchost.exe",,,,,,,,,,,,,18446633084039024640,18446633084039000064,140712899206080,122,699936964608,6052,1763591847004319900,699937587200,699937554432,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0085599Z","2025-11-19 22:37:27.0085599Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",13192,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084039053312,18446633084039028736,140712899206080,0,61842001920,4980,1763591847008559900,61867032576,61867028480,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0088098Z","2025-11-19 22:37:27.0088098Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",4980,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084039081984,18446633084039057408,140712899206080,0,61842010112,4528,1763591847008809800,61868081152,61868077056,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0089567Z","2025-11-19 22:37:27.0089567Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",4528,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084039225344,18446633084039200768,140712899206080,0,61842018304,13000,1763591847008956800,61869129728,61869125632,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0340864Z","2025-11-19 22:37:27.0340864Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",8260,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084032188416,18446633084032163840,140712891292720,0,199841374208,6804,1763591847034086400,199851245568,199851237376,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0668663Z","2025-11-19 22:37:27.0668663Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3420 ctfmon.exe",8900,,," 3420 ctfmon.exe",,,,,,,,,,,,,18446633084037906432,18446633084037881856,140712865112144,0,619648745472,15352,1763591847066866300,619647205376,619647197184,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0685230Z","2025-11-19 22:37:27.0685230Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084038250496,18446633084038225920,140712899206080,0,61842026496,12060,1763591847068523000,61870178304,61870174208,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.1026755Z","2025-11-19 22:37:27.1026755Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6096 svchost.exe",4172,,," 6096 svchost.exe",,,,,,,,,,,,,18446633084032245760,18446633084032221184,140712899206080,25,338488852480,15324,1763591847102675500,338491867136,338491834368,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.1176652Z","2025-11-19 22:37:27.1176652Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6096 svchost.exe",4172,,," 6096 svchost.exe",,,,,,,,,,,,,18446633084033224704,18446633084033200128,140712865112144,25,338488860672,14108,1763591847117665200,338492391424,338492358656,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.1255393Z","2025-11-19 22:37:27.1255393Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2724 svchost.exe",14940,,," 2724 svchost.exe",,,,,,,,,,,,,18446633084039458816,18446633084039434240,140712899206080,232,89489063936,5900,1763591847125539300,89491767296,89491701760,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.1256608Z","2025-11-19 22:37:27.1256608Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2724 svchost.exe",14940,,," 2724 svchost.exe",,,,,,,,,,,,,18446633084039544832,18446633084039520256,140712899206080,232,89489072128,952,1763591847125660800,89492291584,89492258816,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.1267258Z","2025-11-19 22:37:27.1267258Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3256 svchost.exe",4788,,," 3256 svchost.exe",,,,,,,,,,,,,18446633084039630848,18446633084039606272,140712899206080,111,435930234880,3276,1763591847126725800,433794318336,433794285568,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2129195Z","2025-11-19 22:37:27.2129195Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1040 svchost.exe",4220,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\RuntimeBroker.exe",,,,,,,,,,,,,,,,1763591847212919500,,,,,134080654479044376,3,148437,"0x","Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe","runtimebroker07f4358a809ac99a64a67c1",1040,13,6637,3,0,0,1,1175682367,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2141117Z","2025-11-19 22:37:27.2141117Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",4220,,," 6764 RuntimeBroker.exe",,,,,,,,,,,,,18446633084037963776,18446633084037939200,140699399787184,40,848667435008,11572,1763591847214111700,848666886144,848666836992,140699399787184,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2277968Z","2025-11-19 22:37:27.2277968Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,,,,,,,,,,,18446633084039716864,18446633084039692288,140712899206080,0,848667443200,8364,1763591847227796800,848669704192,848669655040,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2280363Z","2025-11-19 22:37:27.2280363Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,,,,,,,,,,,18446633084039831552,18446633084039806976,140712899206080,0,848667451392,11224,1763591847228036300,848670228480,848670179328,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2312370Z","2025-11-19 22:37:27.2312370Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 6764 RuntimeBroker.exe",,,,,,,,,,,,,18446633084039860224,18446633084039835648,140712899206080,0,848667459584,6812,1763591847231237000,848670752768,848670703616,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2313547Z","2025-11-19 22:37:27.2313547Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 6764 RuntimeBroker.exe",,,,,,,,,,,,,18446633084040003584,18446633084039979008,140712899206080,0,848667467776,8708,1763591847231354700,848671277056,848671227904,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2320674Z","2025-11-19 22:37:27.2320674Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6764 RuntimeBroker.exe",11224,,," 6764 RuntimeBroker.exe",,,,,,,,,,,,,18446633084040060928,18446633084040036352,140712899206080,0,848667475968,13408,1763591847232067400,848671801344,848671752192,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2361031Z","2025-11-19 22:37:27.2361031Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,,,,,,,,,,,18446633084040290304,18446633084040265728,140712865112144,0,848667484160,12020,1763591847236103100,848672325632,848672276480,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2455120Z","2025-11-19 22:37:27.2455120Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6764 RuntimeBroker.exe",8708,,," 6764 RuntimeBroker.exe",,,,,,,,,,,,,18446633084040318976,18446633084040294400,140712865112144,0,848667492352,5996,1763591847245512000,848672849920,848672800768,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2473895Z","2025-11-19 22:37:27.2473895Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5252 WerFault.exe",10204,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084040347648,18446633084040323072,140712899206080,0,295361286144,13268,1763591847247389500,295367081984,295367073792,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2567215Z","2025-11-19 22:37:27.2567215Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1660 svchost.exe",5636,,," 1660 svchost.exe",,,,,,,,,,,,,18446633084040376320,18446633084040351744,140712899206080,129,265908367360,8716,1763591847256721500,265905897472,265905864704,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2589399Z","2025-11-19 22:37:27.2589399Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6764 RuntimeBroker.exe",6812,,," 6764 RuntimeBroker.exe",,,,,,,,,,,,,18446633084040491008,18446633084040466432,140712899206080,0,848667500544,13508,1763591847258939900,848673374208,848673325056,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2616936Z","2025-11-19 22:37:27.2616936Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6764 RuntimeBroker.exe",5996,,," 6764 RuntimeBroker.exe",,,,,,,,,,,,,18446633084040548352,18446633084040523776,140712891292720,0,848667508736,2944,1763591847261693600,848673898496,848673849344,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.3163515Z","2025-11-19 22:37:27.3163515Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",13876,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084018688000,18446633084018663424,140711613062896,0,1046354382848,13876,1763591847316351500,1046401253376,1046401236992,140711613062896,2715087,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.099873500Z","2025-11-19 22:37:27.4122768Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Attack done",,,,,,,,,,,,,,,,,1763591847412276800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4128045Z","2025-11-19 22:37:27.4128045Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591847412804500,,,,,,,158678,,,,,,,,,,,3554393863,140712830631936,140712830631936,110592,,,,,,,,,,,, +"2025-11-19 22:37:27.4131942Z","2025-11-19 22:37:27.4131942Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5604 attack-890.exe",8672,,," 5604 attack-890.exe",,,,,,,,,,,,,18446633084029718528,18446633084029693952,140712899206080,0,867488067584,8672,1763591847413194200,867491119104,867491106816,140712899206080,1934283,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4131969Z","2025-11-19 22:37:27.4131969Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5604 attack-890.exe",5960,,," 5604 attack-890.exe",,,,,,,,,,,,,18446633084029747200,18446633084029722624,140712899206080,0,867488059392,5960,1763591847413196900,867490070528,867490062336,140712899206080,2523090,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4132046Z","2025-11-19 22:37:27.4132046Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5604 attack-890.exe",12460,,," 5604 attack-890.exe",,,,,,,,,,,,,18446633084029460480,18446633084029435904,140712899206080,0,867488075776,12460,1763591847413204600,867492167680,867492155392,140712899206080,1586126,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4133776Z","2025-11-19 22:37:27.4133776Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,,,,,,,,,,,18446633084027822080,18446633084027797504,140695618865008,0,867488051200,3452,1763591847413377600,867486007296,867485986816,140695618865008,55165128,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4135007Z","2025-11-19 22:37:27.4135007Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Users\Public\Downloads\attack-890.exe",,,,,,,,,,,,,,,,1763591847413500700,,,,,,,0,,,,,,,,,,,1763491559,140695618846720,140695618846720,53248,,,,,,,,,,,, +"2025-11-19 22:37:27.4135055Z","2025-11-19 22:37:27.4135055Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\msvcp140.dll",,,,,,,,,,,,,,,,1763591847413505500,,,,,,,570439,,,,,,,,,,,1564323704,140711213137920,140711213137920,561152,,,,,,,,,,,, +"2025-11-19 22:37:27.4135084Z","2025-11-19 22:37:27.4135084Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\vcruntime140.dll",,,,,,,,,,,,,,,,1763591847413508400,,,,,,,146072,,,,,,,,,,,254123393,140712353988608,140712353988608,122880,,,,,,,,,,,, +"2025-11-19 22:37:27.4135113Z","2025-11-19 22:37:27.4135113Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\vcruntime140_1.dll",,,,,,,,,,,,,,,,1763591847413511400,,,,,,,57827,,,,,,,,,,,240324076,140712354119680,140712354119680,49152,,,,,,,,,,,, +"2025-11-19 22:37:27.4135253Z","2025-11-19 22:37:27.4135253Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\apphelp.dll",,,,,,,,,,,,,,,,1763591847413525300,,,,,,,675806,,,,,,,,,,,4108425587,140712800485376,140712800485376,651264,,,,,,,,,,,, +"2025-11-19 22:37:27.4135311Z","2025-11-19 22:37:27.4135311Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591847413531100,,,,,,,158678,,,,,,,,,,,3554393863,140712830631936,140712830631936,110592,,,,,,,,,,,, +"2025-11-19 22:37:27.4135386Z","2025-11-19 22:37:27.4135386Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591847413538600,,,,,,,4209945,,,,,,,,,,,2980330054,140712854355968,140712854355968,4161536,,,,,,,,,,,, +"2025-11-19 22:37:27.4135538Z","2025-11-19 22:37:27.4135538Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591847413553800,,,,,,,1436013,,,,,,,,,,,1441720767,140712859467776,140712859467776,1355776,,,,,,,,,,,, +"2025-11-19 22:37:27.4135615Z","2025-11-19 22:37:27.4135615Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591847413561600,,,,,,,716301,,,,,,,,,,,3291623140,140712863203328,140712863203328,679936,,,,,,,,,,,, +"2025-11-19 22:37:27.4135675Z","2025-11-19 22:37:27.4135675Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591847413567500,,,,,,,885660,,,,,,,,,,,2913437033,140712877621248,140712877621248,823296,,,,,,,,,,,, +"2025-11-19 22:37:27.4135740Z","2025-11-19 22:37:27.4135740Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591847413574000,,,,,,,761372,,,,,,,,,,,71854833,140712881618944,140712881618944,737280,,,,,,,,,,,, +"2025-11-19 22:37:27.4135805Z","2025-11-19 22:37:27.4135805Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591847413580500,,,,,,,760295,,,,,,,,,,,460960534,140712894529536,140712894529536,692224,,,,,,,,,,,, +"2025-11-19 22:37:27.4135873Z","2025-11-19 22:37:27.4135873Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591847413587300,,,,,,,1193108,,,,,,,,,,,4275633056,140712897216512,140712897216512,1146880,,,,,,,,,,,, +"2025-11-19 22:37:27.4135935Z","2025-11-19 22:37:27.4135935Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591847413593500,,,,,,,2537167,,,,,,,,,,,2626650689,140712898723840,140712898723840,2523136,,,,,,,,,,,, +"2025-11-19 22:37:27.4136009Z","2025-11-19 22:37:27.4136009Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"attack-890.exe",,,,,,,,,,,,,,,,1763591847413600900,,,,,134080654410040405,,,,,,,,6624,,,,,,,,,974848,974848,61411560,0,134080654481010332,52,9,0,0,3,48,0 +"2025-11-19 22:37:27.4283262Z","2025-11-19 22:37:27.4283262Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",11288,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084024401920,18446633084024377344,140711613062896,0,1046354407424,11288,1763591847428326200,1046418030592,1046418014208,140711613062896,1935036,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.5078343Z","2025-11-19 22:37:27.5078343Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2572 svchost.exe",13832,,," 2572 svchost.exe",,,,,,,,,,,,,18446633084039372800,18446633084039348224,140712899206080,75,140319780864,11052,1763591847507834300,140320964608,140320931840,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.5256444Z","2025-11-19 22:37:27.5256444Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 4868 svchost.exe",,,,,,,,,,,,,18446633084031901696,18446633084031877120,140712899206080,0,47918891008,11596,1763591847525644400,47920971776,47920939008,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.5258154Z","2025-11-19 22:37:27.5258154Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4868 svchost.exe",11596,,," 4868 svchost.exe",,,,,,,,,,,,,18446633084024401920,18446633084024377344,140712899206080,0,47918899200,2940,1763591847525815400,47921496064,47921463296,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6226062Z","2025-11-19 22:37:27.6226062Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1016 services.exe",6816,,,"13800 svchost.exe",,,"C:\Windows\System32\svchost.exe",,,,,,,,,,,,,,,,1763591847622606300,,,,,134080654483059795,0,143552,"0x","","",1016,11,6638,1,1,0,0,14788416,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6232926Z","2025-11-19 22:37:27.6232926Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1016 services.exe",6816,,,"13800 svchost.exe",,,,,,,,,,,,,18446633084027822080,18446633084027797504,140696171073504,0,858544685056,15036,1763591847623292600,858547290112,858547273728,140696171073504,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6289680Z","2025-11-19 22:37:27.6289680Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,,,,,,,,,,,18446633084029747200,18446633084029722624,140712899206080,0,858544693248,9704,1763591847628968000,858547814400,858547781632,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6299477Z","2025-11-19 22:37:27.6299477Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,,,,,,,,,,,18446633084029460480,18446633084029435904,140712899206080,0,858544701440,5924,1763591847629947700,858548338688,858548305920,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6324486Z","2025-11-19 22:37:27.6324486Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13800 svchost.exe",9704,,,"13800 svchost.exe",,,,,,,,,,,,,18446633084039282688,18446633084039258112,140712899206080,0,858544709632,10468,1763591847632448600,858548862976,858548830208,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6355634Z","2025-11-19 22:37:27.6355634Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"13800 svchost.exe",,,,,,,,,,,,,18446633084040663040,18446633084040638464,140712899206080,0,858544717824,11472,1763591847635563500,858549387264,858549354496,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6356777Z","2025-11-19 22:37:27.6356777Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,,,,,,,,,,,18446633084040691712,18446633084040667136,140712863364608,0,858544726016,11168,1763591847635677700,858549911552,858549878784,140712863364608,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6402040Z","2025-11-19 22:37:27.6402040Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13800 svchost.exe",11472,,,"13800 svchost.exe",,,,,,,,,,,,,18446633084040806400,18446633084040781824,140712899206080,0,858544734208,4768,1763591847640204000,858550435840,858550403072,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6406317Z","2025-11-19 22:37:27.6406317Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 5536 svchost.exe",,,,,,,,,,,,,18446633084040835072,18446633084040810496,140712899206080,0,151912235008,3836,1763591847640631700,151921360896,151921328128,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6840379Z","2025-11-19 22:37:27.6840379Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13780 WmiPrvSE.exe",4420,,,"13780 WmiPrvSE.exe",,,,,,,,,,,,,18446633084016447488,18446633084016422912,140712899206080,0,157585104896,4420,1763591847684037900,157587341312,157587275776,140712899206080,4863993,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6840511Z","2025-11-19 22:37:27.6840511Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13780 WmiPrvSE.exe",6868,,,"13780 WmiPrvSE.exe",,,,,,,,,,,,,18446633084055474176,18446633084055449600,140712899206080,0,157585096704,6868,1763591847684051100,157586817024,157586751488,140712899206080,5062025,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.9160604Z","2025-11-19 22:37:27.9160604Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084037419008,18446633084037394432,140712806010720,0,295361277952,5544,1763591847916060400,295366557696,295366512640,140712806010720,887249451,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.9529632Z","2025-11-19 22:37:27.9529632Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",8500,,," 1040 svchost.exe",,,,,,,,,,,,,18446633084041007104,18446633084040982528,140712899206080,0,256031072256,13776,1763591847952963200,256038666240,256038633472,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2233628Z","2025-11-19 22:37:28.2233628Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5252 WerFault.exe",12628,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084035579904,18446633084035555328,140712899206080,0,295361220608,12628,1763591848223362800,295360462848,295360454656,140712899206080,7179256,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2233643Z","2025-11-19 22:37:28.2233643Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5252 WerFault.exe",8368,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084035608576,18446633084035584000,140712899206080,0,295361228800,8368,1763591848223364300,295363411968,295363403776,140712899206080,8636748,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2233701Z","2025-11-19 22:37:28.2233701Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5252 WerFault.exe",12560,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084036497408,18446633084036472832,140712899206080,0,295361245184,12560,1763591848223370100,295364460544,295364452352,140712899206080,281768,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2233711Z","2025-11-19 22:37:28.2233711Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5252 WerFault.exe",13036,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084035780608,18446633084035756032,140712899206080,0,295361236992,13036,1763591848223371100,295363936256,295363928064,140712899206080,7774840,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2233814Z","2025-11-19 22:37:28.2233814Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5252 WerFault.exe",1248,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084038164480,18446633084038139904,140712865112144,0,295361253376,1248,1763591848223381400,295364984832,295364976640,140712865112144,408507,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2233838Z","2025-11-19 22:37:28.2233838Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5252 WerFault.exe",10204,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084038193152,18446633084038168576,140712899206080,0,295361261568,10204,1763591848223383800,295365509120,295365480448,140712899206080,7920068,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2233994Z","2025-11-19 22:37:28.2233994Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5252 WerFault.exe",8320,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084038221824,18446633084038197248,140712899206080,0,295361269760,8320,1763591848223399400,295366033408,295366012928,140712899206080,49276648,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2233996Z","2025-11-19 22:37:28.2233996Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5252 WerFault.exe",13268,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084040347648,18446633084040323072,140712899206080,0,295361286144,13268,1763591848223399600,295367081984,295367065600,140712899206080,10564243,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2249315Z","2025-11-19 22:37:28.2249315Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084035321856,18446633084035297280,140702556693600,0,295361212416,14976,1763591848224931500,295359938560,295359860736,140702556693600,2468929032,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2265618Z","2025-11-19 22:37:28.2265618Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"WerFault.exe",,,,,,,,,,,,,,,,1763591848226561800,,,,,134080654472445997,,,,,,,,6634,,,,,,,,,5734400,13971456,3457303163,0,134080654488973699,205,0,83,2286,3,406,81 +"2025-11-19 22:37:28.2299996Z","2025-11-19 22:37:28.2299996Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,,,,,,,,,,,18446633084031987712,18446633084031963136,2513113579520,0,705865949184,14412,1763591848229999600,705865449472,705865428992,2513113579520,45081055,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2302606Z","2025-11-19 22:37:28.2302606Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\whoami.exe",,,,,,,,,,,,,,,,1763591848230260600,,,,,,,160109,,,,,,,,,,,3602411345,140702344609792,140702344609792,98304,,,,,,,,,,,, +"2025-11-19 22:37:28.2302692Z","2025-11-19 22:37:28.2302692Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\wkscli.dll",,,,,,,,,,,,,,,,1763591848230269200,,,,,,,170846,,,,,,,,,,,1225555544,140712738291712,140712738291712,110592,,,,,,,,,,,, +"2025-11-19 22:37:28.2302764Z","2025-11-19 22:37:28.2302764Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\version.dll",,,,,,,,,,,,,,,,1763591848230276400,,,,,,,72452,,,,,,,,,,,2275202464,140712753168384,140712753168384,45056,,,,,,,,,,,, +"2025-11-19 22:37:28.2302833Z","2025-11-19 22:37:28.2302833Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\apphelp.dll",,,,,,,,,,,,,,,,1763591848230283300,,,,,,,675806,,,,,,,,,,,4108425587,140712800485376,140712800485376,651264,,,,,,,,,,,, +"2025-11-19 22:37:28.2302892Z","2025-11-19 22:37:28.2302892Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\netutils.dll",,,,,,,,,,,,,,,,1763591848230289200,,,,,,,80696,,,,,,,,,,,865845000,140712825847808,140712825847808,53248,,,,,,,,,,,, +"2025-11-19 22:37:28.2303031Z","2025-11-19 22:37:28.2303031Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\authz.dll",,,,,,,,,,,,,,,,1763591848230303100,,,,,,,372179,,,,,,,,,,,771731569,140712826241024,140712826241024,327680,,,,,,,,,,,, +"2025-11-19 22:37:28.2303108Z","2025-11-19 22:37:28.2303108Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\sspicli.dll",,,,,,,,,,,,,,,,1763591848230310800,,,,,,,339222,,,,,,,,,,,3030302172,140712833384448,140712833384448,299008,,,,,,,,,,,, +"2025-11-19 22:37:28.2303160Z","2025-11-19 22:37:28.2303160Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591848230316000,,,,,,,4209945,,,,,,,,,,,2980330054,140712854355968,140712854355968,4161536,,,,,,,,,,,, +"2025-11-19 22:37:28.2303209Z","2025-11-19 22:37:28.2303209Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591848230320900,,,,,,,230350,,,,,,,,,,,2551303736,140712858550272,140712858550272,159744,,,,,,,,,,,, +"2025-11-19 22:37:28.2303256Z","2025-11-19 22:37:28.2303256Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591848230325600,,,,,,,700029,,,,,,,,,,,3371602543,140712858746880,140712858746880,667648,,,,,,,,,,,, +"2025-11-19 22:37:28.2303305Z","2025-11-19 22:37:28.2303305Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591848230330500,,,,,,,1436013,,,,,,,,,,,1441720767,140712859467776,140712859467776,1355776,,,,,,,,,,,, +"2025-11-19 22:37:28.2303347Z","2025-11-19 22:37:28.2303347Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591848230334700,,,,,,,1243850,,,,,,,,,,,792084382,140712861433856,140712861433856,1228800,,,,,,,,,,,, +"2025-11-19 22:37:28.2303393Z","2025-11-19 22:37:28.2303393Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591848230339300,,,,,,,716301,,,,,,,,,,,3291623140,140712863203328,140712863203328,679936,,,,,,,,,,,, +"2025-11-19 22:37:28.2303441Z","2025-11-19 22:37:28.2303441Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591848230344100,,,,,,,885660,,,,,,,,,,,2913437033,140712877621248,140712877621248,823296,,,,,,,,,,,, +"2025-11-19 22:37:28.2303485Z","2025-11-19 22:37:28.2303485Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\ws2_32.dll",,,,,,,,,,,,,,,,1763591848230348500,,,,,,,513405,,,,,,,,,,,3967481067,140712881094656,140712881094656,475136,,,,,,,,,,,, +"2025-11-19 22:37:28.2303531Z","2025-11-19 22:37:28.2303531Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591848230353100,,,,,,,761372,,,,,,,,,,,71854833,140712881618944,140712881618944,737280,,,,,,,,,,,, +"2025-11-19 22:37:28.2303660Z","2025-11-19 22:37:28.2303660Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591848230366000,,,,,,,230873,,,,,,,,,,,527442843,140712882405376,140712882405376,176128,,,,,,,,,,,, +"2025-11-19 22:37:28.2303718Z","2025-11-19 22:37:28.2303718Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,,,,,,,1763591848230371800,,,,,,,233556,,,,,,,,,,,1625678811,140712882601984,140712882601984,200704,,,,,,,,,,,, +"2025-11-19 22:37:28.2303766Z","2025-11-19 22:37:28.2303766Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591848230376600,,,,,,,1923284,,,,,,,,,,,675224942,140712888827904,140712888827904,1863680,,,,,,,,,,,, +"2025-11-19 22:37:28.2303812Z","2025-11-19 22:37:28.2303812Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591848230381200,,,,,,,760295,,,,,,,,,,,460960534,140712894529536,140712894529536,692224,,,,,,,,,,,, +"2025-11-19 22:37:28.2303855Z","2025-11-19 22:37:28.2303855Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591848230385500,,,,,,,1193108,,,,,,,,,,,4275633056,140712897216512,140712897216512,1146880,,,,,,,,,,,, +"2025-11-19 22:37:28.2303897Z","2025-11-19 22:37:28.2303897Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591848230389700,,,,,,,2537167,,,,,,,,,,,2626650689,140712898723840,140712898723840,2523136,,,,,,,,,,,, +"2025-11-19 22:37:28.2303954Z","2025-11-19 22:37:28.2303954Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"whoami.exe",,,,,,,,,,,,,,,,1763591848230395400,,,,,134080654423385232,,,,,,,,6628,,,,,,,,,1265664,1310720,56924383,3221225477,134080654489015372,83,0,1,3,3,0,0 +"2025-11-19 22:37:28.2307155Z","2025-11-19 22:37:28.2307155Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",3864,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028424192,18446633084028399616,140712899206080,0,696750415872,3864,1763591848230715500,696752537600,696752529408,140712899206080,11277899,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2307156Z","2025-11-19 22:37:28.2307156Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028022784,18446633084027998208,140702989817872,0,696750407680,5408,1763591848230715600,696748802048,696748781568,140702989817872,67845830,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2307184Z","2025-11-19 22:37:28.2307184Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",8232,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028223488,18446633084028198912,140712865112144,0,696750440448,8232,1763591848230718400,696755683328,696755675136,140712865112144,269699,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2307232Z","2025-11-19 22:37:28.2307232Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",12624,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028911616,18446633084028887040,140702989233856,0,696750473216,12624,1763591848230723200,696759877632,696759869440,140702989233856,1887132,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2307235Z","2025-11-19 22:37:28.2307235Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",14384,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028510208,18446633084028485632,140712899206080,0,696750432256,14384,1763591848230723500,696754634752,696754622464,140712899206080,8595642,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2307333Z","2025-11-19 22:37:28.2307333Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",9776,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084029231104,18446633084029206528,140702989404080,0,696750489600,9776,1763591848230733300,696761974784,696761962496,140702989404080,957334,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2307340Z","2025-11-19 22:37:28.2307340Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",12484,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028481536,18446633084028456960,140712899206080,0,696750424064,12484,1763591848230734000,696753586176,696753573888,140712899206080,10699281,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2307385Z","2025-11-19 22:37:28.2307385Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",1184,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084035321856,18446633084035297280,140702989086576,0,696750481408,1184,1763591848230738500,696760926208,696760918016,140702989086576,2934612,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2307426Z","2025-11-19 22:37:28.2307426Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",14248,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028538880,18446633084028514304,140712899206080,0,696750448640,14248,1763591848230742600,696756731904,696756690944,140712899206080,21428731,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2307493Z","2025-11-19 22:37:28.2307493Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",10496,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028596224,18446633084028571648,140712899206080,0,696750456832,10496,1763591848230749300,696757780480,696757751808,140712899206080,16702796,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2317641Z","2025-11-19 22:37:28.2317641Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084029116416,18446633084029091840,140702989217024,0,696750465024,8552,1763591848231764100,696758829056,696758800384,140702989217024,18009798,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2329108Z","2025-11-19 22:37:28.2329108Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"OpenConsole.ex",,,,,,,,,,,,,,,,1763591848232910800,,,,,134080654410427174,,,,,,,,6626,,,,,,,,,2904064,2949120,170556274,0,134080654489038872,111,0,12,10,3,52,0 +"2025-11-19 22:37:28.2332799Z","2025-11-19 22:37:28.2332799Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13300 conhost.exe",6828,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028309504,18446633084028284928,140712899206080,0,689119428608,6828,1763591848233279900,689122574336,689122566144,140712899206080,96563,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2332863Z","2025-11-19 22:37:28.2332863Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13300 conhost.exe",14856,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028137472,18446633084028112896,140712899206080,0,689119420416,14856,1763591848233286300,689121525760,689121517568,140712899206080,553353,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2333040Z","2025-11-19 22:37:28.2333040Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13300 conhost.exe",3620,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028108800,18446633084028084224,140712865112144,0,689119412224,3620,1763591848233304000,689121001472,689120993280,140712865112144,120327,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2333088Z","2025-11-19 22:37:28.2333088Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13300 conhost.exe",10848,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084027535360,18446633084027510784,140712899206080,0,689119404032,10848,1763591848233308800,689120477184,689120468992,140712899206080,764586,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2333200Z","2025-11-19 22:37:28.2333200Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13300 conhost.exe",6452,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028252160,18446633084028227584,140696384580832,0,689119395840,6452,1763591848233320000,689122050048,689122021376,140696384580832,28729820,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2336004Z","2025-11-19 22:37:28.2336004Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084029374464,18446633084029349888,140696385038832,0,689119436800,4352,1763591848233600400,689123098624,689123086336,140696385038832,745725,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2340631Z","2025-11-19 22:37:28.2340631Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",6612,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029632512,18446633084029607936,140712373211440,0,932562563072,6612,1763591848234063100,932579377152,932579237888,140712373211440,6105737,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2341385Z","2025-11-19 22:37:28.2341385Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"conhost.exe",,,,,,,,,,,,,,,,1763591848234138500,,,,,134080654410205145,,,,,,,,6625,,,,,,,,,1556480,1605632,60704691,109,134080654489052028,92,0,5,0,3,0,0 +"2025-11-19 22:37:28.2493114Z","2025-11-19 22:37:28.2493114Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",9352,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029317120,18446633084029292544,140712899206080,0,932562546688,9352,1763591848249311400,932577280000,932577267712,140712899206080,3968522,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493126Z","2025-11-19 22:37:28.2493126Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",13692,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028653568,18446633084028628992,140712865112144,0,932562554880,13692,1763591848249312600,932578328576,932578308096,140712865112144,8869104,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493138Z","2025-11-19 22:37:28.2493138Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",14632,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029947904,18446633084029923328,140712899206080,0,932562579456,14632,1763591848249313800,932581474304,932581453824,140712899206080,2144557027,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493139Z","2025-11-19 22:37:28.2493139Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",13488,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028854272,18446633084028829696,140712604173856,0,932562513920,13488,1763591848249313900,932574134272,932574130176,140712604173856,12990007,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493172Z","2025-11-19 22:37:28.2493172Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028624896,18446633084028600320,140702319920256,0,932562440192,2344,1763591848249317200,932564697088,932564606976,140702319920256,1455950499,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493206Z","2025-11-19 22:37:28.2493206Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",6260,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028882944,18446633084028858368,140712378637616,0,932562571264,6260,1763591848249320600,932580425728,932580397056,140712378637616,74326129,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493288Z","2025-11-19 22:37:28.2493288Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",13068,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084056907776,18446633084056883200,140712899206080,0,932562530304,13068,1763591848249328800,932575182848,932575174656,140712899206080,1442413,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493310Z","2025-11-19 22:37:28.2493310Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",4192,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029173760,18446633084029149184,140712632221632,0,932562522112,4192,1763591848249331000,932573085696,932573073408,140712632221632,3191112,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493327Z","2025-11-19 22:37:28.2493327Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",3424,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029546496,18446633084029521920,140712899206080,0,932562587648,3424,1763591848249332700,932582522880,932582510592,140712899206080,7336541,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493342Z","2025-11-19 22:37:28.2493342Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",14684,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028968960,18446633084028944384,140712899206080,0,932562595840,14684,1763591848249334200,932583571456,932583559168,140712899206080,3853099,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493343Z","2025-11-19 22:37:28.2493343Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",3272,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028682240,18446633084028657664,140712899206080,0,932562456576,3272,1763591848249334300,932566794240,932566781952,140712899206080,18018463,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493346Z","2025-11-19 22:37:28.2493346Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028710912,18446633084028686336,140712899206080,0,932562464768,12328,1763591848249334600,932567842816,932567830528,140712899206080,16404047,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493363Z","2025-11-19 22:37:28.2493363Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",6564,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084030005248,18446633084029980672,140712899206080,0,932562612224,6564,1763591848249336300,932585668608,932585660416,140712899206080,1315295,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493371Z","2025-11-19 22:37:28.2493371Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",12924,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084030033920,18446633084030009344,140712899206080,0,932562620416,12924,1763591848249337100,932586717184,932586708992,140712899206080,807962,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493410Z","2025-11-19 22:37:28.2493410Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",13344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029976576,18446633084029952000,140712899206080,0,932562604032,13344,1763591848249341000,932584620032,932584611840,140712899206080,1766050,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493421Z","2025-11-19 22:37:28.2493421Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",10628,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084010672128,18446633084010647552,140712899206080,0,932562472960,10628,1763591848249342100,932568891392,932568879104,140712899206080,4099788,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493446Z","2025-11-19 22:37:28.2493446Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",11164,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028739584,18446633084028715008,140712865112144,0,932562481152,11164,1763591848249344600,932569939968,932569931776,140712865112144,142205,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493466Z","2025-11-19 22:37:28.2493466Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",6140,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028080128,18446633084028055552,140712899206080,0,932562448384,6140,1763591848249346600,932565745664,932565729280,140712899206080,30190715,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493471Z","2025-11-19 22:37:28.2493471Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",13704,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084030062592,18446633084030038016,140712899206080,0,932562628608,13704,1763591848249347100,932587765760,932587761664,140712899206080,393419,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2494031Z","2025-11-19 22:37:28.2494031Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",11792,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029026304,18446633084029001728,140712891292720,0,932562497536,11792,1763591848249403100,932572037120,932572016640,140712891292720,10320952,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2494319Z","2025-11-19 22:37:28.2494319Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",9736,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028768256,18446633084028743680,140712899206080,0,932562489344,9736,1763591848249431900,932570988544,932570972160,140712899206080,8949073,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2494409Z","2025-11-19 22:37:28.2494409Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",4376,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084027793408,18446633084027768832,140712583404848,0,932562538496,4376,1763591848249440900,932576231424,932576223232,140712583404848,640863,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2568176Z","2025-11-19 22:37:28.2568176Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"WindowsTermina",,,,,,,,,,,,,,,,1763591848256817600,,,,,134080654410898354,,,,,,,,6627,,,,,,,,,16748544,19189760,3883624426,0,134080654489267736,577,0,60,53,3,7,0 +"2025-11-19 22:37:28.2575230Z","2025-11-19 22:37:28.2575230Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",13872,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084037992448,18446633084037967872,140711612509856,0,1046354432000,13872,1763591848257523000,1046352232448,1046352216064,140711612509856,1922208,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4656761Z","2025-11-19 22:37:28.4656761Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 8476 ServiceHub.IdentityHost.exe",,,,,,,,,,,,,18446633084041035776,18446633084041011200,140712899206080,0,843735072768,3676,1763591848465676100,843738251264,843738247168,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4657535Z","2025-11-19 22:37:28.4657535Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"13072 vctip.exe",,,,,,,,,,,,,18446633084029317120,18446633084029292544,140712899206080,0,941791567872,9260,1763591848465753500,941796360192,941796352000,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4657851Z","2025-11-19 22:37:28.4657851Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1520 powershell.exe",,,,,,,,,,,,,18446633084027793408,18446633084027768832,140712899206080,0,931707506688,1888,1763591848465785100,931708534784,931708526592,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4658205Z","2025-11-19 22:37:28.4658205Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"12052 ServiceHub.TestWindowStoreHost.exe",,,,,,,,,,,,,18446633084055474176,18446633084055449600,140712899206080,0,17905557504,4840,1763591848465820500,17910726656,17910722560,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4658465Z","2025-11-19 22:37:28.4658465Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,18446633084016447488,18446633084016422912,140712899206080,0,46015684608,10824,1763591848465846500,46028292096,46028275712,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4658775Z","2025-11-19 22:37:28.4658775Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"10252 ServiceHub.IndexingService.exe",,,,,,,,,,,,,18446633084028854272,18446633084028829696,140712899206080,0,848613720064,13472,1763591848465877500,848617799680,848617795584,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4659003Z","2025-11-19 22:37:28.4659003Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"10648 ServiceHub.Host.dotnet.x64.exe",,,,,,,,,,,,,18446633084028624896,18446633084028600320,140712899206080,0,515211558912,1976,1763591848465900300,515216769024,515216764928,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4659380Z","2025-11-19 22:37:28.4659380Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"10200 ServiceHub.VSDetouredHost.exe",,,,,,,,,,,,,18446633084030062592,18446633084030038016,140712899206080,0,617597181952,3900,1763591848465938000,617601826816,617601822720,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4659602Z","2025-11-19 22:37:28.4659602Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9988 Microsoft.ServiceHub.Controller.exe",,,,,,,,,,,,,18446633084028739584,18446633084028715008,140712899206080,0,1049753075712,14992,1763591848465960200,1049757745152,1049757741056,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4704807Z","2025-11-19 22:37:28.4704807Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,18446633084028080128,18446633084028055552,140712899206080,0,46015692800,5212,1763591848470480700,46045069312,46045052928,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4905294Z","2025-11-19 22:37:28.4905294Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9280 Greenshot.exe",,,,,,,,,,,,,18446633084028682240,18446633084028657664,140712899206080,0,948118986752,12724,1763591848490529400,948123467776,948123463680,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:29.3932962Z","2025-11-19 22:37:29.3932962Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13072 vctip.exe",8676,,,"13072 vctip.exe",,,,,,,,,,,,,18446633084057079808,18446633084057055232,140712899206080,0,941791477760,8676,1763591849393296200,941795311616,941795303424,140712899206080,210478,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:29.3933765Z","2025-11-19 22:37:29.3933765Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13072 vctip.exe",6088,,,"13072 vctip.exe",,,,,,,,,,,,,18446633084057051136,18446633084057026560,140712899206080,0,941791469568,6088,1763591849393376500,941794263040,941794254848,140712899206080,1198365,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:29.6961056Z","2025-11-19 22:37:29.6961056Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 9920 ServiceHub.IntellicodeModelService.exe",9760,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,18446633084028108800,18446633084028084224,140711612509856,0,46015700992,1468,1763591849696105600,46012694528,46012678144,140711612509856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:29.8394671Z","2025-11-19 22:37:29.8394671Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","10648 ServiceHub.Host.dotnet.x64.exe",10688,,,"10648 ServiceHub.Host.dotnet.x64.exe",,,,,,,,,,,,,18446633084057079808,18446633084057055232,140711121663952,0,515211567104,9320,1763591849839467100,515218341888,515218337792,140711121663952,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:29.8397391Z","2025-11-19 22:37:29.8397391Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","10648 ServiceHub.Host.dotnet.x64.exe",9320,,,"10648 ServiceHub.Host.dotnet.x64.exe",,,,,,,,,,,,,18446633084028395520,18446633084028370944,140711121663952,0,515211575296,11464,1763591849839739100,515219914752,515219910656,140711121663952,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:29.9831575Z","2025-11-19 22:37:29.9831575Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5096 svchost.exe",15108,,," 5096 svchost.exe",,,,,,,,,,,,,18446633084056850432,18446633084056825856,140712865112144,199,667265712128,15108,1763591849983157500,667271823360,667271790592,140712865112144,285541,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:31.0497261Z","2025-11-19 22:37:31.0497261Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8004 svchost.exe",2300,,," 8004 svchost.exe",,,,,,,,,,,,,18446633084004868096,18446633084004843520,140712899206080,0,841719537664,2300,1763591851049726100,841721839616,841721806848,140712899206080,226697,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:31.2092051Z","2025-11-19 22:37:31.2092051Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9920 ServiceHub.IntellicodeModelService.exe",1468,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,18446633084028108800,18446633084028084224,140711612509856,0,46015700992,1468,1763591851209205100,46012694528,46012678144,140711612509856,929799,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:31.6880035Z","2025-11-19 22:37:31.6880035Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13084 MSBuild.exe",12948,,,"13084 MSBuild.exe",,,,,,,,,,,,,18446633084002254848,18446633084002230272,140712899206080,0,911121563648,12948,1763591851688003500,911130755072,911130738688,140712899206080,5634614,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:31.6915761Z","2025-11-19 22:37:31.6915761Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8972 VBoxTray.exe",9020,,," 8972 VBoxTray.exe",,,,,,,,,,,,,18446633084002254848,18446633084002230272,140700131109808,0,471283212288,10176,1763591851691576100,471299260416,471299256320,140700131109808,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:31.6918214Z","2025-11-19 22:37:31.6918214Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8972 VBoxTray.exe",10176,,," 8972 VBoxTray.exe",,,,,,,,,,,,,18446633084002254848,18446633084002230272,140700131109808,0,471283212288,10176,1763591851691821400,471299260416,471299252224,140700131109808,462825,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:32.0530558Z","2025-11-19 22:37:32.0530558Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 8004 svchost.exe",,,,,,,,,,,,,18446633084028538880,18446633084028514304,140712899206080,0,841719545856,11156,1763591852053055800,841721839616,841721806848,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:32.3222797Z","2025-11-19 22:37:32.3222797Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",10448,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084018716672,18446633084018692096,140711613062896,0,1046354366464,10448,1763591852322279700,1046367698944,1046367682560,140711613062896,941871,,,,,,,,,,,,,,,,,,,,,,,,,,,,, diff --git a/x64/Release/EDRi.exe b/x64/Release/EDRi.exe index a852c59..b79b312 100644 Binary files a/x64/Release/EDRi.exe and b/x64/Release/EDRi.exe differ