From d06b09ded00a5415fc7964a0d6074eaec42e9cd4 Mon Sep 17 00:00:00 2001 From: cailllev Date: Wed, 19 Nov 2025 23:37:53 +0100 Subject: [PATCH] works --- ...fender-vs-Injector-standard-events-All.csv | 3303 +++++++++-------- ...er-vs-Injector-standard-events-Minimal.csv | 79 +- ...r-vs-Injector-standard-events-Relevant.csv | 1178 +++--- x64/Release/EDRi.exe | Bin 522752 -> 522240 bytes 4 files changed, 2282 insertions(+), 2278 deletions(-) diff --git a/EDRi/dumps/Defender-vs-Injector-standard-events-All.csv b/EDRi/dumps/Defender-vs-Injector-standard-events-All.csv index 561d378..07ea32f 100644 --- a/EDRi/dumps/Defender-vs-Injector-standard-events-All.csv +++ b/EDRi/dumps/Defender-vs-Injector-standard-events-All.csv @@ -1,1640 +1,1663 @@ -timestamp_sys,timestamp_etw,src_type,provider_name,event_id,task_info,process_id,thread_id,ppid,pid,targetpid,targettid,message,filepath,cachename,result,vname,name,sigseq,sigsha,commandline,firstparam,secondparam,timestamp_ns,stackbase,stacklimit,startaddr,subprocesstag,tebbase,threadid,userstackbase,userstacklimit,win32startaddr,cycletime,defaultbase,imagebase,imagechecksum,imagesize,timedatestamp,commitcharge,commitpeak,cpucyclecount,createtime,exitcode,exittime,handlecount,hardfaultcount,processsequencenumber,readoperationcount,readtransferkilobytes,tokenelevationtype,writeoperationcount,writetransferkilobytes,flags,mandatorylabel,packagefullname,packagerelativeappid,parentprocessid,parentprocesssequencenumber,processtokenelevationtype,processtokeniselevated,securitymitigations,sessionid"2025-11-19 19:51:16.343730900Z","2025-11-19 19:51:16.3437374Z","myETW","EDRi-Provider",4242,"EDRiTask","12472 EDRi.exe",,,,,,"++ EDRi START MARKER ++",,,,,,,,,,,1763581876343737400,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.5865091Z","2025-11-19 19:51:16.5865091Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8972 VBoxTray.exe",9020,,," 8972 VBoxTray.exe",,,,,,,,,,,,,1763581876586509100,18446633084041842688,18446633084041818112,140700131109808,0,471284228096,9164,471286677504,471286673408,140700131109808,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.5868139Z","2025-11-19 19:51:16.5868139Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8972 VBoxTray.exe",9164,,," 8972 VBoxTray.exe",,,,,,,,,,,,,1763581876586813900,18446633084041842688,18446633084041818112,140700131109808,0,471284228096,9164,471286677504,471286669312,140700131109808,428122,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.6931597Z","2025-11-19 19:51:16.6931597Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"11648 RuntimeBroker.exe",,,,,,,,,,,,,1763581876693159700,18446633084041842688,18446633084041818112,140712899206080,0,503394820096,3896,503397220352,503397171200,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.6933880Z","2025-11-19 19:51:16.6933880Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11648 RuntimeBroker.exe",3896,,,"11648 RuntimeBroker.exe",,,,,,,,,,,,,1763581876693388000,18446633084040663040,18446633084040638464,140712899206080,0,503394828288,8592,503397744640,503397695488,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.7247840Z","2025-11-19 19:51:16.7247840Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 5664 OpenConsole.exe",,,,,,,,,,,,,1763581876724784000,18446633084041900032,18446633084041875456,140712899206080,0,304352927744,12896,304354426880,304354422784,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9633043Z","2025-11-19 19:51:16.9633043Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13120 ",540,,,"13120 ",,,,,,,,,,,,,1763581876963304300,18446633084052176896,18446633084052152320,140712865112144,0,619234459648,540,619238653952,619238604800,140712865112144,934326,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9633044Z","2025-11-19 19:51:16.9633044Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13120 ",8284,,,"13120 ",,,,,,,,,,,,,1763581876963304400,18446633084051488768,18446633084051464192,140712899206080,0,619236544512,8284,619238129664,619238080512,140712899206080,46624563,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9633055Z","2025-11-19 19:51:16.9633055Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13120 ",12604,,,"13120 ",,,,,,,,,,,,,1763581876963305500,18446633084053524480,18446633084053499904,140712899206080,0,619234476032,12604,619237605376,619237556224,140712899206080,736670,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9633063Z","2025-11-19 19:51:16.9633063Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13120 ",14864,,,"13120 ",,,,,,,,,,,,,1763581876963306300,18446633084043333632,18446633084043309056,140712899206080,0,619236519936,14864,619234000896,619233951744,140712899206080,3646014,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9633083Z","2025-11-19 19:51:16.9633083Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13120 ",15068,,,"13120 ",,,,,,,,,,,,,1763581876963308300,18446633084036870144,18446633084036845568,140699399787184,0,619236216832,15068,619233476608,619233427456,140699399787184,56130748,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9633298Z","2025-11-19 19:51:16.9633298Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13120 ",13920,,,"13120 ",,,,,,,,,,,,,1763581876963329800,18446633084041756672,18446633084041732096,140712865112144,0,619236282368,13920,619240226816,619240177664,140712865112144,120178560,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9634505Z","2025-11-19 19:51:16.9634505Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13120 ",1692,,,"13120 ",,,,,,,,,,,,,1763581876963450500,18446633084024516608,18446633084024492032,140712899206080,0,619234467840,1692,619237081088,619237031936,140712899206080,1102179,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9639407Z","2025-11-19 19:51:16.9639407Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5184 explorer.exe",3712,,," 5184 explorer.exe",,,,,,,,,,,,,1763581876963940700,18446633084022595584,18446633084022571008,140712891292720,0,15220736,3712,467664896,467607552,140712891292720,5481847,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9643705Z","2025-11-19 19:51:16.9643705Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\RuntimeBroker.exe",,,,,,,,,,1763581876964370500,,,,,,,,,,,140699399749632,140699399749632,148437,126976,1175682367,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9643839Z","2025-11-19 19:51:16.9643839Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\twinui.dll",,,,,,,,,,1763581876964383900,,,,,,,,,,,140712339046400,140712339046400,5239409,5242880,279122806,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9643947Z","2025-11-19 19:51:16.9643947Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\gamemode.dll",,,,,,,,,,1763581876964394700,,,,,,,,,,,140712543387648,140712543387648,164324,114688,328629043,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9644123Z","2025-11-19 19:51:16.9644123Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\OneCoreCommonProxyStub.dll",,,,,,,,,,1763581876964412300,,,,,,,,,,,140712570257408,140712570257408,903222,823296,2010952444,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9644228Z","2025-11-19 19:51:16.9644228Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\iertutil.dll",,,,,,,,,,1763581876964422800,,,,,,,,,,,140712642805760,140712642805760,2984761,2904064,3815768453,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9644303Z","2025-11-19 19:51:16.9644303Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\srvcli.dll",,,,,,,,,,1763581876964430300,,,,,,,,,,,140712668954624,140712668954624,181029,167936,239922031,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9644395Z","2025-11-19 19:51:16.9644395Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,1763581876964439500,,,,,,,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9644486Z","2025-11-19 19:51:16.9644486Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\mscms.dll",,,,,,,,,,1763581876964448600,,,,,,,,,,,140712711880704,140712711880704,859508,786432,1878966387,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9644575Z","2025-11-19 19:51:16.9644575Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\OneCoreUAPCommonProxyStub.dll",,,,,,,,,,1763581876964457500,,,,,,,,,,,140712713977856,140712713977856,6740758,6615040,2011948997,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9644704Z","2025-11-19 19:51:16.9644704Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\propsys.dll",,,,,,,,,,1763581876964470400,,,,,,,,,,,140712761491456,140712761491456,1123662,1060864,3228732737,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9644816Z","2025-11-19 19:51:16.9644816Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581876964481600,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9644903Z","2025-11-19 19:51:16.9644903Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\uxtheme.dll",,,,,,,,,,1763581876964490300,,,,,,,,,,,140712802254848,140712802254848,696534,696320,1695798817,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9644978Z","2025-11-19 19:51:16.9644978Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\DXCore.dll",,,,,,,,,,1763581876964497800,,,,,,,,,,,140712805400576,140712805400576,331386,274432,2354081039,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9645067Z","2025-11-19 19:51:16.9645067Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\windows.storage.dll",,,,,,,,,,1763581876964506700,,,,,,,,,,,140712812412928,140712812412928,8877403,8769536,3667346596,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9645155Z","2025-11-19 19:51:16.9645155Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\netutils.dll",,,,,,,,,,1763581876964515500,,,,,,,,,,,140712825847808,140712825847808,80696,53248,865845000,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9645240Z","2025-11-19 19:51:16.9645240Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,1763581876964524000,,,,,,,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9645389Z","2025-11-19 19:51:16.9645389Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\ntmarta.dll",,,,,,,,,,1763581876964538900,,,,,,,,,,,140712831811584,140712831811584,265798,221184,3598506564,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9645469Z","2025-11-19 19:51:16.9645469Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\cfgmgr32.dll",,,,,,,,,,1763581876964546900,,,,,,,,,,,140712845049856,140712845049856,385808,356352,1737777300,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9645550Z","2025-11-19 19:51:16.9645550Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\umpdc.dll",,,,,,,,,,1763581876964555000,,,,,,,,,,,140712848064512,140712848064512,98535,81920,1714427184,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9645619Z","2025-11-19 19:51:16.9645619Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\powrprof.dll",,,,,,,,,,1763581876964561900,,,,,,,,,,,140712848195584,140712848195584,457799,385024,2858637235,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9645780Z","2025-11-19 19:51:16.9645780Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\bcrypt.dll",,,,,,,,,,1763581876964578000,,,,,,,,,,,140712848654336,140712848654336,206048,172032,2893678010,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9645934Z","2025-11-19 19:51:16.9645934Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\profapi.dll",,,,,,,,,,1763581876964593400,,,,,,,,,,,140712848850944,140712848850944,229548,167936,2447194521,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9646033Z","2025-11-19 19:51:16.9646033Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,1763581876964603300,,,,,,,,,,,140712851341312,140712851341312,1524912,1486848,1404855129,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9646112Z","2025-11-19 19:51:16.9646112Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,1763581876964611200,,,,,,,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9646188Z","2025-11-19 19:51:16.9646188Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581876964618800,,,,,,,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9646256Z","2025-11-19 19:51:16.9646256Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,1763581876964625600,,,,,,,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9646348Z","2025-11-19 19:51:16.9646348Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581876964634800,,,,,,,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9646423Z","2025-11-19 19:51:16.9646423Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581876964642300,,,,,,,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9646544Z","2025-11-19 19:51:16.9646544Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,1763581876964654400,,,,,,,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9646638Z","2025-11-19 19:51:16.9646638Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581876964663800,,,,,,,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9646705Z","2025-11-19 19:51:16.9646705Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\combase.dll",,,,,,,,,,1763581876964670500,,,,,,,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9646777Z","2025-11-19 19:51:16.9646777Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\shlwapi.dll",,,,,,,,,,1763581876964677700,,,,,,,,,,,140712868839424,140712868839424,479562,421888,2142510382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9646845Z","2025-11-19 19:51:16.9646845Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,1763581876964684500,,,,,,,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9646922Z","2025-11-19 19:51:16.9646922Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581876964692200,,,,,,,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9647006Z","2025-11-19 19:51:16.9647006Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\ole32.dll",,,,,,,,,,1763581876964700600,,,,,,,,,,,140712878473216,140712878473216,1689904,1667072,1018821057,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9647082Z","2025-11-19 19:51:16.9647082Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,1763581876964708200,,,,,,,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9647221Z","2025-11-19 19:51:16.9647221Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581876964722100,,,,,,,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9647286Z","2025-11-19 19:51:16.9647286Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,1763581876964728600,,,,,,,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9647366Z","2025-11-19 19:51:16.9647366Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,1763581876964736600,,,,,,,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9647436Z","2025-11-19 19:51:16.9647436Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,1763581876964743600,,,,,,,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9647507Z","2025-11-19 19:51:16.9647507Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\user32.dll",,,,,,,,,,1763581876964750700,,,,,,,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9647590Z","2025-11-19 19:51:16.9647590Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,1763581876964759000,,,,,,,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9647664Z","2025-11-19 19:51:16.9647664Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581876964766400,,,,,,,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9647802Z","2025-11-19 19:51:16.9647802Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581876964780200,,,,,,,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9647881Z","2025-11-19 19:51:16.9647881Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13120 ",1692,,,"13120 ",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581876964788100,,,,,,,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9648012Z","2025-11-19 19:51:16.9648012Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop ","13120 ",1692,,,"13120 ",,,"RuntimeBroker.",,,,,,,,,,1763581876964801200,,,,,,,,,,,,,,,,3215360,3645440,424320572,134080539436056425,0,134080554769450943,264,0,2861,12,26,3,4,12,,,,,,,,,, -"2025-11-19 19:51:16.9791067Z","2025-11-19 19:51:16.9791067Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1416 ApplicationFrameHost.exe",11516,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,1763581876979106700,18446633084046409728,18446633084046385152,140712891292720,0,199841775616,11516,199843905536,199843897344,140712891292720,31722890,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9793344Z","2025-11-19 19:51:16.9793344Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4340 sihost.exe",13900,,," 4340 sihost.exe",,,,,,,,,,,,,1763581876979334400,18446633084023111680,18446633084023087104,140712891292720,0,645640536064,13900,645647040512,645647028224,140712891292720,5391318,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9950931Z","2025-11-19 19:51:16.9950931Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4340 sihost.exe",13260,,," 4340 sihost.exe",,,,,,,,,,,,,1763581876995093100,18446633084011245568,18446633084011220992,140712891292720,0,645640544256,13260,645647564800,645647548416,140712891292720,3404229,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9951060Z","2025-11-19 19:51:16.9951060Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1416 ApplicationFrameHost.exe",13876,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,1763581876995106000,18446633084045979648,18446633084045955072,140712891292720,0,199841767424,13876,199842332672,199842316288,140712891292720,181487517,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.0111136Z","2025-11-19 19:51:17.0111136Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1416 ApplicationFrameHost.exe",9424,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,1763581877011113600,18446633083987144704,18446633083987120128,140712891292720,0,199841759232,9424,199839318016,199839297536,140712891292720,65582250,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.0430380Z","2025-11-19 19:51:17.0430380Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5992 svchost.exe",13196,,," 5992 svchost.exe",,,,,,,,,,,,,1763581877043038000,18446633084053237760,18446633084053213184,140712899206080,0,477737390080,13196,477738565632,477738532864,140712899206080,8061896,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.0430460Z","2025-11-19 19:51:17.0430460Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5992 svchost.exe",13756,,," 5992 svchost.exe",,,,,,,,,,,,,1763581877043046100,18446633084028424192,18446633084028399616,140712899206080,0,477737398272,13756,477739089920,477739057152,140712899206080,6557245,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.2863561Z","2025-11-19 19:51:17.2863561Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","15184 SearchProtocolHost.exe",4084,,,"15184 SearchProtocolHost.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,1763581877286356100,,,,,,,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.2875043Z","2025-11-19 19:51:17.2875043Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","15184 SearchProtocolHost.exe",4084,,,"15184 SearchProtocolHost.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,1763581877287504300,,,,,,,,,,,140712869888000,140712869888000,7769948,7675904,2341846616,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.2923207Z","2025-11-19 19:51:17.2923207Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6500 SearchHost.exe",14484,,," 6500 SearchHost.exe",,,,,,,,,,,,,1763581877292320700,18446633084058714112,18446633084058689536,140712449945792,0,1050565754880,14484,1050568294400,1050568228864,140712449945792,1580469,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.2923407Z","2025-11-19 19:51:17.2923407Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","15184 SearchProtocolHost.exe",4084,,,"15184 SearchProtocolHost.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,1763581877292340700,,,,,,,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.2924784Z","2025-11-19 19:51:17.2924784Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6500 SearchHost.exe",14300,,," 6500 SearchHost.exe",,,,,,,,,,,,,1763581877292478500,18446633084041756672,18446633084041732096,140712449945792,0,1050565763072,11380,1050568294400,1050568228864,140712449945792,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.2931419Z","2025-11-19 19:51:17.2931419Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","15184 SearchProtocolHost.exe",4084,,,"15184 SearchProtocolHost.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,1763581877293141900,,,,,,,,,,,140712869888000,140712869888000,7769948,7675904,2341846616,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.2967529Z","2025-11-19 19:51:17.2967529Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6500 SearchHost.exe",11380,,," 6500 SearchHost.exe",,,,,,,,,,,,,1763581877296752900,18446633084041756672,18446633084041732096,140712449945792,0,1050565763072,11380,1050568294400,1050568228864,140712449945792,1074644,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.2968507Z","2025-11-19 19:51:17.2968507Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6500 SearchHost.exe",14300,,," 6500 SearchHost.exe",,,,,,,,,,,,,1763581877296850700,18446633084041756672,18446633084041732096,140712449945792,0,1050565771264,14416,1050568294400,1050568228864,140712449945792,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.287575200Z","2025-11-19 19:51:17.3448096Z","myETW","EDRi-Provider",4242,"EDRiTask","12472 EDRi.exe",,,,,,"++ EDRi START MARKER ++",,,,,,,,,,,1763581877344809600,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.5841062Z","2025-11-19 19:51:17.5841062Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9920 ServiceHub.IntellicodeModelService.exe",5860,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,1763581877584106200,18446633084005670912,18446633084005646336,140711612509856,0,46014308352,5860,46012694528,46012678144,140711612509856,774012,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.197740800Z","2025-11-19 19:51:18.3561017Z","myETW","EDRi-Provider",4242,"EDRiTask","12472 EDRi.exe",,,,,,"Before decrypting the attack exe from C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\attacks\Injector-standard.exe.enc",,,,,,,,,,,1763581878356101700,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.199912800Z","2025-11-19 19:51:18.3585127Z","myETW","EDRi-Provider",4242,"EDRiTask","12472 EDRi.exe",,,,,,"After decrypting the attack exe",,,,,,,,,,,1763581878358512700,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.3963495Z","2025-11-19 19:51:18.3963495Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3504 svchost.exe",12864,,," 3504 svchost.exe",,,,,,,,,,,,,1763581878396349500,18446633083987144704,18446633083987120128,140712899206080,38,949314420736,8740,949313404928,949313372160,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.4026822Z","2025-11-19 19:51:18.4026822Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3564 MsMpEng.exe",8704,,," 3564 MsMpEng.exe",,,,,,,,,,,,,1763581878402682200,18446633084043333632,18446633084043309056,140712865112144,247,273686036480,12944,273705598976,273705533440,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.4034668Z","2025-11-19 19:51:18.4034668Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1776 svchost.exe",2748,,," 1776 svchost.exe",,,,,,,,,,,,,1763581878403466800,18446633084042158080,18446633084042133504,140712899206080,122,699936538624,1248,699937587200,699937554432,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.4082367Z","2025-11-19 19:51:18.4082367Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2376 svchost.exe",2640,,," 2376 svchost.exe",,,,,,,,,,,,,1763581878408236700,18446633084042186752,18446633084042162176,140712899206080,248,36400259072,2884,36401315840,36401283072,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.4099234Z","2025-11-19 19:51:18.4099234Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2932 svchost.exe",5072,,," 2932 svchost.exe",,,,,,,,,,,,,1763581878409923400,18446633084045979648,18446633084045955072,140712899206080,49,212461367296,14528,212459651072,212459585536,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.4324897Z","2025-11-19 19:51:18.4324897Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3504 svchost.exe",12864,,," 3504 svchost.exe",,,,,,,,,,,,,1763581878432489700,18446633084042100736,18446633084042076160,140712678802768,38,949314428928,6532,949316747264,949316714496,140712678802768,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.7511985Z","2025-11-19 19:51:18.7511985Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1520 powershell.exe",4168,,," 1520 powershell.exe",,,,,,,,,,,,,1763581878751198500,18446633084042129408,18446633084042104832,140712899206080,0,931706306560,6084,931710107648,931710099456,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.7512011Z","2025-11-19 19:51:18.7512011Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8916 SecurityHealthService.exe",8952,,," 8916 SecurityHealthService.exe",,,,,,,,,,,,,1763581878751201100,18446633084042330112,18446633084042305536,140712899206080,167,33812795392,13648,33815003136,33814994944,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.0792892Z","2025-11-19 19:51:19.0792892Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 872 wininit.exe",5580,,," 872 wininit.exe",,,,,,,,,,,,,1763581879079289300,18446633084040691712,18446633084040667136,140712899206080,0,97764474880,5580,97765556224,97765498880,140712899206080,268944,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.108607600Z","2025-11-19 19:51:19.3681762Z","myETW","EDRi-Provider",4242,"EDRiTask","12472 EDRi.exe",,,,,,"Before starting the attack exe",,,,,,,,,,,1763581879368176200,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.3794628Z","2025-11-19 19:51:19.3794628Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8448 OneDrive.exe",8496,,," 8448 OneDrive.exe",,,,,,,,,,,,,1763581879379462800,18446633084042072064,18446633084042047488,140712859481984,0,70345129984,12656,70351060992,70351056896,140712859481984,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.3795497Z","2025-11-19 19:51:19.3795497Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8448 OneDrive.exe",8496,,," 8448 OneDrive.exe",,,,,,,,,,,,,1763581879379549700,18446633084040691712,18446633084040667136,140712859481984,0,70345138176,4244,70353158144,70353154048,140712859481984,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.5582180Z","2025-11-19 19:51:19.5582180Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1564 svchost.exe",320,,," 1564 svchost.exe",,,,,,,,,,,,,1763581879558218000,18446633083995705344,18446633083995680768,140712899206080,0,86741528576,320,86739845120,86739812352,140712899206080,348156,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.5582222Z","2025-11-19 19:51:19.5582222Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1676 svchost.exe",14356,,," 1676 svchost.exe",,,,,,,,,,,,,1763581879558222300,18446633084007567360,18446633084007542784,140712899206080,0,289651163136,14356,289649328128,289649295360,140712899206080,294971,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.5582251Z","2025-11-19 19:51:19.5582251Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1388 svchost.exe",7708,,," 1388 svchost.exe",,,,,,,,,,,,,1763581879558225100,18446633083995619328,18446633083995594752,140712899206080,0,867845017600,7708,867846062080,867846029312,140712899206080,442079,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.5582269Z","2025-11-19 19:51:19.5582269Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1796 svchost.exe",13672,,," 1796 svchost.exe",,,,,,,,,,,,,1763581879558226900,18446633084043304960,18446633084043280384,140712899206080,0,708991610880,13672,708990205952,708990173184,140712899206080,218022,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.5582272Z","2025-11-19 19:51:19.5582272Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1660 svchost.exe",10848,,," 1660 svchost.exe",,,,,,,,,,,,,1763581879558227200,18446633084006277120,18446633084006252544,140712899206080,0,265906405376,10848,265905373184,265905340416,140712899206080,567308,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.5582306Z","2025-11-19 19:51:19.5582306Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1580 svchost.exe",11172,,," 1580 svchost.exe",,,,,,,,,,,,,1763581879558230600,18446633083995676672,18446633083995652096,140712899206080,0,966821433344,11172,966823247872,966823215104,140712899206080,442078,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.6057562Z","2025-11-19 19:51:19.6057562Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13112 TimelineExplorer.exe",3660,,,"13112 TimelineExplorer.exe",,,,,,,,,,,,,1763581879605756200,18446633083995676672,18446633083995652096,140710065285584,0,1007263309824,6596,1007268921344,1007268917248,140710065285584,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.6062469Z","2025-11-19 19:51:19.6062469Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13112 TimelineExplorer.exe",6596,,,"13112 TimelineExplorer.exe",,,,,,,,,,,,,1763581879606246900,18446633083995705344,18446633083995680768,140710065285584,0,1007263318016,13176,1007270494208,1007270490112,140710065285584,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.6854481Z","2025-11-19 19:51:19.6854481Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2244 svchost.exe",10872,,," 2244 svchost.exe",,,,,,,,,,,,,1763581879685448100,18446633084007510016,18446633084007485440,140712899206080,0,927664201728,10872,927665225728,927665192960,140712899206080,271962,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.7168967Z","2025-11-19 19:51:19.7168967Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2384 svchost.exe",11224,,," 2384 svchost.exe",,,,,,,,,,,,,1763581879716896700,18446633084007280640,18446633084007256064,140712899206080,0,928822128640,11224,928820035584,928820002816,140712899206080,284409,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.7681200Z","2025-11-19 19:51:19.7681200Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3564 MsMpEng.exe",15092,,," 3564 MsMpEng.exe",,,,,,,,,,,,,1763581879768120000,18446633084007280640,18446633084007256064,140712850417280,247,273686044672,13280,273711366144,273711345664,140712850417280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.7962656Z","2025-11-19 19:51:19.7962656Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2572 svchost.exe",12492,,," 2572 svchost.exe",,,,,,,,,,,,,1763581879796265600,18446633083989929984,18446633083989905408,140712899206080,0,140318752768,12492,140317556736,140317523968,140712899206080,58596122,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.7962861Z","2025-11-19 19:51:19.7962861Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2580 svchost.exe",1592,,," 2580 svchost.exe",,,,,,,,,,,,,1763581879796286100,18446633084006535168,18446633084006510592,140712899206080,0,139709349888,1592,139707613184,139707580416,140712899206080,432271,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.8593797Z","2025-11-19 19:51:19.8593797Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2688 svchost.exe",15088,,," 2688 svchost.exe",,,,,,,,,,,,,1763581879859379700,18446633084017565696,18446633084017541120,140712899206080,0,461861052416,15088,461859520512,461859487744,140712899206080,3639602,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.8593858Z","2025-11-19 19:51:19.8593858Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2824 svchost.exe",14692,,," 2824 svchost.exe",,,,,,,,,,,,,1763581879859385800,18446633084007337984,18446633084007313408,140712899206080,0,912958394368,14692,912960520192,912960487424,140712899206080,190109,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.8593878Z","2025-11-19 19:51:19.8593878Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2924 svchost.exe",15280,,," 2924 svchost.exe",,,,,,,,,,,,,1763581879859387800,18446633084053037056,18446633084053012480,140712899206080,0,22795169792,15280,22796566528,22796533760,140712899206080,320242,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.9394117Z","2025-11-19 19:51:19.9394117Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2724 svchost.exe",13784,,," 2724 svchost.exe",,,,,,,,,,,,,1763581879939411700,18446633084007624704,18446633084007600128,140712899206080,0,89489293312,13784,89490718720,89490685952,140712899206080,388516,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.9713021Z","2025-11-19 19:51:19.9713021Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3316 svchost.exe",15048,,," 3316 svchost.exe",,,,,,,,,,,,,1763581879971302100,18446633084007768064,18446633084007743488,140712899206080,0,725981220864,15048,725982642176,725982609408,140712899206080,116932,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.9713034Z","2025-11-19 19:51:19.9713034Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3256 svchost.exe",14068,,," 3256 svchost.exe",,,,,,,,,,,,,1763581879971303400,18446633084007653376,18446633084007628800,140712899206080,0,435930497024,14068,433793794048,433793761280,140712899206080,313453,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.9713095Z","2025-11-19 19:51:19.9713095Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3456 svchost.exe",11540,,," 3456 svchost.exe",,,,,,,,,,,,,1763581879971309500,18446633084007858176,18446633084007833600,140712899206080,0,94398496768,11540,94400151552,94400118784,140712899206080,179170,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.9713146Z","2025-11-19 19:51:19.9713146Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3000 svchost.exe",11392,,," 3000 svchost.exe",,,,,,,,,,,,,1763581879971314600,18446633084019789824,18446633084019765248,140712899206080,0,1014020698112,11392,1014021750784,1014021718016,140712899206080,198407,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.9713249Z","2025-11-19 19:51:19.9713249Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3532 svchost.exe",8628,,," 3532 svchost.exe",,,,,,,,,,,,,1763581879971324900,18446633083996078080,18446633083996053504,140712899206080,0,761505017856,8628,761506299904,761506267136,140712899206080,396438,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.0667475Z","2025-11-19 19:51:20.0667475Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3608 svchost.exe",13932,,," 3608 svchost.exe",,,,,,,,,,,,,1763581880066747500,18446633084007944192,18446633084007919616,140712899206080,0,310404599808,13932,310406807552,310406774784,140712899206080,237636,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.0667560Z","2025-11-19 19:51:20.0667560Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3740 svchost.exe",11332,,," 3740 svchost.exe",,,,,,,,,,,,,1763581880066756000,18446633083981160448,18446633083981135872,140712899206080,0,100414373888,11332,100416356352,100416323584,140712899206080,504693,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.0827302Z","2025-11-19 19:51:20.0827302Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 872 wininit.exe",,,,,,,,,,,,,1763581880082730200,18446633083981160448,18446633083981135872,140712899206080,0,97764483072,1924,97765556224,97765498880,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.2250627Z","2025-11-19 19:51:20.2250627Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4192 svchost.exe",7568,,," 4192 svchost.exe",,,,,,,,,,,,,1763581880225062700,18446633083979362304,18446633083979337728,140712899206080,0,330479362048,7568,330476748800,330476716032,140712899206080,297987,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.5099571Z","2025-11-19 19:51:20.5099571Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","12740 svchost.exe",14676,,,"12740 svchost.exe",,,,,,,,,,,,,1763581880509957100,18446633084011245568,18446633084011220992,140712899206080,9,237559373824,8312,237558366208,237558333440,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.5732911Z","2025-11-19 19:51:20.5732911Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1388 svchost.exe",,,,,,,,,,,,,1763581880573291100,18446633084043304960,18446633084043280384,140712899206080,0,867845025792,11356,867846062080,867846029312,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.5733821Z","2025-11-19 19:51:20.5733821Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1564 svchost.exe",,,,,,,,,,,,,1763581880573382100,18446633083995619328,18446633083995594752,140712899206080,0,86741536768,13068,86739845120,86739812352,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.5734717Z","2025-11-19 19:51:20.5734717Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1676 svchost.exe",,,,,,,,,,,,,1763581880573471700,18446633084006277120,18446633084006252544,140712899206080,0,289651171328,9168,289649328128,289649295360,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.5735685Z","2025-11-19 19:51:20.5735685Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1796 svchost.exe",,,,,,,,,,,,,1763581880573568500,18446633084007567360,18446633084007542784,140712899206080,0,708991619072,8208,708990205952,708990173184,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.5736152Z","2025-11-19 19:51:20.5736152Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1660 svchost.exe",,,,,,,,,,,,,1763581880573615200,18446633084046409728,18446633084046385152,140712899206080,0,265906413568,13016,265905373184,265905340416,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.5737346Z","2025-11-19 19:51:20.5737346Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1580 svchost.exe",,,,,,,,,,,,,1763581880573734600,18446633084041408512,18446633084041383936,140712899206080,0,966821441536,500,966823247872,966823215104,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.7004875Z","2025-11-19 19:51:20.7004875Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 2244 svchost.exe",,,,,,,,,,,,,1763581880700487500,18446633084042616832,18446633084042592256,140712899206080,0,927664209920,5500,927665225728,927665192960,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.7323852Z","2025-11-19 19:51:20.7323852Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 2384 svchost.exe",,,,,,,,,,,,,1763581880732385200,18446633084042645504,18446633084042620928,140712899206080,0,928822153216,12408,928820035584,928820002816,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.7964031Z","2025-11-19 19:51:20.7964031Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 2572 svchost.exe",,,,,,,,,,,,,1763581880796403100,18446633084042702848,18446633084042678272,140712899206080,0,140318842880,1864,140317556736,140317523968,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.7965326Z","2025-11-19 19:51:20.7965326Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 2580 svchost.exe",,,,,,,,,,,,,1763581880796532600,18446633084042731520,18446633084042706944,140712899206080,0,139709366272,11504,139707613184,139707580416,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.8746075Z","2025-11-19 19:51:20.8746075Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 2688 svchost.exe",,,,,,,,,,,,,1763581880874607500,18446633084043046912,18446633084043022336,140712899206080,0,461861085184,12512,461859520512,461859487744,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.8747287Z","2025-11-19 19:51:20.8747287Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 2824 svchost.exe",,,,,,,,,,,,,1763581880874728700,18446633084007624704,18446633084007600128,140712899206080,0,912958402560,4252,912960520192,912960487424,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.8748579Z","2025-11-19 19:51:20.8748579Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 2924 svchost.exe",,,,,,,,,,,,,1763581880874857900,18446633084007510016,18446633084007485440,140712899206080,0,22795177984,10452,22796566528,22796533760,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9540010Z","2025-11-19 19:51:20.9540010Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 2724 svchost.exe",,,,,,,,,,,,,1763581880954001000,18446633084043075584,18446633084043051008,140712899206080,0,89489301504,7700,89490718720,89490685952,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9624111Z","2025-11-19 19:51:20.9624111Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",5020,,," 5184 explorer.exe",,,,,,,,,,,,,1763581880962411100,18446633084043362304,18446633084043337728,140712891545280,0,15286272,5116,467664896,467607552,140712891545280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9698780Z","2025-11-19 19:51:20.9698780Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4608 svchost.exe",11692,,," 4608 svchost.exe",,,,,,,,,,,,,1763581880969878000,18446633084008919040,18446633084008894464,140712899206080,0,287385964544,11692,287387942912,287387910144,140712899206080,352306,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9763041Z","2025-11-19 19:51:20.9763041Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1040 svchost.exe",2280,,,"11956 smartscreen.exe",,,"C:\Windows\System32\smartscreen.exe",,,,,,,,,,1763581880976304100,,,,,,,,,,,,,664452,,419447766,,,,134080554805558624,,,,,3391,,,,,,0,"0x","","",1040,13,3,0,0,1 -"2025-11-19 19:51:20.9772717Z","2025-11-19 19:51:20.9772717Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",2280,,,"11956 smartscreen.exe",,,,,,,,,,,,,1763581880977271700,18446633084008919040,18446633084008894464,140696524147856,40,4299116544,12552,4295491584,4295483392,140696524147856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9789415Z","2025-11-19 19:51:20.9789415Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\smartscreen.exe",,,,,,,,,,1763581880978941500,,,,,,,,,,,140696524029952,140696524029952,664452,614400,419447766,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9789788Z","2025-11-19 19:51:20.9789788Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581880978978800,,,,,,,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9823811Z","2025-11-19 19:51:20.9823811Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581880982381100,,,,,,,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9825014Z","2025-11-19 19:51:20.9825014Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581880982501400,,,,,,,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9836941Z","2025-11-19 19:51:20.9836941Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581880983694100,,,,,,,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9837895Z","2025-11-19 19:51:20.9837895Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,,,,,,,,,,,1763581880983789500,18446633084042788864,18446633084042764288,140712899206080,0,4299124736,6108,4296015872,4296007680,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9838695Z","2025-11-19 19:51:20.9838695Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,1763581880983869500,,,,,,,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9840834Z","2025-11-19 19:51:20.9840834Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581880984083400,,,,,,,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9841934Z","2025-11-19 19:51:20.9841934Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,,,,,,,,,,,1763581880984193400,18446633084043190272,18446633084043165696,140712899206080,0,4299132928,6996,4296540160,4296531968,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9842740Z","2025-11-19 19:51:20.9842740Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,1763581880984274000,,,,,,,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9842847Z","2025-11-19 19:51:20.9842847Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,,,,,,,,,,,1763581880984284700,18446633084043247616,18446633084043223040,140712899206080,0,4299141120,204,4297064448,4297056256,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9844610Z","2025-11-19 19:51:20.9844610Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,1763581880984461000,,,,,,,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9846184Z","2025-11-19 19:51:20.9846184Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,1763581880984618400,,,,,,,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9847528Z","2025-11-19 19:51:20.9847528Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,"C:\Windows\System32\smartscreen.dll",,,,,,,,,,1763581880984752800,,,,,,,,,,,140712383414272,140712383414272,6028386,6057984,1751620389,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9847585Z","2025-11-19 19:51:20.9847585Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,1763581880984758500,,,,,,,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9849421Z","2025-11-19 19:51:20.9849421Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581880984942100,,,,,,,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9849424Z","2025-11-19 19:51:20.9849424Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,1763581880984942400,,,,,,,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9851390Z","2025-11-19 19:51:20.9851390Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581880985139000,,,,,,,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9851423Z","2025-11-19 19:51:20.9851423Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",204,,,"11956 smartscreen.exe",,,"C:\Windows\System32\winhttp.dll",,,,,,,,,,1763581880985142300,,,,,,,,,,,140712750350336,140712750350336,1261038,1212416,84984727,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9851960Z","2025-11-19 19:51:20.9851960Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581880985196000,,,,,,,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9854024Z","2025-11-19 19:51:20.9854024Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",204,,,"11956 smartscreen.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581880985402400,,,,,,,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9854512Z","2025-11-19 19:51:20.9854512Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581880985451200,,,,,,,,,,,1646826618880,1646826618880,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9854713Z","2025-11-19 19:51:20.9854713Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\crypt32.dll",,,,,,,,,,1763581880985471300,,,,,,,,,,,140712849768448,140712849768448,1584869,1536000,3438168074,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9855242Z","2025-11-19 19:51:20.9855242Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581880985524200,,,,,,,,,,,1646826618880,1646826618880,716301,692224,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9856395Z","2025-11-19 19:51:20.9856395Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,"C:\Windows\System32\ws2_32.dll",,,,,,,,,,1763581880985639500,,,,,,,,,,,140712881094656,140712881094656,513405,475136,3967481067,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9856905Z","2025-11-19 19:51:20.9856905Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,1763581880985690500,,,,,,,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9858908Z","2025-11-19 19:51:20.9858908Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",204,,,"11956 smartscreen.exe",,,"C:\Windows\System32\cryptsp.dll",,,,,,,,,,1763581880985890800,,,,,,,,,,,140712839217152,140712839217152,146168,110592,1658328178,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9859779Z","2025-11-19 19:51:20.9859779Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3316 svchost.exe",,,,,,,,,,,,,1763581880985977900,18446633084043276288,18446633084043251712,140712899206080,0,725981229056,5216,725982642176,725982609408,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9860302Z","2025-11-19 19:51:20.9860302Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,1763581880986030200,,,,,,,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9860717Z","2025-11-19 19:51:20.9860717Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3256 svchost.exe",,,,,,,,,,,,,1763581880986071700,18446633084043390976,18446633084043366400,140712899206080,0,435930505216,13464,433793794048,433793761280,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9861764Z","2025-11-19 19:51:20.9861764Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3000 svchost.exe",,,,,,,,,,,,,1763581880986176400,18446633084043476992,18446633084043452416,140712899206080,0,1014020706304,13692,1014021750784,1014021718016,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9862140Z","2025-11-19 19:51:20.9862140Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3456 svchost.exe",,,,,,,,,,,,,1763581880986214000,18446633084043538432,18446633084043513856,140712899206080,0,94398504960,12164,94400151552,94400118784,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9863024Z","2025-11-19 19:51:20.9863024Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3532 svchost.exe",,,,,,,,,,,,,1763581880986302400,18446633084043997184,18446633084043972608,140712899206080,0,761505026048,6444,761506299904,761506267136,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9864111Z","2025-11-19 19:51:20.9864111Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",204,,,"11956 smartscreen.exe",,,"C:\Windows\System32\dnsapi.dll",,,,,,,,,,1763581880986411100,,,,,,,,,,,140712824274944,140712824274944,1293169,1228800,1381219389,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9864222Z","2025-11-19 19:51:20.9864222Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,1763581880986422200,,,,,,,,,,,140712851341312,140712851341312,1524912,1486848,1404855129,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9866834Z","2025-11-19 19:51:20.9866834Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,"C:\Windows\System32\wintrust.dll",,,,,,,,,,1763581880986683400,,,,,,,,,,,140712860844032,140712860844032,590783,520192,452262045,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9867955Z","2025-11-19 19:51:20.9867955Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",204,,,"11956 smartscreen.exe",,,"C:\Windows\System32\IPHLPAPI.DLL",,,,,,,,,,1763581880986795500,,,,,,,,,,,140712824012800,140712824012800,233044,212992,945822897,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9869651Z","2025-11-19 19:51:20.9869651Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,"C:\Windows\System32\ole32.dll",,,,,,,,,,1763581880986965100,,,,,,,,,,,140712878473216,140712878473216,1689904,1667072,1018821057,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9890552Z","2025-11-19 19:51:20.9890552Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\nsi.dll",,,,,,,,,,1763581880989055200,,,,,,,,,,,140712892956672,140712892956672,111648,40960,4223476491,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9896219Z","2025-11-19 19:51:20.9896219Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,1763581880989621900,,,,,,,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9913559Z","2025-11-19 19:51:20.9913559Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\msasn1.dll",,,,,,,,,,1763581880991355900,,,,,,,,,,,140712839675904,140712839675904,150871,77824,2536054058,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9921028Z","2025-11-19 19:51:20.9921028Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,,,,,,,,,,,1763581880992102800,18446633084042960896,18446633084042936320,140712387241344,0,4299149312,5980,4299685888,4299677696,140712387241344,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9924315Z","2025-11-19 19:51:20.9924315Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",5980,,,"11956 smartscreen.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,1763581880992431500,,,,,,,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9928273Z","2025-11-19 19:51:20.9928273Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,1763581880992827300,,,,,,,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9932375Z","2025-11-19 19:51:20.9932375Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"11956 smartscreen.exe",,,,,,,,,,,,,1763581880993237500,18446633084044025856,18446633084044001280,140712899206080,0,4297064448,3708,4300210176,4300201984,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9935171Z","2025-11-19 19:51:20.9935171Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",3708,,,"11956 smartscreen.exe",,,"C:\Windows\System32\wtdsensor.dll",,,,,,,,,,1763581880993517100,,,,,,,,,,,140712681996288,140712681996288,56489,45056,4237415889,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9946637Z","2025-11-19 19:51:20.9946637Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,1763581880994663700,,,,,,,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9955563Z","2025-11-19 19:51:20.9955563Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,,,,,,,,,,,1763581880995556300,18446633084044054528,18446633084044029952,140712865112144,0,4297072640,2328,4300734464,4300726272,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9958285Z","2025-11-19 19:51:20.9958285Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11956 smartscreen.exe",3708,,,"11956 smartscreen.exe",,,,,,,,,,,,,1763581880995828500,18446633084044197888,18446633084044173312,140712899206080,0,4297080832,4856,4301258752,4301250560,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9975541Z","2025-11-19 19:51:20.9975541Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11956 smartscreen.exe",3708,,,"11956 smartscreen.exe",,,,,,,,,,,,,1763581880997554100,18446633084044255232,18446633084044230656,140712899206080,0,4297089024,11364,4301783040,4301774848,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9987968Z","2025-11-19 19:51:20.9987968Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",3708,,,"11956 smartscreen.exe",,,"C:\Windows\System32\smartscreenps.dll",,,,,,,,,,1763581880998796800,,,,,,,,,,,140712623865856,140712623865856,151429,122880,4089359051,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0003864Z","2025-11-19 19:51:21.0003864Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",3708,,,"11956 smartscreen.exe",,,"C:\Windows\System32\Windows.Management.Workplace.dll",,,,,,,,,,1763581881000386400,,,,,,,,,,,140712429879296,140712429879296,215437,204800,170946563,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0012539Z","2025-11-19 19:51:21.0012539Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",3708,,,"11956 smartscreen.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581881001253900,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0017586Z","2025-11-19 19:51:21.0017586Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11956 smartscreen.exe",3708,,,"11956 smartscreen.exe",,,,,,,,,,,,,1763581881001758600,18446633084044283904,18446633084044259328,140712387241344,0,4297097216,9852,4302307328,4302299136,140712387241344,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0413450Z","2025-11-19 19:51:21.0413450Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 5184 explorer.exe",5116,,," 3348 attack-589.exe",,,"C:\Users\Public\Downloads\attack-589.exe",,,,,,,,,,1763581881041345000,,,,,,,,,,,,,0,,1763491559,,,,134080554806144016,,,,,3392,,,,,,0,"0x","","",5184,140,3,0,0,1 -"2025-11-19 19:51:21.0443828Z","2025-11-19 19:51:21.0443828Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",5116,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581881044382800,18446633084044398592,18446633084044374016,140695599400816,0,289797906432,11212,289800192000,289800187904,140695599400816,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0471547Z","2025-11-19 19:51:21.0471547Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 5536 svchost.exe",,,,,,,,,,,,,1763581881047154700,18446633084043419648,18446633084043395072,140712899206080,0,151912587264,1300,151915069440,151915036672,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0473929Z","2025-11-19 19:51:21.0473929Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5536 svchost.exe",1300,,," 5536 svchost.exe",,,,,,,,,,,,,1763581881047392900,18446633084044513280,18446633084044488704,140712899206080,132,151912595456,7072,151915593728,151915560960,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0502108Z","2025-11-19 19:51:21.0502108Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5536 svchost.exe",1300,,," 5536 svchost.exe",,,"C:\Windows\System32\pcadm.dll",,,,,,,,,,1763581881050210800,,,,,,,,,,,140711755710464,140711755710464,249405,204800,3376468140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0503483Z","2025-11-19 19:51:21.0503483Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5536 svchost.exe",11248,,," 5536 svchost.exe",,,,,,,,,,,,,1763581881050348300,18446633084043161600,18446633084043137024,140712899206080,0,151912603648,1620,151916118016,151916085248,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0504664Z","2025-11-19 19:51:21.0504664Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5536 svchost.exe",1620,,," 5536 svchost.exe",,,,,,,,,,,,,1763581881050466400,18446633084044455936,18446633084044431360,140712899206080,0,151912611840,8960,151920836608,151920803840,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0505067Z","2025-11-19 19:51:21.0505067Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5536 svchost.exe",1300,,," 5536 svchost.exe",,,"C:\Windows\System32\wdi.dll",,,,,,,,,,1763581881050506700,,,,,,,,,,,140712669413376,140712669413376,172159,126976,589396027,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0505702Z","2025-11-19 19:51:21.0505702Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5536 svchost.exe",11248,,," 5536 svchost.exe",,,"C:\Windows\System32\pcacli.dll",,,,,,,,,,1763581881050570200,,,,,,,,,,,140712543977472,140712543977472,146563,102400,3048676746,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0506830Z","2025-11-19 19:51:21.0506830Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5536 svchost.exe",1620,,," 5536 svchost.exe",,,"C:\Windows\System32\aepic.dll",,,,,,,,,,1763581881050683000,,,,,,,,,,,140712428109824,140712428109824,641436,577536,321124434,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0509198Z","2025-11-19 19:51:21.0509198Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5536 svchost.exe",1300,,," 5536 svchost.exe",,,"C:\Windows\System32\mpr.dll",,,,,,,,,,1763581881050919800,,,,,,,,,,,140712737832960,140712737832960,203967,135168,2433114060,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0540458Z","2025-11-19 19:51:21.0540458Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5536 svchost.exe",1300,,," 5536 svchost.exe",,,"C:\Windows\System32\wdi.dll",,,,,,,,,,1763581881054045800,,,,,,,,,,,140712669413376,140712669413376,172159,139264,589396027,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0541183Z","2025-11-19 19:51:21.0541183Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5536 svchost.exe",1300,,," 5536 svchost.exe",,,"C:\Windows\System32\mpr.dll",,,,,,,,,,1763581881054118300,,,,,,,,,,,140712737832960,140712737832960,203967,147456,2433114060,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0541690Z","2025-11-19 19:51:21.0541690Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5536 svchost.exe",1300,,," 5536 svchost.exe",,,"C:\Windows\System32\pcacli.dll",,,,,,,,,,1763581881054169000,,,,,,,,,,,140712543977472,140712543977472,146563,114688,3048676746,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0542753Z","2025-11-19 19:51:21.0542753Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5536 svchost.exe",1300,,," 5536 svchost.exe",,,"C:\Windows\System32\aepic.dll",,,,,,,,,,1763581881054275300,,,,,,,,,,,140712428109824,140712428109824,641436,589824,321124434,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0543297Z","2025-11-19 19:51:21.0543297Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5536 svchost.exe",1300,,," 5536 svchost.exe",,,"C:\Windows\System32\pcadm.dll",,,,,,,,,,1763581881054329700,,,,,,,,,,,140711755710464,140711755710464,249405,217088,3376468140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0550224Z","2025-11-19 19:51:21.0550224Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Users\Public\Downloads\attack-589.exe",,,,,,,,,,1763581881055022400,,,,,,,,,,,140695599382528,140695599382528,0,53248,1763491559,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0550597Z","2025-11-19 19:51:21.0550597Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581881055059700,,,,,,,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0557966Z","2025-11-19 19:51:21.0557966Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581881055796600,,,,,,,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0559164Z","2025-11-19 19:51:21.0559164Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581881055916400,,,,,,,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0568214Z","2025-11-19 19:51:21.0568214Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 3348 attack-589.exe",11212,,," 3100 conhost.exe",,,"C:\Windows\System32\conhost.exe",,,,,,,,,,1763581881056821400,,,,,,,,,,,,,1035098,,2671108986,,,,134080554806283315,,,,,3393,,,,,,0,"0x","","",3348,3392,3,0,0,1 -"2025-11-19 19:51:21.0581639Z","2025-11-19 19:51:21.0581639Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3348 attack-589.exe",11212,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881058163900,18446633084006535168,18446633084006510592,140696384751904,0,1013857710080,13484,1013860270080,1013860261888,140696384751904,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0582474Z","2025-11-19 19:51:21.0582474Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",13484,,," 3100 conhost.exe",,,"C:\Windows\System32\conhost.exe",,,,,,,,,,1763581881058247400,,,,,,,,,,,140696384438272,140696384438272,1035098,1028096,2671108986,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0582687Z","2025-11-19 19:51:21.0582687Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",13484,,," 3100 conhost.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581881058268700,,,,,,,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0588502Z","2025-11-19 19:51:21.0588502Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",13484,,," 3100 conhost.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581881058850200,,,,,,,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0589666Z","2025-11-19 19:51:21.0589666Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",13484,,," 3100 conhost.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581881058966600,,,,,,,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0601426Z","2025-11-19 19:51:21.0601426Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",13484,,," 3100 conhost.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581881060142600,,,,,,,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0602700Z","2025-11-19 19:51:21.0602700Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",13484,,," 3100 conhost.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581881060270000,,,,,,,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0603778Z","2025-11-19 19:51:21.0603778Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3100 conhost.exe",13484,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881060377800,18446633084044943360,18446633084044918784,140712899206080,0,1013857718272,4844,1013860794368,1013860786176,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0604718Z","2025-11-19 19:51:21.0604718Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3100 conhost.exe",4844,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881060471800,18446633084044570624,18446633084044546048,140712899206080,0,1013857726464,11404,1013861318656,1013861310464,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0611900Z","2025-11-19 19:51:21.0611900Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",13484,,," 3100 conhost.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581881061190000,,,,,,,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0613159Z","2025-11-19 19:51:21.0613159Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",13484,,," 3100 conhost.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581881061315900,,,,,,,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0614814Z","2025-11-19 19:51:21.0614814Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",13484,,," 3100 conhost.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581881061481400,,,,,,,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0616334Z","2025-11-19 19:51:21.0616334Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",13484,,," 3100 conhost.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581881061633400,,,,,,,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0622388Z","2025-11-19 19:51:21.0622388Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",13484,,," 3100 conhost.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,1763581881062238800,,,,,,,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0623650Z","2025-11-19 19:51:21.0623650Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",13484,,," 3100 conhost.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,1763581881062365000,,,,,,,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0624923Z","2025-11-19 19:51:21.0624923Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",13484,,," 3100 conhost.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,1763581881062492300,,,,,,,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0626266Z","2025-11-19 19:51:21.0626266Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",13484,,," 3100 conhost.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,1763581881062626600,,,,,,,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0631789Z","2025-11-19 19:51:21.0631789Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",13484,,," 3100 conhost.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,1763581881063178900,,,,,,,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0649429Z","2025-11-19 19:51:21.0649429Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3100 conhost.exe",13484,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881064942900,18446633084044627968,18446633084044603392,140696384580832,0,1013857734656,6724,1013861842944,1013861834752,140696384580832,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0650293Z","2025-11-19 19:51:21.0650293Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3100 conhost.exe",11404,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881065029300,18446633084044570624,18446633084044546048,140712899206080,0,1013857726464,11404,1013861318656,1013861310464,140712899206080,1647609,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0650435Z","2025-11-19 19:51:21.0650435Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3100 conhost.exe",4844,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881065043500,18446633084044943360,18446633084044918784,140712899206080,0,1013857718272,4844,1013860794368,1013860786176,140712899206080,754023,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0651883Z","2025-11-19 19:51:21.0651883Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3100 conhost.exe",13484,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881065188400,18446633084006535168,18446633084006510592,140696384751904,0,1013857710080,13484,1013860270080,1013860253696,140696384751904,23804713,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0651943Z","2025-11-19 19:51:21.0651943Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",6724,,," 3100 conhost.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,1763581881065194300,,,,,,,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0654850Z","2025-11-19 19:51:21.0654850Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3100 conhost.exe",6724,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881065485000,18446633084006535168,18446633084006510592,140712899206080,0,1013857742848,4376,1013860270080,1013860261888,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0663851Z","2025-11-19 19:51:21.0663851Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",6724,,," 3100 conhost.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,1763581881066385100,,,,,,,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0666224Z","2025-11-19 19:51:21.0666224Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",6724,,," 3100 conhost.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,1763581881066622400,,,,,,,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0670806Z","2025-11-19 19:51:21.0670806Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",6724,,," 3100 conhost.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,1763581881067080600,,,,,,,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0678039Z","2025-11-19 19:51:21.0678039Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",6724,,," 3100 conhost.exe",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,1763581881067803900,,,,,,,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0707449Z","2025-11-19 19:51:21.0707449Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3100 conhost.exe",6724,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881070744900,18446633084044943360,18446633084044918784,140712865112144,0,1013857751040,2976,1013860794368,1013860786176,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0709822Z","2025-11-19 19:51:21.0709822Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881070982200,18446633084044656640,18446633084044632064,140712899206080,0,1013857759232,9260,1013861318656,1013861310464,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0711453Z","2025-11-19 19:51:21.0711453Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3100 conhost.exe",9260,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881071145300,18446633084044828672,18446633084044804096,140712899206080,0,1013857767424,1400,1013862367232,1013862359040,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0809895Z","2025-11-19 19:51:21.0809895Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3608 svchost.exe",,,,,,,,,,,,,1763581881080989500,18446633084044972032,18446633084044947456,140712899206080,0,310404608000,2980,310406807552,310406774784,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0810351Z","2025-11-19 19:51:21.0810351Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3740 svchost.exe",,,,,,,,,,,,,1763581881081035100,18446633084045029376,18446633084045004800,140712899206080,0,100414390272,14328,100416356352,100416323584,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0819304Z","2025-11-19 19:51:21.0819304Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1040 svchost.exe",2280,,,"13828 OpenConsole.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\OpenConsole.exe",,,,,,,,,,1763581881081930400,,,,,,,,,,,,,1210794,,1759975785,,,,134080554806509408,,,,,3394,,,,,,3,"0x","Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe","App",1040,13,3,0,0,1 -"2025-11-19 19:51:21.0828506Z","2025-11-19 19:51:21.0828506Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",2280,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881082850600,18446633084045201408,18446633084045176832,140702989817872,40,132813885440,4736,132815781888,132815777792,140702989817872,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0854337Z","2025-11-19 19:51:21.0854337Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\OpenConsole.exe",,,,,,,,,,1763581881085433700,,,,,,,,,,,140702989025280,140702989025280,1210794,1159168,1759975785,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0854753Z","2025-11-19 19:51:21.0854753Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581881085475300,,,,,,,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0893306Z","2025-11-19 19:51:21.0893306Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581881089330600,,,,,,,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0894603Z","2025-11-19 19:51:21.0894603Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581881089460300,,,,,,,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0907756Z","2025-11-19 19:51:21.0907756Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,1763581881090775600,,,,,,,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0909113Z","2025-11-19 19:51:21.0909113Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581881090911300,,,,,,,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0910041Z","2025-11-19 19:51:21.0910041Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881091004200,18446633084045402112,18446633084045377536,140712899206080,0,132813893632,14136,132816830464,132816826368,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0910719Z","2025-11-19 19:51:21.0910719Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581881091071900,,,,,,,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0912384Z","2025-11-19 19:51:21.0912384Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881091238400,18446633084045430784,18446633084045406208,140712899206080,0,132813901824,12136,132817879040,132817874944,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0913154Z","2025-11-19 19:51:21.0913154Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,1763581881091315500,,,,,,,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0913292Z","2025-11-19 19:51:21.0913292Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13828 OpenConsole.exe",12136,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881091329200,18446633084045807616,18446633084045783040,140712899206080,0,132813910016,1824,132818927616,132818923520,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0914877Z","2025-11-19 19:51:21.0914877Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581881091487800,,,,,,,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0916535Z","2025-11-19 19:51:21.0916535Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",12136,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\UIAutomationCore.dll",,,,,,,,,,1763581881091653500,,,,,,,,,,,140712432762880,140712432762880,4328257,4296704,2096711852,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0916829Z","2025-11-19 19:51:21.0916829Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,1763581881091682900,,,,,,,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0919373Z","2025-11-19 19:51:21.0919373Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,1763581881091937300,,,,,,,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0921223Z","2025-11-19 19:51:21.0921223Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,1763581881092122400,,,,,,,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0922357Z","2025-11-19 19:51:21.0922357Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,1763581881092235700,,,,,,,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0923469Z","2025-11-19 19:51:21.0923469Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,1763581881092346900,,,,,,,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0924867Z","2025-11-19 19:51:21.0924867Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581881092486800,,,,,,,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0926696Z","2025-11-19 19:51:21.0926696Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581881092669600,,,,,,,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0927800Z","2025-11-19 19:51:21.0927800Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",12136,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\windows.storage.dll",,,,,,,,,,1763581881092780000,,,,,,,,,,,140712812412928,140712812412928,8877403,8769536,3667346596,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0928599Z","2025-11-19 19:51:21.0928599Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581881092859900,,,,,,,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0929362Z","2025-11-19 19:51:21.0929362Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",1824,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\propsys.dll",,,,,,,,,,1763581881092936200,,,,,,,,,,,140712761491456,140712761491456,1123662,1060864,3228732737,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0931622Z","2025-11-19 19:51:21.0931622Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,1763581881093162200,,,,,,,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0934193Z","2025-11-19 19:51:21.0934193Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,1763581881093419300,,,,,,,,,,,140712851341312,140712851341312,1524912,1486848,1404855129,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0935568Z","2025-11-19 19:51:21.0935568Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,1763581881093556800,,,,,,,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0938215Z","2025-11-19 19:51:21.0938215Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",1824,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\winmm.dll",,,,,,,,,,1763581881093821500,,,,,,,,,,,140712663842816,140712663842816,263815,217088,2106743460,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0940906Z","2025-11-19 19:51:21.0940906Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\d2d1.dll",,,,,,,,,,1763581881094090600,,,,,,,,,,,140712777744384,140712777744384,6610469,6537216,3013069957,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0941664Z","2025-11-19 19:51:21.0941664Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",12136,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\DWrite.dll",,,,,,,,,,1763581881094166400,,,,,,,,,,,140712784297984,140712784297984,2543119,2519040,1462185185,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0942448Z","2025-11-19 19:51:21.0942448Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",1824,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\dxgi.dll",,,,,,,,,,1763581881094244800,,,,,,,,,,,140712803631104,140712803631104,1320096,1282048,1861212996,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0943214Z","2025-11-19 19:51:21.0943214Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",14136,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\usp10.dll",,,,,,,,,,1763581881094321400,,,,,,,,,,,140711462174720,140711462174720,161304,102400,728066498,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0947967Z","2025-11-19 19:51:21.0947967Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",14136,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\powrprof.dll",,,,,,,,,,1763581881094796700,,,,,,,,,,,140712848195584,140712848195584,457799,385024,2858637235,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0947970Z","2025-11-19 19:51:21.0947970Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",1824,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\D3DCompiler_47.dll",,,,,,,,,,1763581881094797000,,,,,,,,,,,140712769814528,140712769814528,4685395,4714496,796813953,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0948030Z","2025-11-19 19:51:21.0948030Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\d3d11.dll",,,,,,,,,,1763581881094803000,,,,,,,,,,,140712786853888,140712786853888,2582658,2498560,2128032819,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0951898Z","2025-11-19 19:51:21.0951898Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\cryptsp.dll",,,,,,,,,,1763581881095189800,,,,,,,,,,,140712839217152,140712839217152,146168,110592,1658328178,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0994629Z","2025-11-19 19:51:21.0994629Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,1763581881099462900,,,,,,,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0999599Z","2025-11-19 19:51:21.0999599Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\umpdc.dll",,,,,,,,,,1763581881099960000,,,,,,,,,,,140712848064512,140712848064512,98535,81920,1714427184,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1016003Z","2025-11-19 19:51:21.1016003Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,1763581881101600400,,,,,,,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1020667Z","2025-11-19 19:51:21.1020667Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,1763581881102066700,,,,,,,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1028095Z","2025-11-19 19:51:21.1028095Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,1763581881102809500,,,,,,,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1063298Z","2025-11-19 19:51:21.1063298Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881106329800,18446633084045864960,18446633084045840384,140712865112144,0,132813918208,13020,132819976192,132819968000,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1065155Z","2025-11-19 19:51:21.1065155Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881106515500,18446633084045922304,18446633084045897728,140712899206080,0,132813926400,5064,132821024768,132821020672,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1066984Z","2025-11-19 19:51:21.1066984Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13828 OpenConsole.exe",5064,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881106698400,18446633084045950976,18446633084045926400,140712899206080,0,132813934592,2364,132822073344,132822069248,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1144974Z","2025-11-19 19:51:21.1144974Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",2364,,,"13828 OpenConsole.exe",,,"C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\PackagedCom\OpenConsoleProxy.dll",,,,,,,,,,1763581881114497400,,,,,,,,,,,140712723349504,140712723349504,51292,53248,1759975238,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1167784Z","2025-11-19 19:51:21.1167784Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",6724,,," 3100 conhost.exe",,,"C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\PackagedCom\OpenConsoleProxy.dll",,,,,,,,,,1763581881116778400,,,,,,,,,,,140712723349504,140712723349504,51292,53248,1759975238,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1171911Z","2025-11-19 19:51:21.1171911Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3100 conhost.exe",6724,,," 3100 conhost.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,1763581881117191100,,,,,,,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1341345Z","2025-11-19 19:51:21.1341345Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1040 svchost.exe",2280,,," 2344 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe",,,,,,,,,,1763581881134134500,,,,,,,,,,,,,738129,,1759975821,,,,134080554806979193,,,,,3395,,,,,,3,"0x","Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe","App",1040,13,3,0,0,1 -"2025-11-19 19:51:21.1352167Z","2025-11-19 19:51:21.1352167Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",2280,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881135216700,18446633084046352384,18446633084046327808,140702319920256,40,1068179636224,5964,1068177817600,1068177813504,140702319920256,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1380470Z","2025-11-19 19:51:21.1380470Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe",,,,,,,,,,1763581881138047000,,,,,,,,,,,140702319640576,140702319640576,738129,684032,1759975821,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1381031Z","2025-11-19 19:51:21.1381031Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581881138103100,,,,,,,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1471912Z","2025-11-19 19:51:21.1471912Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581881147191200,,,,,,,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1473790Z","2025-11-19 19:51:21.1473790Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581881147379000,,,,,,,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1487993Z","2025-11-19 19:51:21.1487993Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881148799300,18446633084046610432,18446633084046585856,140712899206080,0,1068179644416,11152,1068181225472,1068181221376,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1488621Z","2025-11-19 19:51:21.1488621Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,1763581881148862100,,,,,,,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1490680Z","2025-11-19 19:51:21.1490680Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,1763581881149068000,,,,,,,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1490864Z","2025-11-19 19:51:21.1490864Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",11152,,," 2344 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\TerminalThemeHelpers.dll",,,,,,,,,,1763581881149086400,,,,,,,,,,,140712799895552,140712799895552,93641,61440,1754949712,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1491777Z","2025-11-19 19:51:21.1491777Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881149177700,18446633084046667776,18446633084046643200,140712899206080,0,1068179652608,4348,1068182274048,1068182269952,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1492781Z","2025-11-19 19:51:21.1492781Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,1763581881149278100,,,,,,,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1494533Z","2025-11-19 19:51:21.1494533Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,1763581881149453300,,,,,,,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1496294Z","2025-11-19 19:51:21.1496294Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581881149629400,,,,,,,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1497795Z","2025-11-19 19:51:21.1497795Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581881149779500,,,,,,,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1499435Z","2025-11-19 19:51:21.1499435Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",4348,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881149943500,18446633084046725120,18446633084046700544,140712899206080,0,1068179660800,12024,1068183322624,1068183318528,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1499725Z","2025-11-19 19:51:21.1499725Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,1763581881149972500,,,,,,,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1502065Z","2025-11-19 19:51:21.1502065Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,1763581881150206500,,,,,,,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1504417Z","2025-11-19 19:51:21.1504417Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",11152,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,1763581881150441800,,,,,,,,,,,3023123251200,3023123251200,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1504672Z","2025-11-19 19:51:21.1504672Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581881150467200,,,,,,,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1505520Z","2025-11-19 19:51:21.1505520Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",11152,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,1763581881150552000,,,,,,,,,,,3023123251200,3023123251200,3798760,3727360,2772520021,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1507224Z","2025-11-19 19:51:21.1507224Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,1763581881150722400,,,,,,,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1508978Z","2025-11-19 19:51:21.1508978Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",4348,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,1763581881150897800,,,,,,,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1510182Z","2025-11-19 19:51:21.1510182Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,1763581881151018200,,,,,,,,,,,140712851341312,140712851341312,1524912,1486848,1404855129,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1510625Z","2025-11-19 19:51:21.1510625Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",11152,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\dwmapi.dll",,,,,,,,,,1763581881151062500,,,,,,,,,,,140712805072896,140712805072896,203843,196608,2709117439,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1512242Z","2025-11-19 19:51:21.1512242Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",4348,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581881151224200,,,,,,,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1512747Z","2025-11-19 19:51:21.1512747Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,1763581881151274800,,,,,,,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1514654Z","2025-11-19 19:51:21.1514654Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",12024,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\uxtheme.dll",,,,,,,,,,1763581881151465400,,,,,,,,,,,140712802254848,140712802254848,696534,696320,1695798817,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1531731Z","2025-11-19 19:51:21.1531731Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,1763581881153173100,,,,,,,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1559010Z","2025-11-19 19:51:21.1559010Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,1763581881155901000,,,,,,,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1572477Z","2025-11-19 19:51:21.1572477Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,1763581881157247700,,,,,,,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1577376Z","2025-11-19 19:51:21.1577376Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581881157737600,,,,,,,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1585992Z","2025-11-19 19:51:21.1585992Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,1763581881158599200,,,,,,,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1598069Z","2025-11-19 19:51:21.1598069Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\TerminalApp.dll",,,,,,,,,,1763581881159806900,,,,,,,,,,,140712379940864,140712379940864,3444084,3444736,1759975751,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1599235Z","2025-11-19 19:51:21.1599235Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\ole32.dll",,,,,,,,,,1763581881159923500,,,,,,,,,,,140712878473216,140712878473216,1689904,1667072,1018821057,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1601943Z","2025-11-19 19:51:21.1601943Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",11152,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\winmm.dll",,,,,,,,,,1763581881160194300,,,,,,,,,,,140712663842816,140712663842816,263815,217088,2106743460,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1611402Z","2025-11-19 19:51:21.1611402Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.UI.Xaml.dll",,,,,,,,,,1763581881161140300,,,,,,,,,,,140712596865024,140712596865024,17882163,17858560,706442395,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1626116Z","2025-11-19 19:51:21.1626116Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\twinapi.appcore.dll",,,,,,,,,,1763581881162611600,,,,,,,,,,,140712720924672,140712720924672,2401519,2375680,2646458233,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1630475Z","2025-11-19 19:51:21.1630475Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881163047500,18446633084042817536,18446633084042792960,140712899206080,0,1068179668992,14844,1068184371200,1068184367104,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1658291Z","2025-11-19 19:51:21.1658291Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881165829100,18446633084046983168,18446633084046958592,140712865112144,0,1068179677184,11108,1068185419776,1068185411584,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1661013Z","2025-11-19 19:51:21.1661013Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",14844,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881166101300,18446633084047183872,18446633084047159296,140712899206080,0,1068179685376,8404,1068186468352,1068186464256,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1676192Z","2025-11-19 19:51:21.1676192Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\OneCoreUAPCommonProxyStub.dll",,,,,,,,,,1763581881167619200,,,,,,,,,,,140712713977856,140712713977856,6740758,6615040,2011948997,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1702039Z","2025-11-19 19:51:21.1702039Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\Microsoft.Terminal.Control.dll",,,,,,,,,,1763581881170203900,,,,,,,,,,,140712377909248,140712377909248,1976337,1986560,1759975378,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1705635Z","2025-11-19 19:51:21.1705635Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",12024,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\UIAutomationCore.dll",,,,,,,,,,1763581881170563500,,,,,,,,,,,140712432762880,140712432762880,4328257,4296704,2096711852,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1705724Z","2025-11-19 19:51:21.1705724Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\d2d1.dll",,,,,,,,,,1763581881170572400,,,,,,,,,,,140712777744384,140712777744384,6610469,6537216,3013069957,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1708295Z","2025-11-19 19:51:21.1708295Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",11152,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\DWrite.dll",,,,,,,,,,1763581881170829500,,,,,,,,,,,140712784297984,140712784297984,2543119,2519040,1462185185,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1708432Z","2025-11-19 19:51:21.1708432Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",4348,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\UIAutomationCore.dll",,,,,,,,,,1763581881170843200,,,,,,,,,,,3023127773184,3023127773184,4328257,4296704,2096711852,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1709961Z","2025-11-19 19:51:21.1709961Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",4348,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\UIAutomationCore.dll",,,,,,,,,,1763581881170996200,,,,,,,,,,,3023127773184,3023127773184,4328257,4308992,2096711852,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1710897Z","2025-11-19 19:51:21.1710897Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\dxgi.dll",,,,,,,,,,1763581881171089800,,,,,,,,,,,140712803631104,140712803631104,1320096,1282048,1861212996,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1714438Z","2025-11-19 19:51:21.1714438Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",4348,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\D3DCompiler_47.dll",,,,,,,,,,1763581881171443800,,,,,,,,,,,140712769814528,140712769814528,4685395,4714496,796813953,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1714596Z","2025-11-19 19:51:21.1714596Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\powrprof.dll",,,,,,,,,,1763581881171459600,,,,,,,,,,,140712848195584,140712848195584,457799,385024,2858637235,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1715518Z","2025-11-19 19:51:21.1715518Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",12024,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\d3d11.dll",,,,,,,,,,1763581881171551800,,,,,,,,,,,140712786853888,140712786853888,2582658,2498560,2128032819,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1718598Z","2025-11-19 19:51:21.1718598Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\cryptsp.dll",,,,,,,,,,1763581881171859800,,,,,,,,,,,140712839217152,140712839217152,146168,110592,1658328178,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1730632Z","2025-11-19 19:51:21.1730632Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\umpdc.dll",,,,,,,,,,1763581881173063200,,,,,,,,,,,140712848064512,140712848064512,98535,81920,1714427184,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1755023Z","2025-11-19 19:51:21.1755023Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.8_8.2501.31001.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.dll",,,,,,,,,,1763581881175502300,,,,,,,,,,,140712372011008,140712372011008,5866761,5873664,2056920596,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1762729Z","2025-11-19 19:51:21.1762729Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\CoreMessaging.dll",,,,,,,,,,1763581881176272900,,,,,,,,,,,140712796160000,140712796160000,1232710,1208320,2155847221,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1769292Z","2025-11-19 19:51:21.1769292Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.UI.dll",,,,,,,,,,1763581881176929200,,,,,,,,,,,140712615346176,140712615346176,1414164,1376256,3301850593,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1778568Z","2025-11-19 19:51:21.1778568Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\InputHost.dll",,,,,,,,,,1763581881177856800,,,,,,,,,,,140712583757824,140712583757824,1989124,1970176,2937052880,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1793178Z","2025-11-19 19:51:21.1793178Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581881179317800,,,,,,,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1797227Z","2025-11-19 19:51:21.1797227Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\cryptbase.dll",,,,,,,,,,1763581881179722700,,,,,,,,,,,140712839348224,140712839348224,63718,49152,3897879906,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1819086Z","2025-11-19 19:51:21.1819086Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\msctf.dll",,,,,,,,,,1763581881181908600,,,,,,,,,,,140712893022208,140712893022208,1455420,1433600,4155718050,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1867074Z","2025-11-19 19:51:21.1867074Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\UiaManager.dll",,,,,,,,,,1763581881186707400,,,,,,,,,,,140712461205504,140712461205504,941078,897024,2628067039,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1916998Z","2025-11-19 19:51:21.1916998Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881191699800,18446633084045144064,18446633084045119488,140712891292720,0,1068179693568,6876,1068187516928,1068187512832,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1922859Z","2025-11-19 19:51:21.1922859Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\WindowManagementAPI.dll",,,,,,,,,,1763581881192285900,,,,,,,,,,,140712738422784,140712738422784,1825044,1794048,1605274449,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1936303Z","2025-11-19 19:51:21.1936303Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\urlmon.dll",,,,,,,,,,1763581881193630300,,,,,,,,,,,140712669609984,140712669609984,1970671,1957888,260716450,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1939425Z","2025-11-19 19:51:21.1939425Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",12024,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\windows.storage.dll",,,,,,,,,,1763581881193942500,,,,,,,,,,,140712812412928,140712812412928,8877403,8769536,3667346596,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1939631Z","2025-11-19 19:51:21.1939631Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",4348,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\iertutil.dll",,,,,,,,,,1763581881193963100,,,,,,,,,,,140712642805760,140712642805760,2984761,2904064,3815768453,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1944076Z","2025-11-19 19:51:21.1944076Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",4348,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\srvcli.dll",,,,,,,,,,1763581881194407600,,,,,,,,,,,140712668954624,140712668954624,181029,167936,239922031,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1945330Z","2025-11-19 19:51:21.1945330Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",12024,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\netutils.dll",,,,,,,,,,1763581881194533100,,,,,,,,,,,140712825847808,140712825847808,80696,53248,865845000,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1962029Z","2025-11-19 19:51:21.1962029Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3204 Taskmgr.exe",5876,,," 3204 Taskmgr.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,1763581881196202900,,,,,,,,,,,140712479096832,140712479096832,1613415,1552384,2231457550,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1967609Z","2025-11-19 19:51:21.1967609Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3204 Taskmgr.exe",5876,,," 3204 Taskmgr.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,1763581881196760900,,,,,,,,,,,140712479096832,140712479096832,1613415,1564672,2231457550,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1974505Z","2025-11-19 19:51:21.1974505Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3204 Taskmgr.exe",5876,,," 3204 Taskmgr.exe",,,,,,,,,,,,,1763581881197450500,18446633084047499264,18446633084047474688,140712891292720,0,552496058368,11128,552502034432,552502026240,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1977017Z","2025-11-19 19:51:21.1977017Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881197701700,18446633084047642624,18446633084047618048,140712600145104,0,1068179701760,13936,1068188565504,1068188561408,140712600145104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1977569Z","2025-11-19 19:51:21.1977569Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881197756900,18446633084047790080,18446633084047765504,140712604173856,0,1068179709952,10116,1068189614080,1068189609984,140712604173856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1983622Z","2025-11-19 19:51:21.1983622Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",13936,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\DXCore.dll",,,,,,,,,,1763581881198362200,,,,,,,,,,,140712805400576,140712805400576,331386,274432,2354081039,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1990409Z","2025-11-19 19:51:21.1990409Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",13936,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\ResourcePolicyClient.dll",,,,,,,,,,1763581881199040900,,,,,,,,,,,140712809070592,140712809070592,104020,81920,2069163340,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2005198Z","2025-11-19 19:51:21.2005198Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",13936,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\ResourcePolicyClient.dll",,,,,,,,,,1763581881200519800,,,,,,,,,,,140712809070592,140712809070592,104020,94208,2069163340,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2007046Z","2025-11-19 19:51:21.2007046Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",13936,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\directxdatabasehelper.dll",,,,,,,,,,1763581881200704600,,,,,,,,,,,140712752709632,140712752709632,426573,405504,145563491,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2012776Z","2025-11-19 19:51:21.2012776Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\MrmCoreR.dll",,,,,,,,,,1763581881201277600,,,,,,,,,,,140712631926784,140712631926784,1191374,1146880,1078870765,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2017644Z","2025-11-19 19:51:21.2017644Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",13936,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\cfgmgr32.dll",,,,,,,,,,1763581881201764400,,,,,,,,,,,140712845049856,140712845049856,385808,356352,1737777300,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2022307Z","2025-11-19 19:51:21.2022307Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.StateRepositoryClient.dll",,,,,,,,,,1763581881202230700,,,,,,,,,,,140712696610816,140712696610816,303673,290816,424989122,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2066625Z","2025-11-19 19:51:21.2066625Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",13936,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\d3d10warp.dll",,,,,,,,,,1763581881206662500,,,,,,,,,,,140712731869184,140712731869184,5958575,5943296,1147803111,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2073443Z","2025-11-19 19:51:21.2073443Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\profapi.dll",,,,,,,,,,1763581881207344300,,,,,,,,,,,140712848850944,140712848850944,229548,167936,2447194521,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2082263Z","2025-11-19 19:51:21.2082263Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\dcomp.dll",,,,,,,,,,1763581881208226300,,,,,,,,,,,140712789409792,140712789409792,2309196,2240512,1200801128,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2087632Z","2025-11-19 19:51:21.2087632Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",11152,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Microsoft.Internal.WarpPal.dll",,,,,,,,,,1763581881208763200,,,,,,,,,,,140712769683456,140712769683456,167600,102400,2132685858,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2101600Z","2025-11-19 19:51:21.2101600Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\BCP47mrm.dll",,,,,,,,,,1763581881210160000,,,,,,,,,,,140712628322304,140712628322304,278903,212992,835504572,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2114197Z","2025-11-19 19:51:21.2114197Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",13936,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\TextShaping.dll",,,,,,,,,,1763581881211419700,,,,,,,,,,,140712585789440,140712585789440,770155,733184,2109619091,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2126399Z","2025-11-19 19:51:21.2126399Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",13936,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881212639900,18446633084047642624,18446633084047618048,140712600145104,0,1068179701760,13936,1068188565504,1068188536832,140712600145104,46394848,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2137996Z","2025-11-19 19:51:21.2137996Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881213799600,18446633084047642624,18446633084047618048,140712632221632,0,1068179718144,14500,1068188565504,1068188561408,140712632221632,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2168053Z","2025-11-19 19:51:21.2168053Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3204 Taskmgr.exe",5876,,," 3204 Taskmgr.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,1763581881216805300,,,,,,,,,,,140712479096832,140712479096832,1613415,1552384,2231457550,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2172665Z","2025-11-19 19:51:21.2172665Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3204 Taskmgr.exe",5876,,," 3204 Taskmgr.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,1763581881217266500,,,,,,,,,,,140712479096832,140712479096832,1613415,1564672,2231457550,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2232174Z","2025-11-19 19:51:21.2232174Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.UI.Xaml.Controls.dll",,,,,,,,,,1763581881223217400,,,,,,,,,,,140712586575872,140712586575872,3327252,3313664,3689468694,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2321711Z","2025-11-19 19:51:21.2321711Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.UI.Immersive.dll",,,,,,,,,,1763581881232171100,,,,,,,,,,,140712595423232,140712595423232,1424120,1372160,1559948871,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2338460Z","2025-11-19 19:51:21.2338460Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\DataExchange.dll",,,,,,,,,,1763581881233846000,,,,,,,,,,,140712406614016,140712406614016,399312,368640,696309968,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2359517Z","2025-11-19 19:51:21.2359517Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.ApplicationModel.dll",,,,,,,,,,1763581881235951700,,,,,,,,,,,140712508391424,140712508391424,945679,876544,2857312343,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2392977Z","2025-11-19 19:51:21.2392977Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\Microsoft.Terminal.Settings.Model.dll",,,,,,,,,,1763581881239297700,,,,,,,,,,,140709601476608,140709601476608,2281369,2252800,1759975487,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2395714Z","2025-11-19 19:51:21.2395714Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",4348,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\ntmarta.dll",,,,,,,,,,1763581881239571400,,,,,,,,,,,140712831811584,140712831811584,265798,221184,3598506564,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2398560Z","2025-11-19 19:51:21.2398560Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",12024,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\bcrypt.dll",,,,,,,,,,1763581881239856000,,,,,,,,,,,140712848654336,140712848654336,206048,172032,2893678010,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2399243Z","2025-11-19 19:51:21.2399243Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 4192 svchost.exe",,,,,,,,,,,,,1763581881239924300,18446633084047818752,18446633084047794176,140712899206080,0,330479370240,10680,330476748800,330476716032,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2412638Z","2025-11-19 19:51:21.2412638Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\shlwapi.dll",,,,,,,,,,1763581881241263800,,,,,,,,,,,140712868839424,140712868839424,479562,421888,2142510382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2476772Z","2025-11-19 19:51:21.2476772Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\TerminalConnection.dll",,,,,,,,,,1763581881247677200,,,,,,,,,,,140712371486720,140712371486720,522798,495616,1759975254,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2480478Z","2025-11-19 19:51:21.2480478Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",4348,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\winhttp.dll",,,,,,,,,,1763581881248047800,,,,,,,,,,,140712750350336,140712750350336,1261038,1212416,84984727,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2496031Z","2025-11-19 19:51:21.2496031Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\ProgramData\Microsoft\VisualStudio\Setup\x64\Microsoft.VisualStudio.Setup.Configuration.Native.dll",,,,,,,,,,1763581881249603100,,,,,,,,,,,140711212089344,140711212089344,1007466,1015808,1726088073,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2532698Z","2025-11-19 19:51:21.2532698Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\AppExtension.dll",,,,,,,,,,1763581881253269800,,,,,,,,,,,140712467365888,140712467365888,337294,299008,1656953249,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2562964Z","2025-11-19 19:51:21.2562964Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",6876,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.StateRepositoryPS.dll",,,,,,,,,,1763581881256296400,,,,,,,,,,,140712490369024,140712490369024,879719,802816,374042279,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2604808Z","2025-11-19 19:51:21.2604808Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.Globalization.dll",,,,,,,,,,1763581881260480800,,,,,,,,,,,140712593457152,140712593457152,1640332,1634304,3240919660,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2609450Z","2025-11-19 19:51:21.2609450Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\BCP47Langs.dll",,,,,,,,,,1763581881260945000,,,,,,,,,,,140712631468032,140712631468032,402331,385024,2065030180,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.821877500Z","2025-11-19 19:51:21.2718203Z","myETW","EDRi-Provider",4242,"EDRiTask","12472 EDRi.exe",,,,,,"After starting the attack exe",,,,,,,,,,,1763581881271820300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2731140Z","2025-11-19 19:51:21.2731140Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\PackagedCom\OpenConsoleProxy.dll",,,,,,,,,,1763581881273114000,,,,,,,,,,,140712723349504,140712723349504,51292,53248,1759975238,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2956095Z","2025-11-19 19:51:21.2956095Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\ExplorerFrame.dll",,,,,,,,,,1763581881295609500,,,,,,,,,,,140712345862144,140712345862144,2919775,2867200,3427672670,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3039247Z","2025-11-19 19:51:21.3039247Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4440 svchost.exe",15252,,," 4440 svchost.exe",,,,,,,,,,,,,1763581881303924700,18446633084039225344,18446633084039200768,140712899206080,0,985498337280,15252,985501007872,985500975104,140712899206080,3620366,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3135286Z","2025-11-19 19:51:21.3135286Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\Microsoft.Terminal.UI.dll",,,,,,,,,,1763581881313528600,,,,,,,,,,,140712371224576,140712371224576,255391,258048,1759975265,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3153663Z","2025-11-19 19:51:21.3153663Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\WindowsCodecs.dll",,,,,,,,,,1763581881315366300,,,,,,,,,,,140712775385088,140712775385088,2352359,2293760,3466818398,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3281911Z","2025-11-19 19:51:21.3281911Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\TextInputFramework.dll",,,,,,,,,,1763581881328191100,,,,,,,,,,,140712628846592,140712628846592,1374424,1339392,3535451269,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3351734Z","2025-11-19 19:51:21.3351734Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13828 OpenConsole.exe",2364,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881335173400,18446633084047904768,18446633084047880192,140702989217024,0,132813942784,5760,132823121920,132823117824,140702989217024,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3352289Z","2025-11-19 19:51:21.3352289Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13828 OpenConsole.exe",2364,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881335228900,18446633084039225344,18446633084039200768,140702989233856,0,132813950976,14196,132824170496,132824166400,140702989233856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3369403Z","2025-11-19 19:51:21.3369403Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3100 conhost.exe",6724,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881336940400,18446633084047990784,18446633084047966208,140696385038832,0,1013857775616,11136,1013862891520,1013862883328,140696385038832,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3370686Z","2025-11-19 19:51:21.3370686Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\uxtheme.dll",,,,,,,,,,1763581881337068600,,,,,,,,,,,140712802254848,140712802254848,696534,696320,1695798817,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3414284Z","2025-11-19 19:51:21.3414284Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881341428400,18446633084048019456,18446633084047994880,140702989086576,0,132813959168,5520,132825219072,132825214976,140702989086576,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3415372Z","2025-11-19 19:51:21.3415372Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\directmanipulation.dll",,,,,,,,,,1763581881341537200,,,,,,,,,,,140712583036928,140712583036928,714070,667648,3434535107,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3429436Z","2025-11-19 19:51:21.3429436Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881342943600,18446633084044541952,18446633084044517376,140712583404848,0,1068179726336,11716,1068190662656,1068190658560,140712583404848,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3431486Z","2025-11-19 19:51:21.3431486Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881343148700,18446633084042874880,18446633084042850304,140702989404080,0,132813967360,12916,132826267648,132826263552,140702989404080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3435982Z","2025-11-19 19:51:21.3435982Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",14844,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881343598200,18446633084047876096,18446633084047851520,140712899206080,0,1068179734528,9740,1068191711232,1068191707136,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3840381Z","2025-11-19 19:51:21.3840381Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8448 OneDrive.exe",12656,,," 8448 OneDrive.exe",,,,,,,,,,,,,1763581881384038100,18446633084042072064,18446633084042047488,140712859481984,0,70345129984,12656,70351060992,70351048704,140712859481984,5254774,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3843919Z","2025-11-19 19:51:21.3843919Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\msftedit.dll",,,,,,,,,,1763581881384391900,,,,,,,,,,,140712289107968,140712289107968,3297357,3305472,3878106343,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3869265Z","2025-11-19 19:51:21.3869265Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\globinputhost.dll",,,,,,,,,,1763581881386926500,,,,,,,,,,,140712627863552,140712627863552,263563,208896,1786968813,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3875820Z","2025-11-19 19:51:21.3875820Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.UI.Core.TextInput.dll",,,,,,,,,,1763581881387582000,,,,,,,,,,,140712572354560,140712572354560,1511216,1499136,21441667,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3882611Z","2025-11-19 19:51:21.3882611Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\CoreUIComponents.dll",,,,,,,,,,1763581881388261200,,,,,,,,,,,140712742944768,140712742944768,3046501,3022848,801552868,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3990087Z","2025-11-19 19:51:21.3990087Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4784 svchost.exe",10016,,," 4784 svchost.exe",,,,,,,,,,,,,1763581881399008700,18446633084049223680,18446633084049199104,140712899206080,0,476842119168,10016,476845178880,476845146112,140712899206080,233109,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3991102Z","2025-11-19 19:51:21.3991102Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4148 svchost.exe",14944,,," 4148 svchost.exe",,,,,,,,,,,,,1763581881399110200,18446633084008603648,18446633084008579072,140712899206080,0,934391029760,14944,934392889344,934392856576,140712899206080,547695,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3991392Z","2025-11-19 19:51:21.3991392Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4284 svchost.exe",12524,,," 4284 svchost.exe",,,,,,,,,,,,,1763581881399139300,18446633083996708864,18446633083996684288,140712899206080,0,216311418880,12524,216310611968,216310579200,140712899206080,609932,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4014776Z","2025-11-19 19:51:21.4014776Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881401477600,18446633084042072064,18446633084042047488,140712865112144,0,1068179742720,12568,1068192759808,1068192751616,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4033568Z","2025-11-19 19:51:21.4033568Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",12568,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\sxs.dll",,,,,,,,,,1763581881403356800,,,,,,,,,,,140712846622720,140712846622720,697955,659456,3834976666,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4123099Z","2025-11-19 19:51:21.4123099Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\xmllite.dll",,,,,,,,,,1763581881412309900,,,,,,,,,,,140712684027904,140712684027904,342897,274432,974526834,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4281758Z","2025-11-19 19:51:21.4281758Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\icu.dll",,,,,,,,,,1763581881428175800,,,,,,,,,,,140712684617728,140712684617728,2775448,2744320,3611555297,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4298365Z","2025-11-19 19:51:21.4298365Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881429836500,18446633084042932224,18446633084042907648,140712371704112,0,1068179750912,4932,1068193808384,1068193804288,140712371704112,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4299053Z","2025-11-19 19:51:21.4299053Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881429905300,18446633084007337984,18446633084007313408,140712378178864,0,1068179759104,3968,1068194856960,1068194852864,140712378178864,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4330267Z","2025-11-19 19:51:21.4330267Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\apphelp.dll",,,,,,,,,,1763581881433026700,,,,,,,,,,,140712800485376,140712800485376,675806,651264,4108425587,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4330576Z","2025-11-19 19:51:21.4330576Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",3968,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881433057600,18446633084048162816,18446633084048138240,140712899206080,0,1068179767296,11960,1068195905536,1068195901440,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4385550Z","2025-11-19 19:51:21.4385550Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581881438555000,,,,,,,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4386944Z","2025-11-19 19:51:21.4386944Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581881438694400,,,,,,,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4388601Z","2025-11-19 19:51:21.4388601Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581881438860100,18446633083996708864,18446633083996684288,140712899206080,0,289797914624,11468,289801240576,289801236480,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4389513Z","2025-11-19 19:51:21.4389513Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581881438951300,,,,,,,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4391936Z","2025-11-19 19:51:21.4391936Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581881439193600,,,,,,,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4393533Z","2025-11-19 19:51:21.4393533Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581881439353300,18446633084049022976,18446633084048998400,140712899206080,0,289797922816,3088,289802289152,289802285056,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4394768Z","2025-11-19 19:51:21.4394768Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581881439476800,,,,,,,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4394810Z","2025-11-19 19:51:21.4394810Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3348 attack-589.exe",3088,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581881439481000,18446633084049080320,18446633084049055744,140712899206080,0,289797931008,12904,289803337728,289803333632,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4397699Z","2025-11-19 19:51:21.4397699Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11468,,," 3348 attack-589.exe",,,"C:\Windows\System32\msvcp140.dll",,,,,,,,,,1763581881439769900,,,,,,,,,,,140711213137920,140711213137920,570439,561152,1564323704,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4397897Z","2025-11-19 19:51:21.4397897Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",3088,,," 3348 attack-589.exe",,,"C:\Windows\System32\vcruntime140_1.dll",,,,,,,,,,1763581881439789700,,,,,,,,,,,140712354119680,140712354119680,57827,49152,240324076,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4398073Z","2025-11-19 19:51:21.4398073Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",12904,,," 3348 attack-589.exe",,,"C:\Windows\System32\vcruntime140.dll",,,,,,,,,,1763581881439807300,,,,,,,,,,,140712353988608,140712353988608,146072,122880,254123393,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.974665800Z","2025-11-19 19:51:21.4415712Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Injector started with PID 3348",,,,,,,,,,,1763581881441571200,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4676380Z","2025-11-19 19:51:21.4676380Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",9740,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881467638000,18446633084049252352,18446633084049227776,140712899206080,0,1068179775488,12140,1068196954112,1068196950016,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4804511Z","2025-11-19 19:51:21.4804511Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.Graphics.dll",,,,,,,,,,1763581881480451100,,,,,,,,,,,140712711225344,140712711225344,669723,593920,1068018205,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5091155Z","2025-11-19 19:51:21.5091155Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\threadpoolwinrt.dll",,,,,,,,,,1763581881509115500,,,,,,,,,,,140712555839488,140712555839488,130107,90112,2299561022,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5095245Z","2025-11-19 19:51:21.5095245Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881509524500,18446633084044570624,18446633084044546048,140712899206080,0,1068179783680,3600,1068198002688,1068197998592,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5099019Z","2025-11-19 19:51:21.5099019Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",3600,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881509901900,18446633084046180352,18446633084046155776,140712899206080,0,1068179791872,11228,1068199051264,1068199047168,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5101012Z","2025-11-19 19:51:21.5101012Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",11228,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881510101200,18446633084049424384,18446633084049399808,140712899206080,0,1068179800064,1960,1068200099840,1068200095744,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5102588Z","2025-11-19 19:51:21.5102588Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",3600,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\pfclient.dll",,,,,,,,,,1763581881510258800,,,,,,,,,,,140712803500032,140712803500032,92868,73728,3163590703,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5107492Z","2025-11-19 19:51:21.5107492Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",1960,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881510749200,18446633084049453056,18446633084049428480,140712899206080,0,1068179808256,12764,1068201148416,1068201144320,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5109197Z","2025-11-19 19:51:21.5109197Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",12764,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881510919700,18446633084049481728,18446633084049457152,140712899206080,0,1068179816448,14948,1068202196992,1068202192896,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5586241Z","2025-11-19 19:51:21.5586241Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3564 MsMpEng.exe",15224,,," 3564 MsMpEng.exe",,,,,,,,,,,,,1763581881558624100,18446633084048191488,18446633084048166912,140712899206080,247,273686052864,4152,273715036160,273714970624,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5586910Z","2025-11-19 19:51:21.5586910Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3564 MsMpEng.exe",15224,,," 3564 MsMpEng.exe",,,,,,,,,,,,,1763581881558691000,18446633084049653760,18446633084049629184,140712647800224,247,273686061056,6492,273715560448,273715494912,140712647800224,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5588912Z","2025-11-19 19:51:21.5588912Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3564 MsMpEng.exe",4152,,," 3564 MsMpEng.exe",,,,,,,,,,,,,1763581881558891200,18446633084049739776,18446633084049715200,140712899206080,0,273686069248,908,273716084736,273716019200,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5934226Z","2025-11-19 19:51:21.5934226Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3492 svchost.exe",5904,,," 3492 svchost.exe",,,"C:\Windows\System32\wintrust.dll",,,,,,,,,,1763581881593422600,,,,,,,,,,,140712860844032,140712860844032,590783,520192,452262045,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5947441Z","2025-11-19 19:51:21.5947441Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3564 MsMpEng.exe",6492,,," 3564 MsMpEng.exe",,,,,,,,,,,,,1763581881594744200,18446633084049653760,18446633084049629184,140712647800224,247,273686061056,6492,273715560448,273715494912,140712647800224,444719,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5948825Z","2025-11-19 19:51:21.5948825Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3492 svchost.exe",5904,,," 3492 svchost.exe",,,,,,,,,,,,,1763581881594882500,18446633084049653760,18446633084049629184,140712850417280,51,390179405824,6828,390182469632,390182436864,140712850417280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5949276Z","2025-11-19 19:51:21.5949276Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8972 VBoxTray.exe",9020,,," 8972 VBoxTray.exe",,,,,,,,,,,,,1763581881594927600,18446633084049825792,18446633084049801216,140700131109808,0,471284236288,10404,471286677504,471286673408,140700131109808,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5950105Z","2025-11-19 19:51:21.5950105Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3492 svchost.exe",5904,,," 3492 svchost.exe",,,"C:\Windows\System32\imagehlp.dll",,,,,,,,,,1763581881595010500,,,,,,,,,,,140712892760064,140712892760064,200866,131072,2156568970,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5952887Z","2025-11-19 19:51:21.5952887Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8972 VBoxTray.exe",10404,,," 8972 VBoxTray.exe",,,,,,,,,,,,,1763581881595288800,18446633084049825792,18446633084049801216,140700131109808,0,471284236288,10404,471286677504,471286669312,140700131109808,498282,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.7341752Z","2025-11-19 19:51:21.7341752Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5492 svchost.exe",14880,,," 5492 svchost.exe",,,,,,,,,,,,,1763581881734175200,18446633083981475840,18446633083981451264,140712899206080,0,915765288960,14880,915762446336,915762413568,140712899206080,296102,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.7983187Z","2025-11-19 19:51:21.7983187Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","12224 svchost.exe",9032,,,"12224 svchost.exe",,,,,,,,,,,,,1763581881798318700,18446633084060700672,18446633084060676096,140712899206080,0,706015498240,9032,706018803712,706018770944,140712899206080,8518314,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.7983803Z","2025-11-19 19:51:21.7983803Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","12224 svchost.exe",10960,,,"12224 svchost.exe",,,,,,,,,,,,,1763581881798380300,18446633084060872704,18446633084060848128,140712899206080,0,706015514624,10960,706019852288,706019819520,140712899206080,2446520,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.8777317Z","2025-11-19 19:51:21.8777317Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","12036 svchost.exe",9152,,,"12036 svchost.exe",,,,,,,,,,,,,1763581881877731700,18446633084061933568,18446633084061908992,140712899206080,0,457933398016,9152,457937780736,457937747968,140712899206080,1219109,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.8777978Z","2025-11-19 19:51:21.8777978Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","12036 svchost.exe",1972,,,"12036 svchost.exe",,,,,,,,,,,,,1763581881877797800,18446633084061589504,18446633084061564928,140712899206080,0,457933357056,1972,457935159296,457935126528,140712899206080,44750634,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.8778273Z","2025-11-19 19:51:21.8778273Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","12036 svchost.exe",6012,,,"12036 svchost.exe",,,,,,,,,,,,,1763581881877827300,18446633084061876224,18446633084061851648,140712899206080,0,457933389824,6012,457937256448,457937223680,140712899206080,909052,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.9736609Z","2025-11-19 19:51:21.9736609Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 4608 svchost.exe",,,,,,,,,,,,,1763581881973660900,18446633084061876224,18446633084061851648,140712899206080,0,287385972736,12852,287387942912,287387910144,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.0373099Z","2025-11-19 19:51:22.0373099Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 9692 PerfWatson2.exe",9752,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,1763581882037309900,18446633084061589504,18446633084061564928,140711612509856,0,1046353248256,8132,1046352232448,1046352216064,140711612509856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.0697083Z","2025-11-19 19:51:22.0697083Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6096 svchost.exe",11408,,," 6096 svchost.exe",,,,,,,,,,,,,1763581882069708300,18446633084055818240,18446633084055793664,140712899206080,0,338489364480,11408,338488393728,338488360960,140712899206080,684617,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.1476357Z","2025-11-19 19:51:22.1476357Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9388 devenv.exe",5524,,," 9388 devenv.exe",,,,,,,,,,,,,1763581882147635700,18446633084010299392,18446633084010274816,140711613062896,0,1033376530432,5524,1033400483840,1033400401920,140711613062896,847113123,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.1480054Z","2025-11-19 19:51:22.1480054Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9388 devenv.exe",8848,,," 9388 devenv.exe",,,,,,,,,,,,,1763581882148005400,18446633084060069888,18446633084060045312,140711613062896,0,1033376243712,8848,1033378988032,1033378902016,140711613062896,697768345,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.3061593Z","2025-11-19 19:51:22.3061593Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 4440 svchost.exe",,,,,,,,,,,,,1763581882306159300,18446633084060069888,18446633084060045312,140712899206080,0,985498419200,13764,985501007872,985500975104,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.4015320Z","2025-11-19 19:51:22.4015320Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 4784 svchost.exe",,,,,,,,,,,,,1763581882401532000,18446633084010299392,18446633084010274816,140712899206080,0,476842127360,6624,476845178880,476845146112,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.4016565Z","2025-11-19 19:51:22.4016565Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 4148 svchost.exe",,,,,,,,,,,,,1763581882401656500,18446633084060872704,18446633084060848128,140712899206080,0,934391037952,15288,934392889344,934392856576,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.4017245Z","2025-11-19 19:51:22.4017245Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 4284 svchost.exe",,,,,,,,,,,,,1763581882401724500,18446633084061933568,18446633084061908992,140712899206080,0,216311427072,4948,216310611968,216310579200,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.852182900Z","2025-11-19 19:51:22.4165908Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Running 'standard' config",,,,,,,,,,,1763581882416590800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.852392100Z","2025-11-19 19:51:22.4168223Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Before starting subprocess to inject to",,,,,,,,,,,1763581882416822300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.4176543Z","2025-11-19 19:51:22.4176543Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 3348 attack-589.exe",11212,,," 1436 whoami.exe",,,"C:\Windows\System32\whoami.exe",,,,,,,,,,1763581882417654300,,,,,,,,,,,,,160109,,3602411345,,,,134080554818530829,,,,,3396,,,,,,0,"0x","","",3348,3392,3,0,0,1 -"2025-11-19 19:51:22.4206852Z","2025-11-19 19:51:22.4206852Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3348 attack-589.exe",11212,,," 1436 whoami.exe",,,,,,,,,,,,,1763581882420685200,18446633084049825792,18446633084049801216,140702344617136,0,521061564416,12400,521063104512,521063096320,140702344617136,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.858891900Z","2025-11-19 19:51:22.4240441Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"After starting subprocess with PID 1436",,,,,,,,,,,1763581882424044100,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.5270232Z","2025-11-19 19:51:22.5270232Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2564 svchost.exe",4464,,," 2564 svchost.exe",,,,,,,,,,,,,1763581882527023200,18446633084007137280,18446633084007112704,140712899206080,0,914261585920,4464,914258788352,914258755584,140712899206080,182942,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.5270233Z","2025-11-19 19:51:22.5270233Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6028 svchost.exe",3044,,," 6028 svchost.exe",,,,,,,,,,,,,1763581882527023300,18446633084008202240,18446633084008177664,140712899206080,0,661507956736,3044,661509373952,661509341184,140712899206080,585791,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.5270234Z","2025-11-19 19:51:22.5270234Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","12708 svchost.exe",7104,,,"12708 svchost.exe",,,,,,,,,,,,,1763581882527023400,18446633083981504512,18446633083981479936,140712899206080,0,305338654720,7104,305336352768,305336320000,140712899206080,235373,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.5270347Z","2025-11-19 19:51:22.5270347Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 7916 svchost.exe",5744,,," 7916 svchost.exe",,,,,,,,,,,,,1763581882527034700,18446633084004753408,18446633084004728832,140712899206080,0,401963933696,5744,401962827776,401962795008,140712899206080,435290,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.5586311Z","2025-11-19 19:51:22.5586311Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1356 CrossDeviceResume.exe",14964,,," 1356 CrossDeviceResume.exe",,,,,,,,,,,,,1763581882558631100,18446633083982278656,18446633083982254080,140712899206080,0,401574907904,14964,399433007104,399433003008,140712899206080,155784,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.7344771Z","2025-11-19 19:51:22.7344771Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 5492 svchost.exe",,,,,,,,,,,,,1763581882734477100,18446633084060700672,18446633084060676096,140712899206080,0,915765297152,2416,915762446336,915762413568,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.7967772Z","2025-11-19 19:51:22.7967772Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",6292,,," 5184 explorer.exe",,,,,,,,,,,,,1763581882796777200,18446633083982278656,18446633083982254080,140712899206080,0,15294464,13628,470876160,470818816,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.8136763Z","2025-11-19 19:51:22.8136763Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"12224 svchost.exe",,,,,,,,,,,,,1763581882813676300,18446633084048994304,18446633084048969728,140712899206080,0,706015555584,2892,706017230848,706017198080,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.8602030Z","2025-11-19 19:51:22.8602030Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\twinapi.dll",,,,,,,,,,1763581882860203000,,,,,,,,,,,140712415789056,140712415789056,924452,868352,2129603828,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.8936636Z","2025-11-19 19:51:22.8936636Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"12036 svchost.exe",,,,,,,,,,,,,1763581882893663600,18446633084049969152,18446633084049944576,140712899206080,0,457933406208,2408,457931489280,457931456512,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.9405137Z","2025-11-19 19:51:22.9405137Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1744 svchost.exe",6132,,," 1744 svchost.exe",,,,,,,,,,,,,1763581882940513700,18446633083994210304,18446633083994185728,140712899206080,0,481879539712,6132,481878671360,481878638592,140712899206080,362866,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.9405682Z","2025-11-19 19:51:22.9405682Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1288 mmc.exe",10868,,," 1288 mmc.exe",,,,,,,,,,,,,1763581882940568200,18446633084007137280,18446633084007112704,140711612509856,0,7143424,14856,82575360,82493440,140711612509856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.0825789Z","2025-11-19 19:51:23.0825789Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 6096 svchost.exe",,,,,,,,,,,,,1763581883082578900,18446633083994210304,18446633083994185728,140712899206080,0,338489372672,15276,338488393728,338488360960,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.1468947Z","2025-11-19 19:51:23.1468947Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1520 powershell.exe",14016,,," 1520 powershell.exe",,,,,,,,,,,,,1763581883146894700,18446633084033425408,18446633084033400832,140711613062896,0,931706298368,14016,931709583360,931709571072,140711613062896,897359,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.1469567Z","2025-11-19 19:51:23.1469567Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1520 powershell.exe",7828,,," 1520 powershell.exe",,,,,,,,,,,,,1763581883146956700,18446633084032733184,18446633084032708608,140711613062896,0,931706281984,7828,931709059072,931709046784,140711613062896,2453686,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.2263639Z","2025-11-19 19:51:23.2263639Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8984 svchost.exe",12448,,," 8984 svchost.exe",,,,,,,,,,,,,1763581883226363900,18446633084008632320,18446633084008607744,140712899206080,0,213146189824,12448,213148762112,213148729344,140712899206080,610310,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.737817600Z","2025-11-19 19:51:23.4006311Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Before opening process handle",,,,,,,,,,,1763581883400631100,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.738077500Z","2025-11-19 19:51:23.4009294Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"After opening process handle",,,,,,,,,,,1763581883400929400,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.5280186Z","2025-11-19 19:51:23.5280186Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 6028 svchost.exe",,,,,,,,,,,,,1763581883528018700,18446633084050083840,18446633084050059264,140712899206080,0,661507964928,5984,661509373952,661509341184,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.5280753Z","2025-11-19 19:51:23.5280753Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 2564 svchost.exe",,,,,,,,,,,,,1763581883528075300,18446633084033425408,18446633084033400832,140712899206080,0,914261594112,8752,914258788352,914258755584,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.5282059Z","2025-11-19 19:51:23.5282059Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"12708 svchost.exe",,,,,,,,,,,,,1763581883528205900,18446633084050112512,18446633084050087936,140712899206080,0,305338662912,14960,305336352768,305336320000,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.5283076Z","2025-11-19 19:51:23.5283076Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 7916 svchost.exe",,,,,,,,,,,,,1763581883528307600,18446633084050141184,18446633084050116608,140712899206080,0,401963941888,14924,401962827776,401962795008,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.5439313Z","2025-11-19 19:51:23.5439313Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9832 svchost.exe",12936,,," 9832 svchost.exe",,,,,,,,,,,,,1763581883543931300,18446633084008488960,18446633084008464384,140712899206080,0,234793099264,12936,234792878080,234792845312,140712899206080,581642,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.5439491Z","2025-11-19 19:51:23.5439491Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9184 svchost.exe",10120,,," 9184 svchost.exe",,,,,,,,,,,,,1763581883543949100,18446633084007596032,18446633084007571456,140712899206080,0,580428570624,10120,580430856192,580430823424,140712899206080,265172,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.5441731Z","2025-11-19 19:51:23.5441731Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",8132,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,1763581883544173100,18446633084061589504,18446633084061564928,140711612509856,0,1046353248256,8132,1046352232448,1046352216064,140711612509856,1009010,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.5598467Z","2025-11-19 19:51:23.5598467Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1356 CrossDeviceResume.exe",,,,,,,,,,,,,1763581883559846700,18446633084061589504,18446633084061564928,140712899206080,0,401574932480,6020,399433007104,399433003008,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.8464387Z","2025-11-19 19:51:23.8464387Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6588 Widgets.exe",9292,,," 6588 Widgets.exe",,,,,,,,,,,,,1763581883846438700,18446633084009119744,18446633084009095168,140712899206080,0,120133607424,9292,120137449472,120137445376,140712899206080,571457,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.9424379Z","2025-11-19 19:51:23.9424379Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","11528 msedgewebview2.exe",11184,,,"11528 msedgewebview2.exe",,,,,,,,,,,,,1763581883942437900,18446633084001447936,18446633084001423360,140712899206080,0,473244606464,11184,473262194688,473262186496,140712899206080,36366232,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.9425488Z","2025-11-19 19:51:23.9425488Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1744 svchost.exe",,,,,,,,,,,,,1763581883942548800,18446633084009119744,18446633084009095168,140712899206080,0,481879547904,14720,481878671360,481878638592,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.0224211Z","2025-11-19 19:51:24.0224211Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6904 WidgetService.exe",5232,,," 6904 WidgetService.exe",,,,,,,,,,,,,1763581884022421100,18446633084009377792,18446633084009353216,140712899206080,0,274672095232,5232,274673434624,274673430528,140712899206080,283654,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.1338922Z","2025-11-19 19:51:24.1338922Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9324 msedgewebview2.exe",3756,,," 9324 msedgewebview2.exe",,,,,,,,,,,,,1763581884133892200,18446633084009492480,18446633084009467904,140712899206080,0,717035753472,3756,717054017536,717054013440,140712899206080,302513,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.2294186Z","2025-11-19 19:51:24.2294186Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 8984 svchost.exe",,,,,,,,,,,,,1763581884229418600,18446633084008488960,18446633084008464384,140712899206080,0,213146198016,11968,213148762112,213148729344,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.2665429Z","2025-11-19 19:51:24.2665429Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","15184 SearchProtocolHost.exe",4084,,,"15184 SearchProtocolHost.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,1763581884266542900,,,,,,,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.2699363Z","2025-11-19 19:51:24.2699363Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","15184 SearchProtocolHost.exe",4084,,,"15184 SearchProtocolHost.exe",,,"C:\Windows\System32\profapi.dll",,,,,,,,,,1763581884269936300,,,,,,,,,,,140712848850944,140712848850944,229548,167936,2447194521,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.2770172Z","2025-11-19 19:51:24.2770172Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6500 SearchHost.exe",14416,,," 6500 SearchHost.exe",,,,,,,,,,,,,1763581884277017200,18446633084041756672,18446633084041732096,140712449945792,0,1050565771264,14416,1050568294400,1050568228864,140712449945792,1313034,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.2771868Z","2025-11-19 19:51:24.2771868Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6500 SearchHost.exe",11280,,," 6500 SearchHost.exe",,,,,,,,,,,,,1763581884277186800,18446633084041756672,18446633084041732096,140712449945792,0,1050565779456,14564,1050568294400,1050568228864,140712449945792,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.3409661Z","2025-11-19 19:51:24.3409661Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3540 svchost.exe",9968,,," 3540 svchost.exe",,,,,,,,,,,,,1763581884340966100,18446633084035059712,18446633084035035136,140711742624160,249,589657714688,9968,589661470720,589661437952,140711742624160,391728995,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.3409681Z","2025-11-19 19:51:24.3409681Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3540 svchost.exe",1184,,," 3540 svchost.exe",,,,,,,,,,,,,1763581884340968100,18446633084035031040,18446633084035006464,140711742624160,249,589657706496,1184,589660946432,589660913664,140711742624160,10633090708,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.612812600Z","2025-11-19 19:51:24.3728485Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Before allocating memory for shellcode",,,,,,,,,,,1763581884372848500,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.613174800Z","2025-11-19 19:51:24.3732488Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"After allocating memory for shellcode at 000001FF40840000",,,,,,,,,,,1763581884373248800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.4527822Z","2025-11-19 19:51:24.4527822Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6424 msedgewebview2.exe",9252,,," 6424 msedgewebview2.exe",,,,,,,,,,,,,1763581884452782200,18446633084056793088,18446633084056768512,140712899206080,0,795610513408,9252,795628011520,795628007424,140712899206080,13231797,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.4528000Z","2025-11-19 19:51:24.4528000Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1768 msedgewebview2.exe",7724,,," 1768 msedgewebview2.exe",,,,,,,,,,,,,1763581884452800000,18446633084009091072,18446633084009066496,140712899206080,0,1047163273216,7724,1047324000256,1047323996160,140712899206080,493756,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.5476392Z","2025-11-19 19:51:24.5476392Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9832 svchost.exe",,,,,,,,,,,,,1763581884547639200,18446633084050571264,18446633084050546688,140712899206080,0,234793107456,4980,234792878080,234792845312,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.5476971Z","2025-11-19 19:51:24.5476971Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9184 svchost.exe",,,,,,,,,,,,,1763581884547697100,18446633084009091072,18446633084009066496,140712899206080,0,580428578816,15320,580430856192,580430823424,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.8347452Z","2025-11-19 19:51:24.8347452Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3628 msedgewebview2.exe",2068,,," 3628 msedgewebview2.exe",,,,,,,,,,,,,1763581884834745200,18446633084009865216,18446633084009840640,140712899206080,0,1084563218432,2068,1084732997632,1084732993536,140712899206080,442456,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.8509683Z","2025-11-19 19:51:24.8509683Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 6588 Widgets.exe",,,,,,,,,,,,,1763581884850968300,18446633084009865216,18446633084009840640,140712899206080,0,120133615616,10764,120137449472,120137445376,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.9462310Z","2025-11-19 19:51:24.9462310Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"11528 msedgewebview2.exe",,,,,,,,,,,,,1763581884946231000,18446633084050599936,18446633084050575360,140712899206080,0,473244639232,14000,473262194688,473262190592,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.9464943Z","2025-11-19 19:51:24.9464943Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1288 mmc.exe",14856,,," 1288 mmc.exe",,,,,,,,,,,,,1763581884946494300,18446633084007137280,18446633084007112704,140711612509856,0,7143424,14856,82575360,82493440,140711612509856,1574057,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.0259698Z","2025-11-19 19:51:25.0259698Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 6904 WidgetService.exe",,,,,,,,,,,,,1763581885025969800,18446633084007137280,18446633084007112704,140712899206080,0,274672103424,12200,274673434624,274673430528,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.1377420Z","2025-11-19 19:51:25.1377420Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9324 msedgewebview2.exe",,,,,,,,,,,,,1763581885137742000,18446633083981475840,18446633083981451264,140712899206080,0,717035761664,1928,717054017536,717054013440,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.486948200Z","2025-11-19 19:51:25.3441106Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Before writing shellcode to process",,,,,,,,,,,1763581885344110600,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.487258200Z","2025-11-19 19:51:25.3444526Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"After writing shellcode to process at 000001FF40840000",,,,,,,,,,,1763581885344452600,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.4554544Z","2025-11-19 19:51:25.4554544Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1768 msedgewebview2.exe",,,,,,,,,,,,,1763581885455454400,18446633084050857984,18446633084050833408,140712899206080,0,1047163281408,12460,1047324000256,1047323996160,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.4555172Z","2025-11-19 19:51:25.4555172Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 6424 msedgewebview2.exe",,,,,,,,,,,,,1763581885455517200,18446633084051030016,18446633084051005440,140712899206080,0,795610558464,744,795628011520,795628007424,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.4882512Z","2025-11-19 19:51:25.4882512Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8268 svchost.exe",14888,,," 8268 svchost.exe",,,,,,,,,,,,,1763581885488251200,18446633083999670272,18446633083999645696,140712899206080,0,178507935744,14888,178510102528,178510069760,140712899206080,379840,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.8389195Z","2025-11-19 19:51:25.8389195Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3628 msedgewebview2.exe",,,,,,,,,,,,,1763581885838919500,18446633084050169856,18446633084050145280,140712899206080,0,1084563226624,2912,1084732997632,1084732993536,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.9987993Z","2025-11-19 19:51:25.9987993Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13112 TimelineExplorer.exe",13516,,,"13112 TimelineExplorer.exe",,,,,,,,,,,,,1763581885998799300,18446633083996135424,18446633083996110848,140712899206080,0,1007263227904,13516,1007289368576,1007289360384,140712899206080,343629,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.9989283Z","2025-11-19 19:51:25.9989283Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13112 TimelineExplorer.exe",10004,,,"13112 TimelineExplorer.exe",,,,,,,,,,,,,1763581885998928300,18446633084056133632,18446633084056109056,140712899206080,0,1007263203328,10004,1007284649984,1007284637696,140712899206080,1595177,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:26.0638848Z","2025-11-19 19:51:26.0638848Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5184 explorer.exe",5116,,," 5184 explorer.exe",,,,,,,,,,,,,1763581886063884800,18446633084043362304,18446633084043337728,140712891545280,0,15286272,5116,467664896,467607552,140712891545280,69722029,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:26.0786440Z","2025-11-19 19:51:26.0786440Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 9920 ServiceHub.IntellicodeModelService.exe",9760,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,1763581886078644000,18446633084043362304,18446633084043337728,140711612509856,0,46014316544,11908,46012694528,46012678144,140711612509856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.362253700Z","2025-11-19 19:51:26.3166701Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Before changing memory protection to PAGE_EXECUTE_READ",,,,,,,,,,,1763581886316670100,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.362529500Z","2025-11-19 19:51:26.3169751Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"After changing memory protection to PAGE_EXECUTE_READ",,,,,,,,,,,1763581886316975100,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:26.4924720Z","2025-11-19 19:51:26.4924720Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 8268 svchost.exe",,,,,,,,,,,,,1763581886492472000,18446633084051116032,18446633084051091456,140712899206080,0,178507943936,4236,178510102528,178510069760,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:26.6059639Z","2025-11-19 19:51:26.6059639Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8972 VBoxTray.exe",9020,,," 8972 VBoxTray.exe",,,,,,,,,,,,,1763581886605964000,18446633084051144704,18446633084051120128,140700131109808,0,471284244480,3136,471286677504,471286673408,140700131109808,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:26.6062393Z","2025-11-19 19:51:26.6062393Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8972 VBoxTray.exe",3136,,," 8972 VBoxTray.exe",,,,,,,,,,,,,1763581886606239300,18446633084051144704,18446633084051120128,140700131109808,0,471284244480,3136,471286677504,471286669312,140700131109808,649161,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:26.7793053Z","2025-11-19 19:51:26.7793053Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5184 explorer.exe",8788,,," 5184 explorer.exe",,,,,,,,,,,,,1763581886779305300,18446633084051058688,18446633084051034112,140712891292720,0,15097856,8788,214564864,214507520,140712891292720,14753796,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:26.296106600Z","2025-11-19 19:51:27.3019664Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Before reading memory to verify write",,,,,,,,,,,1763581887301966400,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:26.296340900Z","2025-11-19 19:51:27.3022001Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Before creating remote thread",,,,,,,,,,,1763581887302200100,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3024711Z","2025-11-19 19:51:27.3024711Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3348 attack-589.exe",11212,,," 1436 whoami.exe",,,,,,,,,,,,,1763581887302471100,18446633084051144704,18446633084051120128,2195810680832,0,521061572608,6380,521063628800,521063620608,2195810680832,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:26.296634600Z","2025-11-19 19:51:27.3024967Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"After creating remote thread",,,,,,,,,,,1763581887302496700,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3025746Z","2025-11-19 19:51:27.3025746Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\whoami.exe",,,,,,,,,,1763581887302574600,,,,,,,,,,,140702344609792,140702344609792,160109,98304,3602411345,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3026097Z","2025-11-19 19:51:27.3026097Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581887302609700,,,,,,,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3056213Z","2025-11-19 19:51:27.3056213Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581887305621300,,,,,,,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3057466Z","2025-11-19 19:51:27.3057466Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581887305746600,,,,,,,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3071785Z","2025-11-19 19:51:27.3071785Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\apphelp.dll",,,,,,,,,,1763581887307178500,,,,,,,,,,,140712800485376,140712800485376,675806,651264,4108425587,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3090501Z","2025-11-19 19:51:27.3090501Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581887309050100,,,,,,,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3091555Z","2025-11-19 19:51:27.3091555Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581887309155600,,,,,,,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3092448Z","2025-11-19 19:51:27.3092448Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,,,,,,,,,,,1763581887309244800,18446633084051173376,18446633084051148800,140712899206080,0,521061580800,8880,521064153088,521064144896,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3093136Z","2025-11-19 19:51:27.3093136Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581887309313600,,,,,,,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3095347Z","2025-11-19 19:51:27.3095347Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581887309534700,,,,,,,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3096825Z","2025-11-19 19:51:27.3096825Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,1763581887309682500,,,,,,,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3096888Z","2025-11-19 19:51:27.3096888Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1436 whoami.exe",8880,,," 1436 whoami.exe",,,,,,,,,,,,,1763581887309688800,18446633084051230720,18446633084051206144,140712899206080,0,521061588992,12688,521064677376,521064669184,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3098080Z","2025-11-19 19:51:27.3098080Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3564 MsMpEng.exe",15224,,," 3564 MsMpEng.exe",,,,,,,,,,,,,1763581887309808100,18446633084051259392,18446633084051234816,140712899206080,247,273686077440,11372,273715560448,273715494912,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3099257Z","2025-11-19 19:51:27.3099257Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,1763581887309925700,,,,,,,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3101194Z","2025-11-19 19:51:27.3101194Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,1763581887310119400,,,,,,,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3102504Z","2025-11-19 19:51:27.3102504Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,1763581887310250400,,,,,,,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3103899Z","2025-11-19 19:51:27.3103899Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581887310389900,,,,,,,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3105193Z","2025-11-19 19:51:27.3105193Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581887310519300,,,,,,,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3107041Z","2025-11-19 19:51:27.3107041Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,,,,,,,,,,,1763581887310704100,18446633084051288064,18446633084051263488,140712899206080,0,521061597184,1528,521065201664,521065193472,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3108191Z","2025-11-19 19:51:27.3108191Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\ws2_32.dll",,,,,,,,,,1763581887310819100,,,,,,,,,,,140712881094656,140712881094656,513405,475136,3967481067,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3111648Z","2025-11-19 19:51:27.3111648Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\wkscli.dll",,,,,,,,,,1763581887311164800,,,,,,,,,,,140712738291712,140712738291712,170846,110592,1225555544,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3111762Z","2025-11-19 19:51:27.3111762Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",1528,,," 1436 whoami.exe",,,"C:\Windows\System32\version.dll",,,,,,,,,,1763581887311176200,,,,,,,,,,,140712753168384,140712753168384,72452,45056,2275202464,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3111842Z","2025-11-19 19:51:27.3111842Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",12688,,," 1436 whoami.exe",,,"C:\Windows\System32\authz.dll",,,,,,,,,,1763581887311184200,,,,,,,,,,,140712826241024,140712826241024,372179,327680,771731569,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3111842Z","2025-11-19 19:51:27.3111842Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",8880,,," 1436 whoami.exe",,,"C:\Windows\System32\sspicli.dll",,,,,,,,,,1763581887311184200,,,,,,,,,,,140712833384448,140712833384448,339222,299008,3030302172,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3115813Z","2025-11-19 19:51:27.3115813Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\netutils.dll",,,,,,,,,,1763581887311581300,,,,,,,,,,,140712825847808,140712825847808,80696,53248,865845000,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3132484Z","2025-11-19 19:51:27.3132484Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,1763581887313248400,,,,,,,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3158199Z","2025-11-19 19:51:27.3158199Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1436 whoami.exe",6380,,,"11148 calc.exe",,,"C:\Windows\System32\calc.exe",,,,,,,,,,1763581887315819900,,,,,,,,,,,,,90741,,4001445627,,,,134080554863097645,,,,,3397,,,,,,0,"0x","","",1436,3396,3,0,0,1 -"2025-11-19 19:51:27.3177666Z","2025-11-19 19:51:27.3177666Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4372 vctip.exe",12540,,," 4372 vctip.exe",,,,,,,,,,,,,1763581887317766600,18446633084051431424,18446633084051406848,140711613062896,0,740355272704,8244,740356521984,740356513792,140711613062896,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3178282Z","2025-11-19 19:51:27.3178282Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4372 vctip.exe",12540,,," 4372 vctip.exe",,,,,,,,,,,,,1763581887317828200,18446633084051488768,18446633084051464192,140711612509856,0,740355280896,3948,740352917504,740352909312,140711612509856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3181875Z","2025-11-19 19:51:27.3181875Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4372 vctip.exe",8244,,," 4372 vctip.exe",,,,,,,,,,,,,1763581887318187500,18446633084051517440,18446633084051492864,140711613062896,0,740355289088,8128,740357570560,740357562368,140711613062896,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3182888Z","2025-11-19 19:51:27.3182888Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4372 vctip.exe",8244,,," 4372 vctip.exe",,,,,,,,,,,,,1763581887318288800,18446633084051546112,18446633084051521536,140711613062896,0,740355297280,6044,740358619136,740358610944,140711613062896,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3183397Z","2025-11-19 19:51:27.3183397Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1436 whoami.exe",6380,,,"11148 calc.exe",,,,,,,,,,,,,1763581887318339700,18446633084051058688,18446633084051034112,140696878126912,0,728547835904,4224,728545624064,728545615872,140696878126912,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3194990Z","2025-11-19 19:51:27.3194990Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4372 vctip.exe",8244,,," 4372 vctip.exe",,,,,,,,,,,,,1763581887319499000,18446633084051603456,18446633084051578880,140711613062896,0,740355305472,14984,740361764864,740361756672,140711613062896,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3195689Z","2025-11-19 19:51:27.3195689Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\calc.exe",,,,,,,,,,1763581887319568900,,,,,,,,,,,140696878120960,140696878120960,90741,49152,4001445627,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3195880Z","2025-11-19 19:51:27.3195880Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581887319588000,,,,,,,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3235352Z","2025-11-19 19:51:27.3235352Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581887323535200,,,,,,,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3236546Z","2025-11-19 19:51:27.3236546Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581887323654600,,,,,,,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3246614Z","2025-11-19 19:51:27.3246614Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,1763581887324661400,,,,,,,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3248541Z","2025-11-19 19:51:27.3248541Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581887324854100,,,,,,,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3249716Z","2025-11-19 19:51:27.3249716Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581887324971600,,,,,,,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3250774Z","2025-11-19 19:51:27.3250774Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11148 calc.exe",4224,,,"11148 calc.exe",,,,,,,,,,,,,1763581887325077400,18446633084051718144,18446633084051693568,140712899206080,0,728547844096,5464,728546148352,728546140160,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3251688Z","2025-11-19 19:51:27.3251688Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11148 calc.exe",5464,,,"11148 calc.exe",,,,,,,,,,,,,1763581887325168800,18446633084051746816,18446633084051722240,140712899206080,0,728547852288,12924,728549031936,728549023744,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3251902Z","2025-11-19 19:51:27.3251902Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,1763581887325190200,,,,,,,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3254114Z","2025-11-19 19:51:27.3254114Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,1763581887325411400,,,,,,,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3255722Z","2025-11-19 19:51:27.3255722Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,1763581887325572200,,,,,,,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3256752Z","2025-11-19 19:51:27.3256752Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,1763581887325675200,,,,,,,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3258194Z","2025-11-19 19:51:27.3258194Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,1763581887325819400,,,,,,,,,,,140712851341312,140712851341312,1524912,1486848,1404855129,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3258220Z","2025-11-19 19:51:27.3258220Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11148 calc.exe",5464,,,"11148 calc.exe",,,,,,,,,,,,,1763581887325822000,18446633084051804160,18446633084051779584,140712899206080,0,728547860480,14656,728549556224,728549548032,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3260183Z","2025-11-19 19:51:27.3260183Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,1763581887326018300,,,,,,,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3261489Z","2025-11-19 19:51:27.3261489Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581887326148900,,,,,,,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3263108Z","2025-11-19 19:51:27.3263108Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581887326310800,,,,,,,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3264675Z","2025-11-19 19:51:27.3264675Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581887326467500,,,,,,,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3266221Z","2025-11-19 19:51:27.3266221Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581887326622100,,,,,,,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3274344Z","2025-11-19 19:51:27.3274344Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,1763581887327434400,,,,,,,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3298621Z","2025-11-19 19:51:27.3298621Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\windows.storage.dll",,,,,,,,,,1763581887329862100,,,,,,,,,,,140712812412928,140712812412928,8877403,8769536,3667346596,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3305419Z","2025-11-19 19:51:27.3305419Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,1763581887330541900,,,,,,,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3311302Z","2025-11-19 19:51:27.3311302Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,1763581887331130200,,,,,,,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3316071Z","2025-11-19 19:51:27.3316071Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\shlwapi.dll",,,,,,,,,,1763581887331607100,,,,,,,,,,,140712868839424,140712868839424,479562,421888,2142510382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3319762Z","2025-11-19 19:51:27.3319762Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11148 calc.exe",4224,,,"11148 calc.exe",,,,,,,,,,,,,1763581887331976200,18446633084051861504,18446633084051836928,140712891545280,0,728547868672,8768,728550080512,728550072320,140712891545280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3321090Z","2025-11-19 19:51:27.3321090Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\ole32.dll",,,,,,,,,,1763581887332109000,,,,,,,,,,,140712878473216,140712878473216,1689904,1667072,1018821057,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3324057Z","2025-11-19 19:51:27.3324057Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1436 whoami.exe",12688,,," 1436 whoami.exe",,,,,,,,,,,,,1763581887332405700,18446633084051230720,18446633084051206144,140712899206080,0,521061588992,12688,521064677376,521064669184,140712899206080,4300456,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3324064Z","2025-11-19 19:51:27.3324064Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1436 whoami.exe",12400,,," 1436 whoami.exe",,,,,,,,,,,,,1763581887332406400,18446633084049825792,18446633084049801216,140702344617136,0,521061564416,12400,521063104512,521063096320,140702344617136,33571,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3324102Z","2025-11-19 19:51:27.3324102Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1436 whoami.exe",8880,,," 1436 whoami.exe",,,,,,,,,,,,,1763581887332410200,18446633084051173376,18446633084051148800,140712899206080,0,521061580800,8880,521064153088,521064144896,140712899206080,4289897,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3324118Z","2025-11-19 19:51:27.3324118Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1436 whoami.exe",1528,,," 1436 whoami.exe",,,,,,,,,,,,,1763581887332411800,18446633084051288064,18446633084051263488,140712899206080,0,521061597184,1528,521065201664,521065193472,140712899206080,2544210,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3329388Z","2025-11-19 19:51:27.3329388Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,1763581887332938800,,,,,,,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3335073Z","2025-11-19 19:51:27.3335073Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\uxtheme.dll",,,,,,,,,,1763581887333507300,,,,,,,,,,,140712802254848,140712802254848,696534,696320,1695798817,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3348701Z","2025-11-19 19:51:27.3348701Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\propsys.dll",,,,,,,,,,1763581887334870100,,,,,,,,,,,140712761491456,140712761491456,1123662,1060864,3228732737,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3353689Z","2025-11-19 19:51:27.3353689Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1016 services.exe",15196,,,"13688 svchost.exe",,,"C:\Windows\System32\svchost.exe",,,,,,,,,,1763581887335369000,,,,,,,,,,,,,143552,,14788416,,,,134080554863291166,,,,,3398,,,,,,0,"0x","","",1016,11,1,1,0,0 -"2025-11-19 19:51:27.3353693Z","2025-11-19 19:51:27.3353693Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,1763581887335369300,,,,,,,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3360542Z","2025-11-19 19:51:27.3360542Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1016 services.exe",15196,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887336054200,18446633084051230720,18446633084051206144,140696171073504,0,780822601728,14412,780821725184,780821708800,140696171073504,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3376962Z","2025-11-19 19:51:27.3376962Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",14412,,,"13688 svchost.exe",,,"C:\Windows\System32\svchost.exe",,,,,,,,,,1763581887337696200,,,,,,,,,,,140696171053056,140696171053056,143552,77824,14788416,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3377241Z","2025-11-19 19:51:27.3377241Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",14412,,,"13688 svchost.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581887337724100,,,,,,,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3396922Z","2025-11-19 19:51:27.3396922Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,1763581887339692200,,,,,,,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3402331Z","2025-11-19 19:51:27.3402331Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",14412,,,"13688 svchost.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581887340233100,,,,,,,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3403088Z","2025-11-19 19:51:27.3403088Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,1763581887340308800,,,,,,,,,,,140712479096832,140712479096832,1613415,1552384,2231457550,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3403537Z","2025-11-19 19:51:27.3403537Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",14412,,,"13688 svchost.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581887340353700,,,,,,,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3407912Z","2025-11-19 19:51:27.3407912Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,1763581887340791200,,,,,,,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3414678Z","2025-11-19 19:51:27.3414678Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",14412,,,"13688 svchost.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581887341467800,,,,,,,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3416650Z","2025-11-19 19:51:27.3416650Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13688 svchost.exe",14412,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887341665000,18446633084049825792,18446633084049801216,140712899206080,0,780822609920,9652,780824739840,780824707072,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3423688Z","2025-11-19 19:51:27.3423688Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",14412,,,"13688 svchost.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581887342368900,,,,,,,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3429412Z","2025-11-19 19:51:27.3429412Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",14412,,,"13688 svchost.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581887342941200,,,,,,,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3436525Z","2025-11-19 19:51:27.3436525Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887343652500,18446633084051288064,18446633084051263488,140712899206080,0,780822618112,628,780825264128,780825231360,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3437598Z","2025-11-19 19:51:27.3437598Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13688 svchost.exe",14412,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887343759800,18446633084051173376,18446633084051148800,140712863364608,0,780822626304,12520,780825788416,780825755648,140712863364608,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3438660Z","2025-11-19 19:51:27.3438660Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\urlmon.dll",,,,,,,,,,1763581887343866000,,,,,,,,,,,140712669609984,140712669609984,1970671,1957888,260716450,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3441113Z","2025-11-19 19:51:27.3441113Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",12520,,,"13688 svchost.exe",,,"C:\Windows\System32\wersvc.dll",,,,,,,,,,1763581887344111300,,,,,,,,,,,140709772656640,140709772656640,393902,335872,651237193,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3441416Z","2025-11-19 19:51:27.3441416Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",5464,,,"11148 calc.exe",,,"C:\Windows\System32\iertutil.dll",,,,,,,,,,1763581887344141600,,,,,,,,,,,140712642805760,140712642805760,2984761,2904064,3815768453,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3442471Z","2025-11-19 19:51:27.3442471Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13688 svchost.exe",9652,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887344247200,18446633084051918848,18446633084051894272,140712899206080,0,780822634496,6208,780826312704,780826279936,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3443117Z","2025-11-19 19:51:27.3443117Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13688 svchost.exe",6208,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887344311700,18446633084051976192,18446633084051951616,140712899206080,0,780822642688,14796,780826836992,780826804224,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3443853Z","2025-11-19 19:51:27.3443853Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",12520,,,"13688 svchost.exe",,,"C:\Windows\System32\DiagnosticDataSettings.dll",,,,,,,,,,1763581887344385300,,,,,,,,,,,140712462319616,140712462319616,108991,61440,3234151774,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3444144Z","2025-11-19 19:51:27.3444144Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",12924,,,"11148 calc.exe",,,"C:\Windows\System32\srvcli.dll",,,,,,,,,,1763581887344414400,,,,,,,,,,,140712668954624,140712668954624,181029,167936,239922031,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3444158Z","2025-11-19 19:51:27.3444158Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",5464,,,"11148 calc.exe",,,"C:\Windows\System32\netutils.dll",,,,,,,,,,1763581887344415800,,,,,,,,,,,140712825847808,140712825847808,80696,53248,865845000,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3444853Z","2025-11-19 19:51:27.3444853Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",9652,,,"13688 svchost.exe",,,"C:\Windows\System32\windowsperformancerecordercontrol.dll",,,,,,,,,,1763581887344485300,,,,,,,,,,,140712357462016,140712357462016,1367144,1302528,1403099383,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3445883Z","2025-11-19 19:51:27.3445883Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",6208,,,"13688 svchost.exe",,,"C:\Windows\System32\weretw.dll",,,,,,,,,,1763581887344588300,,,,,,,,,,,140712281899008,140712281899008,267808,245760,3299957735,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3448571Z","2025-11-19 19:51:27.3448571Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",6208,,,"13688 svchost.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,1763581887344857100,,,,,,,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3450467Z","2025-11-19 19:51:27.3450467Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",6208,,,"13688 svchost.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581887345046700,,,,,,,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3451958Z","2025-11-19 19:51:27.3451958Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",6208,,,"13688 svchost.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,1763581887345195800,,,,,,,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3454742Z","2025-11-19 19:51:27.3454742Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",6208,,,"13688 svchost.exe",,,"C:\Windows\System32\bcrypt.dll",,,,,,,,,,1763581887345474200,,,,,,,,,,,140712848654336,140712848654336,206048,172032,2893678010,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3476957Z","2025-11-19 19:51:27.3476957Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\ieframe.dll",,,,,,,,,,1763581887347695700,,,,,,,,,,,140710222364672,140710222364672,7531896,7499776,575051316,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3477126Z","2025-11-19 19:51:27.3477126Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13688 svchost.exe",12520,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887347712600,18446633084052119552,18446633084052094976,140709772859968,243,780822650880,1108,780827361280,780827328512,140709772859968,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3481994Z","2025-11-19 19:51:27.3481994Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13688 svchost.exe",12520,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887348199400,18446633084052148224,18446633084052123648,140709772762688,243,780822659072,15312,780827885568,780827852800,140709772762688,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3484052Z","2025-11-19 19:51:27.3484052Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13688 svchost.exe",12520,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887348405200,18446633084051173376,18446633084051148800,140712863364608,0,780822626304,12520,780825788416,780825755648,140712863364608,10191193,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3485086Z","2025-11-19 19:51:27.3485086Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.7019_none_3e06ffa0e335b8a8\comctl32.dll",,,,,,,,,,1763581887348508600,,,,,,,,,,,140712659910656,140712659910656,2747780,2703360,4095768276,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3486735Z","2025-11-19 19:51:27.3486735Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",628,,,"13688 svchost.exe",,,"C:\Windows\System32\wer.dll",,,,,,,,,,1763581887348673500,,,,,,,,,,,140712805728256,140712805728256,993632,983040,1987637995,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3496249Z","2025-11-19 19:51:27.3496249Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",628,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887349624900,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3502043Z","2025-11-19 19:51:27.3502043Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13688 svchost.exe",628,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887350204300,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3503616Z","2025-11-19 19:51:27.3503616Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",628,,,"13688 svchost.exe",,,"C:\Windows\System32\CorePrivacySettingsStore.dll",,,,,,,,,,1763581887350361600,,,,,,,,,,,140712456290304,140712456290304,263379,196608,2978004593,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3504940Z","2025-11-19 19:51:27.3504940Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\secur32.dll",,,,,,,,,,1763581887350494000,,,,,,,,,,,140712800223232,140712800223232,112844,53248,632019051,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3507703Z","2025-11-19 19:51:27.3507703Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\sspicli.dll",,,,,,,,,,1763581887350770300,,,,,,,,,,,140712833384448,140712833384448,339222,299008,3030302172,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3513844Z","2025-11-19 19:51:27.3513844Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\mlang.dll",,,,,,,,,,1763581887351384400,,,,,,,,,,,140712293761024,140712293761024,318858,278528,3734874788,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3518307Z","2025-11-19 19:51:27.3518307Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\wininet.dll",,,,,,,,,,1763581887351830700,,,,,,,,,,,140712675573760,140712675573760,2677835,2658304,2422963474,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3528482Z","2025-11-19 19:51:27.3528482Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",628,,,"13688 svchost.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,1763581887352848200,,,,,,,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3535252Z","2025-11-19 19:51:27.3535252Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\profapi.dll",,,,,,,,,,1763581887353525200,,,,,,,,,,,140712848850944,140712848850944,229548,167936,2447194521,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3539346Z","2025-11-19 19:51:27.3539346Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",628,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887353934600,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3544717Z","2025-11-19 19:51:27.3544717Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13688 svchost.exe",628,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887354471700,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3567254Z","2025-11-19 19:51:27.3567254Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13688 svchost.exe",628,,,"13688 svchost.exe",,,"C:\Windows\System32\wer.dll",,,,,,,,,,1763581887356725400,,,,,,,,,,,140712805728256,140712805728256,993632,995328,1987637995,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3571880Z","2025-11-19 19:51:27.3571880Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start ","13688 svchost.exe",628,,," 3864 WerFault.exe",,,"C:\Windows\System32\WerFault.exe",,,,,,,,,,1763581887357188000,,,,,,,,,,,,,681036,,630084362,,,,134080554863507391,,,,,3399,,,,,,0,"0x","","",13688,3398,1,1,0,0 -"2025-11-19 19:51:27.3587974Z","2025-11-19 19:51:27.3587974Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13688 svchost.exe",628,,," 3864 WerFault.exe",,,,,,,,,,,,,1763581887358797400,18446633084051173376,18446633084051148800,140702556693600,243,400613777408,2088,400611737600,400611729408,140702556693600,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3602299Z","2025-11-19 19:51:27.3602299Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\edputil.dll",,,,,,,,,,1763581887360229900,,,,,,,,,,,140712471560192,140712471560192,178059,167936,3474529356,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3602549Z","2025-11-19 19:51:27.3602549Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\WerFault.exe",,,,,,,,,,1763581887360254900,,,,,,,,,,,140702556684288,140702556684288,681036,647168,630084362,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3602715Z","2025-11-19 19:51:27.3602715Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581887360271500,,,,,,,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3631150Z","2025-11-19 19:51:27.3631150Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581887363115000,,,,,,,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3632467Z","2025-11-19 19:51:27.3632467Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581887363246700,,,,,,,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3632726Z","2025-11-19 19:51:27.3632726Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\AppXDeploymentClient.dll",,,,,,,,,,1763581887363272600,,,,,,,,,,,140712740257792,140712740257792,1575781,1499136,2615972959,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3633993Z","2025-11-19 19:51:27.3633993Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\imagehlp.dll",,,,,,,,,,1763581887363399300,,,,,,,,,,,140712892760064,140712892760064,200866,131072,2156568970,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3642495Z","2025-11-19 19:51:27.3642495Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581887364249500,,,,,,,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3643485Z","2025-11-19 19:51:27.3643485Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,,,,,,,,,,,1763581887364348500,18446633084052176896,18446633084052152320,140712899206080,0,400613785600,7460,400612261888,400612253696,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3644374Z","2025-11-19 19:51:27.3644374Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,1763581887364437400,,,,,,,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3644418Z","2025-11-19 19:51:27.3644418Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3864 WerFault.exe",7460,,," 3864 WerFault.exe",,,,,,,,,,,,,1763581887364441800,18446633084052205568,18446633084052180992,140712899206080,0,400613793792,9616,400615276544,400615268352,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3646595Z","2025-11-19 19:51:27.3646595Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581887364659600,,,,,,,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3647403Z","2025-11-19 19:51:27.3647403Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",9616,,," 3864 WerFault.exe",,,"C:\Windows\System32\cryptsp.dll",,,,,,,,,,1763581887364740300,,,,,,,,,,,140712839217152,140712839217152,146168,110592,1658328178,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3649326Z","2025-11-19 19:51:27.3649326Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3864 WerFault.exe",9616,,," 3864 WerFault.exe",,,,,,,,,,,,,1763581887364932600,18446633084052320256,18446633084052295680,140712899206080,0,400613801984,15292,400615800832,400615792640,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3649542Z","2025-11-19 19:51:27.3649542Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11148 calc.exe",8768,,,"11148 calc.exe",,,,,,,,,,,,,1763581887364954200,18446633084052348928,18446633084052324352,140712865112144,0,728547876864,13680,728550604800,728550596608,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3649911Z","2025-11-19 19:51:27.3649911Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581887364991100,,,,,,,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3651576Z","2025-11-19 19:51:27.3651576Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"11148 calc.exe",,,,,,,,,,,,,1763581887365157600,18446633084052377600,18446633084052353024,140712899206080,0,728547885056,4656,728551129088,728551120896,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3652532Z","2025-11-19 19:51:27.3652532Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581887365253200,,,,,,,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3652972Z","2025-11-19 19:51:27.3652972Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11148 calc.exe",4656,,,"11148 calc.exe",,,,,,,,,,,,,1763581887365297200,18446633084052406272,18446633084052381696,140712899206080,0,728547893248,11220,728551653376,728551645184,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3653666Z","2025-11-19 19:51:27.3653666Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",7460,,," 3864 WerFault.exe",,,"C:\Windows\System32\DiagnosticDataSettings.dll",,,,,,,,,,1763581887365366600,,,,,,,,,,,140712462319616,140712462319616,108991,61440,3234151774,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3654030Z","2025-11-19 19:51:27.3654030Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",15292,,," 3864 WerFault.exe",,,"C:\Windows\System32\wer.dll",,,,,,,,,,1763581887365403000,,,,,,,,,,,140712805728256,140712805728256,993632,983040,1987637995,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3655048Z","2025-11-19 19:51:27.3655048Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",4600,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,1763581887365504800,18446633084039716864,18446633084039692288,140711613062896,0,1046353240064,4600,1046401253376,1046401236992,140711613062896,1088976,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3655514Z","2025-11-19 19:51:27.3655514Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581887365551400,,,,,,,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3656953Z","2025-11-19 19:51:27.3656953Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",9616,,," 3864 WerFault.exe",,,"C:\Windows\System32\dbghelp.dll",,,,,,,,,,1763581887365695300,,,,,,,,,,,140712664104960,140712664104960,2282862,2367488,82455296,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3657638Z","2025-11-19 19:51:27.3657638Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,1763581887365763900,,,,,,,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3658290Z","2025-11-19 19:51:27.3658290Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",15292,,," 3864 WerFault.exe",,,"C:\Windows\System32\powrprof.dll",,,,,,,,,,1763581887365829000,,,,,,,,,,,140712848195584,140712848195584,457799,385024,2858637235,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3659218Z","2025-11-19 19:51:27.3659218Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",7460,,," 3864 WerFault.exe",,,"C:\Windows\System32\bcrypt.dll",,,,,,,,,,1763581887365921800,,,,,,,,,,,140712848654336,140712848654336,206048,172032,2893678010,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3661565Z","2025-11-19 19:51:27.3661565Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",9616,,," 3864 WerFault.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,1763581887366156500,,,,,,,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3662762Z","2025-11-19 19:51:27.3662762Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887366276200,18446633084039716864,18446633084039692288,140712899206080,0,780822667264,13720,780825788416,780825755648,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3663298Z","2025-11-19 19:51:27.3663298Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,1763581887366329800,,,,,,,,,,,1795834707968,1795834707968,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3663314Z","2025-11-19 19:51:27.3663314Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\twinui.appcore.dll",,,,,,,,,,1763581887366331500,,,,,,,,,,,140712458059776,140712458059776,827472,806912,3228774028,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3663661Z","2025-11-19 19:51:27.3663661Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",9616,,," 3864 WerFault.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581887366366200,,,,,,,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3663906Z","2025-11-19 19:51:27.3663906Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",7460,,," 3864 WerFault.exe",,,"C:\Windows\System32\cfgmgr32.dll",,,,,,,,,,1763581887366390600,,,,,,,,,,,140712845049856,140712845049856,385808,356352,1737777300,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3664039Z","2025-11-19 19:51:27.3664039Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,1763581887366403900,,,,,,,,,,,1795834707968,1795834707968,899838,892928,2878277657,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3666791Z","2025-11-19 19:51:27.3666791Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\ntmarta.dll",,,,,,,,,,1763581887366679100,,,,,,,,,,,140712831811584,140712831811584,265798,221184,3598506564,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3668651Z","2025-11-19 19:51:27.3668651Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",15292,,," 3864 WerFault.exe",,,"C:\Windows\System32\Faultrep.dll",,,,,,,,,,1763581887366865100,,,,,,,,,,,140712281309184,140712281309184,594974,548864,3149101438,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3673538Z","2025-11-19 19:51:27.3673538Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\dbgcore.dll",,,,,,,,,,1763581887367353800,,,,,,,,,,,140712478244864,140712478244864,263772,245760,3120784319,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3692321Z","2025-11-19 19:51:27.3692321Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\umpdc.dll",,,,,,,,,,1763581887369232100,,,,,,,,,,,140712848064512,140712848064512,98535,81920,1714427184,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3692565Z","2025-11-19 19:51:27.3692565Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\OneCoreUAPCommonProxyStub.dll",,,,,,,,,,1763581887369256500,,,,,,,,,,,140712713977856,140712713977856,6740758,6615040,2011948997,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3707568Z","2025-11-19 19:51:27.3707568Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.7019_none_3e06ffa0e335b8a8\comctl32.dll",,,,,,,,,,1763581887370756800,,,,,,,,,,,140712659910656,140712659910656,2747780,2703360,4095768276,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3708896Z","2025-11-19 19:51:27.3708896Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,1763581887370889600,,,,,,,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3710066Z","2025-11-19 19:51:27.3710066Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,1763581887371006600,,,,,,,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3711186Z","2025-11-19 19:51:27.3711186Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,1763581887371118600,,,,,,,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3712575Z","2025-11-19 19:51:27.3712575Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,1763581887371257500,,,,,,,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3736545Z","2025-11-19 19:51:27.3736545Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887373654500,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3742277Z","2025-11-19 19:51:27.3742277Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887374227700,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3743770Z","2025-11-19 19:51:27.3743770Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\CorePrivacySettingsStore.dll",,,,,,,,,,1763581887374377000,,,,,,,,,,,140712456290304,140712456290304,263379,196608,2978004593,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3767542Z","2025-11-19 19:51:27.3767542Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,1763581887376754200,,,,,,,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3778395Z","2025-11-19 19:51:27.3778395Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887377839500,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3783459Z","2025-11-19 19:51:27.3783459Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887378345900,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3812649Z","2025-11-19 19:51:27.3812649Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",14368,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,1763581887381264900,18446633084052434944,18446633084052410368,140712891545280,0,199839866880,11156,199839318016,199839309824,140712891545280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3823710Z","2025-11-19 19:51:27.3823710Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3532 svchost.exe",,,,,,,,,,,,,1763581887382371000,18446633084052578304,18446633084052553728,140712899206080,0,761505034240,3332,761506824192,761506791424,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3824362Z","2025-11-19 19:51:27.3824362Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4404 svchost.exe",12560,,," 4404 svchost.exe",,,,,,,,,,,,,1763581887382436200,18446633084052750336,18446633084052725760,140712865112144,98,679905837056,13712,679909261312,679909228544,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3850457Z","2025-11-19 19:51:27.3850457Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1416 ApplicationFrameHost.exe",11156,,," 1416 ApplicationFrameHost.exe",,,"C:\Windows\System32\d3d10warp.dll",,,,,,,,,,1763581887385045700,,,,,,,,,,,140712731869184,140712731869184,5958575,5943296,1147803111,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3860383Z","2025-11-19 19:51:27.3860383Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,1763581887386038300,,,,,,,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3862869Z","2025-11-19 19:51:27.3862869Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3864 WerFault.exe",9616,,," 3864 WerFault.exe",,,,,,,,,,,,,1763581887386286900,18446633084052205568,18446633084052180992,140712899206080,0,400613793792,9616,400615276544,400615264256,140712899206080,6645135,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3862920Z","2025-11-19 19:51:27.3862920Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3864 WerFault.exe",15292,,," 3864 WerFault.exe",,,,,,,,,,,,,1763581887386292000,18446633084052320256,18446633084052295680,140712899206080,0,400613801984,15292,400615800832,400615792640,140712899206080,7320318,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3863070Z","2025-11-19 19:51:27.3863070Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3864 WerFault.exe",7460,,," 3864 WerFault.exe",,,,,,,,,,,,,1763581887386307000,18446633084052176896,18446633084052152320,140712899206080,0,400613785600,7460,400612261888,400612253696,140712899206080,8436825,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3868922Z","2025-11-19 19:51:27.3868922Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,,,,,,,,,,,1763581887386892200,18446633084051173376,18446633084051148800,140702556693600,0,400613777408,2088,400611737600,400611696640,140702556693600,88862289,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3870995Z","2025-11-19 19:51:27.3870995Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\WerFault.exe",,,,,,,,,,1763581887387099500,,,,,,,,,,,140702556684288,140702556684288,681036,647168,630084362,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3871200Z","2025-11-19 19:51:27.3871200Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\Faultrep.dll",,,,,,,,,,1763581887387120000,,,,,,,,,,,140712281309184,140712281309184,594974,548864,3149101438,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3871304Z","2025-11-19 19:51:27.3871304Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\CorePrivacySettingsStore.dll",,,,,,,,,,1763581887387130400,,,,,,,,,,,140712456290304,140712456290304,263379,196608,2978004593,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3871400Z","2025-11-19 19:51:27.3871400Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\DiagnosticDataSettings.dll",,,,,,,,,,1763581887387140000,,,,,,,,,,,140712462319616,140712462319616,108991,61440,3234151774,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3871483Z","2025-11-19 19:51:27.3871483Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\dbgcore.dll",,,,,,,,,,1763581887387148300,,,,,,,,,,,140712478244864,140712478244864,263772,245760,3120784319,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3871520Z","2025-11-19 19:51:27.3871520Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.7019_none_3e06ffa0e335b8a8\comctl32.dll",,,,,,,,,,1763581887387152000,,,,,,,,,,,140712659910656,140712659910656,2747780,2703360,4095768276,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3871837Z","2025-11-19 19:51:27.3871837Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\dbghelp.dll",,,,,,,,,,1763581887387183700,,,,,,,,,,,140712664104960,140712664104960,2282862,2367488,82455296,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3871932Z","2025-11-19 19:51:27.3871932Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\wer.dll",,,,,,,,,,1763581887387193200,,,,,,,,,,,140712805728256,140712805728256,993632,983040,1987637995,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3871997Z","2025-11-19 19:51:27.3871997Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,1763581887387199700,,,,,,,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3872082Z","2025-11-19 19:51:27.3872082Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\ntmarta.dll",,,,,,,,,,1763581887387208200,,,,,,,,,,,140712831811584,140712831811584,265798,221184,3598506564,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3872171Z","2025-11-19 19:51:27.3872171Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\cryptsp.dll",,,,,,,,,,1763581887387217100,,,,,,,,,,,140712839217152,140712839217152,146168,110592,1658328178,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3872252Z","2025-11-19 19:51:27.3872252Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\cfgmgr32.dll",,,,,,,,,,1763581887387225200,,,,,,,,,,,140712845049856,140712845049856,385808,356352,1737777300,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3872647Z","2025-11-19 19:51:27.3872647Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\umpdc.dll",,,,,,,,,,1763581887387264700,,,,,,,,,,,140712848064512,140712848064512,98535,81920,1714427184,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3872743Z","2025-11-19 19:51:27.3872743Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\powrprof.dll",,,,,,,,,,1763581887387274300,,,,,,,,,,,140712848195584,140712848195584,457799,385024,2858637235,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3872833Z","2025-11-19 19:51:27.3872833Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\bcrypt.dll",,,,,,,,,,1763581887387283300,,,,,,,,,,,140712848654336,140712848654336,206048,172032,2893678010,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3872907Z","2025-11-19 19:51:27.3872907Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,1763581887387290700,,,,,,,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3873058Z","2025-11-19 19:51:27.3873058Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581887387305800,,,,,,,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3873120Z","2025-11-19 19:51:27.3873120Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,1763581887387312000,,,,,,,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3873193Z","2025-11-19 19:51:27.3873193Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581887387319300,,,,,,,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3873259Z","2025-11-19 19:51:27.3873259Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581887387325900,,,,,,,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3873323Z","2025-11-19 19:51:27.3873323Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,1763581887387332300,,,,,,,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3873401Z","2025-11-19 19:51:27.3873401Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581887387340100,,,,,,,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3873470Z","2025-11-19 19:51:27.3873470Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,1763581887387347000,,,,,,,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3873596Z","2025-11-19 19:51:27.3873596Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581887387359600,,,,,,,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3873691Z","2025-11-19 19:51:27.3873691Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,1763581887387369100,,,,,,,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3873757Z","2025-11-19 19:51:27.3873757Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581887387375700,,,,,,,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3873811Z","2025-11-19 19:51:27.3873811Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,1763581887387381100,,,,,,,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3873879Z","2025-11-19 19:51:27.3873879Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,1763581887387387900,,,,,,,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3873943Z","2025-11-19 19:51:27.3873943Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,1763581887387394300,,,,,,,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3874017Z","2025-11-19 19:51:27.3874017Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581887387401700,,,,,,,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3874082Z","2025-11-19 19:51:27.3874082Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581887387408200,,,,,,,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3874198Z","2025-11-19 19:51:27.3874198Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581887387419800,,,,,,,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3874280Z","2025-11-19 19:51:27.3874280Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"WerFault.exe",,,,,,,,,,1763581887387428000,,,,,,,,,,,,,,,,1851392,1888256,113864608,134080554863507391,0,134080554863803366,64,0,3399,1,5,1,0,0,,,,,,,,,, -"2025-11-19 19:51:27.3884600Z","2025-11-19 19:51:27.3884600Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",11156,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,1763581887388460000,18446633084052320256,18446633084052295680,140712891292720,0,199839875072,10204,199842332672,199842324480,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3889413Z","2025-11-19 19:51:27.3889413Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",628,,,"13688 svchost.exe",,,"C:\Windows\System32\Faultrep.dll",,,,,,,,,,1763581887388941300,,,,,,,,,,,140712281309184,140712281309184,594974,548864,3149101438,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3891231Z","2025-11-19 19:51:27.3891231Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",11156,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,1763581887389123100,18446633084051173376,18446633084051148800,140712891292720,0,199839883264,1424,199843381248,199843373056,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3897882Z","2025-11-19 19:51:27.3897882Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",15228,,," 2456 Memory Compression",,,,,,,,,,,,,1763581887389788300,18446633084052205568,18446633084052180992,18446735306729542320,0,0,11548,0,0,18446735306729542320,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3898079Z","2025-11-19 19:51:27.3898079Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",15228,,," 2456 Memory Compression",,,,,,,,,,,,,1763581887389807900,18446633084052807680,18446633084052783104,18446735306729542320,0,0,636,0,0,18446735306729542320,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3898424Z","2025-11-19 19:51:27.3898424Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",15228,,," 2456 Memory Compression",,,,,,,,,,,,,1763581887389842400,18446633084052922368,18446633084052897792,18446735306728238208,0,0,13072,0,0,18446735306728238208,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3898960Z","2025-11-19 19:51:27.3898960Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",15228,,," 2456 Memory Compression",,,,,,,,,,,,,1763581887389896000,18446633084053008384,18446633084052983808,18446735306729822480,0,0,13508,0,0,18446735306729822480,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3899741Z","2025-11-19 19:51:27.3899741Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",628,,,"13688 svchost.exe",,,"C:\Windows\System32\wer.dll",,,,,,,,,,1763581887389974100,,,,,,,,,,,140712805728256,140712805728256,993632,983040,1987637995,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3902495Z","2025-11-19 19:51:27.3902495Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 6028 svchost.exe",15228,,,"13736 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe\CalculatorApp.exe",,,,,,,,,,1763581887390249500,,,,,,,,,,,,,0,,1758293941,,,,134080554863834658,,,,,3401,,,,,,3,"0x","Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe","App",4340,106,3,0,0,1 -"2025-11-19 19:51:27.3906927Z","2025-11-19 19:51:27.3906927Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4404 svchost.exe",11720,,," 4404 svchost.exe",,,,,,,,,,,,,1763581887390692700,18446633084053065728,18446633084053041152,140712899206080,0,679905845248,14572,679909785600,679909752832,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3909406Z","2025-11-19 19:51:27.3909406Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",628,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887390940600,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3912189Z","2025-11-19 19:51:27.3912189Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",15228,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887391218900,18446633084050886656,18446633084050862080,140700165242880,5,320273809408,6548,320276004864,320276000768,140700165242880,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3915564Z","2025-11-19 19:51:27.3915564Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13688 svchost.exe",628,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887391556400,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3930939Z","2025-11-19 19:51:27.3930939Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe\CalculatorApp.exe",,,,,,,,,,1763581887393093900,,,,,,,,,,,140700165210112,140700165210112,0,36864,1758293941,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3931206Z","2025-11-19 19:51:27.3931206Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581887393120600,,,,,,,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3937673Z","2025-11-19 19:51:27.3937673Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581887393767300,,,,,,,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3938781Z","2025-11-19 19:51:27.3938781Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581887393878100,,,,,,,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3945627Z","2025-11-19 19:51:27.3945627Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",628,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887394562700,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3951958Z","2025-11-19 19:51:27.3951958Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13688 svchost.exe",628,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887395195800,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3959109Z","2025-11-19 19:51:27.3959109Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887395910900,18446633084053323776,18446633084053299200,140712899206080,0,320273817600,14660,320277053440,320277049344,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3976099Z","2025-11-19 19:51:27.3976099Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe\CalculatorApp.dll",,,,,,,,,,1763581887397609900,,,,,,,,,,,140709595119616,140709595119616,0,6352896,1758293941,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3977891Z","2025-11-19 19:51:27.3977891Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,1763581887397789100,,,,,,,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3977969Z","2025-11-19 19:51:27.3977969Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",14660,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887397796900,18446633084053237760,18446633084053213184,140712899206080,0,320273825792,6780,320278102016,320278097920,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3979342Z","2025-11-19 19:51:27.3979342Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581887397934200,,,,,,,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3980521Z","2025-11-19 19:51:27.3980521Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887398052100,18446633084053610496,18446633084053585920,140712899206080,0,320273833984,8620,320279150592,320279146496,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3980821Z","2025-11-19 19:51:27.3980821Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",628,,,"13688 svchost.exe",,,"C:\Windows\System32\userenv.dll",,,,,,,,,,1763581887398082100,,,,,,,,,,,140712837054464,140712837054464,245008,176128,731547084,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3981144Z","2025-11-19 19:51:27.3981144Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581887398114400,,,,,,,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3982898Z","2025-11-19 19:51:27.3982898Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6780,,,"13736 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.2.2_2.2.28604.0_x64__8wekyb3d8bbwe\mrt100_app.dll",,,,,,,,,,1763581887398289900,,,,,,,,,,,140711791951872,140711791951872,491795,548864,1580779188,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3983144Z","2025-11-19 19:51:27.3983144Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,1763581887398314400,,,,,,,,,,,140712851341312,140712851341312,1524912,1486848,1404855129,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3986643Z","2025-11-19 19:51:27.3986643Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6780,,,"13736 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe\clrcompression.dll",,,,,,,,,,1763581887398664400,,,,,,,,,,,140712630616064,140712630616064,70610,77824,1653667599,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3987145Z","2025-11-19 19:51:27.3987145Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.33519.0_x64__8wekyb3d8bbwe\vcruntime140_app.dll",,,,,,,,,,1763581887398714500,,,,,,,,,,,140712297627648,140712297627648,155734,118784,1024347489,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3987993Z","2025-11-19 19:51:27.3987993Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6780,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\ole32.dll",,,,,,,,,,1763581887398799300,,,,,,,,,,,140712878473216,140712878473216,1689904,1667072,1018821057,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3988476Z","2025-11-19 19:51:27.3988476Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",628,,,"13688 svchost.exe",,,"C:\Windows\System32\profapi.dll",,,,,,,,,,1763581887398847600,,,,,,,,,,,140712848850944,140712848850944,229548,167936,2447194521,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3989457Z","2025-11-19 19:51:27.3989457Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6780,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581887398945700,,,,,,,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3991252Z","2025-11-19 19:51:27.3991252Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6780,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,1763581887399125200,,,,,,,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3992666Z","2025-11-19 19:51:27.3992666Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6780,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,1763581887399266700,,,,,,,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3993866Z","2025-11-19 19:51:27.3993866Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6780,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,1763581887399386600,,,,,,,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3995441Z","2025-11-19 19:51:27.3995441Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6780,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,1763581887399544100,,,,,,,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4002208Z","2025-11-19 19:51:27.4002208Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",628,,,"13688 svchost.exe",,,"C:\Windows\System32\sspicli.dll",,,,,,,,,,1763581887400220800,,,,,,,,,,,140712833384448,140712833384448,339222,299008,3030302172,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4003875Z","2025-11-19 19:51:27.4003875Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",14660,,,"13736 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.2.2_2.2.29512.0_x64__8wekyb3d8bbwe\SharedLibrary.dll",,,,,,,,,,1763581887400387500,,,,,,,,,,,140709581684736,140709581684736,13461317,13422592,1605180014,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4004983Z","2025-11-19 19:51:27.4004983Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",14660,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581887400498400,,,,,,,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4005967Z","2025-11-19 19:51:27.4005967Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",14660,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581887400596800,,,,,,,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4007005Z","2025-11-19 19:51:27.4007005Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",14660,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581887400700500,,,,,,,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4008393Z","2025-11-19 19:51:27.4008393Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",14660,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,1763581887400839300,,,,,,,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4010598Z","2025-11-19 19:51:27.4010598Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",14660,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\normaliz.dll",,,,,,,,,,1763581887401059800,,,,,,,,,,,140712868773888,140712868773888,48733,32768,3139002400,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4011699Z","2025-11-19 19:51:27.4011699Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6780,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\bcrypt.dll",,,,,,,,,,1763581887401169900,,,,,,,,,,,140712848654336,140712848654336,206048,172032,2893678010,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4011746Z","2025-11-19 19:51:27.4011746Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",14660,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\crypt32.dll",,,,,,,,,,1763581887401174600,,,,,,,,,,,140712849768448,140712849768448,1584869,1536000,3438168074,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4011829Z","2025-11-19 19:51:27.4011829Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start ","13688 svchost.exe",628,,," 3676 WerFault.exe",,,"C:\Windows\System32\WerFault.exe",,,,,,,,,,1763581887401182900,,,,,,,,,,,,,681036,,630084362,,,,134080554863942943,,,,,3402,,,,,,0,"0x","","",1436,3396,3,0,0,1 -"2025-11-19 19:51:27.4017608Z","2025-11-19 19:51:27.4017608Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",14660,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\dpapi.dll",,,,,,,,,,1763581887401760900,,,,,,,,,,,140712845574144,140712845574144,42814,40960,2473566603,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4029543Z","2025-11-19 19:51:27.4029543Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\mrt100.dll",,,,,,,,,,1763581887402954300,,,,,,,,,,,140712630550528,140712630550528,102582,40960,1265422184,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4030141Z","2025-11-19 19:51:27.4030141Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13688 svchost.exe",628,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581887403014100,18446633084051374080,18446633084051349504,140702556693600,243,859767218176,14180,859767832576,859767824384,140702556693600,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4032996Z","2025-11-19 19:51:27.4032996Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",6292,,," 5184 explorer.exe",,,,,,,,,,,,,1763581887403299600,18446633084053667840,18446633084053643264,140712891292720,0,15302656,6204,214564864,214507520,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4037373Z","2025-11-19 19:51:27.4037373Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887403737300,18446633084053696512,18446633084053671936,140712899206080,0,320273842176,9360,320280199168,320280195072,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4039839Z","2025-11-19 19:51:27.4039839Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,1763581887403983900,,,,,,,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4044498Z","2025-11-19 19:51:27.4044498Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,1763581887404449800,,,,,,,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4047110Z","2025-11-19 19:51:27.4047110Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\WerFault.exe",,,,,,,,,,1763581887404711000,,,,,,,,,,,140702556684288,140702556684288,681036,647168,630084362,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4047575Z","2025-11-19 19:51:27.4047575Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581887404757500,,,,,,,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4053230Z","2025-11-19 19:51:27.4053230Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\rmclient.dll",,,,,,,,,,1763581887405323000,,,,,,,,,,,140712808808448,140712808808448,282526,221184,1891057501,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4054583Z","2025-11-19 19:51:27.4054583Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581887405458300,,,,,,,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4055710Z","2025-11-19 19:51:27.4055710Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581887405571000,,,,,,,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4056941Z","2025-11-19 19:51:27.4056941Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887405694100,18446633084053839872,18446633084053815296,140711792263472,0,320273850368,10884,320281247744,320281243648,140711792263472,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4062220Z","2025-11-19 19:51:27.4062220Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,1763581887406222100,,,,,,,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4067884Z","2025-11-19 19:51:27.4067884Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581887406788400,,,,,,,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4068904Z","2025-11-19 19:51:27.4068904Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581887406890400,18446633084053581824,18446633084053557248,140712899206080,0,859767226368,13460,859768356864,859768348672,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4069825Z","2025-11-19 19:51:27.4069825Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,1763581887406982500,,,,,,,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4069840Z","2025-11-19 19:51:27.4069840Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3676 WerFault.exe",13460,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581887406984000,18446633084053868544,18446633084053843968,140712899206080,0,859767234560,8356,859768881152,859768872960,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4071480Z","2025-11-19 19:51:27.4071480Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581887407148000,,,,,,,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4073150Z","2025-11-19 19:51:27.4073150Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",8356,,," 3676 WerFault.exe",,,"C:\Windows\System32\cryptsp.dll",,,,,,,,,,1763581887407315000,,,,,,,,,,,140712839217152,140712839217152,146168,110592,1658328178,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4073300Z","2025-11-19 19:51:27.4073300Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581887407330100,18446633084053897216,18446633084053872640,140712899206080,0,859767242752,11036,859769405440,859769397248,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4074423Z","2025-11-19 19:51:27.4074423Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581887407442300,,,,,,,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4074830Z","2025-11-19 19:51:27.4074830Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1416 ApplicationFrameHost.exe",10204,,," 1416 ApplicationFrameHost.exe",,,"C:\Windows\System32\AppXDeploymentClient.dll",,,,,,,,,,1763581887407483000,,,,,,,,,,,140712740257792,140712740257792,1575781,1499136,2615972959,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4076592Z","2025-11-19 19:51:27.4076592Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1416 ApplicationFrameHost.exe",10204,,," 1416 ApplicationFrameHost.exe",,,"C:\Windows\System32\imagehlp.dll",,,,,,,,,,1763581887407659200,,,,,,,,,,,140712892760064,140712892760064,200866,131072,2156568970,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4076795Z","2025-11-19 19:51:27.4076795Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581887407679600,,,,,,,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4077531Z","2025-11-19 19:51:27.4077531Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",10204,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,1763581887407753100,18446633084053925888,18446633084053901312,140712899206080,0,199839891456,4732,199843905536,199843897344,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4078161Z","2025-11-19 19:51:27.4078161Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",11036,,," 3676 WerFault.exe",,,"C:\Windows\System32\wer.dll",,,,,,,,,,1763581887407816100,,,,,,,,,,,140712805728256,140712805728256,993632,983040,1987637995,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4078845Z","2025-11-19 19:51:27.4078845Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581887407884500,,,,,,,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4079188Z","2025-11-19 19:51:27.4079188Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",13460,,," 3676 WerFault.exe",,,"C:\Windows\System32\dbghelp.dll",,,,,,,,,,1763581887407918900,,,,,,,,,,,140712664104960,140712664104960,2282862,2367488,82455296,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4081531Z","2025-11-19 19:51:27.4081531Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",13460,,," 3676 WerFault.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,1763581887408153100,,,,,,,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4082664Z","2025-11-19 19:51:27.4082664Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,1763581887408266500,,,,,,,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4083184Z","2025-11-19 19:51:27.4083184Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",13460,,," 3676 WerFault.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581887408318500,,,,,,,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4083693Z","2025-11-19 19:51:27.4083693Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1416 ApplicationFrameHost.exe",1424,,," 1416 ApplicationFrameHost.exe",,,"C:\Windows\System32\Windows.StateRepositoryPS.dll",,,,,,,,,,1763581887408369300,,,,,,,,,,,140712490369024,140712490369024,879719,802816,374042279,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4085440Z","2025-11-19 19:51:27.4085440Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",11036,,," 3676 WerFault.exe",,,"C:\Windows\System32\powrprof.dll",,,,,,,,,,1763581887408544000,,,,,,,,,,,140712848195584,140712848195584,457799,385024,2858637235,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4086792Z","2025-11-19 19:51:27.4086792Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\bcrypt.dll",,,,,,,,,,1763581887408679200,,,,,,,,,,,140712848654336,140712848654336,206048,172032,2893678010,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4086899Z","2025-11-19 19:51:27.4086899Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",13460,,," 3676 WerFault.exe",,,"C:\Windows\System32\cfgmgr32.dll",,,,,,,,,,1763581887408689900,,,,,,,,,,,140712845049856,140712845049856,385808,356352,1737777300,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4088844Z","2025-11-19 19:51:27.4088844Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",8356,,," 3676 WerFault.exe",,,"C:\Windows\System32\DiagnosticDataSettings.dll",,,,,,,,,,1763581887408884400,,,,,,,,,,,140712462319616,140712462319616,108991,61440,3234151774,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4090222Z","2025-11-19 19:51:27.4090222Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1416 ApplicationFrameHost.exe",10204,,," 1416 ApplicationFrameHost.exe",,,"C:\Windows\System32\imagehlp.dll",,,,,,,,,,1763581887409022200,,,,,,,,,,,140712892760064,140712892760064,200866,143360,2156568970,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4090349Z","2025-11-19 19:51:27.4090349Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\ntmarta.dll",,,,,,,,,,1763581887409034900,,,,,,,,,,,140712831811584,140712831811584,265798,221184,3598506564,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4090868Z","2025-11-19 19:51:27.4090868Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1416 ApplicationFrameHost.exe",10204,,," 1416 ApplicationFrameHost.exe",,,"C:\Windows\System32\AppXDeploymentClient.dll",,,,,,,,,,1763581887409086900,,,,,,,,,,,140712740257792,140712740257792,1575781,1511424,2615972959,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4093744Z","2025-11-19 19:51:27.4093744Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",11036,,," 3676 WerFault.exe",,,"C:\Windows\System32\Faultrep.dll",,,,,,,,,,1763581887409374500,,,,,,,,,,,140712281309184,140712281309184,594974,548864,3149101438,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4096890Z","2025-11-19 19:51:27.4096890Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",13460,,," 3676 WerFault.exe",,,"C:\Windows\System32\dbgcore.dll",,,,,,,,,,1763581887409689000,,,,,,,,,,,140712478244864,140712478244864,263772,245760,3120784319,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4104144Z","2025-11-19 19:51:27.4104144Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\twinapi.appcore.dll",,,,,,,,,,1763581887410414400,,,,,,,,,,,140712720924672,140712720924672,2401519,2375680,2646458233,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4109892Z","2025-11-19 19:51:27.4109892Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",1424,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,1763581887410989200,18446633084053954560,18446633084053929984,140712891292720,0,199839899648,13520,199847051264,199847043072,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4113830Z","2025-11-19 19:51:27.4113830Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\umpdc.dll",,,,,,,,,,1763581887411383000,,,,,,,,,,,140712848064512,140712848064512,98535,81920,1714427184,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4122533Z","2025-11-19 19:51:27.4122533Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887412253300,18446633084053409792,18446633084053385216,140712865112144,0,320273858560,14384,320282296320,320282288128,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4125886Z","2025-11-19 19:51:27.4125886Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",9360,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887412588700,18446633084053983232,18446633084053958656,140712899206080,0,320273866752,14544,320283344896,320283340800,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4129553Z","2025-11-19 19:51:27.4129553Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.7019_none_3e06ffa0e335b8a8\comctl32.dll",,,,,,,,,,1763581887412955300,,,,,,,,,,,140712659910656,140712659910656,2747780,2703360,4095768276,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4129568Z","2025-11-19 19:51:27.4129568Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\Windows.UI.Xaml.dll",,,,,,,,,,1763581887412956800,,,,,,,,,,,140712596865024,140712596865024,17882163,17858560,706442395,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4130748Z","2025-11-19 19:51:27.4130748Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,1763581887413074800,,,,,,,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4131880Z","2025-11-19 19:51:27.4131880Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,1763581887413188000,,,,,,,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4133043Z","2025-11-19 19:51:27.4133043Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,1763581887413304300,,,,,,,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4134368Z","2025-11-19 19:51:27.4134368Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,1763581887413436800,,,,,,,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4137159Z","2025-11-19 19:51:27.4137159Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\iertutil.dll",,,,,,,,,,1763581887413716000,,,,,,,,,,,140712642805760,140712642805760,2984761,2904064,3815768453,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4139854Z","2025-11-19 19:51:27.4139854Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,1763581887413985400,,,,,,,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4141245Z","2025-11-19 19:51:27.4141245Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",14660,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\srvcli.dll",,,,,,,,,,1763581887414124500,,,,,,,,,,,140712668954624,140712668954624,181029,167936,239922031,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4143023Z","2025-11-19 19:51:27.4143023Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6780,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\netutils.dll",,,,,,,,,,1763581887414302300,,,,,,,,,,,140712825847808,140712825847808,80696,53248,865845000,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4167011Z","2025-11-19 19:51:27.4167011Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\uxtheme.dll",,,,,,,,,,1763581887416701100,,,,,,,,,,,140712802254848,140712802254848,696534,696320,1695798817,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4178760Z","2025-11-19 19:51:27.4178760Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\msctf.dll",,,,,,,,,,1763581887417876100,,,,,,,,,,,140712893022208,140712893022208,1455420,1433600,4155718050,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4184679Z","2025-11-19 19:51:27.4184679Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\execmodelproxy.dll",,,,,,,,,,1763581887418467900,,,,,,,,,,,140712462647296,140712462647296,123398,81920,3588866498,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4201691Z","2025-11-19 19:51:27.4201691Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",9360,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\OneCoreUAPCommonProxyStub.dll",,,,,,,,,,1763581887420169100,,,,,,,,,,,140712713977856,140712713977856,6740758,6615040,2011948997,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4214049Z","2025-11-19 19:51:27.4214049Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887421404900,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4218764Z","2025-11-19 19:51:27.4218764Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,1763581887421876400,,,,,,,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4219402Z","2025-11-19 19:51:27.4219402Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887421940200,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4220809Z","2025-11-19 19:51:27.4220809Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\CorePrivacySettingsStore.dll",,,,,,,,,,1763581887422080900,,,,,,,,,,,140712456290304,140712456290304,263379,196608,2978004593,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4222062Z","2025-11-19 19:51:27.4222062Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887422206200,18446633084054126592,18446633084054102016,140712891545280,0,320273874944,7540,320284393472,320284389376,140712891545280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4226943Z","2025-11-19 19:51:27.4226943Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\Windows.UI.dll",,,,,,,,,,1763581887422694300,,,,,,,,,,,140712615346176,140712615346176,1414164,1376256,3301850593,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4234297Z","2025-11-19 19:51:27.4234297Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\CoreMessaging.dll",,,,,,,,,,1763581887423429700,,,,,,,,,,,140712796160000,140712796160000,1232710,1208320,2155847221,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4240647Z","2025-11-19 19:51:27.4240647Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,1763581887424064700,,,,,,,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4252911Z","2025-11-19 19:51:27.4252911Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\uxtheme.dll",,,,,,,,,,1763581887425291100,,,,,,,,,,,140712802254848,140712802254848,696534,696320,1695798817,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4253028Z","2025-11-19 19:51:27.4253028Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887425302800,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4259673Z","2025-11-19 19:51:27.4259673Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887425967300,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4267062Z","2025-11-19 19:51:27.4267062Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\urlmon.dll",,,,,,,,,,1763581887426706200,,,,,,,,,,,140712669609984,140712669609984,1970671,1957888,260716450,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4268614Z","2025-11-19 19:51:27.4268614Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,1763581887426861400,,,,,,,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4270275Z","2025-11-19 19:51:27.4270275Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",8620,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\windows.storage.dll",,,,,,,,,,1763581887427027500,,,,,,,,,,,140712812412928,140712812412928,8877403,8769536,3667346596,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4290882Z","2025-11-19 19:51:27.4290882Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887429088200,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4296578Z","2025-11-19 19:51:27.4296578Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887429657800,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4302869Z","2025-11-19 19:51:27.4302869Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887430286900,18446633084053524480,18446633084053499904,140712600145104,0,320273883136,8000,320285442048,320285437952,140712600145104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4303353Z","2025-11-19 19:51:27.4303353Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887430335300,18446633084054011904,18446633084053987328,140712604173856,0,320273891328,4596,320286490624,320286486528,140712604173856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4308158Z","2025-11-19 19:51:27.4308158Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",8000,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\dxgi.dll",,,,,,,,,,1763581887430815800,,,,,,,,,,,140712803631104,140712803631104,1320096,1282048,1861212996,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4310946Z","2025-11-19 19:51:27.4310946Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",8620,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\powrprof.dll",,,,,,,,,,1763581887431094600,,,,,,,,,,,140712848195584,140712848195584,457799,385024,2858637235,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4316411Z","2025-11-19 19:51:27.4316411Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",8000,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\umpdc.dll",,,,,,,,,,1763581887431641100,,,,,,,,,,,140712848064512,140712848064512,98535,81920,1714427184,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4329182Z","2025-11-19 19:51:27.4329182Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",8000,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\DXCore.dll",,,,,,,,,,1763581887432918200,,,,,,,,,,,140712805400576,140712805400576,331386,274432,2354081039,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4333119Z","2025-11-19 19:51:27.4333119Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",8000,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\ResourcePolicyClient.dll",,,,,,,,,,1763581887433311900,,,,,,,,,,,140712809070592,140712809070592,104020,81920,2069163340,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4339882Z","2025-11-19 19:51:27.4339882Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887433988200,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4346169Z","2025-11-19 19:51:27.4346169Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887434616900,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4346960Z","2025-11-19 19:51:27.4346960Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13736 CalculatorApp.exe",8000,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\ResourcePolicyClient.dll",,,,,,,,,,1763581887434696000,,,,,,,,,,,140712809070592,140712809070592,104020,94208,2069163340,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4349142Z","2025-11-19 19:51:27.4349142Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",8000,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\directxdatabasehelper.dll",,,,,,,,,,1763581887434914200,,,,,,,,,,,140712752709632,140712752709632,426573,405504,145563491,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4356916Z","2025-11-19 19:51:27.4356916Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",8000,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\cfgmgr32.dll",,,,,,,,,,1763581887435691600,,,,,,,,,,,140712845049856,140712845049856,385808,356352,1737777300,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4373316Z","2025-11-19 19:51:27.4373316Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887437331600,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4379117Z","2025-11-19 19:51:27.4379117Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887437911700,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4385144Z","2025-11-19 19:51:27.4385144Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",8000,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,1763581887438514400,,,,,,,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4401061Z","2025-11-19 19:51:27.4401061Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe\CalcViewModel.dll",,,,,,,,,,1763581887440106100,,,,,,,,,,,140709579456512,140709579456512,0,2224128,1758293703,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4404353Z","2025-11-19 19:51:27.4404353Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",14660,,,"13736 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.33519.0_x64__8wekyb3d8bbwe\msvcp140_app.dll",,,,,,,,,,1763581887440435300,,,,,,,,,,,140712297037824,140712297037824,626197,573440,3775341646,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4404381Z","2025-11-19 19:51:27.4404381Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",8620,,,"13736 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.33519.0_x64__8wekyb3d8bbwe\concrt140_app.dll",,,,,,,,,,1763581887440438100,,,,,,,,,,,140712297758720,140712297758720,326544,303104,3173964004,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4405198Z","2025-11-19 19:51:27.4405198Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",6780,,,"13736 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.33519.0_x64__8wekyb3d8bbwe\vccorlib140_app.dll",,,,,,,,,,1763581887440519800,,,,,,,,,,,140711789264896,140711789264896,385886,335872,1316406955,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4405975Z","2025-11-19 19:51:27.4405975Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.33519.0_x64__8wekyb3d8bbwe\vcruntime140_1_app.dll",,,,,,,,,,1763581887440597500,,,,,,,,,,,140712543911936,140712543911936,99370,49152,606015248,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4414851Z","2025-11-19 19:51:27.4414851Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887441485100,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4420117Z","2025-11-19 19:51:27.4420117Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887442011700,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4422855Z","2025-11-19 19:51:27.4422855Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",8000,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\d3d11.dll",,,,,,,,,,1763581887442285500,,,,,,,,,,,140712786853888,140712786853888,2582658,2498560,2128032819,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4428160Z","2025-11-19 19:51:27.4428160Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\MrmCoreR.dll",,,,,,,,,,1763581887442816000,,,,,,,,,,,140712631926784,140712631926784,1191374,1146880,1078870765,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4435319Z","2025-11-19 19:51:27.4435319Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",8000,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\d3d10warp.dll",,,,,,,,,,1763581887443531900,,,,,,,,,,,140712731869184,140712731869184,5958575,5943296,1147803111,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4440256Z","2025-11-19 19:51:27.4440256Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\Windows.StateRepositoryClient.dll",,,,,,,,,,1763581887444025600,,,,,,,,,,,140712696610816,140712696610816,303673,290816,424989122,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4463643Z","2025-11-19 19:51:27.4463643Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",8000,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\d2d1.dll",,,,,,,,,,1763581887446364300,,,,,,,,,,,140712777744384,140712777744384,6610469,6537216,3013069957,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4487221Z","2025-11-19 19:51:27.4487221Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887448722100,18446633084054241280,18446633084054216704,140712899206080,0,780822675456,5172,780828409856,780828377088,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4488543Z","2025-11-19 19:51:27.4488543Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",8000,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\DWrite.dll",,,,,,,,,,1763581887448854300,,,,,,,,,,,140712784297984,140712784297984,2543119,2519040,1462185185,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4504577Z","2025-11-19 19:51:27.4504577Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\profapi.dll",,,,,,,,,,1763581887450457700,,,,,,,,,,,140712848850944,140712848850944,229548,167936,2447194521,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4509995Z","2025-11-19 19:51:27.4509995Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,1763581887450999500,,,,,,,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4510666Z","2025-11-19 19:51:27.4510666Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\AppXDeploymentClient.dll",,,,,,,,,,1763581887451066600,,,,,,,,,,,140712740257792,140712740257792,1575781,1499136,2615972959,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4512410Z","2025-11-19 19:51:27.4512410Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\imagehlp.dll",,,,,,,,,,1763581887451241000,,,,,,,,,,,140712892760064,140712892760064,200866,131072,2156568970,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4520175Z","2025-11-19 19:51:27.4520175Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",8000,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\TextShaping.dll",,,,,,,,,,1763581887452017500,,,,,,,,,,,140712585789440,140712585789440,770155,733184,2109619091,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4524504Z","2025-11-19 19:51:27.4524504Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\imagehlp.dll",,,,,,,,,,1763581887452450400,,,,,,,,,,,140712892760064,140712892760064,200866,143360,2156568970,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4525514Z","2025-11-19 19:51:27.4525514Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\AppXDeploymentClient.dll",,,,,,,,,,1763581887452551400,,,,,,,,,,,140712740257792,140712740257792,1575781,1511424,2615972959,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4528104Z","2025-11-19 19:51:27.4528104Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\aepic.dll",,,,,,,,,,1763581887452810400,,,,,,,,,,,140712428109824,140712428109824,641436,577536,321124434,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4535033Z","2025-11-19 19:51:27.4535033Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13736 CalculatorApp.exe",8000,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887453503300,18446633084053524480,18446633084053499904,140712600145104,0,320273883136,8000,320285442048,320285413376,140712600145104,59889936,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4541216Z","2025-11-19 19:51:27.4541216Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\BCP47mrm.dll",,,,,,,,,,1763581887454121600,,,,,,,,,,,140712628322304,140712628322304,278903,212992,835504572,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4549744Z","2025-11-19 19:51:27.4549744Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 7916 svchost.exe",,,,,,,,,,,,,1763581887454974400,18446633084054040576,18446633084054016000,140712899206080,0,401963950080,5540,401965842432,401965809664,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4551451Z","2025-11-19 19:51:27.4551451Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 7916 svchost.exe",5540,,," 7916 svchost.exe",,,,,,,,,,,,,1763581887455145100,18446633084054212608,18446633084054188032,140712899206080,90,401963958272,1484,401966366720,401966333952,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4554160Z","2025-11-19 19:51:27.4554160Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\AppXDeploymentClient.dll",,,,,,,,,,1763581887455416000,,,,,,,,,,,140712740257792,140712740257792,1575781,1499136,2615972959,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4555397Z","2025-11-19 19:51:27.4555397Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\imagehlp.dll",,,,,,,,,,1763581887455539700,,,,,,,,,,,140712892760064,140712892760064,200866,131072,2156568970,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4561714Z","2025-11-19 19:51:27.4561714Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\imagehlp.dll",,,,,,,,,,1763581887456171400,,,,,,,,,,,140712892760064,140712892760064,200866,143360,2156568970,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4562302Z","2025-11-19 19:51:27.4562302Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\AppXDeploymentClient.dll",,,,,,,,,,1763581887456230200,,,,,,,,,,,140712740257792,140712740257792,1575781,1511424,2615972959,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4578509Z","2025-11-19 19:51:27.4578509Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",6292,,," 5184 explorer.exe",,,,,,,,,,,,,1763581887457850900,18446633084053037056,18446633084053012480,140712891292720,0,15310848,3032,467664896,467607552,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4581793Z","2025-11-19 19:51:27.4581793Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887458179300,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4587989Z","2025-11-19 19:51:27.4587989Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887458798900,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4594189Z","2025-11-19 19:51:27.4594189Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887459418900,18446633084053524480,18446633084053499904,140712632221632,0,320273899520,11208,320285442048,320285437952,140712632221632,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4638483Z","2025-11-19 19:51:27.4638483Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.8_8.2501.31001.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.dll",,,,,,,,,,1763581887463848300,,,,,,,,,,,140712372011008,140712372011008,5866761,5873664,2056920596,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4668871Z","2025-11-19 19:51:27.4668871Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe\GraphControl.dll",,,,,,,,,,1763581887466887100,,,,,,,,,,,140711787692032,140711787692032,0,761856,1758293638,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4734579Z","2025-11-19 19:51:27.4734579Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\Windows.UI.Xaml.Controls.dll",,,,,,,,,,1763581887473457900,,,,,,,,,,,140712586575872,140712586575872,3327252,3313664,3689468694,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4798406Z","2025-11-19 19:51:27.4798406Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\msctf.dll",,,,,,,,,,1763581887479840600,,,,,,,,,,,140712893022208,140712893022208,1455420,1433600,4155718050,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4806572Z","2025-11-19 19:51:27.4806572Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2992 svchost.exe",14592,,," 2992 svchost.exe",,,,,,,,,,,,,1763581887480657200,18446633084053639168,18446633084053614592,140712899206080,186,170617987072,6428,170619043840,170619011072,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4824726Z","2025-11-19 19:51:27.4824726Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",9360,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\Windows.Shell.ServiceHostBuilder.dll",,,,,,,,,,1763581887482472600,,,,,,,,,,,140712531066880,140712531066880,142966,126976,3904637359,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4833157Z","2025-11-19 19:51:27.4833157Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2960 svchost.exe",13820,,," 2960 svchost.exe",,,,,,,,,,,,,1763581887483315700,18446633084054470656,18446633084054446080,140712891292720,287,403329781760,2140,403332661248,403332628480,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4835767Z","2025-11-19 19:51:27.4835767Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",9360,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\CoreUIComponents.dll",,,,,,,,,,1763581887483576700,,,,,,,,,,,140712742944768,140712742944768,3046501,3022848,801552868,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4862759Z","2025-11-19 19:51:27.4862759Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3204 Taskmgr.exe",5876,,," 3204 Taskmgr.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,1763581887486275900,,,,,,,,,,,140712479096832,140712479096832,1613415,1552384,2231457550,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4868565Z","2025-11-19 19:51:27.4868565Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\InputHost.dll",,,,,,,,,,1763581887486856500,,,,,,,,,,,140712583757824,140712583757824,1989124,1970176,2937052880,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4868955Z","2025-11-19 19:51:27.4868955Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3204 Taskmgr.exe",5876,,," 3204 Taskmgr.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,1763581887486895500,,,,,,,,,,,140712479096832,140712479096832,1613415,1564672,2231457550,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4879547Z","2025-11-19 19:51:27.4879547Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\cryptbase.dll",,,,,,,,,,1763581887487954700,,,,,,,,,,,140712839348224,140712839348224,63718,49152,3897879906,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4880926Z","2025-11-19 19:51:27.4880926Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2992 svchost.exe",4396,,," 2992 svchost.exe",,,,,,,,,,,,,1763581887488092600,18446633084054441984,18446633084054417408,140712899206080,186,170615898112,13424,170620092416,170620059648,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4915654Z","2025-11-19 19:51:27.4915654Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887491565400,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4921816Z","2025-11-19 19:51:27.4921816Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887492181600,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4935016Z","2025-11-19 19:51:27.4935016Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887493501600,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4944361Z","2025-11-19 19:51:27.4944361Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887494436100,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4960737Z","2025-11-19 19:51:27.4960737Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887496073700,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4966319Z","2025-11-19 19:51:27.4966319Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887496631900,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4976216Z","2025-11-19 19:51:27.4976216Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\netapi32.dll",,,,,,,,,,1763581887497621600,,,,,,,,,,,140712696348672,140712696348672,171999,106496,898597876,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4979770Z","2025-11-19 19:51:27.4979770Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\dsreg.dll",,,,,,,,,,1763581887497977000,,,,,,,,,,,140712764768256,140712764768256,1520707,1466368,4143332483,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4982389Z","2025-11-19 19:51:27.4982389Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",8356,,," 3676 WerFault.exe",,,"C:\Windows\System32\userenv.dll",,,,,,,,,,1763581887498238900,,,,,,,,,,,140712837054464,140712837054464,245008,176128,731547084,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4988065Z","2025-11-19 19:51:27.4988065Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\crypt32.dll",,,,,,,,,,1763581887498806500,,,,,,,,,,,140712849768448,140712849768448,1584869,1536000,3438168074,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4993768Z","2025-11-19 19:51:27.4993768Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581887499376800,18446633084054069248,18446633084054044672,140712899206080,0,859767250944,456,859769929728,859769921536,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5002393Z","2025-11-19 19:51:27.5002393Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\profapi.dll",,,,,,,,,,1763581887500239300,,,,,,,,,,,140712848850944,140712848850944,229548,167936,2447194521,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5006428Z","2025-11-19 19:51:27.5006428Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\UiaManager.dll",,,,,,,,,,1763581887500642800,,,,,,,,,,,140712461205504,140712461205504,941078,897024,2628067039,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5014047Z","2025-11-19 19:51:27.5014047Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887501404700,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5019608Z","2025-11-19 19:51:27.5019608Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887501960800,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5036392Z","2025-11-19 19:51:27.5036392Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887503639200,18446633084054880256,18446633084054855680,140712891292720,0,320273907712,14028,320287539200,320287535104,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5041948Z","2025-11-19 19:51:27.5041948Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887504194800,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5042407Z","2025-11-19 19:51:27.5042407Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\WindowManagementAPI.dll",,,,,,,,,,1763581887504240700,,,,,,,,,,,140712738422784,140712738422784,1825044,1794048,1605274449,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5048659Z","2025-11-19 19:51:27.5048659Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887504865900,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5074606Z","2025-11-19 19:51:27.5074606Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887507460600,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5074843Z","2025-11-19 19:51:27.5074843Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4340 sihost.exe",4288,,," 4340 sihost.exe",,,,,,,,,,,,,1763581887507484300,18446633084054736896,18446633084054712320,140712891292720,0,645640560640,12684,645647040512,645647032320,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5080079Z","2025-11-19 19:51:27.5080079Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887508007900,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5115085Z","2025-11-19 19:51:27.5115085Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887511508500,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5121006Z","2025-11-19 19:51:27.5121006Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887512100600,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5122408Z","2025-11-19 19:51:27.5122408Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\Windows.UI.Core.TextInput.dll",,,,,,,,,,1763581887512240800,,,,,,,,,,,140712572354560,140712572354560,1511216,1499136,21441667,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5128279Z","2025-11-19 19:51:27.5128279Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\TextInputFramework.dll",,,,,,,,,,1763581887512827900,,,,,,,,,,,140712628846592,140712628846592,1374424,1339392,3535451269,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5142559Z","2025-11-19 19:51:27.5142559Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887514255900,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5148329Z","2025-11-19 19:51:27.5148329Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887514832900,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5176411Z","2025-11-19 19:51:27.5176411Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887517641100,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5182726Z","2025-11-19 19:51:27.5182726Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887518272600,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5211286Z","2025-11-19 19:51:27.5211286Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\Windows.UI.Immersive.dll",,,,,,,,,,1763581887521128600,,,,,,,,,,,140712595423232,140712595423232,1424120,1372160,1559948871,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5216757Z","2025-11-19 19:51:27.5216757Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887521675700,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5223269Z","2025-11-19 19:51:27.5223269Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887522326900,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5227411Z","2025-11-19 19:51:27.5227411Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\DataExchange.dll",,,,,,,,,,1763581887522741100,,,,,,,,,,,140712406614016,140712406614016,399312,368640,696309968,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5241557Z","2025-11-19 19:51:27.5241557Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887524155700,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5248204Z","2025-11-19 19:51:27.5248204Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887524820400,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5249959Z","2025-11-19 19:51:27.5249959Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",8472,,," 1040 svchost.exe",,,,,,,,,,,,,1763581887524995900,18446633084054822912,18446633084054798336,140712899206080,0,256030941184,13368,256038141952,256038109184,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5251521Z","2025-11-19 19:51:27.5251521Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",14544,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887525152100,18446633084054851584,18446633084054827008,140712899206080,0,320273915904,8232,320288587776,320288583680,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5272466Z","2025-11-19 19:51:27.5272466Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887527246600,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5278286Z","2025-11-19 19:51:27.5278286Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887527828600,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5297584Z","2025-11-19 19:51:27.5297584Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\Windows.Storage.ApplicationData.dll",,,,,,,,,,1763581887529758400,,,,,,,,,,,140712299528192,140712299528192,453266,393216,843877859,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5301687Z","2025-11-19 19:51:27.5301687Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887530168700,18446633084054183936,18446633084054159360,140712865112144,0,320273924096,12316,320289636352,320289628160,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5480885Z","2025-11-19 19:51:27.5480885Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\psapi.dll",,,,,,,,,,1763581887548088500,,,,,,,,,,,140712898396160,140712898396160,102773,32768,992462114,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5485557Z","2025-11-19 19:51:27.5485557Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\version.dll",,,,,,,,,,1763581887548555700,,,,,,,,,,,140712753168384,140712753168384,72452,45056,2275202464,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5490372Z","2025-11-19 19:51:27.5490372Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",8232,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887549037200,18446633084053782528,18446633084053757952,140712899206080,0,320273932288,4792,320290684928,320290680832,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5528390Z","2025-11-19 19:51:27.5528390Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887552839000,18446633084054298624,18446633084054274048,140712297841152,0,320273940480,1904,320291733504,320291729408,140712297841152,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5531803Z","2025-11-19 19:51:27.5531803Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\Windows.Globalization.dll",,,,,,,,,,1763581887553180300,,,,,,,,,,,140712593457152,140712593457152,1640332,1634304,3240919660,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5646449Z","2025-11-19 19:51:27.5646449Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\verifier.dll",,,,,,,,,,1763581887564644900,,,,,,,,,,,140712390295552,140712390295552,444365,466944,1438812236,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5650330Z","2025-11-19 19:51:27.5650330Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\verifier.dll",,,,,,,,,,1763581887565033000,,,,,,,,,,,140712390295552,140712390295552,444365,479232,1438812236,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5650641Z","2025-11-19 19:51:27.5650641Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\psapi.dll",,,,,,,,,,1763581887565064100,,,,,,,,,,,140712898396160,140712898396160,102773,45056,992462114,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5651167Z","2025-11-19 19:51:27.5651167Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\version.dll",,,,,,,,,,1763581887565116700,,,,,,,,,,,140712753168384,140712753168384,72452,57344,2275202464,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5668151Z","2025-11-19 19:51:27.5668151Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887566815100,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5673824Z","2025-11-19 19:51:27.5673824Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887567382400,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5695239Z","2025-11-19 19:51:27.5695239Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\windows.storage.dll",,,,,,,,,,1763581887569523900,,,,,,,,,,,140712812412928,140712812412928,8877403,8769536,3667346596,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5706960Z","2025-11-19 19:51:27.5706960Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\shlwapi.dll",,,,,,,,,,1763581887570696000,,,,,,,,,,,140712868839424,140712868839424,479562,421888,2142510382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5725766Z","2025-11-19 19:51:27.5725766Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887572576600,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5730959Z","2025-11-19 19:51:27.5730959Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\Windows.Globalization.Fontgroups.dll",,,,,,,,,,1763581887573095900,,,,,,,,,,,140712285044736,140712285044736,126310,86016,2401575024,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5735973Z","2025-11-19 19:51:27.5735973Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887573597300,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5736081Z","2025-11-19 19:51:27.5736081Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",14660,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\BCP47Langs.dll",,,,,,,,,,1763581887573608100,,,,,,,,,,,140712631468032,140712631468032,402331,385024,2065030180,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5747666Z","2025-11-19 19:51:27.5747666Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",12316,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\fontgroupsoverride.dll",,,,,,,,,,1763581887574766600,,,,,,,,,,,140712536702976,140712536702976,84550,45056,3684684608,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5749819Z","2025-11-19 19:51:27.5749819Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887574981900,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5755582Z","2025-11-19 19:51:27.5755582Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887575558200,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5799285Z","2025-11-19 19:51:27.5799285Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\dcomp.dll",,,,,,,,,,1763581887579928500,,,,,,,,,,,140712789409792,140712789409792,2309196,2240512,1200801128,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5803791Z","2025-11-19 19:51:27.5803791Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",8620,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\Microsoft.Internal.WarpPal.dll",,,,,,,,,,1763581887580379100,,,,,,,,,,,140712769683456,140712769683456,167600,102400,2132685858,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5818922Z","2025-11-19 19:51:27.5818922Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\Windows.Energy.dll",,,,,,,,,,1763581887581892200,,,,,,,,,,,140712294088704,140712294088704,340121,335872,1240800996,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5890217Z","2025-11-19 19:51:27.5890217Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9920 ServiceHub.IntellicodeModelService.exe",11908,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,1763581887589021700,18446633084043362304,18446633084043337728,140711612509856,0,46014316544,11908,46012694528,46012678144,140711612509856,1303981,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5962844Z","2025-11-19 19:51:27.5962844Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887596284400,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5969253Z","2025-11-19 19:51:27.5969253Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887596925300,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5997444Z","2025-11-19 19:51:27.5997444Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\Windows.ApplicationModel.dll",,,,,,,,,,1763581887599744400,,,,,,,,,,,140712508391424,140712508391424,945679,876544,2857312343,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5998495Z","2025-11-19 19:51:27.5998495Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887599849500,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6003624Z","2025-11-19 19:51:27.6003624Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\Windows.Graphics.dll",,,,,,,,,,1763581887600362400,,,,,,,,,,,140712711225344,140712711225344,669723,593920,1068018205,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6004028Z","2025-11-19 19:51:27.6004028Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887600402800,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6011803Z","2025-11-19 19:51:27.6011803Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887601180400,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6016582Z","2025-11-19 19:51:27.6016582Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887601658200,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6028793Z","2025-11-19 19:51:27.6028793Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887602879300,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6034536Z","2025-11-19 19:51:27.6034536Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887603453600,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6044832Z","2025-11-19 19:51:27.6044832Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,1763581887604483200,,,,,,,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6059873Z","2025-11-19 19:51:27.6059873Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\netprofm.dll",,,,,,,,,,1763581887605987300,,,,,,,,,,,140712762802176,140712762802176,450621,450560,2204449876,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6078731Z","2025-11-19 19:51:27.6078731Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581887607873100,18446633084043362304,18446633084043337728,140712865112144,0,859767259136,7032,859770454016,859770445824,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6081019Z","2025-11-19 19:51:27.6081019Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581887608101900,18446633084054708224,18446633084054683648,140712899206080,0,859767267328,3716,859770978304,859770970112,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6082851Z","2025-11-19 19:51:27.6082851Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3676 WerFault.exe",3716,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581887608285100,18446633084054908928,18446633084054884352,140712899206080,0,859767275520,12996,859771502592,859771494400,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6117108Z","2025-11-19 19:51:27.6117108Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\npmproxy.dll",,,,,,,,,,1763581887611710900,,,,,,,,,,,140712730820608,140712730820608,124253,102400,1533975845,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6131879Z","2025-11-19 19:51:27.6131879Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\netprofm.dll",,,,,,,,,,1763581887613187900,,,,,,,,,,,140712762802176,140712762802176,450621,462848,2204449876,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6132454Z","2025-11-19 19:51:27.6132454Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\npmproxy.dll",,,,,,,,,,1763581887613245400,,,,,,,,,,,140712730820608,140712730820608,124253,114688,1533975845,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6135246Z","2025-11-19 19:51:27.6135246Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\xmllite.dll",,,,,,,,,,1763581887613524600,,,,,,,,,,,140712684027904,140712684027904,342897,274432,974526834,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6146646Z","2025-11-19 19:51:27.6146646Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\WinRtTracing.dll",,,,,,,,,,1763581887614664700,,,,,,,,,,,140712799240192,140712799240192,246648,212992,1391536235,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6151398Z","2025-11-19 19:51:27.6151398Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,1763581887615139800,,,,,,,,,,,140712426930176,140712426930176,1213372,1146880,2699219668,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6155886Z","2025-11-19 19:51:27.6155886Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe\TraceLogging.dll",,,,,,,,,,1763581887615588600,,,,,,,,,,,140712619671552,140712619671552,0,49152,1758293586,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6157920Z","2025-11-19 19:51:27.6157920Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887615792000,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6165249Z","2025-11-19 19:51:27.6165249Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887616524900,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6165988Z","2025-11-19 19:51:27.6165988Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,1763581887616598800,,,,,,,,,,,140712426930176,140712426930176,1213372,1159168,2699219668,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6172681Z","2025-11-19 19:51:27.6172681Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,1763581887617268100,,,,,,,,,,,140712426930176,140712426930176,1213372,1146880,2699219668,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6293151Z","2025-11-19 19:51:27.6293151Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,1763581887629315100,,,,,,,,,,,140712531263488,140712531263488,1042724,999424,915912993,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6298254Z","2025-11-19 19:51:27.6298254Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\Windows.UI.Xaml.Phone.dll",,,,,,,,,,1763581887629825400,,,,,,,,,,,140712592146432,140712592146432,1295254,1273856,3672194386,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6338041Z","2025-11-19 19:51:27.6338041Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,1763581887633804100,,,,,,,,,,,140712531263488,140712531263488,1042724,1011712,915912993,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6339361Z","2025-11-19 19:51:27.6339361Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,1763581887633936200,,,,,,,,,,,140712426930176,140712426930176,1213372,1159168,2699219668,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6342600Z","2025-11-19 19:51:27.6342600Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,1763581887634260000,,,,,,,,,,,140712531263488,140712531263488,1042724,999424,915912993,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6508282Z","2025-11-19 19:51:27.6508282Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\MrmCoreR.dll",,,,,,,,,,1763581887650828200,,,,,,,,,,,140712631926784,140712631926784,1191374,1146880,1078870765,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6517745Z","2025-11-19 19:51:27.6517745Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\UserMgrProxy.dll",,,,,,,,,,1763581887651774500,,,,,,,,,,,140712724660224,140712724660224,390456,393216,1431596644,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6518499Z","2025-11-19 19:51:27.6518499Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\Windows.StateRepositoryClient.dll",,,,,,,,,,1763581887651849900,,,,,,,,,,,140712696610816,140712696610816,303673,290816,424989122,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6542435Z","2025-11-19 19:51:27.6542435Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\BCP47mrm.dll",,,,,,,,,,1763581887654243500,,,,,,,,,,,140712628322304,140712628322304,278903,212992,835504572,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6545344Z","2025-11-19 19:51:27.6545344Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\directmanipulation.dll",,,,,,,,,,1763581887654534400,,,,,,,,,,,140712583036928,140712583036928,714070,667648,3434535107,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6552068Z","2025-11-19 19:51:27.6552068Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11148 calc.exe",8768,,,"11148 calc.exe",,,"C:\Windows\System32\Windows.UI.dll",,,,,,,,,,1763581887655206800,,,,,,,,,,,140712615346176,140712615346176,1414164,1376256,3301850593,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6552156Z","2025-11-19 19:51:27.6552156Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887655215600,18446633084054966272,18446633084054941696,140712583404848,0,320273948672,4172,320292782080,320292777984,140712583404848,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6556590Z","2025-11-19 19:51:27.6556590Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",8232,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887655659000,18446633084055023616,18446633084054999040,140712899206080,0,320273956864,11028,320293830656,320293826560,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6564440Z","2025-11-19 19:51:27.6564440Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","11148 calc.exe",8768,,,"11148 calc.exe",,,,,,,,,,,,,1763581887656444000,18446633084051861504,18446633084051836928,140712891545280,0,728547868672,8768,728550080512,728550047744,140712891545280,153309545,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6564444Z","2025-11-19 19:51:27.6564444Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","11148 calc.exe",13680,,,"11148 calc.exe",,,,,,,,,,,,,1763581887656444400,18446633084052348928,18446633084052324352,140712865112144,0,728547876864,13680,728550604800,728550596608,140712865112144,185583,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6564455Z","2025-11-19 19:51:27.6564455Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","11148 calc.exe",11220,,,"11148 calc.exe",,,,,,,,,,,,,1763581887656445500,18446633084052406272,18446633084052381696,140712899206080,0,728547893248,11220,728551653376,728551645184,140712899206080,861901,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6564455Z","2025-11-19 19:51:27.6564455Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","11148 calc.exe",4656,,,"11148 calc.exe",,,,,,,,,,,,,1763581887656445500,18446633084052377600,18446633084052353024,140712899206080,0,728547885056,4656,728551129088,728551120896,140712899206080,508465,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6564713Z","2025-11-19 19:51:27.6564713Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","11148 calc.exe",14656,,,"11148 calc.exe",,,,,,,,,,,,,1763581887656471300,18446633084051804160,18446633084051779584,140712899206080,0,728547860480,14656,728549556224,728549548032,140712899206080,2722632,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6564795Z","2025-11-19 19:51:27.6564795Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","11148 calc.exe",12924,,,"11148 calc.exe",,,,,,,,,,,,,1763581887656479500,18446633084051746816,18446633084051722240,140712899206080,0,728547852288,12924,728549031936,728549023744,140712899206080,4240860,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6564840Z","2025-11-19 19:51:27.6564840Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","11148 calc.exe",5464,,,"11148 calc.exe",,,,,,,,,,,,,1763581887656484000,18446633084051718144,18446633084051693568,140712899206080,0,728547844096,5464,728546148352,728546136064,140712899206080,6521410,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6567818Z","2025-11-19 19:51:27.6567818Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\threadpoolwinrt.dll",,,,,,,,,,1763581887656781800,,,,,,,,,,,140712555839488,140712555839488,130107,90112,2299561022,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6571683Z","2025-11-19 19:51:27.6571683Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887657168300,18446633084051861504,18446633084051836928,140712899206080,0,320273965056,13636,320294879232,320294875136,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6578769Z","2025-11-19 19:51:27.6578769Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","11148 calc.exe",4224,,,"11148 calc.exe",,,,,,,,,,,,,1763581887657876900,18446633084051058688,18446633084051034112,140696878126912,0,728547835904,4224,728545624064,728545603584,140696878126912,36933534,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6579983Z","2025-11-19 19:51:27.6579983Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\WindowsCodecs.dll",,,,,,,,,,1763581887657998300,,,,,,,,,,,140712775385088,140712775385088,2352359,2293760,3466818398,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6587368Z","2025-11-19 19:51:27.6587368Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\calc.exe",,,,,,,,,,1763581887658736800,,,,,,,,,,,140696878120960,140696878120960,90741,49152,4001445627,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6587482Z","2025-11-19 19:51:27.6587482Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\ieframe.dll",,,,,,,,,,1763581887658748300,,,,,,,,,,,140710222364672,140710222364672,7531896,7499776,575051316,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6587652Z","2025-11-19 19:51:27.6587652Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\mlang.dll",,,,,,,,,,1763581887658765200,,,,,,,,,,,140712293761024,140712293761024,318858,278528,3734874788,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6587767Z","2025-11-19 19:51:27.6587767Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\twinui.appcore.dll",,,,,,,,,,1763581887658776700,,,,,,,,,,,140712458059776,140712458059776,827472,806912,3228774028,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6587847Z","2025-11-19 19:51:27.6587847Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\edputil.dll",,,,,,,,,,1763581887658784800,,,,,,,,,,,140712471560192,140712471560192,178059,167936,3474529356,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6587942Z","2025-11-19 19:51:27.6587942Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,1763581887658794200,,,,,,,,,,,140712479096832,140712479096832,1613415,1552384,2231457550,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6588001Z","2025-11-19 19:51:27.6588001Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\Windows.UI.dll",,,,,,,,,,1763581887658800100,,,,,,,,,,,140712615346176,140712615346176,1414164,1376256,3301850593,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6588065Z","2025-11-19 19:51:27.6588065Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\BCP47mrm.dll",,,,,,,,,,1763581887658806500,,,,,,,,,,,140712628322304,140712628322304,278903,212992,835504572,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6588141Z","2025-11-19 19:51:27.6588141Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\MrmCoreR.dll",,,,,,,,,,1763581887658814100,,,,,,,,,,,140712631926784,140712631926784,1191374,1146880,1078870765,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6588303Z","2025-11-19 19:51:27.6588303Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\iertutil.dll",,,,,,,,,,1763581887658830300,,,,,,,,,,,140712642805760,140712642805760,2984761,2904064,3815768453,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6588406Z","2025-11-19 19:51:27.6588406Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.7019_none_3e06ffa0e335b8a8\comctl32.dll",,,,,,,,,,1763581887658840600,,,,,,,,,,,140712659910656,140712659910656,2747780,2703360,4095768276,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6588494Z","2025-11-19 19:51:27.6588494Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\srvcli.dll",,,,,,,,,,1763581887658849400,,,,,,,,,,,140712668954624,140712668954624,181029,167936,239922031,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6588566Z","2025-11-19 19:51:27.6588566Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\urlmon.dll",,,,,,,,,,1763581887658856600,,,,,,,,,,,140712669609984,140712669609984,1970671,1957888,260716450,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6588647Z","2025-11-19 19:51:27.6588647Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\wininet.dll",,,,,,,,,,1763581887658864700,,,,,,,,,,,140712675573760,140712675573760,2677835,2658304,2422963474,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6588727Z","2025-11-19 19:51:27.6588727Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,1763581887658872700,,,,,,,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6588796Z","2025-11-19 19:51:27.6588796Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\Windows.StateRepositoryClient.dll",,,,,,,,,,1763581887658879600,,,,,,,,,,,140712696610816,140712696610816,303673,290816,424989122,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6588967Z","2025-11-19 19:51:27.6588967Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\OneCoreUAPCommonProxyStub.dll",,,,,,,,,,1763581887658896800,,,,,,,,,,,140712713977856,140712713977856,6740758,6615040,2011948997,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6589058Z","2025-11-19 19:51:27.6589058Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\AppXDeploymentClient.dll",,,,,,,,,,1763581887658905800,,,,,,,,,,,140712740257792,140712740257792,1575781,1499136,2615972959,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6589138Z","2025-11-19 19:51:27.6589138Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\propsys.dll",,,,,,,,,,1763581887658913800,,,,,,,,,,,140712761491456,140712761491456,1123662,1060864,3228732737,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6589207Z","2025-11-19 19:51:27.6589207Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\secur32.dll",,,,,,,,,,1763581887658920700,,,,,,,,,,,140712800223232,140712800223232,112844,53248,632019051,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6589289Z","2025-11-19 19:51:27.6589289Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\uxtheme.dll",,,,,,,,,,1763581887658928900,,,,,,,,,,,140712802254848,140712802254848,696534,696320,1695798817,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6589553Z","2025-11-19 19:51:27.6589553Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\windows.storage.dll",,,,,,,,,,1763581887658955300,,,,,,,,,,,140712812412928,140712812412928,8877403,8769536,3667346596,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6589636Z","2025-11-19 19:51:27.6589636Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\netutils.dll",,,,,,,,,,1763581887658963600,,,,,,,,,,,140712825847808,140712825847808,80696,53248,865845000,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6589733Z","2025-11-19 19:51:27.6589733Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,1763581887658973300,,,,,,,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6589813Z","2025-11-19 19:51:27.6589813Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\sspicli.dll",,,,,,,,,,1763581887658981300,,,,,,,,,,,140712833384448,140712833384448,339222,299008,3030302172,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6589890Z","2025-11-19 19:51:27.6589890Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\profapi.dll",,,,,,,,,,1763581887658989000,,,,,,,,,,,140712848850944,140712848850944,229548,167936,2447194521,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6589975Z","2025-11-19 19:51:27.6589975Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,1763581887658997500,,,,,,,,,,,140712851341312,140712851341312,1524912,1486848,1404855129,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6590124Z","2025-11-19 19:51:27.6590124Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,1763581887659012400,,,,,,,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6590209Z","2025-11-19 19:51:27.6590209Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581887659020900,,,,,,,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6590279Z","2025-11-19 19:51:27.6590279Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,1763581887659027900,,,,,,,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6590357Z","2025-11-19 19:51:27.6590357Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581887659035800,,,,,,,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6590427Z","2025-11-19 19:51:27.6590427Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581887659042700,,,,,,,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6590499Z","2025-11-19 19:51:27.6590499Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,1763581887659049900,,,,,,,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6590568Z","2025-11-19 19:51:27.6590568Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581887659056800,,,,,,,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6590635Z","2025-11-19 19:51:27.6590635Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,1763581887659063500,,,,,,,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6590783Z","2025-11-19 19:51:27.6590783Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\shlwapi.dll",,,,,,,,,,1763581887659078300,,,,,,,,,,,140712868839424,140712868839424,479562,421888,2142510382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6590850Z","2025-11-19 19:51:27.6590850Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,1763581887659085000,,,,,,,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6590922Z","2025-11-19 19:51:27.6590922Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581887659092200,,,,,,,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6591002Z","2025-11-19 19:51:27.6591002Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\ole32.dll",,,,,,,,,,1763581887659100200,,,,,,,,,,,140712878473216,140712878473216,1689904,1667072,1018821057,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6591074Z","2025-11-19 19:51:27.6591074Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,1763581887659107400,,,,,,,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6591151Z","2025-11-19 19:51:27.6591151Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581887659115100,,,,,,,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6591216Z","2025-11-19 19:51:27.6591216Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,1763581887659121600,,,,,,,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6591468Z","2025-11-19 19:51:27.6591468Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,1763581887659146800,,,,,,,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6591558Z","2025-11-19 19:51:27.6591558Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,1763581887659155800,,,,,,,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6591637Z","2025-11-19 19:51:27.6591637Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,1763581887659163700,,,,,,,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6591711Z","2025-11-19 19:51:27.6591711Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,1763581887659171100,,,,,,,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6591779Z","2025-11-19 19:51:27.6591779Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\imagehlp.dll",,,,,,,,,,1763581887659177900,,,,,,,,,,,140712892760064,140712892760064,200866,131072,2156568970,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6591847Z","2025-11-19 19:51:27.6591847Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581887659184700,,,,,,,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6591989Z","2025-11-19 19:51:27.6591989Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581887659198900,,,,,,,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6592065Z","2025-11-19 19:51:27.6592065Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11148 calc.exe",4224,,,"11148 calc.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581887659206500,,,,,,,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6592157Z","2025-11-19 19:51:27.6592157Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop ","11148 calc.exe",4224,,,"11148 calc.exe",,,"calc.exe",,,,,,,,,,1763581887659215700,,,,,,,,,,,,,,,,3203072,3239936,214335219,134080554863097645,0,134080554866492537,116,0,3397,1,12,3,0,0,,,,,,,,,, -"2025-11-19 19:51:27.7973948Z","2025-11-19 19:51:27.7973948Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",9360,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887797394800,18446633084050915328,18446633084050890752,140712899206080,0,320273973248,13212,320295927808,320295923712,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.7978389Z","2025-11-19 19:51:27.7978389Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",13212,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887797838900,18446633084051058688,18446633084051034112,140712899206080,0,320273981440,2940,320296976384,320296972288,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.7980763Z","2025-11-19 19:51:27.7980763Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",2940,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887798076300,18446633084051746816,18446633084051722240,140712899206080,0,320273989632,6112,320298024960,320298020864,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.7982318Z","2025-11-19 19:51:27.7982318Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1168 svchost.exe",9264,,," 1168 svchost.exe",,,,,,,,,,,,,1763581887798231800,18446633084051718144,18446633084051693568,140712899206080,157,641014476800,8364,641021247488,641021214720,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.7986525Z","2025-11-19 19:51:27.7986525Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\twinapi.dll",,,,,,,,,,1763581887798652500,,,,,,,,,,,140712415789056,140712415789056,924452,868352,2129603828,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.7991738Z","2025-11-19 19:51:27.7991738Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",14660,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\xmllite.dll",,,,,,,,,,1763581887799173800,,,,,,,,,,,140712684027904,140712684027904,342897,274432,974526834,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8197198Z","2025-11-19 19:51:27.8197198Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",6112,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887819719900,18446633084052377600,18446633084052353024,140712899206080,0,320273997824,14224,320299073536,320299069440,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8199462Z","2025-11-19 19:51:27.8199462Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",14224,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887819946200,18446633084052348928,18446633084052324352,140712899206080,0,320274006016,13984,320300122112,320300118016,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8347693Z","2025-11-19 19:51:27.8347693Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",11156,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,1763581887834769300,18446633084054269952,18446633084054245376,140712891292720,0,199839907840,11824,199852294144,199852285952,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8471695Z","2025-11-19 19:51:27.8471695Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2960 svchost.exe",14536,,," 2960 svchost.exe",,,,,,,,,,,,,1763581887847169500,18446633084051804160,18446633084051779584,140712899206080,287,403329789952,4884,403333185536,403333152768,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8573571Z","2025-11-19 19:51:27.8573571Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\userenv.dll",,,,,,,,,,1763581887857357100,,,,,,,,,,,140712837054464,140712837054464,245008,176128,731547084,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8573941Z","2025-11-19 19:51:27.8573941Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1040 svchost.exe",13300,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\RuntimeBroker.exe",,,,,,,,,,1763581887857394100,,,,,,,,,,,,,148437,,1175682367,,,,134080554868459116,,,,,3403,,,,,,3,"0x","Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe","runtimebroker07f4358a809ac99a64a67c1",1040,13,3,0,0,1 -"2025-11-19 19:51:27.8577990Z","2025-11-19 19:51:27.8577990Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\profext.dll",,,,,,,,,,1763581887857799000,,,,,,,,,,,140712823488512,140712823488512,220952,200704,1125089802,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8582768Z","2025-11-19 19:51:27.8582768Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",13300,,," 5316 RuntimeBroker.exe",,,,,,,,,,,,,1763581887858276800,18446633084055273472,18446633084055248896,140699399787184,40,1098350678016,7040,1098352427008,1098352377856,140699399787184,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8597804Z","2025-11-19 19:51:27.8597804Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,1763581887859780400,,,,,,,,,,,140712531263488,140712531263488,1042724,1011712,915912993,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8601542Z","2025-11-19 19:51:27.8601542Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\RuntimeBroker.exe",,,,,,,,,,1763581887860154200,,,,,,,,,,,140699399749632,140699399749632,148437,126976,1175682367,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8601818Z","2025-11-19 19:51:27.8601818Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581887860181800,,,,,,,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8601943Z","2025-11-19 19:51:27.8601943Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\twinapi.appcore.dll",,,,,,,,,,1763581887860194300,,,,,,,,,,,140712720924672,140712720924672,2401519,2375680,2646458233,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8610326Z","2025-11-19 19:51:27.8610326Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887861032600,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8622316Z","2025-11-19 19:51:27.8622316Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887862231600,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8623373Z","2025-11-19 19:51:27.8623373Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\twinapi.appcore.dll",,,,,,,,,,1763581887862337300,,,,,,,,,,,140712720924672,140712720924672,2401519,2387968,2646458233,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8638227Z","2025-11-19 19:51:27.8638227Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887863822700,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8646493Z","2025-11-19 19:51:27.8646493Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887864649300,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8653320Z","2025-11-19 19:51:27.8653320Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581887865332000,,,,,,,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8654688Z","2025-11-19 19:51:27.8654688Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581887865468800,,,,,,,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8665581Z","2025-11-19 19:51:27.8665581Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581887866558100,,,,,,,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8666770Z","2025-11-19 19:51:27.8666770Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,,,,,,,,,,,1763581887866677000,18446633084055330816,18446633084055306240,140712899206080,0,1098350686208,9964,1098352951296,1098352902144,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8666978Z","2025-11-19 19:51:27.8666978Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887866697800,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8667674Z","2025-11-19 19:51:27.8667674Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581887866767400,,,,,,,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8672823Z","2025-11-19 19:51:27.8672823Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887867282300,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8675120Z","2025-11-19 19:51:27.8675120Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,1763581887867512000,,,,,,,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8676126Z","2025-11-19 19:51:27.8676126Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581887867612600,,,,,,,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8677378Z","2025-11-19 19:51:27.8677378Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,,,,,,,,,,,1763581887867737800,18446633084054499328,18446633084054474752,140712899206080,0,1098350694400,13000,1098353475584,1098353426432,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8687133Z","2025-11-19 19:51:27.8687133Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,1763581887868713300,,,,,,,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8688315Z","2025-11-19 19:51:27.8688315Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581887868831500,,,,,,,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8691856Z","2025-11-19 19:51:27.8691856Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,1763581887869185600,,,,,,,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8696355Z","2025-11-19 19:51:27.8696355Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\powrprof.dll",,,,,,,,,,1763581887869635500,,,,,,,,,,,140712848195584,140712848195584,457799,385024,2858637235,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8699474Z","2025-11-19 19:51:27.8699474Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\umpdc.dll",,,,,,,,,,1763581887869947400,,,,,,,,,,,140712848064512,140712848064512,98535,81920,1714427184,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8700610Z","2025-11-19 19:51:27.8700610Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887870061000,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8701475Z","2025-11-19 19:51:27.8701475Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 5316 RuntimeBroker.exe",,,,,,,,,,,,,1763581887870147500,18446633084055187456,18446633084055162880,140712899206080,0,1098350702592,13676,1098353999872,1098353950720,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8702475Z","2025-11-19 19:51:27.8702475Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 5316 RuntimeBroker.exe",,,,,,,,,,,,,1763581887870247500,18446633084055359488,18446633084055334912,140712899206080,0,1098350710784,2076,1098354524160,1098354475008,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8705220Z","2025-11-19 19:51:27.8705220Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,1763581887870522000,,,,,,,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8706331Z","2025-11-19 19:51:27.8706331Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,1763581887870633100,,,,,,,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8706461Z","2025-11-19 19:51:27.8706461Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887870646100,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8707694Z","2025-11-19 19:51:27.8707694Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,1763581887870769400,,,,,,,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8708822Z","2025-11-19 19:51:27.8708822Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,1763581887870882200,,,,,,,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8710273Z","2025-11-19 19:51:27.8710273Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5316 RuntimeBroker.exe",13000,,," 5316 RuntimeBroker.exe",,,,,,,,,,,,,1763581887871027300,18446633084055388160,18446633084055363584,140712899206080,0,1098350718976,15148,1098355048448,1098354999296,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8714949Z","2025-11-19 19:51:27.8714949Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,1763581887871494900,,,,,,,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8726023Z","2025-11-19 19:51:27.8726023Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\netprofm.dll",,,,,,,,,,1763581887872602300,,,,,,,,,,,140712762802176,140712762802176,450621,450560,2204449876,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8735961Z","2025-11-19 19:51:27.8735961Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581887873596100,,,,,,,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8745060Z","2025-11-19 19:51:27.8745060Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,1763581887874506000,,,,,,,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8753174Z","2025-11-19 19:51:27.8753174Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,,,,,,,,,,,1763581887875317400,18446633084055416832,18446633084055392256,140712865112144,0,1098350727168,5804,1098355572736,1098355523584,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8753347Z","2025-11-19 19:51:27.8753347Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\npmproxy.dll",,,,,,,,,,1763581887875334700,,,,,,,,,,,140712730820608,140712730820608,124253,102400,1533975845,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8765526Z","2025-11-19 19:51:27.8765526Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\netprofm.dll",,,,,,,,,,1763581887876552600,,,,,,,,,,,140712762802176,140712762802176,450621,462848,2204449876,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8766150Z","2025-11-19 19:51:27.8766150Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\npmproxy.dll",,,,,,,,,,1763581887876615000,,,,,,,,,,,140712730820608,140712730820608,124253,114688,1533975845,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8768601Z","2025-11-19 19:51:27.8768601Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\rmclient.dll",,,,,,,,,,1763581887876860100,,,,,,,,,,,140712808808448,140712808808448,282526,221184,1891057501,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8776426Z","2025-11-19 19:51:27.8776426Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581887877642600,18446633084055445504,18446633084055420928,140712806010720,0,859767283712,4060,859772026880,859772018688,140712806010720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8779951Z","2025-11-19 19:51:27.8779951Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\rometadata.dll",,,,,,,,,,1763581887877995100,,,,,,,,,,,140712295006208,140712295006208,267714,233472,1750277957,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8781009Z","2025-11-19 19:51:27.8781009Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5316 RuntimeBroker.exe",2076,,," 5316 RuntimeBroker.exe",,,,,,,,,,,,,1763581887878100900,18446633084055474176,18446633084055449600,140712899206080,0,1098350735360,12556,1098356097024,1098356047872,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8782289Z","2025-11-19 19:51:27.8782289Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\Windows.Security.Authentication.OnlineId.dll",,,,,,,,,,1763581887878228900,,,,,,,,,,,140712517107712,140712517107712,983040,942080,2052763288,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8784673Z","2025-11-19 19:51:27.8784673Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\WinMetadata\Windows.Foundation.winmd",,,,,,,,,,1763581887878467300,,,,,,,,,,,18014398509481984,1829655543808,134275,69632,1761294834,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8785817Z","2025-11-19 19:51:27.8785817Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",2076,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\twinui.dll",,,,,,,,,,1763581887878581700,,,,,,,,,,,140712339046400,140712339046400,5239409,5242880,279122806,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8786524Z","2025-11-19 19:51:27.8786524Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887878652400,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8787566Z","2025-11-19 19:51:27.8787566Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",2076,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,1763581887878756600,,,,,,,,,,,140712851341312,140712851341312,1524912,1486848,1404855129,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8788237Z","2025-11-19 19:51:27.8788237Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\WinMetadata\Windows.UI.winmd",,,,,,,,,,1763581887878823700,,,,,,,,,,,18014398509481984,1829681233920,773504,737280,1761294835,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8789285Z","2025-11-19 19:51:27.8789285Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",2076,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,1763581887878928500,,,,,,,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8792124Z","2025-11-19 19:51:27.8792124Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",2076,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\gamemode.dll",,,,,,,,,,1763581887879212400,,,,,,,,,,,140712543387648,140712543387648,164324,114688,328629043,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8792172Z","2025-11-19 19:51:27.8792172Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",13000,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\mscms.dll",,,,,,,,,,1763581887879217200,,,,,,,,,,,140712711880704,140712711880704,859508,786432,1878966387,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8794679Z","2025-11-19 19:51:27.8794679Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887879467900,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8796502Z","2025-11-19 19:51:27.8796502Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,1763581887879650200,,,,,,,,,,,140712851341312,140712851341312,1524912,1486848,1404855129,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8799315Z","2025-11-19 19:51:27.8799315Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",2076,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\windows.storage.dll",,,,,,,,,,1763581887879931500,,,,,,,,,,,140712812412928,140712812412928,8877403,8769536,3667346596,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8799559Z","2025-11-19 19:51:27.8799559Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",13636,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887879955900,18446633084055502848,18446633084055478272,140712899206080,0,320274014208,14648,320301170688,320301166592,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8801055Z","2025-11-19 19:51:27.8801055Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",2076,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581887880105500,,,,,,,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8804552Z","2025-11-19 19:51:27.8804552Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",2076,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\DXCore.dll",,,,,,,,,,1763581887880455200,,,,,,,,,,,140712805400576,140712805400576,331386,274432,2354081039,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8804961Z","2025-11-19 19:51:27.8804961Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",12996,,," 3676 WerFault.exe",,,"C:\Windows\System32\dpapi.dll",,,,,,,,,,1763581887880496100,,,,,,,,,,,140712845574144,140712845574144,42814,40960,2473566603,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8815483Z","2025-11-19 19:51:27.8815483Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",12996,,," 3676 WerFault.exe",,,"C:\Windows\System32\cryptbase.dll",,,,,,,,,,1763581887881548300,,,,,,,,,,,140712839348224,140712839348224,63718,49152,3897879906,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8818340Z","2025-11-19 19:51:27.8818340Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",2076,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,1763581887881834000,,,,,,,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8819091Z","2025-11-19 19:51:27.8819091Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\netprofm.dll",,,,,,,,,,1763581887881909100,,,,,,,,,,,140712762802176,140712762802176,450621,450560,2204449876,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8823575Z","2025-11-19 19:51:27.8823575Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\OneCoreUAPCommonProxyStub.dll",,,,,,,,,,1763581887882357500,,,,,,,,,,,140712713977856,140712713977856,6740758,6615040,2011948997,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8829511Z","2025-11-19 19:51:27.8829511Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",2076,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\OneCoreUAPCommonProxyStub.dll",,,,,,,,,,1763581887882951100,,,,,,,,,,,140712713977856,140712713977856,6740758,6615040,2011948997,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8837273Z","2025-11-19 19:51:27.8837273Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\npmproxy.dll",,,,,,,,,,1763581887883727300,,,,,,,,,,,140712730820608,140712730820608,124253,102400,1533975845,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8847613Z","2025-11-19 19:51:27.8847613Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",12556,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,1763581887884761300,,,,,,,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8855369Z","2025-11-19 19:51:27.8855369Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5316 RuntimeBroker.exe",12556,,," 5316 RuntimeBroker.exe",,,,,,,,,,,,,1763581887885536900,18446633084054413312,18446633084054388736,140712865112144,0,1098350743552,9412,1098356621312,1098356572160,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8857542Z","2025-11-19 19:51:27.8857542Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,1763581887885754200,,,,,,,,,,,140712426930176,140712426930176,1213372,1146880,2699219668,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8859883Z","2025-11-19 19:51:27.8859883Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",9412,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\uxtheme.dll",,,,,,,,,,1763581887885988300,,,,,,,,,,,140712802254848,140712802254848,696534,696320,1695798817,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8865289Z","2025-11-19 19:51:27.8865289Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887886528900,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8877574Z","2025-11-19 19:51:27.8877574Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\netprofm.dll",,,,,,,,,,1763581887887757400,,,,,,,,,,,140712762802176,140712762802176,450621,462848,2204449876,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8878769Z","2025-11-19 19:51:27.8878769Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\Windows.Security.Authentication.OnlineId.dll",,,,,,,,,,1763581887887876900,,,,,,,,,,,140712517107712,140712517107712,983040,954368,2052763288,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8879331Z","2025-11-19 19:51:27.8879331Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\npmproxy.dll",,,,,,,,,,1763581887887933100,,,,,,,,,,,140712730820608,140712730820608,124253,114688,1533975845,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8880495Z","2025-11-19 19:51:27.8880495Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887888049500,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8881150Z","2025-11-19 19:51:27.8881150Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,1763581887888115000,,,,,,,,,,,140712426930176,140712426930176,1213372,1159168,2699219668,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8882805Z","2025-11-19 19:51:27.8882805Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\OneCoreUAPCommonProxyStub.dll",,,,,,,,,,1763581887888280500,,,,,,,,,,,140712713977856,140712713977856,6740758,6627328,2011948997,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8883747Z","2025-11-19 19:51:27.8883747Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,1763581887888374700,,,,,,,,,,,140712851341312,140712851341312,1524912,1499136,1404855129,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8888989Z","2025-11-19 19:51:27.8888989Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",9412,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\shlwapi.dll",,,,,,,,,,1763581887888898900,,,,,,,,,,,140712868839424,140712868839424,479562,421888,2142510382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8890915Z","2025-11-19 19:51:27.8890915Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,1763581887889091500,,,,,,,,,,,140712426930176,140712426930176,1213372,1146880,2699219668,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8901899Z","2025-11-19 19:51:27.8901899Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",12556,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\twinapi.appcore.dll",,,,,,,,,,1763581887890189900,,,,,,,,,,,140712720924672,140712720924672,2401519,2375680,2646458233,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8922337Z","2025-11-19 19:51:27.8922337Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",9412,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,1763581887892233700,,,,,,,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8933989Z","2025-11-19 19:51:27.8933989Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",9412,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\ole32.dll",,,,,,,,,,1763581887893398900,,,,,,,,,,,140712878473216,140712878473216,1689904,1667072,1018821057,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8945701Z","2025-11-19 19:51:27.8945701Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",2076,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\cfgmgr32.dll",,,,,,,,,,1763581887894570100,,,,,,,,,,,140712845049856,140712845049856,385808,356352,1737777300,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8951431Z","2025-11-19 19:51:27.8951431Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",9412,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\propsys.dll",,,,,,,,,,1763581887895143100,,,,,,,,,,,140712761491456,140712761491456,1123662,1060864,3228732737,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8976135Z","2025-11-19 19:51:27.8976135Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5316 RuntimeBroker.exe",9412,,," 5316 RuntimeBroker.exe",,,,,,,,,,,,,1763581887897613500,18446633084052406272,18446633084052381696,140712891292720,0,1098350751744,2008,1098357145600,1098357096448,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8992253Z","2025-11-19 19:51:27.8992253Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",2008,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\Windows.StateRepositoryPS.dll",,,,,,,,,,1763581887899225300,,,,,,,,,,,140712490369024,140712490369024,879719,802816,374042279,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9007624Z","2025-11-19 19:51:27.9007624Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",9412,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,1763581887900762400,,,,,,,,,,,140712479096832,140712479096832,1613415,1552384,2231457550,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9044495Z","2025-11-19 19:51:27.9044495Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",9412,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\OneCoreCommonProxyStub.dll",,,,,,,,,,1763581887904449500,,,,,,,,,,,140712570257408,140712570257408,903222,823296,2010952444,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9060955Z","2025-11-19 19:51:27.9060955Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",12556,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\iertutil.dll",,,,,,,,,,1763581887906095500,,,,,,,,,,,140712642805760,140712642805760,2984761,2904064,3815768453,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9062538Z","2025-11-19 19:51:27.9062538Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,1763581887906253800,,,,,,,,,,,140712531263488,140712531263488,1042724,999424,915912993,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9063564Z","2025-11-19 19:51:27.9063564Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",15148,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\srvcli.dll",,,,,,,,,,1763581887906356400,,,,,,,,,,,140712668954624,140712668954624,181029,167936,239922031,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9063629Z","2025-11-19 19:51:27.9063629Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",9964,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\netutils.dll",,,,,,,,,,1763581887906362900,,,,,,,,,,,140712825847808,140712825847808,80696,53248,865845000,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9096350Z","2025-11-19 19:51:27.9096350Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",12556,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\Windows.Web.dll",,,,,,,,,,1763581887909635000,,,,,,,,,,,140712467955712,140712467955712,678716,638976,1581530023,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9109320Z","2025-11-19 19:51:27.9109320Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,1763581887910932000,,,,,,,,,,,140712531263488,140712531263488,1042724,1011712,915912993,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9110781Z","2025-11-19 19:51:27.9110781Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,1763581887911078100,,,,,,,,,,,140712426930176,140712426930176,1213372,1159168,2699219668,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9110873Z","2025-11-19 19:51:27.9110873Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13736 CalculatorApp.exe",14028,,,"13736 CalculatorApp.exe",,,"C:\Windows\System32\Windows.Web.dll",,,,,,,,,,1763581887911087300,,,,,,,,,,,140712467955712,140712467955712,678716,638976,1581530023,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9114183Z","2025-11-19 19:51:27.9114183Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,1763581887911418300,,,,,,,,,,,140712531263488,140712531263488,1042724,999424,915912993,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9208163Z","2025-11-19 19:51:27.9208163Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",2076,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\profapi.dll",,,,,,,,,,1763581887920816300,,,,,,,,,,,140712848850944,140712848850944,229548,167936,2447194521,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9230450Z","2025-11-19 19:51:27.9230450Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6096 svchost.exe",8040,,," 6096 svchost.exe",,,,,,,,,,,,,1763581887923045000,18446633084055560192,18446633084055535616,140712899206080,25,338489380864,8508,338491342848,338491310080,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9306346Z","2025-11-19 19:51:27.9306346Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",9412,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581887930634600,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9322463Z","2025-11-19 19:51:27.9322463Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",9412,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\bcrypt.dll",,,,,,,,,,1763581887932246300,,,,,,,,,,,140712848654336,140712848654336,206048,172032,2893678010,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9417148Z","2025-11-19 19:51:27.9417148Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5316 RuntimeBroker.exe",9412,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\ntmarta.dll",,,,,,,,,,1763581887941714800,,,,,,,,,,,140712831811584,140712831811584,265798,221184,3598506564,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9502687Z","2025-11-19 19:51:27.9502687Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2724 svchost.exe",3692,,," 2724 svchost.exe",,,,,,,,,,,,,1763581887950268700,18446633084056133632,18446633084056109056,140712899206080,232,89489309696,7980,89491243008,89491177472,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9503755Z","2025-11-19 19:51:27.9503755Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2724 svchost.exe",3692,,," 2724 svchost.exe",,,,,,,,,,,,,1763581887950375500,18446633084053151744,18446633084053127168,140712899206080,232,89489317888,14444,89492291584,89492258816,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9627380Z","2025-11-19 19:51:27.9627380Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3204 Taskmgr.exe",5876,,," 3204 Taskmgr.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,1763581887962738000,,,,,,,,,,,140712479096832,140712479096832,1613415,1552384,2231457550,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9637828Z","2025-11-19 19:51:27.9637828Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3204 Taskmgr.exe",5876,,," 3204 Taskmgr.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,1763581887963782800,,,,,,,,,,,140712479096832,140712479096832,1613415,1564672,2231457550,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1314166Z","2025-11-19 19:51:28.1314166Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,1763581888131416600,,,,,,,,,,,140712531263488,140712531263488,1042724,1011712,915912993,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1319160Z","2025-11-19 19:51:28.1319160Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\twinapi.appcore.dll",,,,,,,,,,1763581888131916000,,,,,,,,,,,140712720924672,140712720924672,2401519,2375680,2646458233,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1324896Z","2025-11-19 19:51:28.1324896Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581888132489700,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1335793Z","2025-11-19 19:51:28.1335793Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581888133579400,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1336659Z","2025-11-19 19:51:28.1336659Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\twinapi.appcore.dll",,,,,,,,,,1763581888133665900,,,,,,,,,,,140712720924672,140712720924672,2401519,2387968,2646458233,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1346129Z","2025-11-19 19:51:28.1346129Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581888134612900,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1350968Z","2025-11-19 19:51:28.1350968Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581888135096800,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1366987Z","2025-11-19 19:51:28.1366987Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\winhttp.dll",,,,,,,,,,1763581888136698700,,,,,,,,,,,140712750350336,140712750350336,1261038,1212416,84984727,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1374525Z","2025-11-19 19:51:28.1374525Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\ws2_32.dll",,,,,,,,,,1763581888137452500,,,,,,,,,,,140712881094656,140712881094656,513405,475136,3967481067,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1387808Z","2025-11-19 19:51:28.1387808Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3676 WerFault.exe",3716,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581888138780800,18446633084055674880,18446633084055650304,140712899206080,0,859767291904,1844,859772551168,859772542976,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1389202Z","2025-11-19 19:51:28.1389202Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\mswsock.dll",,,,,,,,,,1763581888138920200,,,,,,,,,,,140712836333568,140712836333568,491870,438272,897307513,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1395785Z","2025-11-19 19:51:28.1395785Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\IPHLPAPI.DLL",,,,,,,,,,1763581888139578500,,,,,,,,,,,140712824012800,140712824012800,233044,212992,945822897,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1399706Z","2025-11-19 19:51:28.1399706Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\winnsi.dll",,,,,,,,,,1763581888139970600,,,,,,,,,,,140712802975744,140712802975744,95519,61440,2268955118,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1401672Z","2025-11-19 19:51:28.1401672Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\nsi.dll",,,,,,,,,,1763581888140167200,,,,,,,,,,,140712892956672,140712892956672,111648,40960,4223476491,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1454079Z","2025-11-19 19:51:28.1454079Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\dhcpcsvc6.dll",,,,,,,,,,1763581888145407900,,,,,,,,,,,140712753233920,140712753233920,145503,122880,2114927498,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1461970Z","2025-11-19 19:51:28.1461970Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\dhcpcsvc.dll",,,,,,,,,,1763581888146197000,,,,,,,,,,,140712746024960,140712746024960,184216,143360,916390222,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1472980Z","2025-11-19 19:51:28.1472980Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\webio.dll",,,,,,,,,,1763581888147298100,,,,,,,,,,,140712635531264,140712635531264,873482,827392,338769958,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1492579Z","2025-11-19 19:51:28.1492579Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,"C:\Windows\System32\sspicli.dll",,,,,,,,,,1763581888149257900,,,,,,,,,,,140712833384448,140712833384448,339222,299008,3030302172,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1534700Z","2025-11-19 19:51:28.1534700Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",1844,,," 3676 WerFault.exe",,,"C:\Windows\System32\dnsapi.dll",,,,,,,,,,1763581888153470000,,,,,,,,,,,140712824274944,140712824274944,1293169,1228800,1381219389,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1547388Z","2025-11-19 19:51:28.1547388Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",3716,,," 3676 WerFault.exe",,,"C:\Windows\System32\rasadhlp.dll",,,,,,,,,,1763581888154738800,,,,,,,,,,,140712730755072,140712730755072,108990,45056,352477361,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1609860Z","2025-11-19 19:51:28.1609860Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",1844,,," 3676 WerFault.exe",,,"C:\Windows\System32\FWPUCLNT.DLL",,,,,,,,,,1763581888160986000,,,,,,,,,,,140712731279360,140712731279360,561494,548864,3096342574,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2219561Z","2025-11-19 19:51:28.2219561Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",14224,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581888221956100,18446633084055703552,18446633084055678976,140712899206080,0,320274022400,8572,320302219264,320302215168,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.261554400Z","2025-11-19 19:51:28.2771678Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Attack done",,,,,,,,,,,1763581888277167800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2777846Z","2025-11-19 19:51:28.2777846Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,1763581888277784600,,,,,,,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2782317Z","2025-11-19 19:51:28.2782317Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3348 attack-589.exe",3088,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581888278231700,18446633084049022976,18446633084048998400,140712899206080,0,289797922816,3088,289802289152,289802280960,140712899206080,2024057,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2782317Z","2025-11-19 19:51:28.2782317Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3348 attack-589.exe",12904,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581888278231700,18446633084049080320,18446633084049055744,140712899206080,0,289797931008,12904,289803337728,289803329536,140712899206080,1558590,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2782336Z","2025-11-19 19:51:28.2782336Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3348 attack-589.exe",11468,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581888278233700,18446633083996708864,18446633083996684288,140712899206080,0,289797914624,11468,289801240576,289801232384,140712899206080,3363869,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2783990Z","2025-11-19 19:51:28.2783990Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581888278399000,18446633084044398592,18446633084044374016,140695599400816,0,289797906432,11212,289800192000,289800171520,140695599400816,64789380,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2785133Z","2025-11-19 19:51:28.2785133Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Users\Public\Downloads\attack-589.exe",,,,,,,,,,1763581888278513300,,,,,,,,,,,140695599382528,140695599382528,0,53248,1763491559,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2785202Z","2025-11-19 19:51:28.2785202Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\msvcp140.dll",,,,,,,,,,1763581888278520200,,,,,,,,,,,140711213137920,140711213137920,570439,561152,1564323704,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2785241Z","2025-11-19 19:51:28.2785241Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\vcruntime140.dll",,,,,,,,,,1763581888278524100,,,,,,,,,,,140712353988608,140712353988608,146072,122880,254123393,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2785276Z","2025-11-19 19:51:28.2785276Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\vcruntime140_1.dll",,,,,,,,,,1763581888278527600,,,,,,,,,,,140712354119680,140712354119680,57827,49152,240324076,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2785509Z","2025-11-19 19:51:28.2785509Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\apphelp.dll",,,,,,,,,,1763581888278550900,,,,,,,,,,,140712800485376,140712800485376,675806,651264,4108425587,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2785585Z","2025-11-19 19:51:28.2785585Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,1763581888278558500,,,,,,,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2785670Z","2025-11-19 19:51:28.2785670Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581888278567000,,,,,,,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2785759Z","2025-11-19 19:51:28.2785759Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581888278575900,,,,,,,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2785835Z","2025-11-19 19:51:28.2785835Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581888278583500,,,,,,,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2785901Z","2025-11-19 19:51:28.2785901Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581888278590100,,,,,,,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2786055Z","2025-11-19 19:51:28.2786055Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581888278605500,,,,,,,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2786133Z","2025-11-19 19:51:28.2786133Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581888278613300,,,,,,,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2786208Z","2025-11-19 19:51:28.2786208Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581888278620800,,,,,,,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2786279Z","2025-11-19 19:51:28.2786279Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581888278627900,,,,,,,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2786366Z","2025-11-19 19:51:28.2786366Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"attack-589.exe",,,,,,,,,,1763581888278636600,,,,,,,,,,,,,,,,958464,958464,72053875,134080554806144016,0,134080554872628582,52,9,3392,0,0,3,48,0,,,,,,,,,, -"2025-11-19 19:51:28.2872477Z","2025-11-19 19:51:28.2872477Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",3716,,," 3676 WerFault.exe",,,"C:\Windows\System32\schannel.dll",,,,,,,,,,1763581888287247700,,,,,,,,,,,140712828731392,140712828731392,849052,802816,24806266,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.3902746Z","2025-11-19 19:51:28.3902746Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1288 mmc.exe",,,,,,,,,,,,,1763581888390274600,18446633084049080320,18446633084049055744,140712899206080,0,7151616,8412,548274176,548192256,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.3904146Z","2025-11-19 19:51:28.3904146Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4868 svchost.exe",6388,,," 4868 svchost.exe",,,,,,,,,,,,,1763581888390414600,18446633083996708864,18446633083996684288,140712899206080,0,47919407104,14244,47921496064,47921463296,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.3905737Z","2025-11-19 19:51:28.3905737Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1288 mmc.exe",8412,,," 1288 mmc.exe",,,,,,,,,,,,,1763581888390573700,18446633084049022976,18446633084048998400,140712899206080,0,7159808,7028,548798464,548716544,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.4693653Z","2025-11-19 19:51:28.4693653Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 4192 svchost.exe",,,,,,,,,,,,,1763581888469365300,18446633084055875584,18446633084055851008,140712899206080,0,330479378432,15260,330477273088,330477240320,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.4695259Z","2025-11-19 19:51:28.4695259Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4192 svchost.exe",15260,,," 4192 svchost.exe",,,,,,,,,,,,,1763581888469525900,18446633084055904256,18446633084055879680,140712899206080,0,330479386624,11272,330480222208,330480189440,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.4698578Z","2025-11-19 19:51:28.4698578Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5536 svchost.exe",7072,,," 5536 svchost.exe",,,,,,,,,,,,,1763581888469857800,18446633084055932928,18446633084055908352,140712899206080,132,151912620032,13504,151921360896,151921328128,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.5348823Z","2025-11-19 19:51:28.5348823Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",3716,,," 3676 WerFault.exe",,,"C:\Windows\System32\ncrypt.dll",,,,,,,,,,1763581888534882300,,,,,,,,,,,140712841445376,140712841445376,272959,196608,3912253876,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.5352695Z","2025-11-19 19:51:28.5352695Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",3716,,," 3676 WerFault.exe",,,"C:\Windows\System32\ntasn1.dll",,,,,,,,,,1763581888535269500,,,,,,,,,,,140712841117696,140712841117696,300816,258048,2667946327,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.5357145Z","2025-11-19 19:51:28.5357145Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",3716,,," 3676 WerFault.exe",,,"C:\Windows\System32\ncryptsslp.dll",,,,,,,,,,1763581888535714500,,,,,,,,,,,140712682061824,140712682061824,310492,270336,4015176457,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.5366068Z","2025-11-19 19:51:28.5366068Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",3716,,," 3676 WerFault.exe",,,"C:\Windows\System32\msasn1.dll",,,,,,,,,,1763581888536606800,,,,,,,,,,,140712839675904,140712839675904,150871,77824,2536054058,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.5402989Z","2025-11-19 19:51:28.5402989Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",3716,,," 3676 WerFault.exe",,,"C:\Windows\System32\cryptnet.dll",,,,,,,,,,1763581888540298900,,,,,,,,,,,140712595161088,140712595161088,304772,241664,919073152,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.8201829Z","2025-11-19 19:51:28.8201829Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4372 vctip.exe",3948,,," 4372 vctip.exe",,,,,,,,,,,,,1763581888820182900,18446633084051488768,18446633084051464192,140711612509856,0,740355280896,3948,740352917504,740352909312,140711612509856,820035,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.8211588Z","2025-11-19 19:51:28.8211588Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581888821158800,18446633084055445504,18446633084055420928,140712806010720,0,859767283712,4060,859772026880,859771981824,140712806010720,967555353,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.8218990Z","2025-11-19 19:51:28.8218990Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581888821899000,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.8225452Z","2025-11-19 19:51:28.8225452Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581888822545200,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.8248238Z","2025-11-19 19:51:28.8248238Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581888824823800,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.8254380Z","2025-11-19 19:51:28.8254380Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581888825438000,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.8278658Z","2025-11-19 19:51:28.8278658Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581888827865800,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.8284518Z","2025-11-19 19:51:28.8284518Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13688 svchost.exe",13720,,,"13688 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581888828451800,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.9301581Z","2025-11-19 19:51:28.9301581Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\rsaenh.dll",,,,,,,,,,1763581888930158100,,,,,,,,,,,140712829976576,140712829976576,300007,237568,1319378437,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.9328146Z","2025-11-19 19:51:28.9328146Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,1763581888932814600,,,,,,,,,,,140712426930176,140712426930176,1213372,1146880,2699219668,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.9334459Z","2025-11-19 19:51:28.9334459Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581888933445900,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.9343016Z","2025-11-19 19:51:28.9343016Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581888934301600,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.9343697Z","2025-11-19 19:51:28.9343697Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,1763581888934369700,,,,,,,,,,,140712426930176,140712426930176,1213372,1159168,2699219668,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.9349533Z","2025-11-19 19:51:28.9349533Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,1763581888934953300,,,,,,,,,,,140712426930176,140712426930176,1213372,1146880,2699219668,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.9499068Z","2025-11-19 19:51:28.9499068Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,1763581888949906800,,,,,,,,,,,140712531263488,140712531263488,1042724,999424,915912993,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.9538395Z","2025-11-19 19:51:28.9538395Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,1763581888953839500,,,,,,,,,,,140712531263488,140712531263488,1042724,1011712,915912993,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.9539474Z","2025-11-19 19:51:28.9539474Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,1763581888953947400,,,,,,,,,,,140712426930176,140712426930176,1213372,1159168,2699219668,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.9542392Z","2025-11-19 19:51:28.9542392Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,1763581888954239200,,,,,,,,,,,140712531263488,140712531263488,1042724,999424,915912993,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1436921Z","2025-11-19 19:51:29.1436921Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,1763581889143692100,,,,,,,,,,,140712531263488,140712531263488,1042724,1011712,915912993,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1441822Z","2025-11-19 19:51:29.1441822Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\twinapi.appcore.dll",,,,,,,,,,1763581889144182200,,,,,,,,,,,140712720924672,140712720924672,2401519,2375680,2646458233,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1447540Z","2025-11-19 19:51:29.1447540Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581889144754000,,,,,,,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1458814Z","2025-11-19 19:51:29.1458814Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581889145881400,,,,,,,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1459531Z","2025-11-19 19:51:29.1459531Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\twinapi.appcore.dll",,,,,,,,,,1763581889145953100,,,,,,,,,,,140712720924672,140712720924672,2401519,2387968,2646458233,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1636841Z","2025-11-19 19:51:29.1636841Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3676 WerFault.exe",13460,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581889163684100,18446633084053581824,18446633084053557248,140712899206080,0,859767226368,13460,859768356864,859768344576,140712899206080,11957619,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1636865Z","2025-11-19 19:51:29.1636865Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3676 WerFault.exe",8356,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581889163686500,18446633084053868544,18446633084053843968,140712899206080,0,859767234560,8356,859768881152,859768868864,140712899206080,7043082,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1636930Z","2025-11-19 19:51:29.1636930Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3676 WerFault.exe",11036,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581889163693000,18446633084053897216,18446633084053872640,140712899206080,0,859767242752,11036,859769405440,859769397248,140712899206080,9124852,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1636935Z","2025-11-19 19:51:29.1636935Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3676 WerFault.exe",7032,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581889163693500,18446633084043362304,18446633084043337728,140712865112144,0,859767259136,7032,859770454016,859770445824,140712865112144,363244,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1636952Z","2025-11-19 19:51:29.1636952Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3676 WerFault.exe",456,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581889163695300,18446633084054069248,18446633084054044672,140712899206080,0,859767250944,456,859769929728,859769921536,140712899206080,310812,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1637012Z","2025-11-19 19:51:29.1637012Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3676 WerFault.exe",3716,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581889163701200,18446633084054708224,18446633084054683648,140712899206080,0,859767267328,3716,859770978304,859770953728,140712899206080,52584328,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1637054Z","2025-11-19 19:51:29.1637054Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3676 WerFault.exe",1844,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581889163705400,18446633084055674880,18446633084055650304,140712899206080,0,859767291904,1844,859772551168,859772522496,140712899206080,16559079,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1637161Z","2025-11-19 19:51:29.1637161Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3676 WerFault.exe",12996,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581889163716100,18446633084054908928,18446633084054884352,140712899206080,0,859767275520,12996,859771502592,859771482112,140712899206080,7689979,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1651994Z","2025-11-19 19:51:29.1651994Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581889165199400,18446633084051374080,18446633084051349504,140702556693600,0,859767218176,14180,859767832576,859767754752,140702556693600,2657930717,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1663997Z","2025-11-19 19:51:29.1663997Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\WerFault.exe",,,,,,,,,,1763581889166399700,,,,,,,,,,,140702556684288,140702556684288,681036,647168,630084362,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1664197Z","2025-11-19 19:51:29.1664197Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\Faultrep.dll",,,,,,,,,,1763581889166419700,,,,,,,,,,,140712281309184,140712281309184,594974,548864,3149101438,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1664308Z","2025-11-19 19:51:29.1664308Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\aepic.dll",,,,,,,,,,1763581889166430800,,,,,,,,,,,140712428109824,140712428109824,641436,577536,321124434,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1664397Z","2025-11-19 19:51:29.1664397Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\CorePrivacySettingsStore.dll",,,,,,,,,,1763581889166439700,,,,,,,,,,,140712456290304,140712456290304,263379,196608,2978004593,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1664483Z","2025-11-19 19:51:29.1664483Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\DiagnosticDataSettings.dll",,,,,,,,,,1763581889166448300,,,,,,,,,,,140712462319616,140712462319616,108991,61440,3234151774,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1664559Z","2025-11-19 19:51:29.1664559Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\dbgcore.dll",,,,,,,,,,1763581889166455900,,,,,,,,,,,140712478244864,140712478244864,263772,245760,3120784319,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1664644Z","2025-11-19 19:51:29.1664644Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\cryptnet.dll",,,,,,,,,,1763581889166464500,,,,,,,,,,,140712595161088,140712595161088,304772,241664,919073152,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1664813Z","2025-11-19 19:51:29.1664813Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\webio.dll",,,,,,,,,,1763581889166481300,,,,,,,,,,,140712635531264,140712635531264,873482,827392,338769958,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1664859Z","2025-11-19 19:51:29.1664859Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.7019_none_3e06ffa0e335b8a8\comctl32.dll",,,,,,,,,,1763581889166485900,,,,,,,,,,,140712659910656,140712659910656,2747780,2703360,4095768276,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1664953Z","2025-11-19 19:51:29.1664953Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\dbghelp.dll",,,,,,,,,,1763581889166495400,,,,,,,,,,,140712664104960,140712664104960,2282862,2367488,82455296,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1665039Z","2025-11-19 19:51:29.1665039Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\ncryptsslp.dll",,,,,,,,,,1763581889166503900,,,,,,,,,,,140712682061824,140712682061824,310492,270336,4015176457,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1665114Z","2025-11-19 19:51:29.1665114Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\xmllite.dll",,,,,,,,,,1763581889166511400,,,,,,,,,,,140712684027904,140712684027904,342897,274432,974526834,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1665182Z","2025-11-19 19:51:29.1665182Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\netapi32.dll",,,,,,,,,,1763581889166518200,,,,,,,,,,,140712696348672,140712696348672,171999,106496,898597876,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1665258Z","2025-11-19 19:51:29.1665258Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\rasadhlp.dll",,,,,,,,,,1763581889166525800,,,,,,,,,,,140712730755072,140712730755072,108990,45056,352477361,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1665409Z","2025-11-19 19:51:29.1665409Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\FWPUCLNT.DLL",,,,,,,,,,1763581889166540900,,,,,,,,,,,140712731279360,140712731279360,561494,548864,3096342574,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1665498Z","2025-11-19 19:51:29.1665498Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\dhcpcsvc.dll",,,,,,,,,,1763581889166549800,,,,,,,,,,,140712746024960,140712746024960,184216,143360,916390222,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1665564Z","2025-11-19 19:51:29.1665564Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\winhttp.dll",,,,,,,,,,1763581889166556400,,,,,,,,,,,140712750350336,140712750350336,1261038,1212416,84984727,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1665638Z","2025-11-19 19:51:29.1665638Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\dhcpcsvc6.dll",,,,,,,,,,1763581889166563900,,,,,,,,,,,140712753233920,140712753233920,145503,122880,2114927498,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1665715Z","2025-11-19 19:51:29.1665715Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\dsreg.dll",,,,,,,,,,1763581889166571500,,,,,,,,,,,140712764768256,140712764768256,1520707,1466368,4143332483,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1665788Z","2025-11-19 19:51:29.1665788Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\uxtheme.dll",,,,,,,,,,1763581889166578800,,,,,,,,,,,140712802254848,140712802254848,696534,696320,1695798817,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1665853Z","2025-11-19 19:51:29.1665853Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\winnsi.dll",,,,,,,,,,1763581889166585300,,,,,,,,,,,140712802975744,140712802975744,95519,61440,2268955118,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1665918Z","2025-11-19 19:51:29.1665918Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\wer.dll",,,,,,,,,,1763581889166591900,,,,,,,,,,,140712805728256,140712805728256,993632,983040,1987637995,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1666077Z","2025-11-19 19:51:29.1666077Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\rmclient.dll",,,,,,,,,,1763581889166607700,,,,,,,,,,,140712808808448,140712808808448,282526,221184,1891057501,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1666159Z","2025-11-19 19:51:29.1666159Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\windows.storage.dll",,,,,,,,,,1763581889166616000,,,,,,,,,,,140712812412928,140712812412928,8877403,8769536,3667346596,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1666226Z","2025-11-19 19:51:29.1666226Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\IPHLPAPI.DLL",,,,,,,,,,1763581889166622600,,,,,,,,,,,140712824012800,140712824012800,233044,212992,945822897,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1666296Z","2025-11-19 19:51:29.1666296Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\dnsapi.dll",,,,,,,,,,1763581889166629600,,,,,,,,,,,140712824274944,140712824274944,1293169,1228800,1381219389,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1666362Z","2025-11-19 19:51:29.1666362Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\schannel.dll",,,,,,,,,,1763581889166636300,,,,,,,,,,,140712828731392,140712828731392,849052,802816,24806266,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1666435Z","2025-11-19 19:51:29.1666435Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\rsaenh.dll",,,,,,,,,,1763581889166643500,,,,,,,,,,,140712829976576,140712829976576,300007,237568,1319378437,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1666513Z","2025-11-19 19:51:29.1666513Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,1763581889166651300,,,,,,,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1666659Z","2025-11-19 19:51:29.1666659Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\ntmarta.dll",,,,,,,,,,1763581889166665900,,,,,,,,,,,140712831811584,140712831811584,265798,221184,3598506564,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1666736Z","2025-11-19 19:51:29.1666736Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\sspicli.dll",,,,,,,,,,1763581889166673600,,,,,,,,,,,140712833384448,140712833384448,339222,299008,3030302172,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1666806Z","2025-11-19 19:51:29.1666806Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\mswsock.dll",,,,,,,,,,1763581889166680700,,,,,,,,,,,140712836333568,140712836333568,491870,438272,897307513,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1666870Z","2025-11-19 19:51:29.1666870Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\userenv.dll",,,,,,,,,,1763581889166687000,,,,,,,,,,,140712837054464,140712837054464,245008,176128,731547084,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1666938Z","2025-11-19 19:51:29.1666938Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\cryptsp.dll",,,,,,,,,,1763581889166693800,,,,,,,,,,,140712839217152,140712839217152,146168,110592,1658328178,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1667004Z","2025-11-19 19:51:29.1667004Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\cryptbase.dll",,,,,,,,,,1763581889166700400,,,,,,,,,,,140712839348224,140712839348224,63718,49152,3897879906,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1667070Z","2025-11-19 19:51:29.1667070Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\msasn1.dll",,,,,,,,,,1763581889166707000,,,,,,,,,,,140712839675904,140712839675904,150871,77824,2536054058,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1667134Z","2025-11-19 19:51:29.1667134Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\ntasn1.dll",,,,,,,,,,1763581889166713400,,,,,,,,,,,140712841117696,140712841117696,300816,258048,2667946327,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1667278Z","2025-11-19 19:51:29.1667278Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\ncrypt.dll",,,,,,,,,,1763581889166727800,,,,,,,,,,,140712841445376,140712841445376,272959,196608,3912253876,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1667449Z","2025-11-19 19:51:29.1667449Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\cfgmgr32.dll",,,,,,,,,,1763581889166744900,,,,,,,,,,,140712845049856,140712845049856,385808,356352,1737777300,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1667522Z","2025-11-19 19:51:29.1667522Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\dpapi.dll",,,,,,,,,,1763581889166752200,,,,,,,,,,,140712845574144,140712845574144,42814,40960,2473566603,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1667591Z","2025-11-19 19:51:29.1667591Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\umpdc.dll",,,,,,,,,,1763581889166759100,,,,,,,,,,,140712848064512,140712848064512,98535,81920,1714427184,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1667653Z","2025-11-19 19:51:29.1667653Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\powrprof.dll",,,,,,,,,,1763581889166765300,,,,,,,,,,,140712848195584,140712848195584,457799,385024,2858637235,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1667721Z","2025-11-19 19:51:29.1667721Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\bcrypt.dll",,,,,,,,,,1763581889166772100,,,,,,,,,,,140712848654336,140712848654336,206048,172032,2893678010,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1667861Z","2025-11-19 19:51:29.1667861Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\profapi.dll",,,,,,,,,,1763581889166786100,,,,,,,,,,,140712848850944,140712848850944,229548,167936,2447194521,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1667937Z","2025-11-19 19:51:29.1667937Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\crypt32.dll",,,,,,,,,,1763581889166793700,,,,,,,,,,,140712849768448,140712849768448,1584869,1536000,3438168074,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1668011Z","2025-11-19 19:51:29.1668011Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,1763581889166801100,,,,,,,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1668080Z","2025-11-19 19:51:29.1668080Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581889166808000,,,,,,,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1668142Z","2025-11-19 19:51:29.1668142Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,1763581889166814200,,,,,,,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1668214Z","2025-11-19 19:51:29.1668214Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581889166821400,,,,,,,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1668277Z","2025-11-19 19:51:29.1668277Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581889166827700,,,,,,,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1668346Z","2025-11-19 19:51:29.1668346Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,1763581889166834600,,,,,,,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1668484Z","2025-11-19 19:51:29.1668484Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581889166848400,,,,,,,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1668560Z","2025-11-19 19:51:29.1668560Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,1763581889166856000,,,,,,,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1668627Z","2025-11-19 19:51:29.1668627Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\shlwapi.dll",,,,,,,,,,1763581889166862700,,,,,,,,,,,140712868839424,140712868839424,479562,421888,2142510382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1668698Z","2025-11-19 19:51:29.1668698Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581889166869900,,,,,,,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1668770Z","2025-11-19 19:51:29.1668770Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,1763581889166877000,,,,,,,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1668836Z","2025-11-19 19:51:29.1668836Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\ws2_32.dll",,,,,,,,,,1763581889166883600,,,,,,,,,,,140712881094656,140712881094656,513405,475136,3967481067,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1668906Z","2025-11-19 19:51:29.1668906Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581889166890600,,,,,,,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1668964Z","2025-11-19 19:51:29.1668964Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,1763581889166896400,,,,,,,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1669110Z","2025-11-19 19:51:29.1669110Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,1763581889166911000,,,,,,,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1669183Z","2025-11-19 19:51:29.1669183Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,1763581889166918300,,,,,,,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1669251Z","2025-11-19 19:51:29.1669251Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,1763581889166925100,,,,,,,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1669317Z","2025-11-19 19:51:29.1669317Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,1763581889166931700,,,,,,,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1669379Z","2025-11-19 19:51:29.1669379Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\nsi.dll",,,,,,,,,,1763581889166937900,,,,,,,,,,,140712892956672,140712892956672,111648,40960,4223476491,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1669445Z","2025-11-19 19:51:29.1669445Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\msctf.dll",,,,,,,,,,1763581889166944500,,,,,,,,,,,140712893022208,140712893022208,1455420,1433600,4155718050,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1669507Z","2025-11-19 19:51:29.1669507Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581889166950700,,,,,,,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1669571Z","2025-11-19 19:51:29.1669571Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581889166957100,,,,,,,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1669710Z","2025-11-19 19:51:29.1669710Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581889166971000,,,,,,,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1669895Z","2025-11-19 19:51:29.1669895Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"WerFault.exe",,,,,,,,,,1763581889166989600,,,,,,,,,,,,,,,,4272128,14024704,3739576266,134080554863942943,0,134080554881418238,203,0,3402,85,2343,3,406,81,,,,,,,,,, -"2025-11-19 19:51:29.1675068Z","2025-11-19 19:51:29.1675068Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1660 svchost.exe",11196,,," 1660 svchost.exe",,,,,,,,,,,,,1763581889167506900,18446633084053581824,18446633084053557248,140712899206080,0,265906421760,7712,265905897472,265905864704,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1704217Z","2025-11-19 19:51:29.1704217Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,,,,,,,,,,,1763581889170421700,18446633084051144704,18446633084051120128,2195810680832,0,521061572608,6380,521063628800,521063608320,2195810680832,45706462,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1706933Z","2025-11-19 19:51:29.1706933Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\whoami.exe",,,,,,,,,,1763581889170693300,,,,,,,,,,,140702344609792,140702344609792,160109,98304,3602411345,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1707129Z","2025-11-19 19:51:29.1707129Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\wkscli.dll",,,,,,,,,,1763581889170712900,,,,,,,,,,,140712738291712,140712738291712,170846,110592,1225555544,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1707242Z","2025-11-19 19:51:29.1707242Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\version.dll",,,,,,,,,,1763581889170724200,,,,,,,,,,,140712753168384,140712753168384,72452,45056,2275202464,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1707328Z","2025-11-19 19:51:29.1707328Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\apphelp.dll",,,,,,,,,,1763581889170732800,,,,,,,,,,,140712800485376,140712800485376,675806,651264,4108425587,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1707405Z","2025-11-19 19:51:29.1707405Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\netutils.dll",,,,,,,,,,1763581889170740500,,,,,,,,,,,140712825847808,140712825847808,80696,53248,865845000,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1707478Z","2025-11-19 19:51:29.1707478Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\authz.dll",,,,,,,,,,1763581889170747800,,,,,,,,,,,140712826241024,140712826241024,372179,327680,771731569,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1707558Z","2025-11-19 19:51:29.1707558Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\sspicli.dll",,,,,,,,,,1763581889170755800,,,,,,,,,,,140712833384448,140712833384448,339222,299008,3030302172,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1707624Z","2025-11-19 19:51:29.1707624Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581889170762400,,,,,,,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1707770Z","2025-11-19 19:51:29.1707770Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,1763581889170777100,,,,,,,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1707839Z","2025-11-19 19:51:29.1707839Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581889170783900,,,,,,,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1707901Z","2025-11-19 19:51:29.1707901Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581889170790100,,,,,,,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1707963Z","2025-11-19 19:51:29.1707963Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,1763581889170796400,,,,,,,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1708021Z","2025-11-19 19:51:29.1708021Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581889170802200,,,,,,,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1708087Z","2025-11-19 19:51:29.1708087Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581889170808700,,,,,,,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1708158Z","2025-11-19 19:51:29.1708158Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\ws2_32.dll",,,,,,,,,,1763581889170815800,,,,,,,,,,,140712881094656,140712881094656,513405,475136,3967481067,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1708219Z","2025-11-19 19:51:29.1708219Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581889170821900,,,,,,,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1708353Z","2025-11-19 19:51:29.1708353Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,1763581889170835300,,,,,,,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1708422Z","2025-11-19 19:51:29.1708422Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,1763581889170842200,,,,,,,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1708492Z","2025-11-19 19:51:29.1708492Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,1763581889170849200,,,,,,,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1708555Z","2025-11-19 19:51:29.1708555Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581889170855500,,,,,,,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1708613Z","2025-11-19 19:51:29.1708613Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581889170861300,,,,,,,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1708672Z","2025-11-19 19:51:29.1708672Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581889170867200,,,,,,,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1708754Z","2025-11-19 19:51:29.1708754Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"whoami.exe",,,,,,,,,,1763581889170875400,,,,,,,,,,,,,,,,1257472,1302528,57157118,134080554818530829,3221225477,134080554881460737,83,0,3396,1,3,3,0,0,,,,,,,,,, -"2025-11-19 19:51:29.1712017Z","2025-11-19 19:51:29.1712017Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",14196,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889171201700,18446633084039225344,18446633084039200768,140702989233856,0,132813950976,14196,132824170496,132824162304,140702989233856,1237595,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1712021Z","2025-11-19 19:51:29.1712021Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",5064,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889171202100,18446633084045922304,18446633084045897728,140712899206080,0,132813926400,5064,132821024768,132821016576,140712899206080,512990,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1712022Z","2025-11-19 19:51:29.1712022Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",13020,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889171202200,18446633084045864960,18446633084045840384,140712865112144,0,132813918208,13020,132819976192,132819968000,140712865112144,214628,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1712025Z","2025-11-19 19:51:29.1712025Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",5520,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889171202500,18446633084017422336,18446633084017397760,140702989086576,0,132813959168,5520,132825219072,132825210880,140702989086576,4438889,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1712026Z","2025-11-19 19:51:29.1712026Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889171202600,18446633084045201408,18446633084045176832,140702989817872,0,132813885440,4736,132815781888,132815761408,140702989817872,67793028,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1712036Z","2025-11-19 19:51:29.1712036Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",12136,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889171203600,18446633084045430784,18446633084045406208,140712899206080,0,132813901824,12136,132817879040,132817870848,140712899206080,12037587,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1712126Z","2025-11-19 19:51:29.1712126Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",12916,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889171212600,18446633084042874880,18446633084042850304,140702989404080,0,132813967360,12916,132826267648,132826255360,140702989404080,1037678,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1712275Z","2025-11-19 19:51:29.1712275Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",14136,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889171227500,18446633084045402112,18446633084045377536,140712899206080,0,132813893632,14136,132816830464,132816822272,140712899206080,8912478,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1712302Z","2025-11-19 19:51:29.1712302Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",2364,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889171230200,18446633084045950976,18446633084045926400,140712899206080,0,132813934592,2364,132822073344,132822032384,140712899206080,41279257,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1712388Z","2025-11-19 19:51:29.1712388Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",1824,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889171238800,18446633084045807616,18446633084045783040,140712899206080,0,132813910016,1824,132818927616,132818915328,140712899206080,9551452,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1723363Z","2025-11-19 19:51:29.1723363Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889172336300,18446633084047904768,18446633084047880192,140702989217024,0,132813942784,5760,132823121920,132823093248,140702989217024,23273616,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1732074Z","2025-11-19 19:51:29.1732074Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\OpenConsole.exe",,,,,,,,,,1763581889173207400,,,,,,,,,,,140702989025280,140702989025280,1210794,1159168,1759975785,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1732299Z","2025-11-19 19:51:29.1732299Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\usp10.dll",,,,,,,,,,1763581889173229900,,,,,,,,,,,140711462174720,140711462174720,161304,102400,728066498,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1732435Z","2025-11-19 19:51:29.1732435Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\UIAutomationCore.dll",,,,,,,,,,1763581889173243500,,,,,,,,,,,140712432762880,140712432762880,4328257,4296704,2096711852,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1732511Z","2025-11-19 19:51:29.1732511Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\winmm.dll",,,,,,,,,,1763581889173251100,,,,,,,,,,,140712663842816,140712663842816,263815,217088,2106743460,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1732602Z","2025-11-19 19:51:29.1732602Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,1763581889173260200,,,,,,,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1732656Z","2025-11-19 19:51:29.1732656Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\PackagedCom\OpenConsoleProxy.dll",,,,,,,,,,1763581889173265600,,,,,,,,,,,140712723349504,140712723349504,51292,53248,1759975238,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1732744Z","2025-11-19 19:51:29.1732744Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\propsys.dll",,,,,,,,,,1763581889173274400,,,,,,,,,,,140712761491456,140712761491456,1123662,1060864,3228732737,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1732824Z","2025-11-19 19:51:29.1732824Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\D3DCompiler_47.dll",,,,,,,,,,1763581889173282400,,,,,,,,,,,140712769814528,140712769814528,4685395,4714496,796813953,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1732964Z","2025-11-19 19:51:29.1732964Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\d2d1.dll",,,,,,,,,,1763581889173296400,,,,,,,,,,,140712777744384,140712777744384,6610469,6537216,3013069957,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1733030Z","2025-11-19 19:51:29.1733030Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\DWrite.dll",,,,,,,,,,1763581889173303100,,,,,,,,,,,140712784297984,140712784297984,2543119,2519040,1462185185,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1733092Z","2025-11-19 19:51:29.1733092Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\d3d11.dll",,,,,,,,,,1763581889173309200,,,,,,,,,,,140712786853888,140712786853888,2582658,2498560,2128032819,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1733160Z","2025-11-19 19:51:29.1733160Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\uxtheme.dll",,,,,,,,,,1763581889173316000,,,,,,,,,,,140712802254848,140712802254848,696534,696320,1695798817,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1733226Z","2025-11-19 19:51:29.1733226Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\dxgi.dll",,,,,,,,,,1763581889173322600,,,,,,,,,,,140712803631104,140712803631104,1320096,1282048,1861212996,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1733305Z","2025-11-19 19:51:29.1733305Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\windows.storage.dll",,,,,,,,,,1763581889173330500,,,,,,,,,,,140712812412928,140712812412928,8877403,8769536,3667346596,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1733393Z","2025-11-19 19:51:29.1733393Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,1763581889173339300,,,,,,,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1733558Z","2025-11-19 19:51:29.1733558Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\cryptsp.dll",,,,,,,,,,1763581889173355800,,,,,,,,,,,140712839217152,140712839217152,146168,110592,1658328178,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1733652Z","2025-11-19 19:51:29.1733652Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\umpdc.dll",,,,,,,,,,1763581889173365200,,,,,,,,,,,140712848064512,140712848064512,98535,81920,1714427184,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1733723Z","2025-11-19 19:51:29.1733723Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\powrprof.dll",,,,,,,,,,1763581889173372300,,,,,,,,,,,140712848195584,140712848195584,457799,385024,2858637235,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1733797Z","2025-11-19 19:51:29.1733797Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,1763581889173379700,,,,,,,,,,,140712851341312,140712851341312,1524912,1486848,1404855129,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1733872Z","2025-11-19 19:51:29.1733872Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,1763581889173387200,,,,,,,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1733932Z","2025-11-19 19:51:29.1733932Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581889173393200,,,,,,,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1733995Z","2025-11-19 19:51:29.1733995Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,1763581889173399500,,,,,,,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1734052Z","2025-11-19 19:51:29.1734052Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581889173405200,,,,,,,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1734179Z","2025-11-19 19:51:29.1734179Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581889173417900,,,,,,,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1734240Z","2025-11-19 19:51:29.1734240Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,1763581889173424000,,,,,,,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1734294Z","2025-11-19 19:51:29.1734294Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581889173429400,,,,,,,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1734358Z","2025-11-19 19:51:29.1734358Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,1763581889173435800,,,,,,,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1734425Z","2025-11-19 19:51:29.1734425Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,1763581889173442500,,,,,,,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1734482Z","2025-11-19 19:51:29.1734482Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581889173448200,,,,,,,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1734554Z","2025-11-19 19:51:29.1734554Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,1763581889173455400,,,,,,,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1734619Z","2025-11-19 19:51:29.1734619Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581889173461900,,,,,,,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1734671Z","2025-11-19 19:51:29.1734671Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,1763581889173467100,,,,,,,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1734800Z","2025-11-19 19:51:29.1734800Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,1763581889173480000,,,,,,,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1734871Z","2025-11-19 19:51:29.1734871Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,1763581889173487100,,,,,,,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1734930Z","2025-11-19 19:51:29.1734930Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,1763581889173493000,,,,,,,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1734996Z","2025-11-19 19:51:29.1734996Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,1763581889173499600,,,,,,,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1735050Z","2025-11-19 19:51:29.1735050Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581889173505000,,,,,,,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1735102Z","2025-11-19 19:51:29.1735102Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581889173510200,,,,,,,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1735153Z","2025-11-19 19:51:29.1735153Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581889173515400,,,,,,,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1735274Z","2025-11-19 19:51:29.1735274Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"OpenConsole.ex",,,,,,,,,,1763581889173527400,,,,,,,,,,,,,,,,2887680,2940928,176179930,134080554806509408,0,134080554881486007,111,0,3394,12,7,3,52,0,,,,,,,,,, -"2025-11-19 19:51:29.1738607Z","2025-11-19 19:51:29.1738607Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3100 conhost.exe",1400,,," 3100 conhost.exe",,,,,,,,,,,,,1763581889173860700,18446633084044828672,18446633084044804096,140712899206080,0,1013857767424,1400,1013862367232,1013862359040,140712899206080,175021,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1738641Z","2025-11-19 19:51:29.1738641Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3100 conhost.exe",9260,,," 3100 conhost.exe",,,,,,,,,,,,,1763581889173864100,18446633084044656640,18446633084044632064,140712899206080,0,1013857759232,9260,1013861318656,1013861310464,140712899206080,523176,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1738680Z","2025-11-19 19:51:29.1738680Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3100 conhost.exe",2976,,," 3100 conhost.exe",,,,,,,,,,,,,1763581889173868000,18446633084044943360,18446633084044918784,140712865112144,0,1013857751040,2976,1013860794368,1013860786176,140712865112144,139564,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1738783Z","2025-11-19 19:51:29.1738783Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3100 conhost.exe",6724,,," 3100 conhost.exe",,,,,,,,,,,,,1763581889173878300,18446633084044627968,18446633084044603392,140696384580832,0,1013857734656,6724,1013861842944,1013861818368,140696384580832,33378427,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1738825Z","2025-11-19 19:51:29.1738825Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3100 conhost.exe",4376,,," 3100 conhost.exe",,,,,,,,,,,,,1763581889173882500,18446633084006535168,18446633084006510592,140712899206080,0,1013857742848,4376,1013860270080,1013860261888,140712899206080,858507,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1741667Z","2025-11-19 19:51:29.1741667Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,,,,,,,,,,,1763581889174166700,18446633084047990784,18446633084047966208,140696385038832,0,1013857775616,11136,1013862891520,1013862879232,140696385038832,732523,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1744927Z","2025-11-19 19:51:29.1744927Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\Windows\System32\conhost.exe",,,,,,,,,,1763581889174492700,,,,,,,,,,,140696384438272,140696384438272,1035098,1028096,2671108986,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1745034Z","2025-11-19 19:51:29.1745034Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,1763581889174503400,,,,,,,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1745074Z","2025-11-19 19:51:29.1745074Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\PackagedCom\OpenConsoleProxy.dll",,,,,,,,,,1763581889174507400,,,,,,,,,,,140712723349504,140712723349504,51292,53248,1759975238,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1745208Z","2025-11-19 19:51:29.1745208Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,1763581889174520800,,,,,,,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1745302Z","2025-11-19 19:51:29.1745302Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,1763581889174530200,,,,,,,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1745358Z","2025-11-19 19:51:29.1745358Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581889174535800,,,,,,,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1745412Z","2025-11-19 19:51:29.1745412Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,1763581889174541200,,,,,,,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1745469Z","2025-11-19 19:51:29.1745469Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581889174546900,,,,,,,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1745524Z","2025-11-19 19:51:29.1745524Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581889174552400,,,,,,,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1745577Z","2025-11-19 19:51:29.1745577Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,1763581889174557700,,,,,,,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1745652Z","2025-11-19 19:51:29.1745652Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581889174565200,,,,,,,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1745709Z","2025-11-19 19:51:29.1745709Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,1763581889174570900,,,,,,,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1745826Z","2025-11-19 19:51:29.1745826Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581889174582600,,,,,,,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1745901Z","2025-11-19 19:51:29.1745901Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,1763581889174590100,,,,,,,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1745956Z","2025-11-19 19:51:29.1745956Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581889174595600,,,,,,,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1746006Z","2025-11-19 19:51:29.1746006Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,1763581889174600600,,,,,,,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1746063Z","2025-11-19 19:51:29.1746063Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,1763581889174606300,,,,,,,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1746124Z","2025-11-19 19:51:29.1746124Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,1763581889174612400,,,,,,,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1746178Z","2025-11-19 19:51:29.1746178Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,1763581889174617800,,,,,,,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1746243Z","2025-11-19 19:51:29.1746243Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581889174624300,,,,,,,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1746299Z","2025-11-19 19:51:29.1746299Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581889174629900,,,,,,,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1746349Z","2025-11-19 19:51:29.1746349Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581889174634900,,,,,,,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1746376Z","2025-11-19 19:51:29.1746376Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",4932,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889174637600,18446633084042932224,18446633084042907648,140712371704112,0,1068179750912,4932,1068193808384,1068193669120,140712371704112,6957459,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1746466Z","2025-11-19 19:51:29.1746466Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"conhost.exe",,,,,,,,,,1763581889174646600,,,,,,,,,,,,,,,,1503232,1552384,66220850,134080554806283315,109,134080554881498658,93,0,3393,5,0,3,0,0,,,,,,,,,, -"2025-11-19 19:51:29.1871394Z","2025-11-19 19:51:29.1871394Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",6876,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187139500,18446633084045144064,18446633084045119488,140712891292720,0,1068179693568,6876,1068187516928,1068187496448,140712891292720,12018349,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1871396Z","2025-11-19 19:51:29.1871396Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",14948,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187139600,18446633084049481728,18446633084049457152,140712899206080,0,1068179816448,14948,1068202196992,1068202188800,140712899206080,346270,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1871397Z","2025-11-19 19:51:29.1871397Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187139700,18446633084046352384,18446633084046327808,140702319920256,0,1068179636224,5964,1068177817600,1068177727488,140702319920256,1443654158,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1871409Z","2025-11-19 19:51:29.1871409Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",11716,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187140900,18446633084044541952,18446633084044517376,140712583404848,0,1068179726336,11716,1068190662656,1068190654464,140712583404848,1102557,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1871452Z","2025-11-19 19:51:29.1871452Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",3968,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187145200,18446633084007337984,18446633084007313408,140712378178864,0,1068179759104,3968,1068194856960,1068194828288,140712378178864,69473835,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1871491Z","2025-11-19 19:51:29.1871491Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",8404,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187149200,18446633084047183872,18446633084047159296,140712899206080,0,1068179685376,8404,1068186468352,1068186451968,140712899206080,8231254,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1871524Z","2025-11-19 19:51:29.1871524Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",9740,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187152400,18446633084047876096,18446633084047851520,140712899206080,0,1068179734528,9740,1068191711232,1068191694848,140712899206080,7053264,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1871535Z","2025-11-19 19:51:29.1871535Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",11228,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187153500,18446633084046180352,18446633084046155776,140712899206080,0,1068179791872,11228,1068199051264,1068199043072,140712899206080,1385833,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1871773Z","2025-11-19 19:51:29.1871773Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",12764,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187177300,18446633084049453056,18446633084049428480,140712899206080,0,1068179808256,12764,1068201148416,1068201140224,140712899206080,780050,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1872444Z","2025-11-19 19:51:29.1872444Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",1960,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187244400,18446633084049424384,18446633084049399808,140712899206080,0,1068179800064,1960,1068200099840,1068200091648,140712899206080,1114250,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1872641Z","2025-11-19 19:51:29.1872641Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",3600,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187264100,18446633084044570624,18446633084044546048,140712899206080,0,1068179783680,3600,1068198002688,1068197990400,140712899206080,4580339,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1872760Z","2025-11-19 19:51:29.1872760Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",12568,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187276000,18446633084042072064,18446633084042047488,140712865112144,0,1068179742720,12568,1068192759808,1068192739328,140712865112144,7322583,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1872767Z","2025-11-19 19:51:29.1872767Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",12140,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187276700,18446633084049252352,18446633084049227776,140712899206080,0,1068179775488,12140,1068196954112,1068196945920,140712899206080,3097568,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1872895Z","2025-11-19 19:51:29.1872895Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",14500,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187289500,18446633084047642624,18446633084047618048,140712632221632,0,1068179718144,14500,1068188565504,1068188553216,140712632221632,3940609,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1873052Z","2025-11-19 19:51:29.1873052Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",14844,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187305200,18446633084042817536,18446633084042792960,140712899206080,0,1068179668992,14844,1068184371200,1068184358912,140712899206080,6994044,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1873232Z","2025-11-19 19:51:29.1873232Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",12024,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187323200,18446633084046725120,18446633084046700544,140712899206080,0,1068179660800,12024,1068183322624,1068183314432,140712899206080,26231986,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1873245Z","2025-11-19 19:51:29.1873245Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",4348,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187324500,18446633084046667776,18446633084046643200,140712899206080,0,1068179652608,4348,1068182274048,1068182261760,140712899206080,20408407,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1873476Z","2025-11-19 19:51:29.1873476Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",11152,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187347600,18446633084046610432,18446633084046585856,140712899206080,0,1068179644416,11152,1068181225472,1068181209088,140712899206080,21606025,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1873670Z","2025-11-19 19:51:29.1873670Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",11960,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187367000,18446633084048162816,18446633084048138240,140712899206080,0,1068179767296,11960,1068195905536,1068195885056,140712899206080,1970379630,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1873893Z","2025-11-19 19:51:29.1873893Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",11108,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187389300,18446633084046983168,18446633084046958592,140712865112144,0,1068179677184,11108,1068185419776,1068185411584,140712865112144,197276,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1878454Z","2025-11-19 19:51:29.1878454Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187845400,18446633084047790080,18446633084047765504,140712604173856,0,1068179709952,10116,1068189614080,1068189605888,140712604173856,13884359,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1940446Z","2025-11-19 19:51:29.1940446Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe",,,,,,,,,,1763581889194044600,,,,,,,,,,,140702319640576,140702319640576,738129,684032,1759975821,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1940562Z","2025-11-19 19:51:29.1940562Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\Microsoft.Terminal.Settings.Model.dll",,,,,,,,,,1763581889194056300,,,,,,,,,,,140709601476608,140709601476608,2281369,2252800,1759975487,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1940676Z","2025-11-19 19:51:29.1940676Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\ProgramData\Microsoft\VisualStudio\Setup\x64\Microsoft.VisualStudio.Setup.Configuration.Native.dll",,,,,,,,,,1763581889194067600,,,,,,,,,,,140711212089344,140711212089344,1007466,1015808,1726088073,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1940933Z","2025-11-19 19:51:29.1940933Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\msftedit.dll",,,,,,,,,,1763581889194093300,,,,,,,,,,,140712289107968,140712289107968,3297357,3305472,3878106343,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1941031Z","2025-11-19 19:51:29.1941031Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\ExplorerFrame.dll",,,,,,,,,,1763581889194103100,,,,,,,,,,,140712345862144,140712345862144,2919775,2867200,3427672670,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1941076Z","2025-11-19 19:51:29.1941076Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\Microsoft.Terminal.UI.dll",,,,,,,,,,1763581889194107600,,,,,,,,,,,140712371224576,140712371224576,255391,258048,1759975265,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1941116Z","2025-11-19 19:51:29.1941116Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\TerminalConnection.dll",,,,,,,,,,1763581889194111600,,,,,,,,,,,140712371486720,140712371486720,522798,495616,1759975254,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1941159Z","2025-11-19 19:51:29.1941159Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.8_8.2501.31001.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.dll",,,,,,,,,,1763581889194115900,,,,,,,,,,,140712372011008,140712372011008,5866761,5873664,2056920596,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1941198Z","2025-11-19 19:51:29.1941198Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\Microsoft.Terminal.Control.dll",,,,,,,,,,1763581889194119800,,,,,,,,,,,140712377909248,140712377909248,1976337,1986560,1759975378,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1941311Z","2025-11-19 19:51:29.1941311Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\TerminalApp.dll",,,,,,,,,,1763581889194131100,,,,,,,,,,,140712379940864,140712379940864,3444084,3444736,1759975751,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1941421Z","2025-11-19 19:51:29.1941421Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\DataExchange.dll",,,,,,,,,,1763581889194142100,,,,,,,,,,,140712406614016,140712406614016,399312,368640,696309968,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1941511Z","2025-11-19 19:51:29.1941511Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\twinapi.dll",,,,,,,,,,1763581889194151100,,,,,,,,,,,140712415789056,140712415789056,924452,868352,2129603828,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1941599Z","2025-11-19 19:51:29.1941599Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\UIAutomationCore.dll",,,,,,,,,,1763581889194159900,,,,,,,,,,,140712432762880,140712432762880,4328257,4296704,2096711852,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1941687Z","2025-11-19 19:51:29.1941687Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\UiaManager.dll",,,,,,,,,,1763581889194168700,,,,,,,,,,,140712461205504,140712461205504,941078,897024,2628067039,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1941778Z","2025-11-19 19:51:29.1941778Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\AppExtension.dll",,,,,,,,,,1763581889194177800,,,,,,,,,,,140712467365888,140712467365888,337294,299008,1656953249,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1941991Z","2025-11-19 19:51:29.1941991Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.StateRepositoryPS.dll",,,,,,,,,,1763581889194199100,,,,,,,,,,,140712490369024,140712490369024,879719,802816,374042279,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1942075Z","2025-11-19 19:51:29.1942075Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.ApplicationModel.dll",,,,,,,,,,1763581889194207500,,,,,,,,,,,140712508391424,140712508391424,945679,876544,2857312343,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1942157Z","2025-11-19 19:51:29.1942157Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\threadpoolwinrt.dll",,,,,,,,,,1763581889194215700,,,,,,,,,,,140712555839488,140712555839488,130107,90112,2299561022,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1942242Z","2025-11-19 19:51:29.1942242Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.UI.Core.TextInput.dll",,,,,,,,,,1763581889194224200,,,,,,,,,,,140712572354560,140712572354560,1511216,1499136,21441667,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1942334Z","2025-11-19 19:51:29.1942334Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\directmanipulation.dll",,,,,,,,,,1763581889194233400,,,,,,,,,,,140712583036928,140712583036928,714070,667648,3434535107,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1942414Z","2025-11-19 19:51:29.1942414Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\InputHost.dll",,,,,,,,,,1763581889194241400,,,,,,,,,,,140712583757824,140712583757824,1989124,1970176,2937052880,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1942566Z","2025-11-19 19:51:29.1942566Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\TextShaping.dll",,,,,,,,,,1763581889194256600,,,,,,,,,,,140712585789440,140712585789440,770155,733184,2109619091,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1942644Z","2025-11-19 19:51:29.1942644Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.UI.Xaml.Controls.dll",,,,,,,,,,1763581889194264400,,,,,,,,,,,140712586575872,140712586575872,3327252,3313664,3689468694,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1942730Z","2025-11-19 19:51:29.1942730Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.Globalization.dll",,,,,,,,,,1763581889194273000,,,,,,,,,,,140712593457152,140712593457152,1640332,1634304,3240919660,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1942816Z","2025-11-19 19:51:29.1942816Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.UI.Immersive.dll",,,,,,,,,,1763581889194281600,,,,,,,,,,,140712595423232,140712595423232,1424120,1372160,1559948871,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1942896Z","2025-11-19 19:51:29.1942896Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.UI.Xaml.dll",,,,,,,,,,1763581889194289600,,,,,,,,,,,140712596865024,140712596865024,17882163,17858560,706442395,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1942973Z","2025-11-19 19:51:29.1942973Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.UI.dll",,,,,,,,,,1763581889194297300,,,,,,,,,,,140712615346176,140712615346176,1414164,1376256,3301850593,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1943052Z","2025-11-19 19:51:29.1943052Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\globinputhost.dll",,,,,,,,,,1763581889194305300,,,,,,,,,,,140712627863552,140712627863552,263563,208896,1786968813,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1943206Z","2025-11-19 19:51:29.1943206Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\BCP47mrm.dll",,,,,,,,,,1763581889194320600,,,,,,,,,,,140712628322304,140712628322304,278903,212992,835504572,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1943291Z","2025-11-19 19:51:29.1943291Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\TextInputFramework.dll",,,,,,,,,,1763581889194329100,,,,,,,,,,,140712628846592,140712628846592,1374424,1339392,3535451269,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1943365Z","2025-11-19 19:51:29.1943365Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\BCP47Langs.dll",,,,,,,,,,1763581889194336500,,,,,,,,,,,140712631468032,140712631468032,402331,385024,2065030180,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1943444Z","2025-11-19 19:51:29.1943444Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\MrmCoreR.dll",,,,,,,,,,1763581889194344400,,,,,,,,,,,140712631926784,140712631926784,1191374,1146880,1078870765,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1943524Z","2025-11-19 19:51:29.1943524Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\iertutil.dll",,,,,,,,,,1763581889194352400,,,,,,,,,,,140712642805760,140712642805760,2984761,2904064,3815768453,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1943595Z","2025-11-19 19:51:29.1943595Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\winmm.dll",,,,,,,,,,1763581889194359500,,,,,,,,,,,140712663842816,140712663842816,263815,217088,2106743460,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1943665Z","2025-11-19 19:51:29.1943665Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\srvcli.dll",,,,,,,,,,1763581889194366500,,,,,,,,,,,140712668954624,140712668954624,181029,167936,239922031,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1943805Z","2025-11-19 19:51:29.1943805Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\urlmon.dll",,,,,,,,,,1763581889194380600,,,,,,,,,,,140712669609984,140712669609984,1970671,1957888,260716450,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1943885Z","2025-11-19 19:51:29.1943885Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\xmllite.dll",,,,,,,,,,1763581889194388500,,,,,,,,,,,140712684027904,140712684027904,342897,274432,974526834,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1943954Z","2025-11-19 19:51:29.1943954Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\icu.dll",,,,,,,,,,1763581889194395400,,,,,,,,,,,140712684617728,140712684617728,2775448,2744320,3611555297,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1944034Z","2025-11-19 19:51:29.1944034Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,1763581889194403400,,,,,,,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1944111Z","2025-11-19 19:51:29.1944111Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.StateRepositoryClient.dll",,,,,,,,,,1763581889194411100,,,,,,,,,,,140712696610816,140712696610816,303673,290816,424989122,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1944191Z","2025-11-19 19:51:29.1944191Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.Graphics.dll",,,,,,,,,,1763581889194419100,,,,,,,,,,,140712711225344,140712711225344,669723,593920,1068018205,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1944274Z","2025-11-19 19:51:29.1944274Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\OneCoreUAPCommonProxyStub.dll",,,,,,,,,,1763581889194427400,,,,,,,,,,,140712713977856,140712713977856,6740758,6615040,2011948997,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1944428Z","2025-11-19 19:51:29.1944428Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\twinapi.appcore.dll",,,,,,,,,,1763581889194442800,,,,,,,,,,,140712720924672,140712720924672,2401519,2375680,2646458233,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1944476Z","2025-11-19 19:51:29.1944476Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\PackagedCom\OpenConsoleProxy.dll",,,,,,,,,,1763581889194447600,,,,,,,,,,,140712723349504,140712723349504,51292,53248,1759975238,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1944558Z","2025-11-19 19:51:29.1944558Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\d3d10warp.dll",,,,,,,,,,1763581889194455800,,,,,,,,,,,140712731869184,140712731869184,5958575,5943296,1147803111,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1944638Z","2025-11-19 19:51:29.1944638Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\WindowManagementAPI.dll",,,,,,,,,,1763581889194463800,,,,,,,,,,,140712738422784,140712738422784,1825044,1794048,1605274449,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1944716Z","2025-11-19 19:51:29.1944716Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\CoreUIComponents.dll",,,,,,,,,,1763581889194471600,,,,,,,,,,,140712742944768,140712742944768,3046501,3022848,801552868,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1944784Z","2025-11-19 19:51:29.1944784Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\winhttp.dll",,,,,,,,,,1763581889194478400,,,,,,,,,,,140712750350336,140712750350336,1261038,1212416,84984727,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1944867Z","2025-11-19 19:51:29.1944867Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\directxdatabasehelper.dll",,,,,,,,,,1763581889194486800,,,,,,,,,,,140712752709632,140712752709632,426573,405504,145563491,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1945018Z","2025-11-19 19:51:29.1945018Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\Microsoft.Internal.WarpPal.dll",,,,,,,,,,1763581889194501800,,,,,,,,,,,140712769683456,140712769683456,167600,102400,2132685858,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1945098Z","2025-11-19 19:51:29.1945098Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\D3DCompiler_47.dll",,,,,,,,,,1763581889194509800,,,,,,,,,,,140712769814528,140712769814528,4685395,4714496,796813953,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1945171Z","2025-11-19 19:51:29.1945171Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\WindowsCodecs.dll",,,,,,,,,,1763581889194517100,,,,,,,,,,,140712775385088,140712775385088,2352359,2293760,3466818398,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1945237Z","2025-11-19 19:51:29.1945237Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\d2d1.dll",,,,,,,,,,1763581889194523700,,,,,,,,,,,140712777744384,140712777744384,6610469,6537216,3013069957,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1945298Z","2025-11-19 19:51:29.1945298Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\DWrite.dll",,,,,,,,,,1763581889194529800,,,,,,,,,,,140712784297984,140712784297984,2543119,2519040,1462185185,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1945358Z","2025-11-19 19:51:29.1945358Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\d3d11.dll",,,,,,,,,,1763581889194535800,,,,,,,,,,,140712786853888,140712786853888,2582658,2498560,2128032819,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1945429Z","2025-11-19 19:51:29.1945429Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\dcomp.dll",,,,,,,,,,1763581889194542900,,,,,,,,,,,140712789409792,140712789409792,2309196,2240512,1200801128,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1945503Z","2025-11-19 19:51:29.1945503Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\CoreMessaging.dll",,,,,,,,,,1763581889194550300,,,,,,,,,,,140712796160000,140712796160000,1232710,1208320,2155847221,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1945607Z","2025-11-19 19:51:29.1945607Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\TerminalThemeHelpers.dll",,,,,,,,,,1763581889194560700,,,,,,,,,,,140712799895552,140712799895552,93641,61440,1754949712,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1945692Z","2025-11-19 19:51:29.1945692Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\uxtheme.dll",,,,,,,,,,1763581889194569200,,,,,,,,,,,140712802254848,140712802254848,696534,696320,1695798817,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1945761Z","2025-11-19 19:51:29.1945761Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\pfclient.dll",,,,,,,,,,1763581889194576100,,,,,,,,,,,140712803500032,140712803500032,92868,73728,3163590703,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1945827Z","2025-11-19 19:51:29.1945827Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\dxgi.dll",,,,,,,,,,1763581889194582700,,,,,,,,,,,140712803631104,140712803631104,1320096,1282048,1861212996,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1945898Z","2025-11-19 19:51:29.1945898Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\dwmapi.dll",,,,,,,,,,1763581889194589800,,,,,,,,,,,140712805072896,140712805072896,203843,196608,2709117439,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1945964Z","2025-11-19 19:51:29.1945964Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\DXCore.dll",,,,,,,,,,1763581889194596400,,,,,,,,,,,140712805400576,140712805400576,331386,274432,2354081039,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1946048Z","2025-11-19 19:51:29.1946048Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\windows.storage.dll",,,,,,,,,,1763581889194604800,,,,,,,,,,,140712812412928,140712812412928,8877403,8769536,3667346596,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1946125Z","2025-11-19 19:51:29.1946125Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\netutils.dll",,,,,,,,,,1763581889194612500,,,,,,,,,,,140712825847808,140712825847808,80696,53248,865845000,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1946274Z","2025-11-19 19:51:29.1946274Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,1763581889194627400,,,,,,,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1946350Z","2025-11-19 19:51:29.1946350Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\ntmarta.dll",,,,,,,,,,1763581889194635000,,,,,,,,,,,140712831811584,140712831811584,265798,221184,3598506564,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1946427Z","2025-11-19 19:51:29.1946427Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\cryptsp.dll",,,,,,,,,,1763581889194642700,,,,,,,,,,,140712839217152,140712839217152,146168,110592,1658328178,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1946496Z","2025-11-19 19:51:29.1946496Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\cryptbase.dll",,,,,,,,,,1763581889194649600,,,,,,,,,,,140712839348224,140712839348224,63718,49152,3897879906,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1946578Z","2025-11-19 19:51:29.1946578Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\cfgmgr32.dll",,,,,,,,,,1763581889194657800,,,,,,,,,,,140712845049856,140712845049856,385808,356352,1737777300,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1946643Z","2025-11-19 19:51:29.1946643Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\sxs.dll",,,,,,,,,,1763581889194664300,,,,,,,,,,,140712846622720,140712846622720,697955,659456,3834976666,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1946718Z","2025-11-19 19:51:29.1946718Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\umpdc.dll",,,,,,,,,,1763581889194671800,,,,,,,,,,,140712848064512,140712848064512,98535,81920,1714427184,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1946853Z","2025-11-19 19:51:29.1946853Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\powrprof.dll",,,,,,,,,,1763581889194685300,,,,,,,,,,,140712848195584,140712848195584,457799,385024,2858637235,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1946929Z","2025-11-19 19:51:29.1946929Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\bcrypt.dll",,,,,,,,,,1763581889194692900,,,,,,,,,,,140712848654336,140712848654336,206048,172032,2893678010,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1947003Z","2025-11-19 19:51:29.1947003Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\profapi.dll",,,,,,,,,,1763581889194700300,,,,,,,,,,,140712848850944,140712848850944,229548,167936,2447194521,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1947080Z","2025-11-19 19:51:29.1947080Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,1763581889194708000,,,,,,,,,,,140712851341312,140712851341312,1524912,1486848,1404855129,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1947150Z","2025-11-19 19:51:29.1947150Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,1763581889194715000,,,,,,,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1947225Z","2025-11-19 19:51:29.1947225Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581889194722500,,,,,,,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1947290Z","2025-11-19 19:51:29.1947290Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,1763581889194729100,,,,,,,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1947357Z","2025-11-19 19:51:29.1947357Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581889194735700,,,,,,,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1947496Z","2025-11-19 19:51:29.1947496Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581889194749600,,,,,,,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1947704Z","2025-11-19 19:51:29.1947704Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,1763581889194770400,,,,,,,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1947784Z","2025-11-19 19:51:29.1947784Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581889194778400,,,,,,,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1947856Z","2025-11-19 19:51:29.1947856Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,1763581889194785600,,,,,,,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1947927Z","2025-11-19 19:51:29.1947927Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\shlwapi.dll",,,,,,,,,,1763581889194792700,,,,,,,,,,,140712868839424,140712868839424,479562,421888,2142510382,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1948058Z","2025-11-19 19:51:29.1948058Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,1763581889194805800,,,,,,,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1948143Z","2025-11-19 19:51:29.1948143Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581889194814300,,,,,,,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1948213Z","2025-11-19 19:51:29.1948213Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\ole32.dll",,,,,,,,,,1763581889194821300,,,,,,,,,,,140712878473216,140712878473216,1689904,1667072,1018821057,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1948280Z","2025-11-19 19:51:29.1948280Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,1763581889194828000,,,,,,,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1948350Z","2025-11-19 19:51:29.1948350Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581889194835000,,,,,,,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1948412Z","2025-11-19 19:51:29.1948412Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,1763581889194841200,,,,,,,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1948481Z","2025-11-19 19:51:29.1948481Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,1763581889194848100,,,,,,,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1948549Z","2025-11-19 19:51:29.1948549Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,1763581889194854900,,,,,,,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1948685Z","2025-11-19 19:51:29.1948685Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,1763581889194868500,,,,,,,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1948764Z","2025-11-19 19:51:29.1948764Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,1763581889194876400,,,,,,,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1948833Z","2025-11-19 19:51:29.1948833Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\msctf.dll",,,,,,,,,,1763581889194883300,,,,,,,,,,,140712893022208,140712893022208,1455420,1433600,4155718050,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1948900Z","2025-11-19 19:51:29.1948900Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581889194890000,,,,,,,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1948967Z","2025-11-19 19:51:29.1948967Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581889194896700,,,,,,,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1949033Z","2025-11-19 19:51:29.1949033Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581889194903300,,,,,,,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1949230Z","2025-11-19 19:51:29.1949230Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"WindowsTermina",,,,,,,,,,1763581889194923100,,,,,,,,,,,,,,,,16732160,19222528,3702983350,134080554806979193,0,134080554881691430,577,0,3395,60,52,3,7,0,,,,,,,,,, -"2025-11-19 19:51:29.2994897Z","2025-11-19 19:51:29.2994897Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6220 svchost.exe",1512,,," 6220 svchost.exe",,,,,,,,,,,,,1763581889299489800,18446633084047761408,18446633084047736832,140712865112144,278,101940486144,1512,101943607296,101943574528,140712865112144,4277070,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.3321791Z","2025-11-19 19:51:29.3321791Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 8476 ServiceHub.IdentityHost.exe",,,,,,,,,,,,,1763581889332179100,18446633084047761408,18446633084047736832,140712899206080,0,843736039424,14488,843738251264,843738247168,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.3322610Z","2025-11-19 19:51:29.3322610Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1956 MSBuild.exe",,,,,,,,,,,,,1763581889332261100,18446633084055846912,18446633084055822336,140712899206080,0,641477595136,11260,641487339520,641487323136,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.3323015Z","2025-11-19 19:51:29.3323015Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 4372 vctip.exe",,,,,,,,,,,,,1763581889332301600,18446633084048019456,18446633084047994880,140712899206080,0,740355313664,12168,740362813440,740362805248,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.3323369Z","2025-11-19 19:51:29.3323369Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"12052 ServiceHub.TestWindowStoreHost.exe",,,,,,,,,,,,,1763581889332336900,18446633084017422336,18446633084017397760,140712899206080,0,17906528256,14160,17910726656,17910722560,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.3323724Z","2025-11-19 19:51:29.3323724Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,1763581889332372400,18446633084042932224,18446633084042907648,140712899206080,0,46014324736,13904,46028292096,46028275712,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.3324120Z","2025-11-19 19:51:29.3324120Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"10252 ServiceHub.IndexingService.exe",,,,,,,,,,,,,1763581889332412000,18446633084039225344,18446633084039200768,140712899206080,0,848612728832,13908,848617799680,848617795584,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.3324467Z","2025-11-19 19:51:29.3324467Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"10648 ServiceHub.Host.dotnet.x64.exe",,,,,,,,,,,,,1763581889332446700,18446633084045807616,18446633084045783040,140712899206080,0,515212726272,7132,515219914752,515219910656,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.3324957Z","2025-11-19 19:51:29.3324957Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"10200 ServiceHub.VSDetouredHost.exe",,,,,,,,,,,,,1763581889332495700,18446633084044943360,18446633084044918784,140712899206080,0,617596755968,7544,617601826816,617601822720,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.3325408Z","2025-11-19 19:51:29.3325408Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9988 Microsoft.ServiceHub.Controller.exe",,,,,,,,,,,,,1763581889332540800,18446633084046180352,18446633084046155776,140712899206080,0,1049753657344,10460,1049757745152,1049757741056,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.3325713Z","2025-11-19 19:51:29.3325713Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9280 Greenshot.exe",,,,,,,,,,,,,1763581889332571300,18446633084049481728,18446633084049457152,140712899206080,0,948118790144,1372,948122419200,948122415104,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:30.2877351Z","2025-11-19 19:51:30.2877351Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5536 svchost.exe",13504,,," 5536 svchost.exe",,,"C:\Windows\System32\aepic.dll",,,,,,,,,,1763581890287735100,,,,,,,,,,,140712428109824,140712428109824,641436,577536,321124434,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:30.2889380Z","2025-11-19 19:51:30.2889380Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5536 svchost.exe",13504,,," 5536 svchost.exe",,,"C:\Windows\System32\aepic.dll",,,,,,,,,,1763581890288938100,,,,,,,,,,,140712428109824,140712428109824,641436,589824,321124434,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:31.6121866Z","2025-11-19 19:51:31.6121866Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8972 VBoxTray.exe",9020,,," 8972 VBoxTray.exe",,,,,,,,,,,,,1763581891612186600,18446633084053868544,18446633084053843968,140700131109808,0,471284252672,11456,471286677504,471286673408,140700131109808,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:31.6124072Z","2025-11-19 19:51:31.6124072Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8972 VBoxTray.exe",11456,,," 8972 VBoxTray.exe",,,,,,,,,,,,,1763581891612407200,18446633084053868544,18446633084053843968,140700131109808,0,471284252672,11456,471286677504,471286669312,140700131109808,433403,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:32.3106101Z","2025-11-19 19:51:32.3106101Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",15084,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,1763581892310610100,18446633084039487488,18446633084039462912,140711613062896,0,1046353207296,15084,1046367698944,1046367674368,140711613062896,4399662,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:32.3106424Z","2025-11-19 19:51:32.3106424Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",12628,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,1763581892310642400,18446633084005355520,18446633084005330944,140711613062896,0,1046353223680,12628,1046388670464,1046388654080,140711613062896,853227,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:32.3427056Z","2025-11-19 19:51:32.3427056Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",11644,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,1763581892342705600,18446633084038852608,18446633084038828032,140711613062896,0,1046353231872,11644,1046392864768,1046392844288,140711613062896,653688,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:32.3427596Z","2025-11-19 19:51:32.3427596Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",14980,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,1763581892342759600,18446633084038365184,18446633084038340608,140711613062896,0,1046353215488,14980,1046371893248,1046371876864,140711613062896,958462,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:33.3438855Z","2025-11-19 19:51:33.3438855Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4832 WmiPrvSE.exe",12044,,," 4832 WmiPrvSE.exe",,,,,,,,,,,,,1763581893343885500,18446633084035751936,18446633084035727360,140712899206080,0,525413761024,12044,525414694912,525414629376,140712899206080,1823386,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:33.3438935Z","2025-11-19 19:51:33.3438935Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4832 WmiPrvSE.exe",13316,,," 4832 WmiPrvSE.exe",,,,,,,,,,,,,1763581893343893500,18446633084035637248,18446633084035612672,140712899206080,0,525413744640,13316,525411221504,525411155968,140712899206080,5525225,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +timestamp_sys,timestamp_etw,src_type,provider_name,event_id,task_info,process_id,thread_id,ppid,pid,targetpid,targettid,message,filepath,cachename,result,vname,name,sigseq,sigsha,commandline,firstparam,secondparam,stackbase,stacklimit,startaddr,subprocesstag,tebbase,threadid,timestamp_ns,userstackbase,userstacklimit,win32startaddr,cycletime,defaultbase,imagebase,imagechecksum,imagesize,timedatestamp,createtime,flags,mandatorylabel,packagefullname,packagerelativeappid,parentprocessid,parentprocesssequencenumber,processsequencenumber,processtokenelevationtype,processtokeniselevated,securitymitigations,sessionid,commitcharge,commitpeak,cpucyclecount,exitcode,exittime,handlecount,hardfaultcount,readoperationcount,readtransferkilobytes,tokenelevationtype,writeoperationcount,writetransferkilobytes"2025-11-19 22:37:11.1915649Z","2025-11-19 22:37:11.1915649Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 6096 svchost.exe",,,,,,,,,,,,,18446633084024459264,18446633084024434688,140712899206080,0,338488844288,636,1763591831191564900,338488393728,338488360960,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.1916937Z","2025-11-19 22:37:11.1916937Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9920 ServiceHub.IntellicodeModelService.exe",12960,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,18446633083978407936,18446633083978383360,140711612509856,0,46015668224,12960,1763591831191693700,46012694528,46012678144,140711612509856,862657,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.2048364Z","2025-11-19 22:37:11.2048364Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",4060,,," 5184 explorer.exe",,,,,,,,,,,,,18446633084024315904,18446633084024291328,140712899206080,0,15343616,1708,1763591831204836400,515375104,515317760,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.3509174Z","2025-11-19 22:37:11.3509174Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8984 svchost.exe",11892,,," 8984 svchost.exe",,,,,,,,,,,,,18446633084049739776,18446633084049715200,140712899206080,0,213147869184,11892,1763591831350917400,213148762112,213148729344,140712899206080,303269,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.3891653Z","2025-11-19 22:37:11.3891653Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5884 SearchProtocolHost.exe",2628,,," 5884 SearchProtocolHost.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,,,,,,,1763591831389165300,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.3901368Z","2025-11-19 22:37:11.3901368Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5884 SearchProtocolHost.exe",2628,,," 5884 SearchProtocolHost.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,,,,,,,1763591831390136800,,,,,140712869888000,140712869888000,7769948,7675904,2341846616,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.3946558Z","2025-11-19 22:37:11.3946558Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5884 SearchProtocolHost.exe",2628,,," 5884 SearchProtocolHost.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,,,,,,,1763591831394655800,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.3953496Z","2025-11-19 22:37:11.3953496Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5884 SearchProtocolHost.exe",2628,,," 5884 SearchProtocolHost.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,,,,,,,1763591831395349600,,,,,140712869888000,140712869888000,7769948,7675904,2341846616,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.5426966Z","2025-11-19 22:37:11.5426966Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"11648 RuntimeBroker.exe",,,,,,,,,,,,,18446633084049739776,18446633084049715200,140712899206080,0,503394197504,7460,1763591831542696600,503396696064,503396646912,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.6406757Z","2025-11-19 22:37:11.6406757Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8972 VBoxTray.exe",9020,,," 8972 VBoxTray.exe",,,,,,,,,,,,,18446633084024516608,18446633084024492032,140700131109808,0,471283179520,1480,1763591831640675700,471299260416,471299256320,140700131109808,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.6409261Z","2025-11-19 22:37:11.6409261Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8972 VBoxTray.exe",1480,,," 8972 VBoxTray.exe",,,,,,,,,,,,,18446633084024516608,18446633084024492032,140700131109808,0,471283179520,1480,1763591831640926100,471299260416,471299252224,140700131109808,560897,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.792165000Z","2025-11-19 22:37:11.7170068Z","myETW","EDRi-Provider",4242,"EDRiTask"," 7508 EDRi.exe",,,,,,"++ EDRi START MARKER ++",,,,,,,,,,,,,,,,,1763591831717006800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.7170149Z","2025-11-19 22:37:11.7170149Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9832 svchost.exe",11208,,," 9832 svchost.exe",,,,,,,,,,,,,18446633084050743296,18446633084050718720,140712899206080,0,234794704896,11208,1763591831717014900,234792878080,234792845312,140712899206080,383989,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.9502056Z","2025-11-19 22:37:11.9502056Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",2956,,," 5184 explorer.exe",,,,,,,,,,,,,18446633084024545280,18446633084024520704,140712899206080,0,15351808,13348,1763591831950205600,515899392,515842048,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:12.2126523Z","2025-11-19 22:37:12.2126523Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 9692 PerfWatson2.exe",12736,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084023541760,18446633084023517184,140711613062896,0,1046354399232,11240,1763591832212652300,1046413836288,1046413819904,140711613062896,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:12.3065571Z","2025-11-19 22:37:12.3065571Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","11904 msedgewebview2.exe",8860,,,"11904 msedgewebview2.exe",,,,,,,,,,,,,18446633083980414976,18446633083980390400,140712899206080,0,667618459648,8860,1763591832306557100,665728319488,665728315392,140712899206080,357587,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:12.3133629Z","2025-11-19 22:37:12.3133629Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 9692 PerfWatson2.exe",12616,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084024401920,18446633084024377344,140711613062896,0,1046354407424,11288,1763591832313362900,1046418030592,1046418014208,140711613062896,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:12.3544946Z","2025-11-19 22:37:12.3544946Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9324 msedgewebview2.exe",4216,,," 9324 msedgewebview2.exe",,,,,,,,,,,,,18446633083980595200,18446633083980570624,140712899206080,0,717037178880,4216,1763591832354494600,717054017536,717054013440,140712899206080,351927,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:12.3545599Z","2025-11-19 22:37:12.3545599Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 8984 svchost.exe",,,,,,,,,,,,,18446633084024057856,18446633084024033280,140712899206080,0,213147877376,276,1763591832354559900,213148762112,213148729344,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:12.5148249Z","2025-11-19 22:37:12.5148249Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9388 devenv.exe",12204,,," 9388 devenv.exe",,,,,,,,,,,,,18446633083985420288,18446633083985395712,140711613062896,0,1033377087488,12204,1763591832514824900,1033415163904,1033415143424,140711613062896,125044070,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:12.7208620Z","2025-11-19 22:37:12.7208620Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9832 svchost.exe",,,,,,,,,,,,,18446633083980414976,18446633083980390400,140712899206080,0,234794721280,11672,1763591832720862100,234792878080,234792845312,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:12.9904828Z","2025-11-19 22:37:12.9904828Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 7884 msedgewebview2.exe",5984,,," 7884 msedgewebview2.exe",,,,,,,,,,,,,18446633083980652544,18446633083980627968,140712899206080,0,139211661312,5984,1763591832990482800,139246698496,139246694400,140712899206080,266303,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:12.9904834Z","2025-11-19 22:37:12.9904834Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 7956 msedgewebview2.exe",504,,," 7956 msedgewebview2.exe",,,,,,,,,,,,,18446633084048707584,18446633084048683008,140712899206080,0,334435393536,504,1763591832990483400,334462189568,334462181376,140712899206080,245557,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.2297646Z","2025-11-19 22:37:13.2297646Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",2776,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084047761408,18446633084047736832,140711612509856,0,1046354391040,2776,1763591833229764600,1046352232448,1046352216064,140711612509856,1727953,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.2614302Z","2025-11-19 22:37:13.2614302Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13084 MSBuild.exe",2512,,,"13084 MSBuild.exe",,,,,,,,,,,,,18446633084004839424,18446633084004814848,140711613062896,0,911121752064,2512,1763591833261430200,911223029760,911223013376,140711613062896,1215338,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.2614809Z","2025-11-19 22:37:13.2614809Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13084 MSBuild.exe",12292,,,"13084 MSBuild.exe",,,,,,,,,,,,,18446633084004552704,18446633084004528128,140711613062896,0,911121727488,12292,1763591833261480900,911210446848,911210430464,140711613062896,2454817,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3089749Z","2025-11-19 22:37:13.3089749Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13084 MSBuild.exe",1488,,,"13084 MSBuild.exe",,,,,,,,,,,,,18446633084004638720,18446633084004614144,140711613062896,0,911121735680,1488,1763591833308974900,911214641152,911214624768,140711613062896,3342749,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3090104Z","2025-11-19 22:37:13.3090104Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13084 MSBuild.exe",14060,,,"13084 MSBuild.exe",,,,,,,,,,,,,18446633084004495360,18446633084004470784,140711613062896,0,911121719296,14060,1763591833309010400,911206252544,911206236160,140711613062896,2587216,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3090477Z","2025-11-19 22:37:13.3090477Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13084 MSBuild.exe",12864,,,"13084 MSBuild.exe",,,,,,,,,,,,,18446633084003921920,18446633084003897344,140711613062896,0,911121661952,12864,1763591833309047700,911176892416,911176876032,140711613062896,7149828,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3090782Z","2025-11-19 22:37:13.3090782Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"11904 msedgewebview2.exe",,,,,,,,,,,,,18446633084004552704,18446633084004528128,140712899206080,0,667618467840,7748,1763591833309078300,665728319488,665728315392,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3091086Z","2025-11-19 22:37:13.3091086Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13084 MSBuild.exe",9556,,,"13084 MSBuild.exe",,,,,,,,,,,,,18446633084004810752,18446633084004786176,140711613062896,0,911121743872,9556,1763591833309108600,911218835456,911218819072,140711613062896,1270411,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3091215Z","2025-11-19 22:37:13.3091215Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13084 MSBuild.exe",4244,,,"13084 MSBuild.exe",,,,,,,,,,,,,18446633084003979264,18446633084003954688,140711613062896,0,911121670144,4244,1763591833309121500,911181086720,911181066240,140711613062896,4226150,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3091312Z","2025-11-19 22:37:13.3091312Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","10648 ServiceHub.Host.dotnet.x64.exe",9652,,,"10648 ServiceHub.Host.dotnet.x64.exe",,,,,,,,,,,,,18446633083986194432,18446633083986169856,140711121663952,0,515211550720,9652,1763591833309131200,515230924800,515230879744,140711121663952,150560519,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3091350Z","2025-11-19 22:37:13.3091350Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13084 MSBuild.exe",13796,,,"13084 MSBuild.exe",,,,,,,,,,,,,18446633084004380672,18446633084004356096,140711613062896,0,911121711104,13796,1763591833309135000,911202058240,911202041856,140711613062896,3047023,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3091895Z","2025-11-19 22:37:13.3091895Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","10252 ServiceHub.IndexingService.exe",2196,,,"10252 ServiceHub.IndexingService.exe",,,,,,,,,,,,,18446633083984613376,18446633083984588800,140711121663952,0,848613646336,2196,1763591833309189500,848619372544,848619352064,140711121663952,39058301,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3092519Z","2025-11-19 22:37:13.3092519Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","10252 ServiceHub.IndexingService.exe",12808,,,"10252 ServiceHub.IndexingService.exe",,,,,,,,,,,,,18446633083985076224,18446633083985051648,140711121663952,0,848613662720,12808,1763591833309251900,848627761152,848627744768,140711121663952,23238547,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3093391Z","2025-11-19 22:37:13.3093391Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","10252 ServiceHub.IndexingService.exe",3892,,,"10252 ServiceHub.IndexingService.exe",,,,,,,,,,,,,18446633083986423808,18446633083986399232,140711121663952,0,848613687296,3892,1763591833309339100,848635625472,848635600896,140711121663952,49327209,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3567871Z","2025-11-19 22:37:13.3567871Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9324 msedgewebview2.exe",,,,,,,,,,,,,18446633084004638720,18446633084004614144,140712899206080,0,717037187072,8800,1763591833356787100,717054017536,717054013440,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.7697452Z","2025-11-19 22:37:13.7697452Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8268 svchost.exe",7544,,," 8268 svchost.exe",,,,,,,,,,,,,18446633084022276096,18446633084022251520,140712899206080,0,178507522048,7544,1763591833769745200,178510102528,178510069760,140712899206080,191618,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.9920204Z","2025-11-19 22:37:13.9920204Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 7884 msedgewebview2.exe",,,,,,,,,,,,,18446633083985420288,18446633083985395712,140712899206080,0,139211669504,5744,1763591833992020400,139246698496,139246694400,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.9921417Z","2025-11-19 22:37:13.9921417Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 7956 msedgewebview2.exe",,,,,,,,,,,,,18446633084025638912,18446633084025614336,140712899206080,0,334435401728,12716,1763591833992141700,334462189568,334462185472,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:14.0077231Z","2025-11-19 22:37:14.0077231Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5884 SearchProtocolHost.exe",14676,,," 5884 SearchProtocolHost.exe",,,,,,,,,,,,,18446633084009955328,18446633084009930752,140712899206080,0,100230639616,14676,1763591834007723100,100232331264,100232298496,140712899206080,4036415,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:14.0077232Z","2025-11-19 22:37:14.0077232Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5884 SearchProtocolHost.exe",8420,,," 5884 SearchProtocolHost.exe",,,,,,,,,,,,,18446633084010127360,18446633084010102784,140712899206080,0,100230647808,8420,1763591834007723200,100232855552,100232822784,140712899206080,1875060,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:14.0077273Z","2025-11-19 22:37:14.0077273Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5884 SearchProtocolHost.exe",7836,,," 5884 SearchProtocolHost.exe",,,,,,,,,,,,,18446633083987718144,18446633083987693568,140712899206080,0,100230656000,7836,1763591834007727300,100233379840,100233347072,140712899206080,74308,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:14.7714898Z","2025-11-19 22:37:14.7714898Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8916 SecurityHealthService.exe",2640,,," 8916 SecurityHealthService.exe",,,,,,,,,,,,,18446633083981217792,18446633083981193216,140712899206080,0,33814335488,2640,1763591834771489900,33812054016,33812045824,140712899206080,256119,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:14.7715058Z","2025-11-19 22:37:14.7715058Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 8268 svchost.exe",,,,,,,,,,,,,18446633084010127360,18446633084010102784,140712899206080,0,178507530240,4892,1763591834771505800,178510102528,178510069760,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:15.2004649Z","2025-11-19 22:37:15.2004649Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 700 lsass.exe",3660,,," 700 lsass.exe",,,,,,,,,,,,,18446633084010872832,18446633084010848256,140712850417280,0,81706889216,3660,1763591835200464900,81709760512,81709740032,140712850417280,513746,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:16.175848500Z","2025-11-19 22:37:15.7424568Z","myETW","EDRi-Provider",4242,"EDRiTask"," 7508 EDRi.exe",,,,,,"Before decrypting the attack exe from C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\attacks\Injector-standard.exe.enc",,,,,,,,,,,,,,,,,1763591835742456800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:16.182157400Z","2025-11-19 22:37:15.7482493Z","myETW","EDRi-Provider",4242,"EDRiTask"," 7508 EDRi.exe",,,,,,"After decrypting the attack exe",,,,,,,,,,,,,,,,,1763591835748249300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:15.7731036Z","2025-11-19 22:37:15.7731036Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 8916 SecurityHealthService.exe",,,,,,,,,,,,,18446633083980652544,18446633083980627968,140712899206080,0,33814343680,12872,1763591835773103700,33812054016,33812045824,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:16.1094589Z","2025-11-19 22:37:16.1094589Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 9692 PerfWatson2.exe",9752,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084025667584,18446633084025643008,140711612509856,0,1046354415616,1060,1763591836109458900,1046352232448,1046352216064,140711612509856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:16.6517984Z","2025-11-19 22:37:16.6517984Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8972 VBoxTray.exe",9020,,," 8972 VBoxTray.exe",,,,,,,,,,,,,18446633084025724928,18446633084025700352,140700131109808,0,471283187712,6728,1763591836651798400,471299260416,471299256320,140700131109808,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:16.6520139Z","2025-11-19 22:37:16.6520139Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8972 VBoxTray.exe",6728,,," 8972 VBoxTray.exe",,,,,,,,,,,,,18446633084025724928,18446633084025700352,140700131109808,0,471283187712,6728,1763591836652013900,471299260416,471299252224,140700131109808,456412,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:17.282796100Z","2025-11-19 22:37:16.7589463Z","myETW","EDRi-Provider",4242,"EDRiTask"," 7508 EDRi.exe",,,,,,"Before starting the attack exe",,,,,,,,,,,,,,,,,1763591836758946300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:17.4750774Z","2025-11-19 22:37:17.4750774Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1520 powershell.exe",2068,,," 1520 powershell.exe",,,,,,,,,,,,,18446633084010586112,18446633084010561536,140711613062896,0,931707432960,2068,1763591837475077400,931708534784,931708522496,140711613062896,2147777,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:17.4751035Z","2025-11-19 22:37:17.4751035Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1520 powershell.exe",13452,,," 1520 powershell.exe",,,,,,,,,,,,,18446633084010672128,18446633084010647552,140711613062896,0,931707449344,13452,1763591837475103500,931709059072,931709046784,140711613062896,1240989,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:17.4751539Z","2025-11-19 22:37:17.4751539Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1520 powershell.exe",7756,,," 1520 powershell.exe",,,,,,,,,,,,,18446633084000100352,18446633084000075776,140711613062896,0,931707490304,7756,1763591837475153900,931710107648,931710091264,140711613062896,1639311,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:17.4752016Z","2025-11-19 22:37:17.4752016Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1520 powershell.exe",9588,,," 1520 powershell.exe",,,,,,,,,,,,,18446633083999985664,18446633083999961088,140711613062896,0,931707482112,9588,1763591837475201600,931709583360,931709571072,140711613062896,1332647,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:17.6179244Z","2025-11-19 22:37:17.6179244Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",1060,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084025667584,18446633084025643008,140711612509856,0,1046354415616,1060,1763591837617924400,1046352232448,1046352216064,140711612509856,1229672,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:18.1080912Z","2025-11-19 22:37:18.1080912Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2376 svchost.exe",10840,,," 2376 svchost.exe",,,,,,,,,,,,,18446633084000100352,18446633084000075776,140712899206080,0,36399751168,5764,1763591838108091200,36401315840,36401283072,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:18.1082195Z","2025-11-19 22:37:18.1082195Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2376 svchost.exe",5764,,," 2376 svchost.exe",,,,,,,,,,,,,18446633084010586112,18446633084010561536,140712899206080,248,36399759360,7176,1763591838108219500,36401840128,36401807360,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:18.1091428Z","2025-11-19 22:37:18.1091428Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2932 svchost.exe",6236,,," 2932 svchost.exe",,,,,,,,,,,,,18446633084026470400,18446633084026445824,140712899206080,49,212462006272,4884,1763591838109142800,212464566272,212464500736,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:18.1100127Z","2025-11-19 22:37:18.1100127Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2376 svchost.exe",5764,,," 2376 svchost.exe",,,,,,,,,,,,,18446633084026499072,18446633084026474496,140712899206080,248,36399767552,3700,1763591838110012700,36402364416,36402331648,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:18.1100995Z","2025-11-19 22:37:18.1100995Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2376 svchost.exe",3700,,," 2376 svchost.exe",,,,,,,,,,,,,18446633084026585088,18446633084026560512,140712899206080,0,36399775744,8648,1763591838110099500,36402888704,36402855936,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:18.1101842Z","2025-11-19 22:37:18.1101842Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2376 svchost.exe",8648,,," 2376 svchost.exe",,,,,,,,,,,,,18446633084026613760,18446633084026589184,140712899206080,0,36399783936,12324,1763591838110184200,36403412992,36403380224,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:18.1102113Z","2025-11-19 22:37:18.1102113Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2080 svchost.exe",11748,,," 2080 svchost.exe",,,,,,,,,,,,,18446633084026675200,18446633084026650624,140712899206080,57,246078193664,4500,1763591838110211300,246081912832,246081880064,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:18.8842832Z","2025-11-19 22:37:18.8842832Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3540 svchost.exe",1372,,," 3540 svchost.exe",,,,,,,,,,,,,18446633084056907776,18446633084056883200,140711742624160,249,589657747456,1372,1763591838884283200,589660946432,589660913664,140711742624160,10493143486,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:18.8843028Z","2025-11-19 22:37:18.8843028Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3540 svchost.exe",2056,,," 3540 svchost.exe",,,,,,,,,,,,,18446633084013084672,18446633084013060096,140711742624160,249,589657755648,2056,1763591838884302800,589661470720,589661437952,140711742624160,413754083,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:18.9486568Z","2025-11-19 22:37:18.9486568Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8448 OneDrive.exe",14752,,," 8448 OneDrive.exe",,,,,,,,,,,,,18446633083984125952,18446633083984101376,140712859481984,0,70346272768,14752,1763591838948656800,70353158144,70353149952,140712859481984,764961,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:19.6822614Z","2025-11-19 22:37:19.6822614Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 9920 ServiceHub.IntellicodeModelService.exe",9760,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,18446633084027449344,18446633084027424768,140711612509856,0,46015676416,4196,1763591839682261400,46012694528,46012678144,140711612509856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:19.8417299Z","2025-11-19 22:37:19.8417299Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","10648 ServiceHub.Host.dotnet.x64.exe",7644,,,"10648 ServiceHub.Host.dotnet.x64.exe",,,,,,,,,,,,,18446633083985477632,18446633083985453056,140711121663952,0,515211534336,7644,1763591839841729900,515226206208,515226185728,140711121663952,242289127,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:19.8417852Z","2025-11-19 22:37:19.8417852Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","10648 ServiceHub.Host.dotnet.x64.exe",13156,,,"10648 ServiceHub.Host.dotnet.x64.exe",,,,,,,,,,,,,18446633084058513408,18446633084058488832,140711121663952,0,515213594624,13156,1763591839841785200,515234070528,515234017280,140711121663952,314582142,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.0924127Z","2025-11-19 22:37:20.0924127Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",5020,,," 5184 explorer.exe",,,,,,,,,,,,,18446633084027592704,18446633084027568128,140712891545280,0,15360000,15136,1763591840092412700,470351872,470294528,140712891545280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1091605Z","2025-11-19 22:37:20.1091605Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1040 svchost.exe",4480,,,"13388 smartscreen.exe",,,"C:\Windows\System32\smartscreen.exe",,,,,,,,,,,,,,,,1763591840109160500,,,,,,,664452,,419447766,134080654409311255,0,"0x","","",1040,13,6623,3,0,0,1,,,,,,,,,,,, +"2025-11-19 22:37:20.1098332Z","2025-11-19 22:37:20.1098332Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",4480,,,"13388 smartscreen.exe",,,,,,,,,,,,,18446633083984125952,18446633083984101376,140696524147856,40,184868757504,12744,1763591840109833200,184867422208,184867414016,140696524147856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1113626Z","2025-11-19 22:37:20.1113626Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\smartscreen.exe",,,,,,,,,,,,,,,,1763591840111362600,,,,,140696524029952,140696524029952,664452,614400,419447766,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1113736Z","2025-11-19 22:37:20.1113736Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591840111373600,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1148161Z","2025-11-19 22:37:20.1148161Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591840114816100,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1149453Z","2025-11-19 22:37:20.1149453Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591840114945300,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1160739Z","2025-11-19 22:37:20.1160739Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591840116073900,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1161632Z","2025-11-19 22:37:20.1161632Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,,,,,,,,,,,18446633084027420672,18446633084027396096,140712899206080,0,184868765696,7684,1763591840116163200,184867946496,184867938304,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1162258Z","2025-11-19 22:37:20.1162258Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,,,,,,,1763591840116225800,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1163609Z","2025-11-19 22:37:20.1163609Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591840116360900,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1164719Z","2025-11-19 22:37:20.1164719Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,,,,,,,,,,,18446633084058513408,18446633084058488832,140712899206080,0,184868773888,3956,1763591840116471900,184870764544,184870756352,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1165504Z","2025-11-19 22:37:20.1165504Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,,,,,,,,,,,18446633083985477632,18446633083985453056,140712899206080,0,184868782080,11600,1763591840116550400,184871288832,184871280640,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1165516Z","2025-11-19 22:37:20.1165516Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,,,,,,,1763591840116551600,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1167496Z","2025-11-19 22:37:20.1167496Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591840116749600,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1169151Z","2025-11-19 22:37:20.1169151Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591840116915100,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1170578Z","2025-11-19 22:37:20.1170578Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,"C:\Windows\System32\smartscreen.dll",,,,,,,,,,,,,,,,1763591840117057800,,,,,140711778385920,140711778385920,6028386,6057984,1751620389,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1170667Z","2025-11-19 22:37:20.1170667Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591840117066700,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1172650Z","2025-11-19 22:37:20.1172650Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591840117265000,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1172844Z","2025-11-19 22:37:20.1172844Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591840117284400,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1174617Z","2025-11-19 22:37:20.1174617Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",7684,,,"13388 smartscreen.exe",,,"C:\Windows\System32\winhttp.dll",,,,,,,,,,,,,,,,1763591840117461700,,,,,140712750350336,140712750350336,1261038,1212416,84984727,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1174902Z","2025-11-19 22:37:20.1174902Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591840117490200,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1175715Z","2025-11-19 22:37:20.1175715Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591840117571500,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1177224Z","2025-11-19 22:37:20.1177224Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",7684,,,"13388 smartscreen.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591840117722400,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1177989Z","2025-11-19 22:37:20.1177989Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591840117798900,,,,,2261897052160,2261897052160,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1178688Z","2025-11-19 22:37:20.1178688Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\crypt32.dll",,,,,,,,,,,,,,,,1763591840117868800,,,,,140712849768448,140712849768448,1584869,1536000,3438168074,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1178750Z","2025-11-19 22:37:20.1178750Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591840117875000,,,,,2261897052160,2261897052160,716301,692224,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1180529Z","2025-11-19 22:37:20.1180529Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,"C:\Windows\System32\ws2_32.dll",,,,,,,,,,,,,,,,1763591840118052900,,,,,140712881094656,140712881094656,513405,475136,3967481067,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1180716Z","2025-11-19 22:37:20.1180716Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,,,,,,,1763591840118071600,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1183282Z","2025-11-19 22:37:20.1183282Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",7684,,,"13388 smartscreen.exe",,,"C:\Windows\System32\cryptsp.dll",,,,,,,,,,,,,,,,1763591840118328200,,,,,140712839217152,140712839217152,146168,110592,1658328178,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1184654Z","2025-11-19 22:37:20.1184654Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,,,,,,,1763591840118465400,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1186873Z","2025-11-19 22:37:20.1186873Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",7684,,,"13388 smartscreen.exe",,,"C:\Windows\System32\dnsapi.dll",,,,,,,,,,,,,,,,1763591840118687300,,,,,140712824274944,140712824274944,1293169,1228800,1381219389,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1187105Z","2025-11-19 22:37:20.1187105Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,,,,,,,1763591840118710500,,,,,140712851341312,140712851341312,1524912,1486848,1404855129,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1189211Z","2025-11-19 22:37:20.1189211Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,"C:\Windows\System32\wintrust.dll",,,,,,,,,,,,,,,,1763591840118921100,,,,,140712860844032,140712860844032,590783,520192,452262045,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1190908Z","2025-11-19 22:37:20.1190908Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",11600,,,"13388 smartscreen.exe",,,"C:\Windows\System32\IPHLPAPI.DLL",,,,,,,,,,,,,,,,1763591840119090800,,,,,140712824012800,140712824012800,233044,212992,945822897,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1191038Z","2025-11-19 22:37:20.1191038Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,"C:\Windows\System32\ole32.dll",,,,,,,,,,,,,,,,1763591840119103800,,,,,140712878473216,140712878473216,1689904,1667072,1018821057,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1211887Z","2025-11-19 22:37:20.1211887Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\nsi.dll",,,,,,,,,,,,,,,,1763591840121188700,,,,,140712892956672,140712892956672,111648,40960,4223476491,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1217296Z","2025-11-19 22:37:20.1217296Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,,,,,,,1763591840121729600,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1234427Z","2025-11-19 22:37:20.1234427Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\msasn1.dll",,,,,,,,,,,,,,,,1763591840123442700,,,,,140712839675904,140712839675904,150871,77824,2536054058,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1241762Z","2025-11-19 22:37:20.1241762Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,,,,,,,,,,,18446633084027277312,18446633084027252736,140711782212992,0,184868790272,3760,1763591840124176200,184871813120,184871804928,140711782212992,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1244097Z","2025-11-19 22:37:20.1244097Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",3760,,,"13388 smartscreen.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591840124409700,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1247167Z","2025-11-19 22:37:20.1247167Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,,,,,,,1763591840124716700,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1250862Z","2025-11-19 22:37:20.1250862Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"13388 smartscreen.exe",,,,,,,,,,,,,18446633084027650048,18446633084027625472,140712899206080,0,184868798464,14596,1763591840125086200,184872337408,184872329216,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1253125Z","2025-11-19 22:37:20.1253125Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",14596,,,"13388 smartscreen.exe",,,"C:\Windows\System32\wtdsensor.dll",,,,,,,,,,,,,,,,1763591840125312500,,,,,140712681996288,140712681996288,56489,45056,4237415889,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1267405Z","2025-11-19 22:37:20.1267405Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,,,,,,,1763591840126740500,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1275908Z","2025-11-19 22:37:20.1275908Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,,,,,,,,,,,18446633084013084672,18446633084013060096,140712865112144,0,184868806656,13360,1763591840127590800,184872861696,184872853504,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1278602Z","2025-11-19 22:37:20.1278602Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13388 smartscreen.exe",14596,,,"13388 smartscreen.exe",,,,,,,,,,,,,18446633084027764736,18446633084027740160,140712899206080,0,184868814848,6860,1763591840127860200,184873385984,184873377792,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1303812Z","2025-11-19 22:37:20.1303812Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",14596,,,"13388 smartscreen.exe",,,"C:\Windows\System32\smartscreenps.dll",,,,,,,,,,,,,,,,1763591840130381200,,,,,140712623865856,140712623865856,151429,122880,4089359051,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1319012Z","2025-11-19 22:37:20.1319012Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",14596,,,"13388 smartscreen.exe",,,"C:\Windows\System32\Windows.Management.Workplace.dll",,,,,,,,,,,,,,,,1763591840131901200,,,,,140712429879296,140712429879296,215437,204800,170946563,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1326328Z","2025-11-19 22:37:20.1326328Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",14596,,,"13388 smartscreen.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591840132632800,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1331654Z","2025-11-19 22:37:20.1331654Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13388 smartscreen.exe",14596,,,"13388 smartscreen.exe",,,,,,,,,,,,,18446633084027478016,18446633084027453440,140711782212992,0,184868823040,11928,1763591840133165400,184873910272,184873902080,140711782212992,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1334794Z","2025-11-19 22:37:20.1334794Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13388 smartscreen.exe",6860,,,"13388 smartscreen.exe",,,,,,,,,,,,,18446633084027736064,18446633084027711488,140712899206080,0,184868831232,8216,1763591840133479400,184874434560,184874426368,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1761396Z","2025-11-19 22:37:20.1761396Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 5184 explorer.exe",15136,,," 5604 attack-890.exe",,,"C:\Users\Public\Downloads\attack-890.exe",,,,,,,,,,,,,,,,1763591840176139600,,,,,,,0,,1763491559,134080654410040405,0,"0x","","",5184,140,6624,3,0,0,1,,,,,,,,,,,, +"2025-11-19 22:37:20.1789263Z","2025-11-19 22:37:20.1789263Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",15136,,," 5604 attack-890.exe",,,,,,,,,,,,,18446633084027822080,18446633084027797504,140695618865008,0,867488051200,3452,1763591840178926300,867486007296,867486003200,140695618865008,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1817085Z","2025-11-19 22:37:20.1817085Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5536 svchost.exe",13256,,," 5536 svchost.exe",,,,,,,,,,,,,18446633084027908096,18446633084027883520,140712899206080,132,151912210432,14100,1763591840181708500,151915593728,151915560960,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1842611Z","2025-11-19 22:37:20.1842611Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5536 svchost.exe",13256,,," 5536 svchost.exe",,,"C:\Windows\System32\pcadm.dll",,,,,,,,,,,,,,,,1763591840184261100,,,,,140712537882624,140712537882624,249405,204800,3376468140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1844108Z","2025-11-19 22:37:20.1844108Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5536 svchost.exe",13256,,," 5536 svchost.exe",,,,,,,,,,,,,18446633084027879424,18446633084027854848,140712899206080,132,151912218624,2184,1763591840184410800,151916118016,151916085248,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1844961Z","2025-11-19 22:37:20.1844961Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5536 svchost.exe",2184,,," 5536 svchost.exe",,,,,,,,,,,,,18446633084027994112,18446633084027969536,140712899206080,0,151912226816,9180,1763591840184496100,151920836608,151920803840,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1845349Z","2025-11-19 22:37:20.1845349Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5536 svchost.exe",3884,,," 5536 svchost.exe",,,"C:\Windows\System32\wdi.dll",,,,,,,,,,,,,,,,1763591840184534900,,,,,140712669413376,140712669413376,172159,126976,589396027,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1846510Z","2025-11-19 22:37:20.1846510Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5536 svchost.exe",13256,,," 5536 svchost.exe",,,"C:\Windows\System32\pcacli.dll",,,,,,,,,,,,,,,,1763591840184651000,,,,,140712543977472,140712543977472,146563,102400,3048676746,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1847940Z","2025-11-19 22:37:20.1847940Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5536 svchost.exe",2184,,," 5536 svchost.exe",,,"C:\Windows\System32\aepic.dll",,,,,,,,,,,,,,,,1763591840184794000,,,,,140712428109824,140712428109824,641436,577536,321124434,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1850214Z","2025-11-19 22:37:20.1850214Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5536 svchost.exe",3884,,," 5536 svchost.exe",,,"C:\Windows\System32\mpr.dll",,,,,,,,,,,,,,,,1763591840185021400,,,,,140712737832960,140712737832960,203967,135168,2433114060,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1884155Z","2025-11-19 22:37:20.1884155Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5536 svchost.exe",13256,,," 5536 svchost.exe",,,"C:\Windows\System32\wdi.dll",,,,,,,,,,,,,,,,1763591840188415500,,,,,140712669413376,140712669413376,172159,139264,589396027,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1884903Z","2025-11-19 22:37:20.1884903Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5536 svchost.exe",13256,,," 5536 svchost.exe",,,"C:\Windows\System32\mpr.dll",,,,,,,,,,,,,,,,1763591840188490300,,,,,140712737832960,140712737832960,203967,147456,2433114060,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1885390Z","2025-11-19 22:37:20.1885390Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5536 svchost.exe",13256,,," 5536 svchost.exe",,,"C:\Windows\System32\pcacli.dll",,,,,,,,,,,,,,,,1763591840188539000,,,,,140712543977472,140712543977472,146563,114688,3048676746,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1886532Z","2025-11-19 22:37:20.1886532Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5536 svchost.exe",13256,,," 5536 svchost.exe",,,"C:\Windows\System32\aepic.dll",,,,,,,,,,,,,,,,1763591840188653200,,,,,140712428109824,140712428109824,641436,589824,321124434,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1887053Z","2025-11-19 22:37:20.1887053Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5536 svchost.exe",13256,,," 5536 svchost.exe",,,"C:\Windows\System32\pcadm.dll",,,,,,,,,,,,,,,,1763591840188705300,,,,,140712537882624,140712537882624,249405,217088,3376468140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1893585Z","2025-11-19 22:37:20.1893585Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Users\Public\Downloads\attack-890.exe",,,,,,,,,,,,,,,,1763591840189358600,,,,,140695618846720,140695618846720,0,53248,1763491559,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1893886Z","2025-11-19 22:37:20.1893886Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591840189388600,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1901610Z","2025-11-19 22:37:20.1901610Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591840190161000,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1902585Z","2025-11-19 22:37:20.1902585Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591840190258500,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1912674Z","2025-11-19 22:37:20.1912674Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 5604 attack-890.exe",3452,,,"13300 conhost.exe",,,"C:\Windows\System32\conhost.exe",,,,,,,,,,,,,,,,1763591840191267400,,,,,,,1035098,,2671108986,134080654410205145,0,"0x","","",5604,6624,6625,3,0,0,1,,,,,,,,,,,, +"2025-11-19 22:37:20.1924430Z","2025-11-19 22:37:20.1924430Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5604 attack-890.exe",3452,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084027535360,18446633084027510784,140696384751904,0,689119371264,4616,1763591840192443000,689120477184,689120468992,140696384751904,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1925113Z","2025-11-19 22:37:20.1925113Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",4616,,,"13300 conhost.exe",,,"C:\Windows\System32\conhost.exe",,,,,,,,,,,,,,,,1763591840192511300,,,,,140696384438272,140696384438272,1035098,1028096,2671108986,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1925439Z","2025-11-19 22:37:20.1925439Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",4616,,,"13300 conhost.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591840192543900,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1931167Z","2025-11-19 22:37:20.1931167Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",4616,,,"13300 conhost.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591840193116700,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1932481Z","2025-11-19 22:37:20.1932481Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",4616,,,"13300 conhost.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591840193248100,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1945040Z","2025-11-19 22:37:20.1945040Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",4616,,,"13300 conhost.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591840194504000,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1946398Z","2025-11-19 22:37:20.1946398Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",4616,,,"13300 conhost.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591840194639800,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1947313Z","2025-11-19 22:37:20.1947313Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13300 conhost.exe",4616,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028108800,18446633084028084224,140712899206080,0,689119379456,12308,1763591840194731300,689121001472,689120993280,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1948066Z","2025-11-19 22:37:20.1948066Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13300 conhost.exe",12308,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028137472,18446633084028112896,140712899206080,0,689119387648,3500,1763591840194806600,689121525760,689121517568,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1955230Z","2025-11-19 22:37:20.1955230Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",4616,,,"13300 conhost.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591840195523000,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1956281Z","2025-11-19 22:37:20.1956281Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",4616,,,"13300 conhost.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591840195628100,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1957266Z","2025-11-19 22:37:20.1957266Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",4616,,,"13300 conhost.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591840195726600,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1958833Z","2025-11-19 22:37:20.1958833Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",4616,,,"13300 conhost.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591840195883300,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1964362Z","2025-11-19 22:37:20.1964362Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",4616,,,"13300 conhost.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591840196436200,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1965271Z","2025-11-19 22:37:20.1965271Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",4616,,,"13300 conhost.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591840196527100,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1966343Z","2025-11-19 22:37:20.1966343Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",4616,,,"13300 conhost.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591840196634300,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1967289Z","2025-11-19 22:37:20.1967289Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",4616,,,"13300 conhost.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591840196729000,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1972874Z","2025-11-19 22:37:20.1972874Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",4616,,,"13300 conhost.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,,,,,,,1763591840197287400,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1989205Z","2025-11-19 22:37:20.1989205Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13300 conhost.exe",4616,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028252160,18446633084028227584,140696384580832,0,689119395840,6452,1763591840198920500,689122050048,689122041856,140696384580832,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1990028Z","2025-11-19 22:37:20.1990028Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13300 conhost.exe",3500,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028137472,18446633084028112896,140712899206080,0,689119387648,3500,1763591840199002800,689121525760,689121517568,140712899206080,1810182,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1990139Z","2025-11-19 22:37:20.1990139Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13300 conhost.exe",12308,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028108800,18446633084028084224,140712899206080,0,689119379456,12308,1763591840199013900,689121001472,689120993280,140712899206080,569572,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1991188Z","2025-11-19 22:37:20.1991188Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13300 conhost.exe",4616,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084027535360,18446633084027510784,140696384751904,0,689119371264,4616,1763591840199118900,689120477184,689120460800,140696384751904,22444533,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1991908Z","2025-11-19 22:37:20.1991908Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",6452,,,"13300 conhost.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,,,,,,,1763591840199190800,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1994019Z","2025-11-19 22:37:20.1994019Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13300 conhost.exe",6452,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084027535360,18446633084027510784,140712899206080,0,689119404032,10848,1763591840199401900,689120477184,689120468992,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2002361Z","2025-11-19 22:37:20.2002361Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",6452,,,"13300 conhost.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591840200236100,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2004689Z","2025-11-19 22:37:20.2004689Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",6452,,,"13300 conhost.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,,,,,,,1763591840200468900,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2009502Z","2025-11-19 22:37:20.2009502Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",6452,,,"13300 conhost.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,,,,,,,1763591840200950200,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2016575Z","2025-11-19 22:37:20.2016575Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",6452,,,"13300 conhost.exe",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,,,,,,,1763591840201657500,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2042774Z","2025-11-19 22:37:20.2042774Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13300 conhost.exe",6452,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028108800,18446633084028084224,140712865112144,0,689119412224,3620,1763591840204277400,689121001472,689120993280,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2044792Z","2025-11-19 22:37:20.2044792Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028137472,18446633084028112896,140712899206080,0,689119420416,14856,1763591840204479200,689121525760,689121517568,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2046406Z","2025-11-19 22:37:20.2046406Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13300 conhost.exe",14856,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028309504,18446633084028284928,140712899206080,0,689119428608,6828,1763591840204640600,689122574336,689122566144,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2084663Z","2025-11-19 22:37:20.2084663Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2992 svchost.exe",8856,,," 2992 svchost.exe",,,,,,,,,,,,,18446633084028338176,18446633084028313600,140712899206080,186,170617454592,14440,1763591840208466300,170615767040,170615734272,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2118325Z","2025-11-19 22:37:20.2118325Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1040 svchost.exe",4480,,," 632 OpenConsole.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\OpenConsole.exe",,,,,,,,,,,,,,,,1763591840211832500,,,,,,,1210794,,1759975785,134080654410427174,3,"0x","Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe","App",1040,13,6626,3,0,0,1,,,,,,,,,,,, +"2025-11-19 22:37:20.2124452Z","2025-11-19 22:37:20.2124452Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",4480,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028022784,18446633084027998208,140702989817872,40,696750407680,5408,1763591840212445200,696748802048,696748797952,140702989817872,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2146117Z","2025-11-19 22:37:20.2146117Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1040 svchost.exe",,,,,,,,,,,,,18446633084028366848,18446633084028342272,140712899206080,0,256031023104,9432,1763591840214611700,256033947648,256033914880,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2148741Z","2025-11-19 22:37:20.2148741Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\OpenConsole.exe",,,,,,,,,,,,,,,,1763591840214874100,,,,,140702989025280,140702989025280,1210794,1159168,1759975785,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2149027Z","2025-11-19 22:37:20.2149027Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591840214902700,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2183156Z","2025-11-19 22:37:20.2183156Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591840218315600,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2184582Z","2025-11-19 22:37:20.2184582Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591840218458200,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2196960Z","2025-11-19 22:37:20.2196960Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,,,,,,,1763591840219696000,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2198222Z","2025-11-19 22:37:20.2198222Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591840219822200,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2198977Z","2025-11-19 22:37:20.2198977Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028424192,18446633084028399616,140712899206080,0,696750415872,3864,1763591840219897700,696752537600,696752533504,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2199559Z","2025-11-19 22:37:20.2199559Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591840219955900,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2201168Z","2025-11-19 22:37:20.2201168Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028481536,18446633084028456960,140712899206080,0,696750424064,12484,1763591840220116800,696753586176,696753582080,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2201837Z","2025-11-19 22:37:20.2201837Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,,,,,,,1763591840220183700,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2202127Z","2025-11-19 22:37:20.2202127Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 632 OpenConsole.exe",12484,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028510208,18446633084028485632,140712899206080,0,696750432256,14384,1763591840220212700,696754634752,696754630656,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2203444Z","2025-11-19 22:37:20.2203444Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591840220344400,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2205371Z","2025-11-19 22:37:20.2205371Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,,,,,,,1763591840220537100,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2205413Z","2025-11-19 22:37:20.2205413Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",12484,,," 632 OpenConsole.exe",,,"C:\Windows\System32\UIAutomationCore.dll",,,,,,,,,,,,,,,,1763591840220541300,,,,,140712432762880,140712432762880,4328257,4296704,2096711852,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2207712Z","2025-11-19 22:37:20.2207712Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591840220771200,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2210529Z","2025-11-19 22:37:20.2210529Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591840221052900,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2211786Z","2025-11-19 22:37:20.2211786Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591840221178600,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2212737Z","2025-11-19 22:37:20.2212737Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591840221273700,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2214099Z","2025-11-19 22:37:20.2214099Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591840221409900,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2216296Z","2025-11-19 22:37:20.2216296Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591840221629600,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2217163Z","2025-11-19 22:37:20.2217163Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",3864,,," 632 OpenConsole.exe",,,"C:\Windows\System32\windows.storage.dll",,,,,,,,,,,,,,,,1763591840221716300,,,,,140712812412928,140712812412928,8877403,8769536,3667346596,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2217880Z","2025-11-19 22:37:20.2217880Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",12484,,," 632 OpenConsole.exe",,,"C:\Windows\System32\propsys.dll",,,,,,,,,,,,,,,,1763591840221788000,,,,,140712761491456,140712761491456,1123662,1060864,3228732737,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2218169Z","2025-11-19 22:37:20.2218169Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591840221816900,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2221345Z","2025-11-19 22:37:20.2221345Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,,,,,,,1763591840222134500,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2223554Z","2025-11-19 22:37:20.2223554Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,,,,,,,1763591840222355400,,,,,140712851341312,140712851341312,1524912,1486848,1404855129,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2225067Z","2025-11-19 22:37:20.2225067Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,,,,,,,1763591840222506700,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2228291Z","2025-11-19 22:37:20.2228291Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",12484,,," 632 OpenConsole.exe",,,"C:\Windows\System32\winmm.dll",,,,,,,,,,,,,,,,1763591840222829100,,,,,140712663842816,140712663842816,263815,217088,2106743460,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2230199Z","2025-11-19 22:37:20.2230199Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",14384,,," 632 OpenConsole.exe",,,"C:\Windows\System32\d2d1.dll",,,,,,,,,,,,,,,,1763591840223019900,,,,,140712777744384,140712777744384,6610469,6537216,3013069957,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2230365Z","2025-11-19 22:37:20.2230365Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",3864,,," 632 OpenConsole.exe",,,"C:\Windows\System32\usp10.dll",,,,,,,,,,,,,,,,1763591840223036500,,,,,140711462174720,140711462174720,161304,102400,728066498,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2231119Z","2025-11-19 22:37:20.2231119Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\DWrite.dll",,,,,,,,,,,,,,,,1763591840223111900,,,,,140712784297984,140712784297984,2543119,2519040,1462185185,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2234109Z","2025-11-19 22:37:20.2234109Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",12484,,," 632 OpenConsole.exe",,,"C:\Windows\System32\dxgi.dll",,,,,,,,,,,,,,,,1763591840223410900,,,,,140712803631104,140712803631104,1320096,1282048,1861212996,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2235191Z","2025-11-19 22:37:20.2235191Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",14384,,," 632 OpenConsole.exe",,,"C:\Windows\System32\D3DCompiler_47.dll",,,,,,,,,,,,,,,,1763591840223519100,,,,,140712769814528,140712769814528,4685395,4714496,796813953,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2235551Z","2025-11-19 22:37:20.2235551Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",3864,,," 632 OpenConsole.exe",,,"C:\Windows\System32\d3d11.dll",,,,,,,,,,,,,,,,1763591840223555100,,,,,140712786853888,140712786853888,2582658,2498560,2128032819,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2238951Z","2025-11-19 22:37:20.2238951Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",14384,,," 632 OpenConsole.exe",,,"C:\Windows\System32\cryptsp.dll",,,,,,,,,,,,,,,,1763591840223895100,,,,,140712839217152,140712839217152,146168,110592,1658328178,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2239313Z","2025-11-19 22:37:20.2239313Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\powrprof.dll",,,,,,,,,,,,,,,,1763591840223931300,,,,,140712848195584,140712848195584,457799,385024,2858637235,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2288168Z","2025-11-19 22:37:20.2288168Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,,,,,,,1763591840228816800,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2293460Z","2025-11-19 22:37:20.2293460Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\umpdc.dll",,,,,,,,,,,,,,,,1763591840229346000,,,,,140712848064512,140712848064512,98535,81920,1714427184,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2309648Z","2025-11-19 22:37:20.2309648Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591840230964800,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2314234Z","2025-11-19 22:37:20.2314234Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,,,,,,,1763591840231423400,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2321707Z","2025-11-19 22:37:20.2321707Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,,,,,,,1763591840232170700,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2353969Z","2025-11-19 22:37:20.2353969Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028223488,18446633084028198912,140712865112144,0,696750440448,8232,1763591840235396900,696755683328,696755675136,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2356120Z","2025-11-19 22:37:20.2356120Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028538880,18446633084028514304,140712899206080,0,696750448640,14248,1763591840235612000,696756731904,696756727808,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2357894Z","2025-11-19 22:37:20.2357894Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 632 OpenConsole.exe",14248,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028596224,18446633084028571648,140712899206080,0,696750456832,10496,1763591840235789400,696757780480,696757776384,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2430002Z","2025-11-19 22:37:20.2430002Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",10496,,," 632 OpenConsole.exe",,,"C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\PackagedCom\OpenConsoleProxy.dll",,,,,,,,,,,,,,,,1763591840243000200,,,,,140712723349504,140712723349504,51292,53248,1759975238,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2446215Z","2025-11-19 22:37:20.2446215Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",6452,,,"13300 conhost.exe",,,"C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\PackagedCom\OpenConsoleProxy.dll",,,,,,,,,,,,,,,,1763591840244621500,,,,,140712723349504,140712723349504,51292,53248,1759975238,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2450024Z","2025-11-19 22:37:20.2450024Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13300 conhost.exe",6452,,,"13300 conhost.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,,,,,,,1763591840245002400,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2599092Z","2025-11-19 22:37:20.2599092Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1040 svchost.exe",4480,,,"13248 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe",,,,,,,,,,,,,,,,1763591840259909200,,,,,,,738129,,1759975821,134080654410898354,3,"0x","Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe","App",1040,13,6627,3,0,0,1,,,,,,,,,,,, +"2025-11-19 22:37:20.2605834Z","2025-11-19 22:37:20.2605834Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",4480,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028624896,18446633084028600320,140702319920256,40,932562440192,2344,1763591840260583400,932564697088,932564692992,140702319920256,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2632791Z","2025-11-19 22:37:20.2632791Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe",,,,,,,,,,,,,,,,1763591840263279100,,,,,140702319640576,140702319640576,738129,684032,1759975821,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2633139Z","2025-11-19 22:37:20.2633139Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591840263313900,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2725222Z","2025-11-19 22:37:20.2725222Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591840272522200,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2726420Z","2025-11-19 22:37:20.2726420Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591840272642000,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2738132Z","2025-11-19 22:37:20.2738132Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028080128,18446633084028055552,140712899206080,0,932562448384,6140,1763591840273813200,932565745664,932565741568,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2738795Z","2025-11-19 22:37:20.2738795Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591840273879500,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2740912Z","2025-11-19 22:37:20.2740912Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",6140,,,"13248 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\TerminalThemeHelpers.dll",,,,,,,,,,,,,,,,1763591840274091200,,,,,140712700477440,140712700477440,93641,61440,1754949712,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2740994Z","2025-11-19 22:37:20.2740994Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591840274099400,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2742321Z","2025-11-19 22:37:20.2742321Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028682240,18446633084028657664,140712899206080,0,932562456576,3272,1763591840274232100,932566794240,932566790144,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2743295Z","2025-11-19 22:37:20.2743295Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591840274329500,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2745410Z","2025-11-19 22:37:20.2745410Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591840274541000,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2747256Z","2025-11-19 22:37:20.2747256Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591840274725600,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2748534Z","2025-11-19 22:37:20.2748534Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",6140,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,,,,,,,1763591840274853400,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2749410Z","2025-11-19 22:37:20.2749410Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591840274941000,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2750530Z","2025-11-19 22:37:20.2750530Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",6140,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591840275053000,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2752392Z","2025-11-19 22:37:20.2752392Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",3272,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028710912,18446633084028686336,140712899206080,0,932562464768,12328,1763591840275239200,932567842816,932567838720,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2753425Z","2025-11-19 22:37:20.2753425Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,,,,,,,1763591840275342500,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2756494Z","2025-11-19 22:37:20.2756494Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,,,,,,,1763591840275649400,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2757017Z","2025-11-19 22:37:20.2757017Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",6140,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591840275701700,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2759292Z","2025-11-19 22:37:20.2759292Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",3272,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\dwmapi.dll",,,,,,,,,,,,,,,,1763591840275929200,,,,,140712805072896,140712805072896,203843,196608,2709117439,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2759552Z","2025-11-19 22:37:20.2759552Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",6140,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591840275955200,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2759632Z","2025-11-19 22:37:20.2759632Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,,,,,,,1763591840275963200,,,,,140712851341312,140712851341312,1524912,1486848,1404855129,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2761511Z","2025-11-19 22:37:20.2761511Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\uxtheme.dll",,,,,,,,,,,,,,,,1763591840276151100,,,,,140712802254848,140712802254848,696534,696320,1695798817,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2762574Z","2025-11-19 22:37:20.2762574Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,,,,,,,1763591840276257400,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2778854Z","2025-11-19 22:37:20.2778854Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,,,,,,,1763591840277885400,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2806601Z","2025-11-19 22:37:20.2806601Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,,,,,,,1763591840280660100,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2819391Z","2025-11-19 22:37:20.2819391Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,,,,,,,1763591840281939100,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2824009Z","2025-11-19 22:37:20.2824009Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591840282400900,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2832509Z","2025-11-19 22:37:20.2832509Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,,,,,,,1763591840283250900,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2844014Z","2025-11-19 22:37:20.2844014Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\TerminalApp.dll",,,,,,,,,,,,,,,,1763591840284401500,,,,,140711774912512,140711774912512,3444084,3444736,1759975751,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2845231Z","2025-11-19 22:37:20.2845231Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\ole32.dll",,,,,,,,,,,,,,,,1763591840284523200,,,,,140712878473216,140712878473216,1689904,1667072,1018821057,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2848307Z","2025-11-19 22:37:20.2848307Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",3272,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\winmm.dll",,,,,,,,,,,,,,,,1763591840284830700,,,,,140712663842816,140712663842816,263815,217088,2106743460,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2856888Z","2025-11-19 22:37:20.2856888Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.UI.Xaml.dll",,,,,,,,,,,,,,,,1763591840285688800,,,,,140712596865024,140712596865024,17882163,17858560,706442395,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2871609Z","2025-11-19 22:37:20.2871609Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\twinapi.appcore.dll",,,,,,,,,,,,,,,,1763591840287160900,,,,,140712720924672,140712720924672,2401519,2375680,2646458233,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2876075Z","2025-11-19 22:37:20.2876075Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084010672128,18446633084010647552,140712899206080,0,932562472960,10628,1763591840287607500,932568891392,932568887296,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2899172Z","2025-11-19 22:37:20.2899172Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028739584,18446633084028715008,140712865112144,0,932562481152,11164,1763591840289917200,932569939968,932569931776,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2901850Z","2025-11-19 22:37:20.2901850Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",10628,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028768256,18446633084028743680,140712899206080,0,932562489344,9736,1763591840290185100,932570988544,932570984448,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2915289Z","2025-11-19 22:37:20.2915289Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\OneCoreUAPCommonProxyStub.dll",,,,,,,,,,,,,,,,1763591840291528900,,,,,140712713977856,140712713977856,6740758,6615040,2011948997,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2939256Z","2025-11-19 22:37:20.2939256Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\Microsoft.Terminal.Control.dll",,,,,,,,,,,,,,,,1763591840293925600,,,,,140712378368000,140712378368000,1976337,1986560,1759975378,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2942453Z","2025-11-19 22:37:20.2942453Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\UIAutomationCore.dll",,,,,,,,,,,,,,,,1763591840294245300,,,,,140712432762880,140712432762880,4328257,4296704,2096711852,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2944574Z","2025-11-19 22:37:20.2944574Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",6140,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\UIAutomationCore.dll",,,,,,,,,,,,,,,,1763591840294457400,,,,,2186478157824,2186478157824,4328257,4296704,2096711852,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2944674Z","2025-11-19 22:37:20.2944674Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\d2d1.dll",,,,,,,,,,,,,,,,1763591840294467400,,,,,140712777744384,140712777744384,6610469,6537216,3013069957,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2945179Z","2025-11-19 22:37:20.2945179Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",3272,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\DWrite.dll",,,,,,,,,,,,,,,,1763591840294517900,,,,,140712784297984,140712784297984,2543119,2519040,1462185185,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2945565Z","2025-11-19 22:37:20.2945565Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",6140,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\UIAutomationCore.dll",,,,,,,,,,,,,,,,1763591840294556500,,,,,2186478157824,2186478157824,4328257,4308992,2096711852,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2948295Z","2025-11-19 22:37:20.2948295Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\dxgi.dll",,,,,,,,,,,,,,,,1763591840294829500,,,,,140712803631104,140712803631104,1320096,1282048,1861212996,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2949237Z","2025-11-19 22:37:20.2949237Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",6140,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\d3d11.dll",,,,,,,,,,,,,,,,1763591840294923700,,,,,140712786853888,140712786853888,2582658,2498560,2128032819,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2950761Z","2025-11-19 22:37:20.2950761Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",3272,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\D3DCompiler_47.dll",,,,,,,,,,,,,,,,1763591840295076100,,,,,140712769814528,140712769814528,4685395,4714496,796813953,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2952664Z","2025-11-19 22:37:20.2952664Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\powrprof.dll",,,,,,,,,,,,,,,,1763591840295266400,,,,,140712848195584,140712848195584,457799,385024,2858637235,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2954151Z","2025-11-19 22:37:20.2954151Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",6140,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\cryptsp.dll",,,,,,,,,,,,,,,,1763591840295415100,,,,,140712839217152,140712839217152,146168,110592,1658328178,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2967112Z","2025-11-19 22:37:20.2967112Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\umpdc.dll",,,,,,,,,,,,,,,,1763591840296711200,,,,,140712848064512,140712848064512,98535,81920,1714427184,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2992523Z","2025-11-19 22:37:20.2992523Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.8_8.2501.31001.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.dll",,,,,,,,,,,,,,,,1763591840299252300,,,,,140710095028224,140710095028224,5866761,5873664,2056920596,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3000178Z","2025-11-19 22:37:20.3000178Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\CoreMessaging.dll",,,,,,,,,,,,,,,,1763591840300017800,,,,,140712796160000,140712796160000,1232710,1208320,2155847221,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3007616Z","2025-11-19 22:37:20.3007616Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.UI.dll",,,,,,,,,,,,,,,,1763591840300761600,,,,,140712615346176,140712615346176,1414164,1376256,3301850593,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3016096Z","2025-11-19 22:37:20.3016096Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\InputHost.dll",,,,,,,,,,,,,,,,1763591840301609600,,,,,140712583757824,140712583757824,1989124,1970176,2937052880,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3030827Z","2025-11-19 22:37:20.3030827Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591840303082700,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3035687Z","2025-11-19 22:37:20.3035687Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\cryptbase.dll",,,,,,,,,,,,,,,,1763591840303568700,,,,,140712839348224,140712839348224,63718,49152,3897879906,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3054760Z","2025-11-19 22:37:20.3054760Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\msctf.dll",,,,,,,,,,,,,,,,1763591840305476000,,,,,140712893022208,140712893022208,1455420,1433600,4155718050,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3085814Z","2025-11-19 22:37:20.3085814Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3204 Taskmgr.exe",5876,,," 3204 Taskmgr.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,,,,,,,1763591840308581400,,,,,140712479096832,140712479096832,1613415,1552384,2231457550,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3089701Z","2025-11-19 22:37:20.3089701Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3204 Taskmgr.exe",5876,,," 3204 Taskmgr.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,,,,,,,1763591840308970200,,,,,140712479096832,140712479096832,1613415,1564672,2231457550,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3093537Z","2025-11-19 22:37:20.3093537Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3204 Taskmgr.exe",5876,,," 3204 Taskmgr.exe",,,,,,,,,,,,,18446633084027248640,18446633084027224064,140712891292720,0,552496762880,15292,1763591840309353700,552499937280,552499929088,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3100653Z","2025-11-19 22:37:20.3100653Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\UiaManager.dll",,,,,,,,,,,,,,,,1763591840310065300,,,,,140712461205504,140712461205504,941078,897024,2628067039,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3148892Z","2025-11-19 22:37:20.3148892Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4340 sihost.exe",10460,,," 4340 sihost.exe",,,,,,,,,,,,,18446633084028825600,18446633084028801024,140712899206080,0,645639995392,13916,1763591840314889200,645642321920,645642313728,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3153193Z","2025-11-19 22:37:20.3153193Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029026304,18446633084029001728,140712891292720,0,932562497536,11792,1763591840315319300,932572037120,932572033024,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3157769Z","2025-11-19 22:37:20.3157769Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\WindowManagementAPI.dll",,,,,,,,,,,,,,,,1763591840315776900,,,,,140712738422784,140712738422784,1825044,1794048,1605274449,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3168106Z","2025-11-19 22:37:20.3168106Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\urlmon.dll",,,,,,,,,,,,,,,,1763591840316810600,,,,,140712669609984,140712669609984,1970671,1957888,260716450,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3170805Z","2025-11-19 22:37:20.3170805Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\windows.storage.dll",,,,,,,,,,,,,,,,1763591840317080500,,,,,140712812412928,140712812412928,8877403,8769536,3667346596,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3170934Z","2025-11-19 22:37:20.3170934Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",3272,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\iertutil.dll",,,,,,,,,,,,,,,,1763591840317093500,,,,,140712642805760,140712642805760,2984761,2904064,3815768453,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3175653Z","2025-11-19 22:37:20.3175653Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",3272,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\srvcli.dll",,,,,,,,,,,,,,,,1763591840317565300,,,,,140712668954624,140712668954624,181029,167936,239922031,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3178450Z","2025-11-19 22:37:20.3178450Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\netutils.dll",,,,,,,,,,,,,,,,1763591840317845000,,,,,140712825847808,140712825847808,80696,53248,865845000,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3206848Z","2025-11-19 22:37:20.3206848Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029173760,18446633084029149184,140712600145104,0,932562505728,7808,1763591840320684800,932573085696,932573081600,140712600145104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3207124Z","2025-11-19 22:37:20.3207124Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028854272,18446633084028829696,140712604173856,0,932562513920,13488,1763591840320712400,932574134272,932574130176,140712604173856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3212137Z","2025-11-19 22:37:20.3212137Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",7808,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\DXCore.dll",,,,,,,,,,,,,,,,1763591840321213700,,,,,140712805400576,140712805400576,331386,274432,2354081039,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3217217Z","2025-11-19 22:37:20.3217217Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",7808,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\ResourcePolicyClient.dll",,,,,,,,,,,,,,,,1763591840321721700,,,,,140712809070592,140712809070592,104020,81920,2069163340,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3229857Z","2025-11-19 22:37:20.3229857Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",7808,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\ResourcePolicyClient.dll",,,,,,,,,,,,,,,,1763591840322985700,,,,,140712809070592,140712809070592,104020,94208,2069163340,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3231289Z","2025-11-19 22:37:20.3231289Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",7808,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\directxdatabasehelper.dll",,,,,,,,,,,,,,,,1763591840323128900,,,,,140712752709632,140712752709632,426573,405504,145563491,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3234021Z","2025-11-19 22:37:20.3234021Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3204 Taskmgr.exe",5876,,," 3204 Taskmgr.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,,,,,,,1763591840323402100,,,,,140712479096832,140712479096832,1613415,1552384,2231457550,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3237693Z","2025-11-19 22:37:20.3237693Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3204 Taskmgr.exe",5876,,," 3204 Taskmgr.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,,,,,,,1763591840323769300,,,,,140712479096832,140712479096832,1613415,1564672,2231457550,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3238215Z","2025-11-19 22:37:20.3238215Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\MrmCoreR.dll",,,,,,,,,,,,,,,,1763591840323821500,,,,,140712631926784,140712631926784,1191374,1146880,1078870765,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3242437Z","2025-11-19 22:37:20.3242437Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",7808,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\cfgmgr32.dll",,,,,,,,,,,,,,,,1763591840324243700,,,,,140712845049856,140712845049856,385808,356352,1737777300,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3246445Z","2025-11-19 22:37:20.3246445Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.StateRepositoryClient.dll",,,,,,,,,,,,,,,,1763591840324644500,,,,,140712696610816,140712696610816,303673,290816,424989122,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3282109Z","2025-11-19 22:37:20.3282109Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\profapi.dll",,,,,,,,,,,,,,,,1763591840328210900,,,,,140712848850944,140712848850944,229548,167936,2447194521,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3291000Z","2025-11-19 22:37:20.3291000Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",7808,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\d3d10warp.dll",,,,,,,,,,,,,,,,1763591840329100000,,,,,140712731869184,140712731869184,5958575,5943296,1147803111,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3296216Z","2025-11-19 22:37:20.3296216Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\dcomp.dll",,,,,,,,,,,,,,,,1763591840329621600,,,,,140712789409792,140712789409792,2309196,2240512,1200801128,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3300491Z","2025-11-19 22:37:20.3300491Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",6140,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Microsoft.Internal.WarpPal.dll",,,,,,,,,,,,,,,,1763591840330049100,,,,,140712769683456,140712769683456,167600,102400,2132685858,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3313797Z","2025-11-19 22:37:20.3313797Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\BCP47mrm.dll",,,,,,,,,,,,,,,,1763591840331379700,,,,,140712628322304,140712628322304,278903,212992,835504572,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3338243Z","2025-11-19 22:37:20.3338243Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",7808,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\TextShaping.dll",,,,,,,,,,,,,,,,1763591840333824300,,,,,140712585789440,140712585789440,770155,733184,2109619091,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3350748Z","2025-11-19 22:37:20.3350748Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",7808,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029173760,18446633084029149184,140712600145104,0,932562505728,7808,1763591840335074800,932573085696,932573057024,140712600145104,47684873,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3353558Z","2025-11-19 22:37:20.3353558Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029173760,18446633084029149184,140712632221632,0,932562522112,4192,1763591840335355800,932573085696,932573081600,140712632221632,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3423358Z","2025-11-19 22:37:20.3423358Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.UI.Xaml.Controls.dll",,,,,,,,,,,,,,,,1763591840342335800,,,,,140712586575872,140712586575872,3327252,3313664,3689468694,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3497808Z","2025-11-19 22:37:20.3497808Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.UI.Immersive.dll",,,,,,,,,,,,,,,,1763591840349780800,,,,,140712595423232,140712595423232,1424120,1372160,1559948871,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3511864Z","2025-11-19 22:37:20.3511864Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\DataExchange.dll",,,,,,,,,,,,,,,,1763591840351186400,,,,,140712406614016,140712406614016,399312,368640,696309968,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3528649Z","2025-11-19 22:37:20.3528649Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.ApplicationModel.dll",,,,,,,,,,,,,,,,1763591840352864900,,,,,140712508391424,140712508391424,945679,876544,2857312343,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3556662Z","2025-11-19 22:37:20.3556662Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\Microsoft.Terminal.Settings.Model.dll",,,,,,,,,,,,,,,,1763591840355666200,,,,,140712373518336,140712373518336,2281369,2252800,1759975487,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3559122Z","2025-11-19 22:37:20.3559122Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",3272,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\ntmarta.dll",,,,,,,,,,,,,,,,1763591840355912200,,,,,140712831811584,140712831811584,265798,221184,3598506564,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3560892Z","2025-11-19 22:37:20.3560892Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\bcrypt.dll",,,,,,,,,,,,,,,,1763591840356089200,,,,,140712848654336,140712848654336,206048,172032,2893678010,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3570938Z","2025-11-19 22:37:20.3570938Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\shlwapi.dll",,,,,,,,,,,,,,,,1763591840357093800,,,,,140712868839424,140712868839424,479562,421888,2142510382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3625434Z","2025-11-19 22:37:20.3625434Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\TerminalConnection.dll",,,,,,,,,,,,,,,,1763591840362543400,,,,,140712372994048,140712372994048,522798,495616,1759975254,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3628410Z","2025-11-19 22:37:20.3628410Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",6140,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\winhttp.dll",,,,,,,,,,,,,,,,1763591840362841000,,,,,140712750350336,140712750350336,1261038,1212416,84984727,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3642498Z","2025-11-19 22:37:20.3642498Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\ProgramData\Microsoft\VisualStudio\Setup\x64\Microsoft.VisualStudio.Setup.Configuration.Native.dll",,,,,,,,,,,,,,,,1763591840364249800,,,,,140711212089344,140711212089344,1007466,1015808,1726088073,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3680813Z","2025-11-19 22:37:20.3680813Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\AppExtension.dll",,,,,,,,,,,,,,,,1763591840368081300,,,,,140712467365888,140712467365888,337294,299008,1656953249,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3706276Z","2025-11-19 22:37:20.3706276Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",11792,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.StateRepositoryPS.dll",,,,,,,,,,,,,,,,1763591840370627600,,,,,140712490369024,140712490369024,879719,802816,374042279,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3746113Z","2025-11-19 22:37:20.3746113Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.Globalization.dll",,,,,,,,,,,,,,,,1763591840374611300,,,,,140712593457152,140712593457152,1640332,1634304,3240919660,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3750584Z","2025-11-19 22:37:20.3750584Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\BCP47Langs.dll",,,,,,,,,,,,,,,,1763591840375058400,,,,,140712631468032,140712631468032,402331,385024,2065030180,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3857419Z","2025-11-19 22:37:20.3857419Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\PackagedCom\OpenConsoleProxy.dll",,,,,,,,,,,,,,,,1763591840385741900,,,,,140712723349504,140712723349504,51292,53248,1759975238,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4060164Z","2025-11-19 22:37:20.4060164Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\ExplorerFrame.dll",,,,,,,,,,,,,,,,1763591840406016400,,,,,140712345862144,140712345862144,2919775,2867200,3427672670,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4214447Z","2025-11-19 22:37:20.4214447Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\Microsoft.Terminal.UI.dll",,,,,,,,,,,,,,,,1763591840421444700,,,,,140712537882624,140712537882624,255391,258048,1759975265,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4227887Z","2025-11-19 22:37:20.4227887Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\WindowsCodecs.dll",,,,,,,,,,,,,,,,1763591840422788700,,,,,140712775385088,140712775385088,2352359,2293760,3466818398,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4344248Z","2025-11-19 22:37:20.4344248Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\TextInputFramework.dll",,,,,,,,,,,,,,,,1763591840434424800,,,,,140712628846592,140712628846592,1374424,1339392,3535451269,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4409754Z","2025-11-19 22:37:20.4409754Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 632 OpenConsole.exe",14248,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084029116416,18446633084029091840,140702989217024,0,696750465024,8552,1763591840440975400,696758829056,696758824960,140702989217024,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4410144Z","2025-11-19 22:37:20.4410144Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 632 OpenConsole.exe",14248,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028911616,18446633084028887040,140702989233856,0,696750473216,12624,1763591840441014400,696759877632,696759873536,140702989233856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4411382Z","2025-11-19 22:37:20.4411382Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084056907776,18446633084056883200,140712899206080,0,932562530304,13068,1763591840441138200,932575182848,932575178752,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4420605Z","2025-11-19 22:37:20.4420605Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\uxtheme.dll",,,,,,,,,,,,,,,,1763591840442060500,,,,,140712802254848,140712802254848,696534,696320,1695798817,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4421089Z","2025-11-19 22:37:20.4421089Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13300 conhost.exe",6452,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084029374464,18446633084029349888,140696385038832,0,689119436800,4352,1763591840442108900,689123098624,689123090432,140696385038832,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4439257Z","2025-11-19 22:37:20.4439257Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028395520,18446633084028370944,140702989086576,0,696750481408,1184,1763591840443925700,696760926208,696760922112,140702989086576,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4450459Z","2025-11-19 22:37:20.4450459Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\directmanipulation.dll",,,,,,,,,,,,,,,,1763591840445045900,,,,,140712583036928,140712583036928,714070,667648,3434535107,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4452004Z","2025-11-19 22:37:20.4452004Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084029231104,18446633084029206528,140702989404080,0,696750489600,9776,1763591840445200400,696761974784,696761970688,140702989404080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4464556Z","2025-11-19 22:37:20.4464556Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084027793408,18446633084027768832,140712583404848,0,932562538496,4376,1763591840446455600,932576231424,932576227328,140712583404848,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4469069Z","2025-11-19 22:37:20.4469069Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",13068,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029317120,18446633084029292544,140712899206080,0,932562546688,9352,1763591840446906900,932577280000,932577275904,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4800926Z","2025-11-19 22:37:20.4800926Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9388 devenv.exe",6884,,," 9388 devenv.exe",,,,,,,,,,,,,18446633083996995584,18446633083996971008,140712899206080,0,1033377136640,6884,1763591840480092600,1033431941120,1033431932928,140712899206080,158801,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4824637Z","2025-11-19 22:37:20.4824637Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\msftedit.dll",,,,,,,,,,,,,,,,1763591840482463700,,,,,140712289107968,140712289107968,3297357,3305472,3878106343,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4850000Z","2025-11-19 22:37:20.4850000Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\globinputhost.dll",,,,,,,,,,,,,,,,1763591840485000000,,,,,140712627863552,140712627863552,263563,208896,1786968813,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4858122Z","2025-11-19 22:37:20.4858122Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.UI.Core.TextInput.dll",,,,,,,,,,,,,,,,1763591840485812200,,,,,140712572354560,140712572354560,1511216,1499136,21441667,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4864712Z","2025-11-19 22:37:20.4864712Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\CoreUIComponents.dll",,,,,,,,,,,,,,,,1763591840486471200,,,,,140712742944768,140712742944768,3046501,3022848,801552868,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5057422Z","2025-11-19 22:37:20.5057422Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028653568,18446633084028628992,140712865112144,0,932562554880,13692,1763591840505742200,932578328576,932578320384,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5078368Z","2025-11-19 22:37:20.5078368Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",13692,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\sxs.dll",,,,,,,,,,,,,,,,1763591840507836800,,,,,140712846622720,140712846622720,697955,659456,3834976666,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5184957Z","2025-11-19 22:37:20.5184957Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\xmllite.dll",,,,,,,,,,,,,,,,1763591840518495700,,,,,140712684027904,140712684027904,342897,274432,974526834,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5423103Z","2025-11-19 22:37:20.5423103Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\icu.dll",,,,,,,,,,,,,,,,1763591840542310300,,,,,140712684617728,140712684617728,2775448,2744320,3611555297,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5442487Z","2025-11-19 22:37:20.5442487Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029632512,18446633084029607936,140712373211440,0,932562563072,6612,1763591840544248700,932579377152,932579373056,140712373211440,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5443223Z","2025-11-19 22:37:20.5443223Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028882944,18446633084028858368,140712378637616,0,932562571264,6260,1763591840544322300,932580425728,932580421632,140712378637616,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5475582Z","2025-11-19 22:37:20.5475582Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\apphelp.dll",,,,,,,,,,,,,,,,1763591840547558200,,,,,140712800485376,140712800485376,675806,651264,4108425587,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5478450Z","2025-11-19 22:37:20.5478450Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",6260,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029947904,18446633084029923328,140712899206080,0,932562579456,14632,1763591840547845000,932581474304,932581470208,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5508273Z","2025-11-19 22:37:20.5508273Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591840550827300,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5509553Z","2025-11-19 22:37:20.5509553Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591840550955300,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5510805Z","2025-11-19 22:37:20.5510805Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,,,,,,,,,,,18446633084029747200,18446633084029722624,140712899206080,0,867488059392,5960,1763591840551080500,867490070528,867490066432,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5511743Z","2025-11-19 22:37:20.5511743Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591840551174300,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5513846Z","2025-11-19 22:37:20.5513846Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591840551384600,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5515459Z","2025-11-19 22:37:20.5515459Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5604 attack-890.exe",5960,,," 5604 attack-890.exe",,,,,,,,,,,,,18446633084029718528,18446633084029693952,140712899206080,0,867488067584,8672,1763591840551545900,867491119104,867491115008,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5515805Z","2025-11-19 22:37:20.5515805Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591840551580500,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5516458Z","2025-11-19 22:37:20.5516458Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5604 attack-890.exe",8672,,," 5604 attack-890.exe",,,,,,,,,,,,,18446633084029460480,18446633084029435904,140712899206080,0,867488075776,12460,1763591840551645800,867492167680,867492163584,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5518883Z","2025-11-19 22:37:20.5518883Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",8672,,," 5604 attack-890.exe",,,"C:\Windows\System32\msvcp140.dll",,,,,,,,,,,,,,,,1763591840551888300,,,,,140711213137920,140711213137920,570439,561152,1564323704,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5518888Z","2025-11-19 22:37:20.5518888Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",12460,,," 5604 attack-890.exe",,,"C:\Windows\System32\vcruntime140.dll",,,,,,,,,,,,,,,,1763591840551888800,,,,,140712353988608,140712353988608,146072,122880,254123393,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5518982Z","2025-11-19 22:37:20.5518982Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\vcruntime140_1.dll",,,,,,,,,,,,,,,,1763591840551898200,,,,,140712354119680,140712354119680,57827,49152,240324076,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:21.377891300Z","2025-11-19 22:37:20.5537813Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Injector started with PID 5604",,,,,,,,,,,,,,,,,1763591840553781300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.6045242Z","2025-11-19 22:37:20.6045242Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",10628,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029546496,18446633084029521920,140712899206080,0,932562587648,3424,1763591840604524200,932582522880,932582518784,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.6192368Z","2025-11-19 22:37:20.6192368Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.Graphics.dll",,,,,,,,,,,,,,,,1763591840619236800,,,,,140712711225344,140712711225344,669723,593920,1068018205,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.6238285Z","2025-11-19 22:37:20.6238285Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\threadpoolwinrt.dll",,,,,,,,,,,,,,,,1763591840623828500,,,,,140712555839488,140712555839488,130107,90112,2299561022,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.6242698Z","2025-11-19 22:37:20.6242698Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028968960,18446633084028944384,140712899206080,0,932562595840,14684,1763591840624269800,932583571456,932583567360,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.6245269Z","2025-11-19 22:37:20.6245269Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",14684,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029976576,18446633084029952000,140712899206080,0,932562604032,13344,1763591840624526900,932584620032,932584615936,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.6247078Z","2025-11-19 22:37:20.6247078Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",13344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084030005248,18446633084029980672,140712899206080,0,932562612224,6564,1763591840624707800,932585668608,932585664512,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.6248408Z","2025-11-19 22:37:20.6248408Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",14684,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\pfclient.dll",,,,,,,,,,,,,,,,1763591840624840800,,,,,140712803500032,140712803500032,92868,73728,3163590703,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.6252373Z","2025-11-19 22:37:20.6252373Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",6564,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084030033920,18446633084030009344,140712899206080,0,932562620416,12924,1763591840625237300,932586717184,932586713088,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.6254041Z","2025-11-19 22:37:20.6254041Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",12924,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084030062592,18446633084030038016,140712899206080,0,932562628608,13704,1763591840625404100,932587765760,932587761664,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:21.477249300Z","2025-11-19 22:37:20.6551680Z","myETW","EDRi-Provider",4242,"EDRiTask"," 7508 EDRi.exe",,,,,,"After starting the attack exe",,,,,,,,,,,,,,,,,1763591840655168000,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.6886346Z","2025-11-19 22:37:20.6886346Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4392 MsMpEng.exe",5064,,," 4392 MsMpEng.exe",,,,,,,,,,,,,18446633084030177280,18446633084030152704,140712899206080,247,389820030976,14760,1763591840688634600,389842731008,389842665472,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.6886949Z","2025-11-19 22:37:20.6886949Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4392 MsMpEng.exe",5064,,," 4392 MsMpEng.exe",,,,,,,,,,,,,18446633084030205952,18446633084030181376,140712647800224,247,389820039168,8032,1763591840688695000,389849022464,389848956928,140712647800224,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.6889335Z","2025-11-19 22:37:20.6889335Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4392 MsMpEng.exe",14760,,," 4392 MsMpEng.exe",,,,,,,,,,,,,18446633084030263296,18446633084030238720,140712899206080,0,389820047360,4232,1763591840688933500,389849546752,389849481216,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.7227607Z","2025-11-19 22:37:20.7227607Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3492 svchost.exe",5904,,," 3492 svchost.exe",,,"C:\Windows\System32\wintrust.dll",,,,,,,,,,,,,,,,1763591840722760700,,,,,140712860844032,140712860844032,590783,520192,452262045,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.7236916Z","2025-11-19 22:37:20.7236916Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4392 MsMpEng.exe",8032,,," 4392 MsMpEng.exe",,,,,,,,,,,,,18446633084030205952,18446633084030181376,140712647800224,247,389820039168,8032,1763591840723691600,389849022464,389848956928,140712647800224,428874,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.7244852Z","2025-11-19 22:37:20.7244852Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3492 svchost.exe",5904,,," 3492 svchost.exe",,,,,,,,,,,,,18446633084030492672,18446633084030468096,140712850417280,51,390180667392,11232,1763591840724485200,390182993920,390182961152,140712850417280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.7245695Z","2025-11-19 22:37:20.7245695Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3492 svchost.exe",5904,,," 3492 svchost.exe",,,"C:\Windows\System32\imagehlp.dll",,,,,,,,,,,,,,,,1763591840724569500,,,,,140712892760064,140712892760064,200866,131072,2156568970,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.8298783Z","2025-11-19 22:37:20.8298783Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 9692 PerfWatson2.exe",9752,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084030607360,18446633084030582784,140711612509856,0,1046354423808,12036,1763591840829878300,1046352232448,1046352216064,140711612509856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:21.1973315Z","2025-11-19 22:37:21.1973315Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9920 ServiceHub.IntellicodeModelService.exe",4196,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,18446633084027449344,18446633084027424768,140711612509856,0,46015676416,4196,1763591841197331500,46012694528,46012678144,140711612509856,1084450,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.337559700Z","2025-11-19 22:37:21.5329408Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Running 'standard' config",,,,,,,,,,,,,,,,,1763591841532940800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.337798100Z","2025-11-19 22:37:21.5331820Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Before starting subprocess to inject to",,,,,,,,,,,,,,,,,1763591841533182000,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:21.5339696Z","2025-11-19 22:37:21.5339696Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 5604 attack-890.exe",3452,,," 7284 whoami.exe",,,"C:\Windows\System32\whoami.exe",,,,,,,,,,,,,,,,1763591841533969600,,,,,,,160109,,3602411345,134080654423385232,0,"0x","","",5604,6624,6628,3,0,0,1,,,,,,,,,,,, +"2025-11-19 22:37:21.5373410Z","2025-11-19 22:37:21.5373410Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5604 attack-890.exe",3452,,," 7284 whoami.exe",,,,,,,,,,,,,18446633084031127552,18446633084031102976,140702344617136,0,705865940992,14048,1763591841537341000,705864925184,705864916992,140702344617136,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.345203800Z","2025-11-19 22:37:21.5407378Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"After starting subprocess with PID 7284",,,,,,,,,,,,,,,,,1763591841540737800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:21.6656904Z","2025-11-19 22:37:21.6656904Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8972 VBoxTray.exe",9020,,," 8972 VBoxTray.exe",,,,,,,,,,,,,18446633084031156224,18446633084031131648,140700131109808,0,471283195904,13812,1763591841665690400,471299260416,471299256320,140700131109808,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:21.6659145Z","2025-11-19 22:37:21.6659145Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8972 VBoxTray.exe",13812,,," 8972 VBoxTray.exe",,,,,,,,,,,,,18446633084031156224,18446633084031131648,140700131109808,0,471283195904,13812,1763591841665914500,471299260416,471299252224,140700131109808,462070,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:21.7785972Z","2025-11-19 22:37:21.7785972Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5884 SearchProtocolHost.exe",2628,,," 5884 SearchProtocolHost.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,,,,,,,1763591841778597200,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:21.7817636Z","2025-11-19 22:37:21.7817636Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5884 SearchProtocolHost.exe",2628,,," 5884 SearchProtocolHost.exe",,,"C:\Windows\System32\profapi.dll",,,,,,,,,,,,,,,,1763591841781763600,,,,,140712848850944,140712848850944,229548,167936,2447194521,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:21.7818665Z","2025-11-19 22:37:21.7818665Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5884 SearchProtocolHost.exe",2628,,," 5884 SearchProtocolHost.exe",,,,,,,,,,,,,18446633084030406656,18446633084030382080,140712899206080,0,100230713344,14588,1763591841781866500,100232331264,100232298496,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.1405740Z","2025-11-19 22:37:22.1405740Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","12492 vcpkgsrv.exe",5660,,,"12492 vcpkgsrv.exe",,,,,,,,,,,,,18446633083994841088,18446633083994816512,1996775712,0,2646016,5660,1763591842140574000,82115456,82083840,1996775712,8294629,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.1405740Z","2025-11-19 22:37:22.1405740Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","12492 vcpkgsrv.exe",11756,,,"12492 vcpkgsrv.exe",,,,,,,,,,,,,18446633083994554368,18446633083994529792,1996775712,0,2678784,11756,1763591842140574000,82639744,82608128,1996775712,7370867,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.1405831Z","2025-11-19 22:37:22.1405831Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","12492 vcpkgsrv.exe",12180,,,"12492 vcpkgsrv.exe",,,,,,,,,,,,,18446633083994812416,18446633083994787840,1996775712,0,2662400,12180,1763591842140583100,82377600,82345984,1996775712,6546307,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.1562316Z","2025-11-19 22:37:22.1562316Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6836 vcpkgsrv.exe",7868,,," 6836 vcpkgsrv.exe",,,,,,,,,,,,,18446633083994869760,18446633083994845184,1996775712,0,3006464,7868,1763591842156231600,92011392,91979776,1996775712,9602384,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.1562444Z","2025-11-19 22:37:22.1562444Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6836 vcpkgsrv.exe",9036,,," 6836 vcpkgsrv.exe",,,,,,,,,,,,,18446633083993722880,18446633083993698304,1996775712,0,2990080,9036,1763591842156244400,87554944,87523328,1996775712,7058542,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.1562554Z","2025-11-19 22:37:22.1562554Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6836 vcpkgsrv.exe",5384,,," 6836 vcpkgsrv.exe",,,,,,,,,,,,,18446633083994296320,18446633083994271744,1996775712,0,2973696,5384,1763591842156255400,81066880,81035264,1996775712,4502262,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.3316961Z","2025-11-19 22:37:22.3316961Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",12036,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084030607360,18446633084030582784,140711612509856,0,1046354423808,12036,1763591842331696100,1046352232448,1046352216064,140711612509856,931306,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:23.308564200Z","2025-11-19 22:37:22.5236651Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Before opening process handle",,,,,,,,,,,,,,,,,1763591842523665100,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:23.308868400Z","2025-11-19 22:37:22.5239746Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"After opening process handle",,,,,,,,,,,,,,,,,1763591842523974600,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.8295591Z","2025-11-19 22:37:22.8295591Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 9388 devenv.exe",9392,,," 9388 devenv.exe",,,,,,,,,,,,,18446633084031385600,18446633084031361024,140711613062896,0,1033377177600,7724,1763591842829559100,1033415163904,1033415155712,140711613062896,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.8335220Z","2025-11-19 22:37:22.8335220Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9388 devenv.exe",7724,,," 9388 devenv.exe",,,,,,,,,,,,,18446633084031385600,18446633084031361024,140711613062896,0,1033377177600,7724,1763591842833522000,1033415163904,1033415143424,140711613062896,14353592,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:24.262849900Z","2025-11-19 22:37:23.4973313Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Before allocating memory for shellcode",,,,,,,,,,,,,,,,,1763591843497331300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:24.263130400Z","2025-11-19 22:37:23.4976143Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"After allocating memory for shellcode at 00000249213E0000",,,,,,,,,,,,,,,,,1763591843497614300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:25.227755400Z","2025-11-19 22:37:24.4818310Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Before writing shellcode to process",,,,,,,,,,,,,,,,,1763591844481831000,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:25.228060100Z","2025-11-19 22:37:24.4821409Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"After writing shellcode to process at 00000249213E0000",,,,,,,,,,,,,,,,,1763591844482140900,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:25.2014730Z","2025-11-19 22:37:25.2014730Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5184 explorer.exe",15136,,," 5184 explorer.exe",,,,,,,,,,,,,18446633084027592704,18446633084027568128,140712891545280,0,15360000,15136,1763591845201473000,470351872,470294528,140712891545280,63346597,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:25.3923641Z","2025-11-19 22:37:25.3923641Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","10404 NisSrv.exe",4312,,,"10404 NisSrv.exe",,,,,,,,,,,,,18446633083999313920,18446633083999289344,140712899206080,0,792924913664,4312,1763591845392364100,792924389376,792924323840,140712899206080,494887,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:25.3923667Z","2025-11-19 22:37:25.3923667Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3604 dllhost.exe",11476,,," 3604 dllhost.exe",,,,,,,,,,,,,18446633083999285248,18446633083999260672,140712899206080,0,256852123648,11476,1763591845392366700,256853934080,256853901312,140712899206080,241408,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.182844300Z","2025-11-19 22:37:25.4563155Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Before changing memory protection to PAGE_EXECUTE_READ",,,,,,,,,,,,,,,,,1763591845456315500,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.183142300Z","2025-11-19 22:37:25.4566185Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"After changing memory protection to PAGE_EXECUTE_READ",,,,,,,,,,,,,,,,,1763591845456618500,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:25.6312786Z","2025-11-19 22:37:25.6312786Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3232 dllhost.exe",8960,,," 3232 dllhost.exe",,,,,,,,,,,,,18446633084035751936,18446633084035727360,140712899206080,0,493780983808,8960,1763591845631278600,493783875584,493783842816,140712899206080,221416,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.1657030Z","2025-11-19 22:37:26.1657030Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\twinapi.dll",,,,,,,,,,,,,,,,1763591846165703000,,,,,140712415789056,140712415789056,924452,868352,2129603828,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4082033Z","2025-11-19 22:37:26.4082033Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"10404 NisSrv.exe",,,,,,,,,,,,,18446633083999313920,18446633083999289344,140712899206080,0,792924921856,6856,1763591846408203300,792924389376,792924323840,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4083766Z","2025-11-19 22:37:26.4083766Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3604 dllhost.exe",,,,,,,,,,,,,18446633084031959040,18446633084031934464,140712899206080,0,256852131840,8832,1763591846408376600,256853934080,256853901312,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.147034500Z","2025-11-19 22:37:26.4400898Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Before reading memory to verify write",,,,,,,,,,,,,,,,,1763591846440089800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.147308700Z","2025-11-19 22:37:26.4403653Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Before creating remote thread",,,,,,,,,,,,,,,,,1763591846440365300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4406187Z","2025-11-19 22:37:26.4406187Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5604 attack-890.exe",3452,,," 7284 whoami.exe",,,,,,,,,,,,,18446633084031987712,18446633084031963136,2513113579520,0,705865949184,14412,1763591846440618700,705865449472,705865441280,2513113579520,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.147575800Z","2025-11-19 22:37:26.4406370Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"After creating remote thread",,,,,,,,,,,,,,,,,1763591846440637000,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4407225Z","2025-11-19 22:37:26.4407225Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\whoami.exe",,,,,,,,,,,,,,,,1763591846440722500,,,,,140702344609792,140702344609792,160109,98304,3602411345,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4407621Z","2025-11-19 22:37:26.4407621Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591846440762100,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4441987Z","2025-11-19 22:37:26.4441987Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591846444198700,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4443217Z","2025-11-19 22:37:26.4443217Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591846444321700,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4457000Z","2025-11-19 22:37:26.4457000Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\apphelp.dll",,,,,,,,,,,,,,,,1763591846445700000,,,,,140712800485376,140712800485376,675806,651264,4108425587,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4474777Z","2025-11-19 22:37:26.4474777Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591846447477700,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4475785Z","2025-11-19 22:37:26.4475785Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591846447578500,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4476640Z","2025-11-19 22:37:26.4476640Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,,,,,,,,,,,18446633084032073728,18446633084032049152,140712899206080,0,705865957376,2340,1763591846447664000,705868333056,705868324864,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4477295Z","2025-11-19 22:37:26.4477295Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591846447729500,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4479501Z","2025-11-19 22:37:26.4479501Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591846447950100,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4481009Z","2025-11-19 22:37:26.4481009Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 7284 whoami.exe",2340,,," 7284 whoami.exe",,,,,,,,,,,,,18446633084032102400,18446633084032077824,140712899206080,0,705865965568,10456,1763591846448100900,705868857344,705868849152,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4481023Z","2025-11-19 22:37:26.4481023Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591846448102300,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4483317Z","2025-11-19 22:37:26.4483317Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591846448331700,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4484701Z","2025-11-19 22:37:26.4484701Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591846448470100,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4485775Z","2025-11-19 22:37:26.4485775Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591846448577500,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4486883Z","2025-11-19 22:37:26.4486883Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591846448688300,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4487781Z","2025-11-19 22:37:26.4487781Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591846448778100,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4489528Z","2025-11-19 22:37:26.4489528Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 7284 whoami.exe",10456,,," 7284 whoami.exe",,,,,,,,,,,,,18446633084032131072,18446633084032106496,140712899206080,0,705865973760,14716,1763591846448952800,705869381632,705869373440,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4489859Z","2025-11-19 22:37:26.4489859Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\ws2_32.dll",,,,,,,,,,,,,,,,1763591846448985900,,,,,140712881094656,140712881094656,513405,475136,3967481067,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4490753Z","2025-11-19 22:37:26.4490753Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4392 MsMpEng.exe",4916,,," 4392 MsMpEng.exe",,,,,,,,,,,,,18446633084032159744,18446633084032135168,140712899206080,0,389820055552,1844,1763591846449075300,389849022464,389848956928,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4493466Z","2025-11-19 22:37:26.4493466Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",10456,,," 7284 whoami.exe",,,"C:\Windows\System32\version.dll",,,,,,,,,,,,,,,,1763591846449346600,,,,,140712753168384,140712753168384,72452,45056,2275202464,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4493531Z","2025-11-19 22:37:26.4493531Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14716,,," 7284 whoami.exe",,,"C:\Windows\System32\authz.dll",,,,,,,,,,,,,,,,1763591846449353100,,,,,140712826241024,140712826241024,372179,327680,771731569,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4493680Z","2025-11-19 22:37:26.4493680Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\wkscli.dll",,,,,,,,,,,,,,,,1763591846449368000,,,,,140712738291712,140712738291712,170846,110592,1225555544,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4494965Z","2025-11-19 22:37:26.4494965Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",2340,,," 7284 whoami.exe",,,"C:\Windows\System32\sspicli.dll",,,,,,,,,,,,,,,,1763591846449496500,,,,,140712833384448,140712833384448,339222,299008,3030302172,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4498152Z","2025-11-19 22:37:26.4498152Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",10456,,," 7284 whoami.exe",,,"C:\Windows\System32\netutils.dll",,,,,,,,,,,,,,,,1763591846449815200,,,,,140712825847808,140712825847808,80696,53248,865845000,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4515038Z","2025-11-19 22:37:26.4515038Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,,,,,,,1763591846451503800,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4541760Z","2025-11-19 22:37:26.4541760Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 7284 whoami.exe",14412,,," 3812 calc.exe",,,"C:\Windows\System32\calc.exe",,,,,,,,,,,,,,,,1763591846454176000,,,,,,,90741,,4001445627,134080654471607920,0,"0x","","",7284,6628,6629,3,0,0,1,,,,,,,,,,,, +"2025-11-19 22:37:26.4568912Z","2025-11-19 22:37:26.4568912Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 7284 whoami.exe",14412,,," 3812 calc.exe",,,,,,,,,,,,,18446633084032245760,18446633084032221184,140696878126912,0,801455390720,10660,1763591846456891200,801453899776,801453891584,140696878126912,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4581526Z","2025-11-19 22:37:26.4581526Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\calc.exe",,,,,,,,,,,,,,,,1763591846458152600,,,,,140696878120960,140696878120960,90741,49152,4001445627,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4581973Z","2025-11-19 22:37:26.4581973Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591846458197300,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4628811Z","2025-11-19 22:37:26.4628811Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591846462881100,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4630065Z","2025-11-19 22:37:26.4630065Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591846463006500,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4640583Z","2025-11-19 22:37:26.4640583Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,,,,,,,1763591846464058300,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4642117Z","2025-11-19 22:37:26.4642117Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591846464211700,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4643075Z","2025-11-19 22:37:26.4643075Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591846464307500,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4644282Z","2025-11-19 22:37:26.4644282Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3812 calc.exe",10660,,," 3812 calc.exe",,,,,,,,,,,,,18446633084032274432,18446633084032249856,140712899206080,0,801455398912,7976,1763591846464428200,801456521216,801456513024,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4645279Z","2025-11-19 22:37:26.4645279Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3812 calc.exe",7976,,," 3812 calc.exe",,,,,,,,,,,,,18446633084032331776,18446633084032307200,140712899206080,0,801455407104,14584,1763591846464527900,801457045504,801457037312,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4645607Z","2025-11-19 22:37:26.4645607Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591846464560700,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4647508Z","2025-11-19 22:37:26.4647508Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591846464750800,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4648516Z","2025-11-19 22:37:26.4648516Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591846464851600,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4649551Z","2025-11-19 22:37:26.4649551Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591846464955100,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4650967Z","2025-11-19 22:37:26.4650967Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3812 calc.exe",14584,,," 3812 calc.exe",,,,,,,,,,,,,18446633084032389120,18446633084032364544,140712899206080,0,801455415296,6196,1763591846465096700,801457569792,801457561600,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4651239Z","2025-11-19 22:37:26.4651239Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,,,,,,,1763591846465123900,,,,,140712851341312,140712851341312,1524912,1486848,1404855129,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4653184Z","2025-11-19 22:37:26.4653184Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,,,,,,,1763591846465318400,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4654502Z","2025-11-19 22:37:26.4654502Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591846465450200,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4656236Z","2025-11-19 22:37:26.4656236Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591846465623600,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4658267Z","2025-11-19 22:37:26.4658267Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591846465826700,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4659715Z","2025-11-19 22:37:26.4659715Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591846465971500,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4668828Z","2025-11-19 22:37:26.4668828Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,,,,,,,1763591846466882800,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4696437Z","2025-11-19 22:37:26.4696437Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\windows.storage.dll",,,,,,,,,,,,,,,,1763591846469643700,,,,,140712812412928,140712812412928,8877403,8769536,3667346596,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4703225Z","2025-11-19 22:37:26.4703225Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,,,,,,,1763591846470322500,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4709329Z","2025-11-19 22:37:26.4709329Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,,,,,,,1763591846470932900,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4714414Z","2025-11-19 22:37:26.4714414Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\shlwapi.dll",,,,,,,,,,,,,,,,1763591846471441400,,,,,140712868839424,140712868839424,479562,421888,2142510382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4718323Z","2025-11-19 22:37:26.4718323Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3812 calc.exe",10660,,," 3812 calc.exe",,,,,,,,,,,,,18446633084032417792,18446633084032393216,140712891545280,0,801455423488,6204,1763591846471832300,801458094080,801458085888,140712891545280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4719501Z","2025-11-19 22:37:26.4719501Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\ole32.dll",,,,,,,,,,,,,,,,1763591846471950100,,,,,140712878473216,140712878473216,1689904,1667072,1018821057,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4722524Z","2025-11-19 22:37:26.4722524Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 7284 whoami.exe",14716,,," 7284 whoami.exe",,,,,,,,,,,,,18446633084032131072,18446633084032106496,140712899206080,0,705865973760,14716,1763591846472252400,705869381632,705869373440,140712899206080,2406535,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4722566Z","2025-11-19 22:37:26.4722566Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 7284 whoami.exe",2340,,," 7284 whoami.exe",,,,,,,,,,,,,18446633084032073728,18446633084032049152,140712899206080,0,705865957376,2340,1763591846472256600,705868333056,705868320768,140712899206080,4734616,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4722886Z","2025-11-19 22:37:26.4722886Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 7284 whoami.exe",10456,,," 7284 whoami.exe",,,,,,,,,,,,,18446633084032102400,18446633084032077824,140712899206080,0,705865965568,10456,1763591846472288600,705868857344,705868849152,140712899206080,4410225,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4723088Z","2025-11-19 22:37:26.4723088Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 7284 whoami.exe",14048,,," 7284 whoami.exe",,,,,,,,,,,,,18446633084031127552,18446633084031102976,140702344617136,0,705865940992,14048,1763591846472308800,705864925184,705864916992,140702344617136,41492,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4728396Z","2025-11-19 22:37:26.4728396Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 700 lsass.exe",1344,,," 700 lsass.exe",,,,,,,,,,,,,18446633084031127552,18446633084031102976,140712899206080,0,81706905600,12956,1763591846472839600,81709760512,81709711360,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4731999Z","2025-11-19 22:37:26.4731999Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591846473199900,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4738359Z","2025-11-19 22:37:26.4738359Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\uxtheme.dll",,,,,,,,,,,,,,,,1763591846473835900,,,,,140712802254848,140712802254848,696534,696320,1695798817,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4748159Z","2025-11-19 22:37:26.4748159Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1016 services.exe",2816,,," 5784 svchost.exe",,,"C:\Windows\System32\svchost.exe",,,,,,,,,,,,,,,,1763591846474815900,,,,,,,143552,,14788416,134080654471810362,0,"0x","","",1016,11,6630,1,1,0,0,,,,,,,,,,,, +"2025-11-19 22:37:26.4752828Z","2025-11-19 22:37:26.4752828Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\propsys.dll",,,,,,,,,,,,,,,,1763591846475282800,,,,,140712761491456,140712761491456,1123662,1060864,3228732737,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4754583Z","2025-11-19 22:37:26.4754583Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1016 services.exe",2816,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084032217088,18446633084032192512,140696171073504,0,513414782976,14348,1763591846475458300,513413939200,513413922816,140696171073504,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4758653Z","2025-11-19 22:37:26.4758653Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,,,,,,,1763591846475865300,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4766087Z","2025-11-19 22:37:26.4766087Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",14348,,," 5784 svchost.exe",,,"C:\Windows\System32\svchost.exe",,,,,,,,,,,,,,,,1763591846476608700,,,,,140696171053056,140696171053056,143552,77824,14788416,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4766271Z","2025-11-19 22:37:26.4766271Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",14348,,," 5784 svchost.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591846476627100,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4799460Z","2025-11-19 22:37:26.4799460Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,,,,,,,1763591846479946000,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4802417Z","2025-11-19 22:37:26.4802417Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",14348,,," 5784 svchost.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591846480241700,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4803979Z","2025-11-19 22:37:26.4803979Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",14348,,," 5784 svchost.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591846480397900,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4807609Z","2025-11-19 22:37:26.4807609Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,,,,,,,1763591846480760900,,,,,140712479096832,140712479096832,1613415,1552384,2231457550,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4812229Z","2025-11-19 22:37:26.4812229Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,,,,,,,1763591846481222900,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4815090Z","2025-11-19 22:37:26.4815090Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",14348,,," 5784 svchost.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591846481509000,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4816419Z","2025-11-19 22:37:26.4816419Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5784 svchost.exe",14348,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084032102400,18446633084032077824,140712899206080,0,513414791168,12200,1763591846481641900,513416888320,513416855552,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4823900Z","2025-11-19 22:37:26.4823900Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",14348,,," 5784 svchost.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591846482390000,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4828756Z","2025-11-19 22:37:26.4828756Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",14348,,," 5784 svchost.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591846482875600,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4835328Z","2025-11-19 22:37:26.4835328Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1016 services.exe",,,,,,,,,,,,,18446633084032073728,18446633084032049152,140712899206080,0,156998295552,6816,1763591846483532800,156996403200,156996370432,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4837740Z","2025-11-19 22:37:26.4837740Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084032131072,18446633084032106496,140712899206080,0,513414799360,5288,1763591846483774000,513417412608,513417379840,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4839041Z","2025-11-19 22:37:26.4839041Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5784 svchost.exe",14348,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084032503808,18446633084032479232,140712863364608,0,513414807552,8604,1763591846483904100,513417936896,513417904128,140712863364608,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4843058Z","2025-11-19 22:37:26.4843058Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\urlmon.dll",,,,,,,,,,,,,,,,1763591846484305800,,,,,140712669609984,140712669609984,1970671,1957888,260716450,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4843095Z","2025-11-19 22:37:26.4843095Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",8604,,," 5784 svchost.exe",,,"C:\Windows\System32\wersvc.dll",,,,,,,,,,,,,,,,1763591846484309500,,,,,140712377974784,140712377974784,393902,335872,651237193,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4844347Z","2025-11-19 22:37:26.4844347Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5784 svchost.exe",12200,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084032532480,18446633084032507904,140712899206080,0,513414815744,2748,1763591846484434700,513418461184,513418428416,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4845003Z","2025-11-19 22:37:26.4845003Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5784 svchost.exe",2748,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084032589824,18446633084032565248,140712899206080,0,513414823936,8772,1763591846484500300,513418985472,513418952704,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4845732Z","2025-11-19 22:37:26.4845732Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",8604,,," 5784 svchost.exe",,,"C:\Windows\System32\DiagnosticDataSettings.dll",,,,,,,,,,,,,,,,1763591846484573200,,,,,140712462319616,140712462319616,108991,61440,3234151774,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4846229Z","2025-11-19 22:37:26.4846229Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6196,,," 3812 calc.exe",,,"C:\Windows\System32\iertutil.dll",,,,,,,,,,,,,,,,1763591846484622900,,,,,140712642805760,140712642805760,2984761,2904064,3815768453,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4846726Z","2025-11-19 22:37:26.4846726Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",12200,,," 5784 svchost.exe",,,"C:\Windows\System32\windowsperformancerecordercontrol.dll",,,,,,,,,,,,,,,,1763591846484672600,,,,,140712357462016,140712357462016,1367144,1302528,1403099383,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4847302Z","2025-11-19 22:37:26.4847302Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",2748,,," 5784 svchost.exe",,,"C:\Windows\System32\weretw.dll",,,,,,,,,,,,,,,,1763591846484730200,,,,,140712372731904,140712372731904,267808,245760,3299957735,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4849407Z","2025-11-19 22:37:26.4849407Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",2748,,," 5784 svchost.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,,,,,,,1763591846484940700,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4849950Z","2025-11-19 22:37:26.4849950Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",14584,,," 3812 calc.exe",,,"C:\Windows\System32\srvcli.dll",,,,,,,,,,,,,,,,1763591846484995000,,,,,140712668954624,140712668954624,181029,167936,239922031,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4850866Z","2025-11-19 22:37:26.4850866Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6196,,," 3812 calc.exe",,,"C:\Windows\System32\netutils.dll",,,,,,,,,,,,,,,,1763591846485086600,,,,,140712825847808,140712825847808,80696,53248,865845000,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4851748Z","2025-11-19 22:37:26.4851748Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",2748,,," 5784 svchost.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591846485174800,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4852998Z","2025-11-19 22:37:26.4852998Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",2748,,," 5784 svchost.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,,,,,,,1763591846485299800,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4855952Z","2025-11-19 22:37:26.4855952Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",2748,,," 5784 svchost.exe",,,"C:\Windows\System32\bcrypt.dll",,,,,,,,,,,,,,,,1763591846485595200,,,,,140712848654336,140712848654336,206048,172032,2893678010,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4877533Z","2025-11-19 22:37:26.4877533Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5784 svchost.exe",8604,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084032618496,18446633084032593920,140712378178112,243,513414832128,3068,1763591846487753300,513419509760,513419476992,140712378178112,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4882101Z","2025-11-19 22:37:26.4882101Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5784 svchost.exe",8604,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084032675840,18446633084032651264,140712378080832,243,513414840320,14092,1763591846488210100,513420034048,513420001280,140712378080832,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4883853Z","2025-11-19 22:37:26.4883853Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5784 svchost.exe",8604,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084032503808,18446633084032479232,140712863364608,0,513414807552,8604,1763591846488385300,513417936896,513417904128,140712863364608,9893579,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4886534Z","2025-11-19 22:37:26.4886534Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\ieframe.dll",,,,,,,,,,,,,,,,1763591846488653400,,,,,140710222364672,140710222364672,7531896,7499776,575051316,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4886694Z","2025-11-19 22:37:26.4886694Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",5288,,," 5784 svchost.exe",,,"C:\Windows\System32\wer.dll",,,,,,,,,,,,,,,,1763591846488669400,,,,,140712805728256,140712805728256,993632,983040,1987637995,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4895371Z","2025-11-19 22:37:26.4895371Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",5288,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846489537100,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4897960Z","2025-11-19 22:37:26.4897960Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.7019_none_3e06ffa0e335b8a8\comctl32.dll",,,,,,,,,,,,,,,,1763591846489796000,,,,,140712659910656,140712659910656,2747780,2703360,4095768276,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4901708Z","2025-11-19 22:37:26.4901708Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5784 svchost.exe",5288,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846490170800,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4904097Z","2025-11-19 22:37:26.4904097Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",5288,,," 5784 svchost.exe",,,"C:\Windows\System32\CorePrivacySettingsStore.dll",,,,,,,,,,,,,,,,1763591846490409700,,,,,140712456290304,140712456290304,263379,196608,2978004593,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4919326Z","2025-11-19 22:37:26.4919326Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\secur32.dll",,,,,,,,,,,,,,,,1763591846491932600,,,,,140712800223232,140712800223232,112844,53248,632019051,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4922137Z","2025-11-19 22:37:26.4922137Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\sspicli.dll",,,,,,,,,,,,,,,,1763591846492213700,,,,,140712833384448,140712833384448,339222,299008,3030302172,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4928237Z","2025-11-19 22:37:26.4928237Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\mlang.dll",,,,,,,,,,,,,,,,1763591846492823700,,,,,140712293761024,140712293761024,318858,278528,3734874788,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4929792Z","2025-11-19 22:37:26.4929792Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",5288,,," 5784 svchost.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,,,,,,,1763591846492979200,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4932006Z","2025-11-19 22:37:26.4932006Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\wininet.dll",,,,,,,,,,,,,,,,1763591846493200600,,,,,140712675573760,140712675573760,2677835,2658304,2422963474,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4940521Z","2025-11-19 22:37:26.4940521Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",5288,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846494052100,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4944064Z","2025-11-19 22:37:26.4944064Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\profapi.dll",,,,,,,,,,,,,,,,1763591846494406400,,,,,140712848850944,140712848850944,229548,167936,2447194521,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4945317Z","2025-11-19 22:37:26.4945317Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5784 svchost.exe",5288,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846494531700,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4964884Z","2025-11-19 22:37:26.4964884Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5784 svchost.exe",5288,,," 5784 svchost.exe",,,"C:\Windows\System32\wer.dll",,,,,,,,,,,,,,,,1763591846496488400,,,,,140712805728256,140712805728256,993632,995328,1987637995,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4969809Z","2025-11-19 22:37:26.4969809Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 5784 svchost.exe",5288,,,"13020 WerFault.exe",,,"C:\Windows\System32\WerFault.exe",,,,,,,,,,,,,,,,1763591846496980900,,,,,,,681036,,630084362,134080654472027581,0,"0x","","",5784,6630,6631,1,1,0,0,,,,,,,,,,,, +"2025-11-19 22:37:26.4984170Z","2025-11-19 22:37:26.4984170Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5784 svchost.exe",5288,,,"13020 WerFault.exe",,,,,,,,,,,,,18446633084032704512,18446633084032679936,140702556693600,243,4297187328,14996,1763591846498417000,4295491584,4295483392,140702556693600,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4996292Z","2025-11-19 22:37:26.4996292Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\WerFault.exe",,,,,,,,,,,,,,,,1763591846499629200,,,,,140702556684288,140702556684288,681036,647168,630084362,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4996635Z","2025-11-19 22:37:26.4996635Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591846499663500,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5006105Z","2025-11-19 22:37:26.5006105Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\edputil.dll",,,,,,,,,,,,,,,,1763591846500610500,,,,,140712471560192,140712471560192,178059,167936,3474529356,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5024731Z","2025-11-19 22:37:26.5024731Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591846502473100,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5025835Z","2025-11-19 22:37:26.5025835Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591846502583500,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5031397Z","2025-11-19 22:37:26.5031397Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\AppXDeploymentClient.dll",,,,,,,,,,,,,,,,1763591846503139700,,,,,140712740257792,140712740257792,1575781,1499136,2615972959,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5032567Z","2025-11-19 22:37:26.5032567Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\imagehlp.dll",,,,,,,,,,,,,,,,1763591846503256800,,,,,140712892760064,140712892760064,200866,131072,2156568970,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5034888Z","2025-11-19 22:37:26.5034888Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",13052,,," 1040 svchost.exe",,,,,,,,,,,,,18446633084032733184,18446633084032708608,140712899206080,0,256031031296,8500,1763591846503488800,256034471936,256034439168,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5037071Z","2025-11-19 22:37:26.5037071Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591846503707100,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5037125Z","2025-11-19 22:37:26.5037125Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",8500,,," 1040 svchost.exe",,,,,,,,,,,,,18446633084032790528,18446633084032765952,140712899206080,0,256031047680,12540,1763591846503712500,256035520512,256035487744,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5037392Z","2025-11-19 22:37:26.5037392Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1016 services.exe",2816,,," 1016 services.exe",,,,,,,,,,,,,18446633084032819200,18446633084032794624,140712899206080,0,156998303744,11304,1763591846503739200,156999614464,156999581696,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5038480Z","2025-11-19 22:37:26.5038480Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,,,,,,,,,,,18446633084032847872,18446633084032823296,140712899206080,0,4297195520,9800,1763591846503848000,4296015872,4296007680,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5039283Z","2025-11-19 22:37:26.5039283Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13020 WerFault.exe",9800,,,"13020 WerFault.exe",,,,,,,,,,,,,18446633084032876544,18446633084032851968,140712899206080,0,4297203712,8392,1763591846503928300,4296540160,4296531968,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5039434Z","2025-11-19 22:37:26.5039434Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,,,,,,,1763591846503943400,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5042193Z","2025-11-19 22:37:26.5042193Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591846504219300,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5042908Z","2025-11-19 22:37:26.5042908Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084032966656,18446633084032942080,140712899206080,0,513414848512,14268,1763591846504290800,513417936896,513417904128,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5043126Z","2025-11-19 22:37:26.5043126Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",8392,,,"13020 WerFault.exe",,,"C:\Windows\System32\cryptsp.dll",,,,,,,,,,,,,,,,1763591846504312700,,,,,140712839217152,140712839217152,146168,110592,1658328178,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5044925Z","2025-11-19 22:37:26.5044925Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13020 WerFault.exe",8392,,,"13020 WerFault.exe",,,,,,,,,,,,,18446633084033167360,18446633084033142784,140712899206080,0,4297211904,11612,1763591846504492500,4297064448,4297056256,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5045208Z","2025-11-19 22:37:26.5045208Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591846504520800,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5047618Z","2025-11-19 22:37:26.5047618Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591846504761800,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5048553Z","2025-11-19 22:37:26.5048553Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",9800,,,"13020 WerFault.exe",,,"C:\Windows\System32\wer.dll",,,,,,,,,,,,,,,,1763591846504855300,,,,,140712805728256,140712805728256,993632,983040,1987637995,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5049284Z","2025-11-19 22:37:26.5049284Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",8392,,,"13020 WerFault.exe",,,"C:\Windows\System32\dbghelp.dll",,,,,,,,,,,,,,,,1763591846504928400,,,,,140712664104960,140712664104960,2282862,2367488,82455296,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5049420Z","2025-11-19 22:37:26.5049420Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",11612,,,"13020 WerFault.exe",,,"C:\Windows\System32\DiagnosticDataSettings.dll",,,,,,,,,,,,,,,,1763591846504942000,,,,,140712462319616,140712462319616,108991,61440,3234151774,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5050027Z","2025-11-19 22:37:26.5050027Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591846505002700,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5050066Z","2025-11-19 22:37:26.5050066Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3812 calc.exe",6204,,," 3812 calc.exe",,,,,,,,,,,,,18446633084033224704,18446633084033200128,140712865112144,0,801455431680,2088,1763591846505006600,801458618368,801458610176,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5052049Z","2025-11-19 22:37:26.5052049Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",8392,,,"13020 WerFault.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,,,,,,,1763591846505204900,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5052250Z","2025-11-19 22:37:26.5052250Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3812 calc.exe",,,,,,,,,,,,,18446633084033310720,18446633084033286144,140712899206080,0,801455439872,652,1763591846505225000,801459142656,801459134464,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5053291Z","2025-11-19 22:37:26.5053291Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",9800,,,"13020 WerFault.exe",,,"C:\Windows\System32\powrprof.dll",,,,,,,,,,,,,,,,1763591846505329100,,,,,140712848195584,140712848195584,457799,385024,2858637235,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5053308Z","2025-11-19 22:37:26.5053308Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,,,,,,,1763591846505330800,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5053978Z","2025-11-19 22:37:26.5053978Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3812 calc.exe",652,,," 3812 calc.exe",,,,,,,,,,,,,18446633084033368064,18446633084033343488,140712899206080,0,801455448064,3100,1763591846505397800,801459666944,801459658752,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5054372Z","2025-11-19 22:37:26.5054372Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",11612,,,"13020 WerFault.exe",,,"C:\Windows\System32\bcrypt.dll",,,,,,,,,,,,,,,,1763591846505437200,,,,,140712848654336,140712848654336,206048,172032,2893678010,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5054424Z","2025-11-19 22:37:26.5054424Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",8392,,,"13020 WerFault.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591846505442400,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5057555Z","2025-11-19 22:37:26.5057555Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\cfgmgr32.dll",,,,,,,,,,,,,,,,1763591846505755500,,,,,140712845049856,140712845049856,385808,356352,1737777300,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5058654Z","2025-11-19 22:37:26.5058654Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",9800,,,"13020 WerFault.exe",,,"C:\Windows\System32\ntmarta.dll",,,,,,,,,,,,,,,,1763591846505865400,,,,,140712831811584,140712831811584,265798,221184,3598506564,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5060640Z","2025-11-19 22:37:26.5060640Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",8392,,,"13020 WerFault.exe",,,"C:\Windows\System32\Faultrep.dll",,,,,,,,,,,,,,,,1763591846506064000,,,,,140712371552256,140712371552256,594974,548864,3149101438,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5061970Z","2025-11-19 22:37:26.5061970Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\twinui.appcore.dll",,,,,,,,,,,,,,,,1763591846506197000,,,,,140712458059776,140712458059776,827472,806912,3228774028,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5063575Z","2025-11-19 22:37:26.5063575Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",11612,,,"13020 WerFault.exe",,,"C:\Windows\System32\dbgcore.dll",,,,,,,,,,,,,,,,1763591846506357500,,,,,140712478244864,140712478244864,263772,245760,3120784319,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5081175Z","2025-11-19 22:37:26.5081175Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\umpdc.dll",,,,,,,,,,,,,,,,1763591846508117600,,,,,140712848064512,140712848064512,98535,81920,1714427184,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5085497Z","2025-11-19 22:37:26.5085497Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\OneCoreUAPCommonProxyStub.dll",,,,,,,,,,,,,,,,1763591846508549700,,,,,140712713977856,140712713977856,6740758,6615040,2011948997,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5095118Z","2025-11-19 22:37:26.5095118Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.7019_none_3e06ffa0e335b8a8\comctl32.dll",,,,,,,,,,,,,,,,1763591846509511800,,,,,140712659910656,140712659910656,2747780,2703360,4095768276,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5096246Z","2025-11-19 22:37:26.5096246Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591846509624600,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5097060Z","2025-11-19 22:37:26.5097060Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591846509706000,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5097917Z","2025-11-19 22:37:26.5097917Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591846509791700,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5099200Z","2025-11-19 22:37:26.5099200Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591846509920000,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5120207Z","2025-11-19 22:37:26.5120207Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846512020700,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5125470Z","2025-11-19 22:37:26.5125470Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846512547000,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5126863Z","2025-11-19 22:37:26.5126863Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\CorePrivacySettingsStore.dll",,,,,,,,,,,,,,,,1763591846512686300,,,,,140712456290304,140712456290304,263379,196608,2978004593,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5132399Z","2025-11-19 22:37:26.5132399Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 4340 sihost.exe",13916,,," 4340 sihost.exe",,,"C:\Windows\System32\Windows.Security.Integrity.dll",,,,,,,,,,,,,,,,1763591846513239900,,,,,140712657616896,140712657616896,193382,118784,3625026862,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5147180Z","2025-11-19 22:37:26.5147180Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,,,,,,,1763591846514718000,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5152530Z","2025-11-19 22:37:26.5152530Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1984 svchost.exe",12532,,," 1984 svchost.exe",,,,,,,,,,,,,18446633084033511424,18446633084033486848,140712899206080,210,1068662685696,5024,1763591846515253000,1068666191872,1068666159104,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5155636Z","2025-11-19 22:37:26.5155636Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846515563600,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5160022Z","2025-11-19 22:37:26.5160022Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846516002200,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5170650Z","2025-11-19 22:37:26.5170650Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",9432,,," 1040 svchost.exe",,,,,,,,,,,,,18446633084033568768,18446633084033544192,140712899206080,0,256031055872,4220,1763591846517065000,256037617664,256037584896,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5171078Z","2025-11-19 22:37:26.5171078Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2228 svchost.exe",14732,,," 2228 svchost.exe",,,,,,,,,,,,,18446633084033626112,18446633084033601536,140712899206080,191,717848268800,12692,1763591846517107800,717850935296,717850902528,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5196294Z","2025-11-19 22:37:26.5196294Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084033712128,18446633084033687552,140712899206080,0,199841259520,8664,1763591846519629400,199839318016,199839309824,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5198874Z","2025-11-19 22:37:26.5198874Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",8664,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084033798144,18446633084033773568,140712899206080,0,199841267712,14376,1763591846519887500,199842856960,199842848768,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5199855Z","2025-11-19 22:37:26.5199855Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",8664,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084033912832,18446633084033888256,140712891545280,0,199841275904,8260,1763591846519985500,199843381248,199843373056,140712891545280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5201152Z","2025-11-19 22:37:26.5201152Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4340 sihost.exe",1696,,," 4340 sihost.exe",,,,,,,,,,,,,18446633084034056192,18446633084034031616,140712899206080,0,645640011776,7292,1763591846520115200,645644943360,645644935168,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5204931Z","2025-11-19 22:37:26.5204931Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4404 svchost.exe",4644,,," 4404 svchost.exe",,,,,,,,,,,,,18446633084034170880,18446633084034146304,140712865112144,98,679905755136,9140,1763591846520493100,679908737024,679908704256,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5211322Z","2025-11-19 22:37:26.5211322Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",14912,,," 6028 svchost.exe",,,,,,,,,,,,,18446633084034314240,18446633084034289664,140712899206080,5,661507424256,14032,1763591846521132200,661510422528,661510389760,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5222504Z","2025-11-19 22:37:26.5222504Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4404 svchost.exe",5524,,," 4404 svchost.exe",,,,,,,,,,,,,18446633084034371584,18446633084034347008,140712899206080,0,679905763328,1300,1763591846522250400,679909261312,679909228544,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5231511Z","2025-11-19 22:37:26.5231511Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591846523151100,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5234656Z","2025-11-19 22:37:26.5234656Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13020 WerFault.exe",11612,,,"13020 WerFault.exe",,,,,,,,,,,,,18446633084033167360,18446633084033142784,140712899206080,0,4297211904,11612,1763591846523465600,4297064448,4297056256,140712899206080,6532729,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5234671Z","2025-11-19 22:37:26.5234671Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13020 WerFault.exe",8392,,,"13020 WerFault.exe",,,,,,,,,,,,,18446633084032876544,18446633084032851968,140712899206080,0,4297203712,8392,1763591846523467100,4296540160,4296523776,140712899206080,8081892,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5234695Z","2025-11-19 22:37:26.5234695Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13020 WerFault.exe",9800,,,"13020 WerFault.exe",,,,,,,,,,,,,18446633084032847872,18446633084032823296,140712899206080,0,4297195520,9800,1763591846523469500,4296015872,4296007680,140712899206080,7302586,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5237811Z","2025-11-19 22:37:26.5237811Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",8260,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084032847872,18446633084032823296,140712865112144,0,199841284096,7648,1763591846523781100,199843905536,199843897344,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5240969Z","2025-11-19 22:37:26.5240969Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",8260,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084033167360,18446633084033142784,140712891292720,0,199841292288,4796,1763591846524096900,199844429824,199844421632,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5242561Z","2025-11-19 22:37:26.5242561Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,,,,,,,,,,,18446633084032704512,18446633084032679936,140702556693600,0,4297187328,14996,1763591846524256100,4295491584,4295450624,140702556693600,79585807,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5244263Z","2025-11-19 22:37:26.5244263Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",8260,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084032016384,18446633084031991808,140712891292720,0,199841300480,13628,1763591846524426300,199844954112,199844945920,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5244702Z","2025-11-19 22:37:26.5244702Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\WerFault.exe",,,,,,,,,,,,,,,,1763591846524470300,,,,,140702556684288,140702556684288,681036,647168,630084362,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5244830Z","2025-11-19 22:37:26.5244830Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\Faultrep.dll",,,,,,,,,,,,,,,,1763591846524483000,,,,,140712371552256,140712371552256,594974,548864,3149101438,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5244963Z","2025-11-19 22:37:26.5244963Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\CorePrivacySettingsStore.dll",,,,,,,,,,,,,,,,1763591846524496300,,,,,140712456290304,140712456290304,263379,196608,2978004593,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5245079Z","2025-11-19 22:37:26.5245079Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\DiagnosticDataSettings.dll",,,,,,,,,,,,,,,,1763591846524507900,,,,,140712462319616,140712462319616,108991,61440,3234151774,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5245284Z","2025-11-19 22:37:26.5245284Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\dbgcore.dll",,,,,,,,,,,,,,,,1763591846524528500,,,,,140712478244864,140712478244864,263772,245760,3120784319,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5245331Z","2025-11-19 22:37:26.5245331Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.7019_none_3e06ffa0e335b8a8\comctl32.dll",,,,,,,,,,,,,,,,1763591846524533100,,,,,140712659910656,140712659910656,2747780,2703360,4095768276,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5245438Z","2025-11-19 22:37:26.5245438Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\dbghelp.dll",,,,,,,,,,,,,,,,1763591846524543800,,,,,140712664104960,140712664104960,2282862,2367488,82455296,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5245526Z","2025-11-19 22:37:26.5245526Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\wer.dll",,,,,,,,,,,,,,,,1763591846524552600,,,,,140712805728256,140712805728256,993632,983040,1987637995,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5245607Z","2025-11-19 22:37:26.5245607Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591846524560700,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5245700Z","2025-11-19 22:37:26.5245700Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\ntmarta.dll",,,,,,,,,,,,,,,,1763591846524570000,,,,,140712831811584,140712831811584,265798,221184,3598506564,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5245911Z","2025-11-19 22:37:26.5245911Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\cryptsp.dll",,,,,,,,,,,,,,,,1763591846524591100,,,,,140712839217152,140712839217152,146168,110592,1658328178,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5246025Z","2025-11-19 22:37:26.5246025Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\cfgmgr32.dll",,,,,,,,,,,,,,,,1763591846524602500,,,,,140712845049856,140712845049856,385808,356352,1737777300,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5246124Z","2025-11-19 22:37:26.5246124Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\umpdc.dll",,,,,,,,,,,,,,,,1763591846524612400,,,,,140712848064512,140712848064512,98535,81920,1714427184,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5246222Z","2025-11-19 22:37:26.5246222Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\powrprof.dll",,,,,,,,,,,,,,,,1763591846524622200,,,,,140712848195584,140712848195584,457799,385024,2858637235,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5246318Z","2025-11-19 22:37:26.5246318Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\bcrypt.dll",,,,,,,,,,,,,,,,1763591846524631800,,,,,140712848654336,140712848654336,206048,172032,2893678010,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5246552Z","2025-11-19 22:37:26.5246552Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,,,,,,,1763591846524655200,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5246651Z","2025-11-19 22:37:26.5246651Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591846524665100,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5246738Z","2025-11-19 22:37:26.5246738Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591846524673800,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5246821Z","2025-11-19 22:37:26.5246821Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591846524682100,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5246903Z","2025-11-19 22:37:26.5246903Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591846524690300,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5247110Z","2025-11-19 22:37:26.5247110Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591846524711000,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5247221Z","2025-11-19 22:37:26.5247221Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591846524722100,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5247313Z","2025-11-19 22:37:26.5247313Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,,,,,,,1763591846524731300,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5247396Z","2025-11-19 22:37:26.5247396Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591846524739600,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5247465Z","2025-11-19 22:37:26.5247465Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,,,,,,,1763591846524746500,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5247538Z","2025-11-19 22:37:26.5247538Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591846524753800,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5247676Z","2025-11-19 22:37:26.5247676Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591846524767600,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5247735Z","2025-11-19 22:37:26.5247735Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591846524773600,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5247796Z","2025-11-19 22:37:26.5247796Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,,,,,,,1763591846524779600,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5247849Z","2025-11-19 22:37:26.5247849Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591846524784900,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5247902Z","2025-11-19 22:37:26.5247902Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591846524790200,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5247955Z","2025-11-19 22:37:26.5247955Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591846524795500,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5248036Z","2025-11-19 22:37:26.5248036Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"WerFault.exe",,,,,,,,,,,,,,,,1763591846524803600,,,,,,,,,,134080654472027581,,,,,,,6631,,,,,1810432,1847296,101743666,0,134080654472296792,64,0,1,5,1,0,0 +"2025-11-19 22:37:26.5251511Z","2025-11-19 22:37:26.5251511Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",14376,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084034457600,18446633084034433024,140712899206080,0,199841308672,13944,1763591846525151100,199845478400,199845470208,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5270224Z","2025-11-19 22:37:26.5270224Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",5288,,," 5784 svchost.exe",,,"C:\Windows\System32\Faultrep.dll",,,,,,,,,,,,,,,,1763591846527022400,,,,,140712371552256,140712371552256,594974,548864,3149101438,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5272308Z","2025-11-19 22:37:26.5272308Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",14376,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084032704512,18446633084032679936,140712899206080,0,199841316864,8372,1763591846527230900,199846002688,199845994496,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5279480Z","2025-11-19 22:37:26.5279480Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",5288,,," 5784 svchost.exe",,,"C:\Windows\System32\wer.dll",,,,,,,,,,,,,,,,1763591846527948000,,,,,140712805728256,140712805728256,993632,983040,1987637995,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5282052Z","2025-11-19 22:37:26.5282052Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",8260,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084032045056,18446633084032020480,140712899206080,0,199841325056,14436,1763591846528205200,199846526976,199846518784,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5284531Z","2025-11-19 22:37:26.5284531Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",8260,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084034629632,18446633084034605056,140712899206080,0,199841333248,11504,1763591846528453100,199847051264,199847043072,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5291882Z","2025-11-19 22:37:26.5291882Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",5288,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846529188300,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5292181Z","2025-11-19 22:37:26.5292181Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",14912,,," 2456 Memory Compression",,,,,,,,,,,,,18446633084034801664,18446633084034777088,18446735306729542320,0,0,9992,1763591846529218100,0,0,18446735306729542320,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5292346Z","2025-11-19 22:37:26.5292346Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",14912,,," 2456 Memory Compression",,,,,,,,,,,,,18446633084034973696,18446633084034949120,18446735306729542320,0,0,13288,1763591846529234700,0,0,18446735306729542320,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5292738Z","2025-11-19 22:37:26.5292738Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",14912,,," 2456 Memory Compression",,,,,,,,,,,,,18446633084035002368,18446633084034977792,18446735306728238208,0,0,12392,1763591846529273800,0,0,18446735306728238208,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5293277Z","2025-11-19 22:37:26.5293277Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",14912,,," 2456 Memory Compression",,,,,,,,,,,,,18446633084035031040,18446633084035006464,18446735306729822480,0,0,13828,1763591846529327700,0,0,18446735306729822480,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5295885Z","2025-11-19 22:37:26.5295885Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 6028 svchost.exe",14912,,,"14660 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe\CalculatorApp.exe",,,,,,,,,,,,,,,,1763591846529588500,,,,,,,0,,1758293941,134080654472346829,3,"0x","Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe","App",4340,106,6633,3,0,0,1,,,,,,,,,,,, +"2025-11-19 22:37:26.5298937Z","2025-11-19 22:37:26.5298937Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5784 svchost.exe",5288,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846529893700,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5305120Z","2025-11-19 22:37:26.5305120Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",14912,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084035059712,18446633084035035136,140700165242880,5,61841813504,11616,1763591846530512000,61843963904,61843959808,140700165242880,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5327190Z","2025-11-19 22:37:26.5327190Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",5288,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846532719000,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5328256Z","2025-11-19 22:37:26.5328256Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe\CalculatorApp.exe",,,,,,,,,,,,,,,,1763591846532825600,,,,,140700165210112,140700165210112,0,36864,1758293941,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5328516Z","2025-11-19 22:37:26.5328516Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591846532851600,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5334643Z","2025-11-19 22:37:26.5334643Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5784 svchost.exe",5288,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846533464400,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5343675Z","2025-11-19 22:37:26.5343675Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5184 explorer.exe",11800,,," 5184 explorer.exe",,,"C:\Windows\System32\Windows.StateRepositoryBroker.dll",,,,,,,,,,,,,,,,1763591846534367500,,,,,140712518615040,140712518615040,179235,143360,3561268012,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5358014Z","2025-11-19 22:37:26.5358014Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",5288,,," 5784 svchost.exe",,,"C:\Windows\System32\userenv.dll",,,,,,,,,,,,,,,,1763591846535801400,,,,,140712837054464,140712837054464,245008,176128,731547084,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5362097Z","2025-11-19 22:37:26.5362097Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",5288,,," 5784 svchost.exe",,,"C:\Windows\System32\profapi.dll",,,,,,,,,,,,,,,,1763591846536209700,,,,,140712848850944,140712848850944,229548,167936,2447194521,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5385751Z","2025-11-19 22:37:26.5385751Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",5288,,," 5784 svchost.exe",,,"C:\Windows\System32\sspicli.dll",,,,,,,,,,,,,,,,1763591846538575100,,,,,140712833384448,140712833384448,339222,299008,3030302172,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5393979Z","2025-11-19 22:37:26.5393979Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",6292,,," 5184 explorer.exe",,,,,,,,,,,,,18446633084032876544,18446633084032851968,140712891292720,0,15368192,10612,1763591846539397900,470351872,470294528,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5396692Z","2025-11-19 22:37:26.5396692Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 5784 svchost.exe",5288,,," 5252 WerFault.exe",,,"C:\Windows\System32\WerFault.exe",,,,,,,,,,,,,,,,1763591846539669200,,,,,,,681036,,630084362,134080654472445997,0,"0x","","",7284,6628,6634,3,0,0,1,,,,,,,,,,,, +"2025-11-19 22:37:26.5412000Z","2025-11-19 22:37:26.5412000Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5784 svchost.exe",5288,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084035321856,18446633084035297280,140702556693600,243,295361212416,14976,1763591846541200000,295359938560,295359930368,140702556693600,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5427716Z","2025-11-19 22:37:26.5427716Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\WerFault.exe",,,,,,,,,,,,,,,,1763591846542771600,,,,,140702556684288,140702556684288,681036,647168,630084362,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5427834Z","2025-11-19 22:37:26.5427834Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591846542783400,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5430938Z","2025-11-19 22:37:26.5430938Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591846543093800,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5432060Z","2025-11-19 22:37:26.5432060Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591846543206000,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5433814Z","2025-11-19 22:37:26.5433814Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591846543381400,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5434752Z","2025-11-19 22:37:26.5434752Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591846543475200,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5438262Z","2025-11-19 22:37:26.5438262Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1416 ApplicationFrameHost.exe",4796,,," 1416 ApplicationFrameHost.exe",,,"C:\Windows\System32\Windows.StateRepositoryPS.dll",,,,,,,,,,,,,,,,1763591846543826200,,,,,140712490369024,140712490369024,879719,802816,374042279,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5441461Z","2025-11-19 22:37:26.5441461Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1416 ApplicationFrameHost.exe",13628,,," 1416 ApplicationFrameHost.exe",,,"C:\Windows\System32\MrmCoreR.dll",,,,,,,,,,,,,,,,1763591846544146100,,,,,140712631926784,140712631926784,1191374,1146880,1078870765,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5448212Z","2025-11-19 22:37:26.5448212Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084035551232,18446633084035526656,140712899206080,0,61841821696,7992,1763591846544821300,61845012480,61845008384,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5448579Z","2025-11-19 22:37:26.5448579Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591846544857900,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5450078Z","2025-11-19 22:37:26.5450078Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084035579904,18446633084035555328,140712899206080,0,295361220608,12628,1763591846545007800,295360462848,295360454656,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5450421Z","2025-11-19 22:37:26.5450421Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe\CalculatorApp.dll",,,,,,,,,,,,,,,,1763591846545042100,,,,,140710075629568,140710075629568,0,6352896,1758293941,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5451022Z","2025-11-19 22:37:26.5451022Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5252 WerFault.exe",12628,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084035608576,18446633084035584000,140712899206080,0,295361228800,8368,1763591846545102200,295363411968,295363403776,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5451412Z","2025-11-19 22:37:26.5451412Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,,,,,,,1763591846545141200,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5452108Z","2025-11-19 22:37:26.5452108Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,,,,,,,1763591846545210800,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5452382Z","2025-11-19 22:37:26.5452382Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",7992,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084035637248,18446633084035612672,140712899206080,0,61841829888,4128,1763591846545238200,61846061056,61846056960,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5453483Z","2025-11-19 22:37:26.5453483Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591846545348300,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5453640Z","2025-11-19 22:37:26.5453640Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",8368,,," 5252 WerFault.exe",,,"C:\Windows\System32\cryptsp.dll",,,,,,,,,,,,,,,,1763591846545364000,,,,,140712839217152,140712839217152,146168,110592,1658328178,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5453953Z","2025-11-19 22:37:26.5453953Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591846545395300,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5454506Z","2025-11-19 22:37:26.5454506Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084035665920,18446633084035641344,140712899206080,0,61841838080,13260,1763591846545450600,61847109632,61847105536,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5455053Z","2025-11-19 22:37:26.5455053Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591846545505300,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5455108Z","2025-11-19 22:37:26.5455108Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1416 ApplicationFrameHost.exe",13628,,," 1416 ApplicationFrameHost.exe",,,"C:\Windows\System32\AppXDeploymentClient.dll",,,,,,,,,,,,,,,,1763591846545510800,,,,,140712740257792,140712740257792,1575781,1499136,2615972959,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5455989Z","2025-11-19 22:37:26.5455989Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",4128,,,"14660 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.2.2_2.2.28604.0_x64__8wekyb3d8bbwe\mrt100_app.dll",,,,,,,,,,,,,,,,1763591846545599000,,,,,140712281636864,140712281636864,491795,548864,1580779188,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5456988Z","2025-11-19 22:37:26.5456988Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",7992,,,"14660 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.2.2_2.2.29512.0_x64__8wekyb3d8bbwe\SharedLibrary.dll",,,,,,,,,,,,,,,,1763591846545698800,,,,,140710033162240,140710033162240,13461317,13422592,1605180014,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5457035Z","2025-11-19 22:37:26.5457035Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591846545703500,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5457195Z","2025-11-19 22:37:26.5457195Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1416 ApplicationFrameHost.exe",13628,,," 1416 ApplicationFrameHost.exe",,,"C:\Windows\System32\imagehlp.dll",,,,,,,,,,,,,,,,1763591846545719500,,,,,140712892760064,140712892760064,200866,131072,2156568970,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5457716Z","2025-11-19 22:37:26.5457716Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,,,,,,,1763591846545771600,,,,,140712851341312,140712851341312,1524912,1486848,1404855129,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5458407Z","2025-11-19 22:37:26.5458407Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591846545840700,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5458801Z","2025-11-19 22:37:26.5458801Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",7992,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\ole32.dll",,,,,,,,,,,,,,,,1763591846545880100,,,,,140712878473216,140712878473216,1689904,1667072,1018821057,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5459013Z","2025-11-19 22:37:26.5459013Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",13628,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084035694592,18446633084035670016,140712899206080,0,199841341440,11828,1763591846545901300,199847575552,199847567360,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5459688Z","2025-11-19 22:37:26.5459688Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591846545968800,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5460525Z","2025-11-19 22:37:26.5460525Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",7992,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591846546052500,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5460628Z","2025-11-19 22:37:26.5460628Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",4128,,,"14660 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe\clrcompression.dll",,,,,,,,,,,,,,,,1763591846546062800,,,,,140712633237504,140712633237504,70610,77824,1653667599,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5462188Z","2025-11-19 22:37:26.5462188Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",13260,,,"14660 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.33519.0_x64__8wekyb3d8bbwe\vcruntime140_app.dll",,,,,,,,,,,,,,,,1763591846546218800,,,,,140712297627648,140712297627648,155734,118784,1024347489,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5462454Z","2025-11-19 22:37:26.5462454Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",7992,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591846546245400,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5463071Z","2025-11-19 22:37:26.5463071Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",4796,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084035809280,18446633084035784704,140712891292720,0,199841349632,10832,1763591846546307100,199848099840,199848091648,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5463310Z","2025-11-19 22:37:26.5463310Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,,,,,,,1763591846546331000,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5464045Z","2025-11-19 22:37:26.5464045Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5252 WerFault.exe",8368,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084035780608,18446633084035756032,140712899206080,0,295361236992,13036,1763591846546404500,295363936256,295363928064,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5464303Z","2025-11-19 22:37:26.5464303Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",7992,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591846546430300,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5464807Z","2025-11-19 22:37:26.5464807Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,,,,,,,1763591846546480700,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5465145Z","2025-11-19 22:37:26.5465145Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",7992,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591846546514500,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5466119Z","2025-11-19 22:37:26.5466119Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",7992,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591846546611900,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5466387Z","2025-11-19 22:37:26.5466387Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591846546638700,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5467434Z","2025-11-19 22:37:26.5467434Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",7992,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591846546743400,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5468788Z","2025-11-19 22:37:26.5468788Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\DiagnosticDataSettings.dll",,,,,,,,,,,,,,,,1763591846546878800,,,,,140712462319616,140712462319616,108991,61440,3234151774,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5468834Z","2025-11-19 22:37:26.5468834Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",7992,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591846546883400,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5469678Z","2025-11-19 22:37:26.5469678Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",12628,,," 5252 WerFault.exe",,,"C:\Windows\System32\wer.dll",,,,,,,,,,,,,,,,1763591846546967800,,,,,140712805728256,140712805728256,993632,983040,1987637995,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5470229Z","2025-11-19 22:37:26.5470229Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",7992,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591846547022900,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5470365Z","2025-11-19 22:37:26.5470365Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",8368,,," 5252 WerFault.exe",,,"C:\Windows\System32\dbghelp.dll",,,,,,,,,,,,,,,,1763591846547036500,,,,,140712664104960,140712664104960,2282862,2367488,82455296,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5470447Z","2025-11-19 22:37:26.5470447Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\powrprof.dll",,,,,,,,,,,,,,,,1763591846547044700,,,,,140712848195584,140712848195584,457799,385024,2858637235,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5471589Z","2025-11-19 22:37:26.5471589Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",7992,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,,,,,,,1763591846547159000,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5472636Z","2025-11-19 22:37:26.5472636Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1416 ApplicationFrameHost.exe",13628,,," 1416 ApplicationFrameHost.exe",,,"C:\Windows\System32\imagehlp.dll",,,,,,,,,,,,,,,,1763591846547263600,,,,,140712892760064,140712892760064,200866,143360,2156568970,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5473171Z","2025-11-19 22:37:26.5473171Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",7992,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\normaliz.dll",,,,,,,,,,,,,,,,1763591846547317100,,,,,140712868773888,140712868773888,48733,32768,3139002400,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5474015Z","2025-11-19 22:37:26.5474015Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",7992,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\crypt32.dll",,,,,,,,,,,,,,,,1763591846547401500,,,,,140712849768448,140712849768448,1584869,1536000,3438168074,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5474632Z","2025-11-19 22:37:26.5474632Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\bcrypt.dll",,,,,,,,,,,,,,,,1763591846547463200,,,,,140712848654336,140712848654336,206048,172032,2893678010,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5475536Z","2025-11-19 22:37:26.5475536Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",13260,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\bcrypt.dll",,,,,,,,,,,,,,,,1763591846547553600,,,,,140712848654336,140712848654336,206048,172032,2893678010,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5475801Z","2025-11-19 22:37:26.5475801Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",8368,,," 5252 WerFault.exe",,,"C:\Windows\System32\cfgmgr32.dll",,,,,,,,,,,,,,,,1763591846547580100,,,,,140712845049856,140712845049856,385808,356352,1737777300,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5478180Z","2025-11-19 22:37:26.5478180Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1416 ApplicationFrameHost.exe",13628,,," 1416 ApplicationFrameHost.exe",,,"C:\Windows\System32\AppXDeploymentClient.dll",,,,,,,,,,,,,,,,1763591846547818000,,,,,140712740257792,140712740257792,1575781,1511424,2615972959,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5478669Z","2025-11-19 22:37:26.5478669Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\Faultrep.dll",,,,,,,,,,,,,,,,1763591846547866900,,,,,140712371552256,140712371552256,594974,548864,3149101438,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5479497Z","2025-11-19 22:37:26.5479497Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",4128,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\dpapi.dll",,,,,,,,,,,,,,,,1763591846547949700,,,,,140712845574144,140712845574144,42814,40960,2473566603,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5482159Z","2025-11-19 22:37:26.5482159Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",13036,,," 5252 WerFault.exe",,,"C:\Windows\System32\ntmarta.dll",,,,,,,,,,,,,,,,1763591846548215900,,,,,140712831811584,140712831811584,265798,221184,3598506564,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5486356Z","2025-11-19 22:37:26.5486356Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",12628,,," 5252 WerFault.exe",,,"C:\Windows\System32\dbgcore.dll",,,,,,,,,,,,,,,,1763591846548635600,,,,,140712478244864,140712478244864,263772,245760,3120784319,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5490612Z","2025-11-19 22:37:26.5490612Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\mrt100.dll",,,,,,,,,,,,,,,,1763591846549061200,,,,,140712698314752,140712698314752,102582,40960,1265422184,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5495929Z","2025-11-19 22:37:26.5495929Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084035751936,18446633084035727360,140712899206080,0,61841846272,11964,1763591846549592900,61848158208,61848154112,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5497433Z","2025-11-19 22:37:26.5497433Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591846549743300,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5500587Z","2025-11-19 22:37:26.5500587Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,,,,,,,1763591846550058700,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5507269Z","2025-11-19 22:37:26.5507269Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\rmclient.dll",,,,,,,,,,,,,,,,1763591846550726900,,,,,140712808808448,140712808808448,282526,221184,1891057501,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5507595Z","2025-11-19 22:37:26.5507595Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\umpdc.dll",,,,,,,,,,,,,,,,1763591846550759500,,,,,140712848064512,140712848064512,98535,81920,1714427184,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5510549Z","2025-11-19 22:37:26.5510549Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084035952640,18446633084035928064,140712281948464,0,61841854464,12508,1763591846551054900,61849206784,61849202688,140712281948464,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5515201Z","2025-11-19 22:37:26.5515201Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,,,,,,,1763591846551520100,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5526048Z","2025-11-19 22:37:26.5526048Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.7019_none_3e06ffa0e335b8a8\comctl32.dll",,,,,,,,,,,,,,,,1763591846552604800,,,,,140712659910656,140712659910656,2747780,2703360,4095768276,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5527731Z","2025-11-19 22:37:26.5527731Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591846552773100,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5529168Z","2025-11-19 22:37:26.5529168Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591846552916800,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5530617Z","2025-11-19 22:37:26.5530617Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591846553061700,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5532231Z","2025-11-19 22:37:26.5532231Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591846553223100,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5537087Z","2025-11-19 22:37:26.5537087Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1016 services.exe",6816,,," 6616 svchost.exe",,,"C:\Windows\System32\svchost.exe",,,,,,,,,,,,,,,,1763591846553708700,,,,,,,143552,,14788416,134080654472583582,0,"0x","","",1016,11,6635,1,1,0,0,,,,,,,,,,,, +"2025-11-19 22:37:26.5537621Z","2025-11-19 22:37:26.5537621Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,,,,,,,1763591846553762100,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5542305Z","2025-11-19 22:37:26.5542305Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",14436,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084036096000,18446633084036071424,140712899206080,0,199841357824,5004,1763591846554230500,199849148416,199849140224,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5542583Z","2025-11-19 22:37:26.5542583Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1016 services.exe",6816,,," 6616 svchost.exe",,,,,,,,,,,,,18446633084036009984,18446633084035985408,140696171073504,0,816038653952,5908,1763591846554258300,816037298176,816037281792,140696171073504,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5550967Z","2025-11-19 22:37:26.5550967Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",5908,,," 6616 svchost.exe",,,"C:\Windows\System32\svchost.exe",,,,,,,,,,,,,,,,1763591846555096800,,,,,140696171053056,140696171053056,143552,77824,14788416,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5551590Z","2025-11-19 22:37:26.5551590Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",5908,,," 6616 svchost.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591846555159000,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5561101Z","2025-11-19 22:37:26.5561101Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\uxtheme.dll",,,,,,,,,,,,,,,,1763591846556110100,,,,,140712802254848,140712802254848,696534,696320,1695798817,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5562230Z","2025-11-19 22:37:26.5562230Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\twinapi.appcore.dll",,,,,,,,,,,,,,,,1763591846556223000,,,,,140712720924672,140712720924672,2401519,2375680,2646458233,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5572355Z","2025-11-19 22:37:26.5572355Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\msctf.dll",,,,,,,,,,,,,,,,1763591846557235500,,,,,140712893022208,140712893022208,1455420,1433600,4155718050,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5583165Z","2025-11-19 22:37:26.5583165Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084036182016,18446633084036157440,140712865112144,0,61841862656,956,1763591846558316500,61850255360,61850247168,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5587337Z","2025-11-19 22:37:26.5587337Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11964,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084032503808,18446633084032479232,140712899206080,0,61841870848,11720,1763591846558733800,61851303936,61851299840,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5591317Z","2025-11-19 22:37:26.5591317Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\Windows.UI.Xaml.dll",,,,,,,,,,,,,,,,1763591846559131700,,,,,140712596865024,140712596865024,17882163,17858560,706442395,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5595566Z","2025-11-19 22:37:26.5595566Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",5908,,," 6616 svchost.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591846559556600,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5599738Z","2025-11-19 22:37:26.5599738Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846559973800,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5599850Z","2025-11-19 22:37:26.5599850Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\iertutil.dll",,,,,,,,,,,,,,,,1763591846559985000,,,,,140712642805760,140712642805760,2984761,2904064,3815768453,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5601623Z","2025-11-19 22:37:26.5601623Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",5908,,," 6616 svchost.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591846560162400,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5603646Z","2025-11-19 22:37:26.5603646Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",4128,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\netutils.dll",,,,,,,,,,,,,,,,1763591846560364600,,,,,140712825847808,140712825847808,80696,53248,865845000,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5605341Z","2025-11-19 22:37:26.5605341Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",7992,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\srvcli.dll",,,,,,,,,,,,,,,,1763591846560534100,,,,,140712668954624,140712668954624,181029,167936,239922031,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5605512Z","2025-11-19 22:37:26.5605512Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846560551200,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5606967Z","2025-11-19 22:37:26.5606967Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\CorePrivacySettingsStore.dll",,,,,,,,,,,,,,,,1763591846560696700,,,,,140712456290304,140712456290304,263379,196608,2978004593,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5628270Z","2025-11-19 22:37:26.5628270Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,,,,,,,1763591846562827000,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5639203Z","2025-11-19 22:37:26.5639203Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6616 svchost.exe",5908,,," 6616 svchost.exe",,,,,,,,,,,,,18446633084034744320,18446633084034719744,140712899206080,0,816038662144,12396,1763591846563920300,816040116224,816040083456,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5639954Z","2025-11-19 22:37:26.5639954Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6616 svchost.exe",12396,,," 6616 svchost.exe",,,,,,,,,,,,,18446633084031729664,18446633084031705088,140712899206080,0,816038670336,13720,1763591846563995400,816040640512,816040607744,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5640851Z","2025-11-19 22:37:26.5640851Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6616 svchost.exe",13720,,," 6616 svchost.exe",,,,,,,,,,,,,18446633084036268032,18446633084036243456,140712899206080,0,816038678528,10796,1763591846564085200,816041164800,816041132032,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5641175Z","2025-11-19 22:37:26.5641175Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\execmodelproxy.dll",,,,,,,,,,,,,,,,1763591846564117500,,,,,140712462647296,140712462647296,123398,81920,3588866498,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5642306Z","2025-11-19 22:37:26.5642306Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",5908,,," 6616 svchost.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591846564230600,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5642606Z","2025-11-19 22:37:26.5642606Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846564260600,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5643518Z","2025-11-19 22:37:26.5643518Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",12396,,," 6616 svchost.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591846564351800,,,,,2495699353600,2495699353600,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5644087Z","2025-11-19 22:37:26.5644087Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 6616 svchost.exe",12396,,," 6616 svchost.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591846564408700,,,,,2495699353600,2495699353600,1436013,1368064,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5644825Z","2025-11-19 22:37:26.5644825Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",13720,,," 6616 svchost.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591846564482600,,,,,2495700729856,2495700729856,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5645458Z","2025-11-19 22:37:26.5645458Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 6616 svchost.exe",13720,,," 6616 svchost.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591846564545800,,,,,2495700729856,2495700729856,1436013,1368064,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5650838Z","2025-11-19 22:37:26.5650838Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846565083800,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5651222Z","2025-11-19 22:37:26.5651222Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",8664,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084036325376,18446633084036300800,140712899206080,0,199841366016,4344,1763591846565122200,199849672704,199849664512,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5655740Z","2025-11-19 22:37:26.5655740Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",5908,,," 6616 svchost.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,,,,,,,1763591846565574000,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5657805Z","2025-11-19 22:37:26.5657805Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11964,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084035866624,18446633084035842048,140712899206080,0,61841879040,496,1763591846565780500,61852352512,61852348416,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5659128Z","2025-11-19 22:37:26.5659128Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",13720,,," 6616 svchost.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591846565912800,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5661966Z","2025-11-19 22:37:26.5661966Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11964,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\OneCoreUAPCommonProxyStub.dll",,,,,,,,,,,,,,,,1763591846566196600,,,,,140712713977856,140712713977856,6740758,6615040,2011948997,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5670887Z","2025-11-19 22:37:26.5670887Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",5908,,," 6616 svchost.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591846567088700,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5673494Z","2025-11-19 22:37:26.5673494Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2688 svchost.exe",14020,,," 2688 svchost.exe",,,,,,,,,,,,,18446633084036354048,18446633084036329472,140712899206080,13,461860601856,4036,1763591846567349400,461863124992,461863059456,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5674619Z","2025-11-19 22:37:26.5674619Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",10796,,," 6616 svchost.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591846567461900,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5682237Z","2025-11-19 22:37:26.5682237Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,,,,,,,1763591846568223800,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5685445Z","2025-11-19 22:37:26.5685445Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084036698112,18446633084036673536,140712891545280,0,61841887232,11644,1763591846568544500,61853401088,61853396992,140712891545280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5687278Z","2025-11-19 22:37:26.5687278Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",5908,,," 6616 svchost.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,,,,,,,1763591846568727800,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5690351Z","2025-11-19 22:37:26.5690351Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\Windows.UI.dll",,,,,,,,,,,,,,,,1763591846569035100,,,,,140712615346176,140712615346176,1414164,1376256,3301850593,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5691801Z","2025-11-19 22:37:26.5691801Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846569180100,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5699282Z","2025-11-19 22:37:26.5699282Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\CoreMessaging.dll",,,,,,,,,,,,,,,,1763591846569928200,,,,,140712796160000,140712796160000,1232710,1208320,2155847221,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5702098Z","2025-11-19 22:37:26.5702098Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",5908,,," 6616 svchost.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591846570209800,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5703114Z","2025-11-19 22:37:26.5703114Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846570311400,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5705948Z","2025-11-19 22:37:26.5705948Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",13720,,," 6616 svchost.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591846570594800,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5708784Z","2025-11-19 22:37:26.5708784Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",10796,,," 6616 svchost.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591846570878400,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5721072Z","2025-11-19 22:37:26.5721072Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",12396,,," 6616 svchost.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591846572107200,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5723892Z","2025-11-19 22:37:26.5723892Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",10796,,," 6616 svchost.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591846572389200,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5724418Z","2025-11-19 22:37:26.5724418Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\uxtheme.dll",,,,,,,,,,,,,,,,1763591846572441800,,,,,140712802254848,140712802254848,696534,696320,1695798817,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5725585Z","2025-11-19 22:37:26.5725585Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",12432,,," 5184 explorer.exe",,,,,,,,,,,,,18446633084036382720,18446633084036358144,140712891292720,0,15376384,5476,1763591846572558500,470876160,470818816,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5747335Z","2025-11-19 22:37:26.5747335Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\urlmon.dll",,,,,,,,,,,,,,,,1763591846574733500,,,,,140712669609984,140712669609984,1970671,1957888,260716450,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5747902Z","2025-11-19 22:37:26.5747902Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",5908,,," 6616 svchost.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591846574790200,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5748669Z","2025-11-19 22:37:26.5748669Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,,,,,,,1763591846574866900,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5749286Z","2025-11-19 22:37:26.5749286Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846574928600,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5750931Z","2025-11-19 22:37:26.5750931Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",13260,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\windows.storage.dll",,,,,,,,,,,,,,,,1763591846575093100,,,,,140712812412928,140712812412928,8877403,8769536,3667346596,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5755393Z","2025-11-19 22:37:26.5755393Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846575539300,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5758335Z","2025-11-19 22:37:26.5758335Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1016 services.exe",2816,,," 1016 services.exe",,,,,,,,,,,,,18446633084035379200,18446633084035354624,140712899206080,0,156998311936,13420,1763591846575833500,157000663040,157000630272,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5761292Z","2025-11-19 22:37:26.5761292Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 6616 svchost.exe",,,,,,,,,,,,,18446633084027592704,18446633084027568128,140712899206080,0,816038686720,14644,1763591846576129200,816041689088,816041656320,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5762722Z","2025-11-19 22:37:26.5762722Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6616 svchost.exe",5908,,," 6616 svchost.exe",,,,,,,,,,,,,18446633084036870144,18446633084036845568,140712863364608,0,816038694912,6360,1763591846576272200,816042213376,816042180608,140712863364608,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5766200Z","2025-11-19 22:37:26.5766200Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",6360,,," 6616 svchost.exe",,,"C:\Windows\System32\ClipSVC.dll",,,,,,,,,,,,,,,,1763591846576620000,,,,,140711799947264,140711799947264,995492,937984,2750693646,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5768886Z","2025-11-19 22:37:26.5768886Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",10796,,," 6616 svchost.exe",,,"C:\Windows\System32\cryptxml.dll",,,,,,,,,,,,,,,,1763591846576888600,,,,,140712699756544,140712699756544,221698,167936,777793652,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5769277Z","2025-11-19 22:37:26.5769277Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",12396,,," 6616 svchost.exe",,,"C:\Windows\System32\wldp.dll",,,,,,,,,,,,,,,,1763591846576927700,,,,,140712840134656,140712840134656,483686,413696,393104014,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5769914Z","2025-11-19 22:37:26.5769914Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",6360,,," 6616 svchost.exe",,,"C:\Windows\System32\cfgmgr32.dll",,,,,,,,,,,,,,,,1763591846576991400,,,,,140712845049856,140712845049856,385808,356352,1737777300,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5779044Z","2025-11-19 22:37:26.5779044Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",13720,,," 6616 svchost.exe",,,"C:\Windows\System32\webservices.dll",,,,,,,,,,,,,,,,1763591846577904400,,,,,140712626225152,140712626225152,1516689,1454080,24987314,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5780367Z","2025-11-19 22:37:26.5780367Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846578036700,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5785558Z","2025-11-19 22:37:26.5785558Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846578555800,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5785928Z","2025-11-19 22:37:26.5785928Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",12396,,," 6616 svchost.exe",,,"C:\Windows\System32\bcrypt.dll",,,,,,,,,,,,,,,,1763591846578592800,,,,,140712848654336,140712848654336,206048,172032,2893678010,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5790575Z","2025-11-19 22:37:26.5790575Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084036726784,18446633084036702208,140712600145104,0,61841895424,11252,1763591846579057600,61854449664,61854445568,140712600145104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5791074Z","2025-11-19 22:37:26.5791074Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084036841472,18446633084036816896,140712604173856,0,61841903616,12480,1763591846579107400,61855498240,61855494144,140712604173856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5795040Z","2025-11-19 22:37:26.5795040Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11252,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\dxgi.dll",,,,,,,,,,,,,,,,1763591846579504000,,,,,140712803631104,140712803631104,1320096,1282048,1861212996,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5797701Z","2025-11-19 22:37:26.5797701Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",4128,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\powrprof.dll",,,,,,,,,,,,,,,,1763591846579770100,,,,,140712848195584,140712848195584,457799,385024,2858637235,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5803771Z","2025-11-19 22:37:26.5803771Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11252,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\umpdc.dll",,,,,,,,,,,,,,,,1763591846580377100,,,,,140712848064512,140712848064512,98535,81920,1714427184,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5814009Z","2025-11-19 22:37:26.5814009Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11252,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\DXCore.dll",,,,,,,,,,,,,,,,1763591846581401000,,,,,140712805400576,140712805400576,331386,274432,2354081039,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5818322Z","2025-11-19 22:37:26.5818322Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11252,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\ResourcePolicyClient.dll",,,,,,,,,,,,,,,,1763591846581832200,,,,,140712809070592,140712809070592,104020,81920,2069163340,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5819795Z","2025-11-19 22:37:26.5819795Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6616 svchost.exe",14644,,," 6616 svchost.exe",,,,,,,,,,,,,18446633084037246976,18446633084037222400,140712899206080,31,816038703104,7752,1763591846581979500,816042737664,816042704896,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5822357Z","2025-11-19 22:37:26.5822357Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6616 svchost.exe",6360,,," 6616 svchost.exe",,,,,,,,,,,,,18446633084036870144,18446633084036845568,140712863364608,0,816038694912,6360,1763591846582235700,816042213376,816042180608,140712863364608,10158747,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5824665Z","2025-11-19 22:37:26.5824665Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",14644,,," 6616 svchost.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,,,,,,,1763591846582466500,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5828577Z","2025-11-19 22:37:26.5828577Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846582857700,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5833239Z","2025-11-19 22:37:26.5833239Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","14660 CalculatorApp.exe",11252,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\ResourcePolicyClient.dll",,,,,,,,,,,,,,,,1763591846583323900,,,,,140712809070592,140712809070592,104020,94208,2069163340,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5834574Z","2025-11-19 22:37:26.5834574Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846583457400,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5835698Z","2025-11-19 22:37:26.5835698Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11252,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\directxdatabasehelper.dll",,,,,,,,,,,,,,,,1763591846583569800,,,,,140712752709632,140712752709632,426573,405504,145563491,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5845291Z","2025-11-19 22:37:26.5845291Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11252,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\cfgmgr32.dll",,,,,,,,,,,,,,,,1763591846584529100,,,,,140712845049856,140712845049856,385808,356352,1737777300,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5850139Z","2025-11-19 22:37:26.5850139Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,,,,,,,1763591846585013900,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5864087Z","2025-11-19 22:37:26.5864087Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe\CalcViewModel.dll",,,,,,,,,,,,,,,,1763591846586408800,,,,,140711788806144,140711788806144,0,2224128,1758293703,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5867568Z","2025-11-19 22:37:26.5867568Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",4128,,,"14660 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.33519.0_x64__8wekyb3d8bbwe\concrt140_app.dll",,,,,,,,,,,,,,,,1763591846586756800,,,,,140712297758720,140712297758720,326544,303104,3173964004,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5867639Z","2025-11-19 22:37:26.5867639Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",13260,,,"14660 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.33519.0_x64__8wekyb3d8bbwe\vccorlib140_app.dll",,,,,,,,,,,,,,,,1763591846586763900,,,,,140712371159040,140712371159040,385886,335872,1316406955,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5868239Z","2025-11-19 22:37:26.5868239Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.33519.0_x64__8wekyb3d8bbwe\vcruntime140_1_app.dll",,,,,,,,,,,,,,,,1763591846586823900,,,,,140712543911936,140712543911936,99370,49152,606015248,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5868919Z","2025-11-19 22:37:26.5868919Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",7992,,,"14660 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.33519.0_x64__8wekyb3d8bbwe\msvcp140_app.dll",,,,,,,,,,,,,,,,1763591846586891900,,,,,140712297037824,140712297037824,626197,573440,3775341646,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5886424Z","2025-11-19 22:37:26.5886424Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11252,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\d3d11.dll",,,,,,,,,,,,,,,,1763591846588642400,,,,,140712786853888,140712786853888,2582658,2498560,2128032819,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5892768Z","2025-11-19 22:37:26.5892768Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\MrmCoreR.dll",,,,,,,,,,,,,,,,1763591846589276800,,,,,140712631926784,140712631926784,1191374,1146880,1078870765,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5899171Z","2025-11-19 22:37:26.5899171Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11252,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\d3d10warp.dll",,,,,,,,,,,,,,,,1763591846589917100,,,,,140712731869184,140712731869184,5958575,5943296,1147803111,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5903912Z","2025-11-19 22:37:26.5903912Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\Windows.StateRepositoryClient.dll",,,,,,,,,,,,,,,,1763591846590391300,,,,,140712696610816,140712696610816,303673,290816,424989122,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5921168Z","2025-11-19 22:37:26.5921168Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11252,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\d2d1.dll",,,,,,,,,,,,,,,,1763591846592116800,,,,,140712777744384,140712777744384,6610469,6537216,3013069957,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5926313Z","2025-11-19 22:37:26.5926313Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591846592631300,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5936153Z","2025-11-19 22:37:26.5936153Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11252,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\DWrite.dll",,,,,,,,,,,,,,,,1763591846593615300,,,,,140712784297984,140712784297984,2543119,2519040,1462185185,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5955621Z","2025-11-19 22:37:26.5955621Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\aepic.dll",,,,,,,,,,,,,,,,1763591846595562100,,,,,140712428109824,140712428109824,641436,577536,321124434,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5961071Z","2025-11-19 22:37:26.5961071Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\profapi.dll",,,,,,,,,,,,,,,,1763591846596107100,,,,,140712848850944,140712848850944,229548,167936,2447194521,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5966342Z","2025-11-19 22:37:26.5966342Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\AppXDeploymentClient.dll",,,,,,,,,,,,,,,,1763591846596634200,,,,,140712740257792,140712740257792,1575781,1499136,2615972959,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5967378Z","2025-11-19 22:37:26.5967378Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\imagehlp.dll",,,,,,,,,,,,,,,,1763591846596737800,,,,,140712892760064,140712892760064,200866,131072,2156568970,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5975316Z","2025-11-19 22:37:26.5975316Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\imagehlp.dll",,,,,,,,,,,,,,,,1763591846597531600,,,,,140712892760064,140712892760064,200866,143360,2156568970,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5975847Z","2025-11-19 22:37:26.5975847Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\AppXDeploymentClient.dll",,,,,,,,,,,,,,,,1763591846597584700,,,,,140712740257792,140712740257792,1575781,1511424,2615972959,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5988529Z","2025-11-19 22:37:26.5988529Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11252,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\TextShaping.dll",,,,,,,,,,,,,,,,1763591846598852900,,,,,140712585789440,140712585789440,770155,733184,2109619091,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5994904Z","2025-11-19 22:37:26.5994904Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\BCP47mrm.dll",,,,,,,,,,,,,,,,1763591846599490400,,,,,140712628322304,140712628322304,278903,212992,835504572,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6006887Z","2025-11-19 22:37:26.6006887Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6616 svchost.exe",7752,,," 6616 svchost.exe",,,"C:\Windows\System32\winbrand.dll",,,,,,,,,,,,,,,,1763591846600688700,,,,,140712543649792,140712543649792,256572,225280,2043489911,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6008547Z","2025-11-19 22:37:26.6008547Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","14660 CalculatorApp.exe",11252,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084036726784,18446633084036702208,140712600145104,0,61841895424,11252,1763591846600854700,61854449664,61854420992,140712600145104,59786572,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6011225Z","2025-11-19 22:37:26.6011225Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\AppXDeploymentClient.dll",,,,,,,,,,,,,,,,1763591846601122500,,,,,140712740257792,140712740257792,1575781,1499136,2615972959,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6012220Z","2025-11-19 22:37:26.6012220Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\imagehlp.dll",,,,,,,,,,,,,,,,1763591846601222000,,,,,140712892760064,140712892760064,200866,131072,2156568970,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6019054Z","2025-11-19 22:37:26.6019054Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\imagehlp.dll",,,,,,,,,,,,,,,,1763591846601905400,,,,,140712892760064,140712892760064,200866,143360,2156568970,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6019518Z","2025-11-19 22:37:26.6019518Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\AppXDeploymentClient.dll",,,,,,,,,,,,,,,,1763591846601951800,,,,,140712740257792,140712740257792,1575781,1511424,2615972959,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6041470Z","2025-11-19 22:37:26.6041470Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 7916 svchost.exe",,,,,,,,,,,,,18446633084036726784,18446633084036702208,140712899206080,0,401963515904,13956,1763591846604147000,401965842432,401965809664,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6044711Z","2025-11-19 22:37:26.6044711Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 7916 svchost.exe",13956,,," 7916 svchost.exe",,,,,,,,,,,,,18446633084037013504,18446633084036988928,140712899206080,90,401963524096,14624,1763591846604471100,401966366720,401966333952,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6060394Z","2025-11-19 22:37:26.6060394Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2992 svchost.exe",8856,,," 2992 svchost.exe",,,,,,,,,,,,,18446633084036612096,18446633084036587520,140712899206080,186,170617462784,332,1763591846606039500,170619568128,170619535360,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6060619Z","2025-11-19 22:37:26.6060619Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3204 Taskmgr.exe",5876,,," 3204 Taskmgr.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,,,,,,,1763591846606061900,,,,,140712479096832,140712479096832,1613415,1552384,2231457550,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6061470Z","2025-11-19 22:37:26.6061470Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084037304320,18446633084037279744,140712632221632,0,61841911808,12900,1763591846606147000,61854449664,61854445568,140712632221632,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6063648Z","2025-11-19 22:37:26.6063648Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846606364800,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6065952Z","2025-11-19 22:37:26.6065952Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3204 Taskmgr.exe",5876,,," 3204 Taskmgr.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,,,,,,,1763591846606595200,,,,,140712479096832,140712479096832,1613415,1564672,2231457550,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6069040Z","2025-11-19 22:37:26.6069040Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846606904100,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6106366Z","2025-11-19 22:37:26.6106366Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.8_8.2501.31001.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.dll",,,,,,,,,,,,,,,,1763591846610636600,,,,,140710095028224,140710095028224,5866761,5873664,2056920596,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6129928Z","2025-11-19 22:37:26.6129928Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe\GraphControl.dll",,,,,,,,,,,,,,,,1763591846612992900,,,,,140711891632128,140711891632128,0,761856,1758293638,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6179798Z","2025-11-19 22:37:26.6179798Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2960 svchost.exe",4584,,," 2960 svchost.exe",,,,,,,,,,,,,18446633084037156864,18446633084037132288,140712899206080,287,403329839104,11740,1763591846617979800,403332661248,403332628480,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6188438Z","2025-11-19 22:37:26.6188438Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2960 svchost.exe",11740,,," 2960 svchost.exe",,,,,,,,,,,,,18446633084031815680,18446633084031791104,140712899206080,287,403329847296,13172,1763591846618843800,403333185536,403333152768,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6189176Z","2025-11-19 22:37:26.6189176Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2960 svchost.exe",11740,,," 2960 svchost.exe",,,,,,,,,,,,,18446633084037332992,18446633084037308416,140712891292720,287,403329855488,11772,1763591846618917600,403333709824,403333677056,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6193177Z","2025-11-19 22:37:26.6193177Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2992 svchost.exe",14440,,," 2992 svchost.exe",,,,,,,,,,,,,18446633084037476352,18446633084037451776,140712899206080,186,170617470976,11856,1763591846619317700,170620092416,170620059648,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6203665Z","2025-11-19 22:37:26.6203665Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\Windows.UI.Xaml.Controls.dll",,,,,,,,,,,,,,,,1763591846620366500,,,,,140712586575872,140712586575872,3327252,3313664,3689468694,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6255431Z","2025-11-19 22:37:26.6255431Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\msctf.dll",,,,,,,,,,,,,,,,1763591846625543100,,,,,140712893022208,140712893022208,1455420,1433600,4155718050,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6277330Z","2025-11-19 22:37:26.6277330Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11964,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\Windows.Shell.ServiceHostBuilder.dll",,,,,,,,,,,,,,,,1763591846627733000,,,,,140712531066880,140712531066880,142966,126976,3904637359,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6289816Z","2025-11-19 22:37:26.6289816Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11964,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\CoreUIComponents.dll",,,,,,,,,,,,,,,,1763591846628981600,,,,,140712742944768,140712742944768,3046501,3022848,801552868,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6354473Z","2025-11-19 22:37:26.6354473Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846635447300,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6362114Z","2025-11-19 22:37:26.6362114Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846636211400,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6369089Z","2025-11-19 22:37:26.6369089Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\InputHost.dll",,,,,,,,,,,,,,,,1763591846636909000,,,,,140712583757824,140712583757824,1989124,1970176,2937052880,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6372769Z","2025-11-19 22:37:26.6372769Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846637276900,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6379103Z","2025-11-19 22:37:26.6379103Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846637910300,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6381420Z","2025-11-19 22:37:26.6381420Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\cryptbase.dll",,,,,,,,,,,,,,,,1763591846638142000,,,,,140712839348224,140712839348224,63718,49152,3897879906,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6394566Z","2025-11-19 22:37:26.6394566Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846639456600,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6400935Z","2025-11-19 22:37:26.6400935Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846640093500,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6410045Z","2025-11-19 22:37:26.6410045Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\netapi32.dll",,,,,,,,,,,,,,,,1763591846641004500,,,,,140712696348672,140712696348672,171999,106496,898597876,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6412559Z","2025-11-19 22:37:26.6412559Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\dsreg.dll",,,,,,,,,,,,,,,,1763591846641255900,,,,,140712764768256,140712764768256,1520707,1466368,4143332483,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6414776Z","2025-11-19 22:37:26.6414776Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",8368,,," 5252 WerFault.exe",,,"C:\Windows\System32\userenv.dll",,,,,,,,,,,,,,,,1763591846641477600,,,,,140712837054464,140712837054464,245008,176128,731547084,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6418554Z","2025-11-19 22:37:26.6418554Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\crypt32.dll",,,,,,,,,,,,,,,,1763591846641855400,,,,,140712849768448,140712849768448,1584869,1536000,3438168074,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6422521Z","2025-11-19 22:37:26.6422521Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084036497408,18446633084036472832,140712899206080,0,295361245184,12560,1763591846642252100,295364460544,295364452352,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6428469Z","2025-11-19 22:37:26.6428469Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\profapi.dll",,,,,,,,,,,,,,,,1763591846642846900,,,,,140712848850944,140712848850944,229548,167936,2447194521,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6454813Z","2025-11-19 22:37:26.6454813Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846645481300,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6460449Z","2025-11-19 22:37:26.6460449Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846646044900,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6467946Z","2025-11-19 22:37:26.6467946Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3232 dllhost.exe",,,,,,,,,,,,,18446633084037763072,18446633084037738496,140712899206080,0,493780992000,10288,1763591846646794600,493783875584,493783842816,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6476504Z","2025-11-19 22:37:26.6476504Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\UiaManager.dll",,,,,,,,,,,,,,,,1763591846647650400,,,,,140712461205504,140712461205504,941078,897024,2628067039,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6483813Z","2025-11-19 22:37:26.6483813Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846648381300,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6491669Z","2025-11-19 22:37:26.6491669Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846649166900,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6496679Z","2025-11-19 22:37:26.6496679Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084037533696,18446633084037509120,140712891292720,0,61841920000,12588,1763591846649667900,61856546816,61856542720,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6502376Z","2025-11-19 22:37:26.6502376Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\WindowManagementAPI.dll",,,,,,,,,,,,,,,,1763591846650237600,,,,,140712738422784,140712738422784,1825044,1794048,1605274449,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6521536Z","2025-11-19 22:37:26.6521536Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846652153700,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6528598Z","2025-11-19 22:37:26.6528598Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4340 sihost.exe",4288,,," 4340 sihost.exe",,,,,,,,,,,,,18446633083999285248,18446633083999260672,140712891292720,0,645640036352,4748,1763591846652859800,645646516224,645646508032,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6529159Z","2025-11-19 22:37:26.6529159Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846652915900,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6562562Z","2025-11-19 22:37:26.6562562Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846656256200,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6570449Z","2025-11-19 22:37:26.6570449Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846657044900,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6571279Z","2025-11-19 22:37:26.6571279Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\Windows.UI.Core.TextInput.dll",,,,,,,,,,,,,,,,1763591846657127900,,,,,140712572354560,140712572354560,1511216,1499136,21441667,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6576227Z","2025-11-19 22:37:26.6576227Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\TextInputFramework.dll",,,,,,,,,,,,,,,,1763591846657622800,,,,,140712628846592,140712628846592,1374424,1339392,3535451269,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6596334Z","2025-11-19 22:37:26.6596334Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846659633400,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6602346Z","2025-11-19 22:37:26.6602346Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846660234700,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6624134Z","2025-11-19 22:37:26.6624134Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846662413400,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6632147Z","2025-11-19 22:37:26.6632147Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846663214700,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6670494Z","2025-11-19 22:37:26.6670494Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846667049400,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6683190Z","2025-11-19 22:37:26.6683190Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846668319000,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6707208Z","2025-11-19 22:37:26.6707208Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846670720800,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6714648Z","2025-11-19 22:37:26.6714648Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846671464800,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6724458Z","2025-11-19 22:37:26.6724458Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\Windows.UI.Immersive.dll",,,,,,,,,,,,,,,,1763591846672445800,,,,,140712595423232,140712595423232,1424120,1372160,1559948871,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6732346Z","2025-11-19 22:37:26.6732346Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846673234600,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6736820Z","2025-11-19 22:37:26.6736820Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\DataExchange.dll",,,,,,,,,,,,,,,,1763591846673682100,,,,,140712406614016,140712406614016,399312,368640,696309968,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6737187Z","2025-11-19 22:37:26.6737187Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846673718700,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6791641Z","2025-11-19 22:37:26.6791641Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",8500,,," 1040 svchost.exe",,,,,,,,,,,,,18446633084036870144,18446633084036845568,140712899206080,0,256031064064,12504,1763591846679164100,256038141952,256038109184,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6794671Z","2025-11-19 22:37:26.6794671Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084036669440,18446633084036644864,140712899206080,0,61841928192,11328,1763591846679467100,61857595392,61857591296,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6826487Z","2025-11-19 22:37:26.6826487Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\Windows.Storage.ApplicationData.dll",,,,,,,,,,,,,,,,1763591846682648800,,,,,140712299528192,140712299528192,453266,393216,843877859,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6832366Z","2025-11-19 22:37:26.6832366Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084037619712,18446633084037595136,140712865112144,0,61841936384,336,1763591846683236600,61858643968,61858635776,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6839927Z","2025-11-19 22:37:26.6839927Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8972 VBoxTray.exe",9020,,," 8972 VBoxTray.exe",,,,,,,,,,,,,18446633084036812800,18446633084036788224,140700131109808,0,471283204096,6380,1763591846683992700,471299260416,471299256320,140700131109808,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6842196Z","2025-11-19 22:37:26.6842196Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8972 VBoxTray.exe",6380,,," 8972 VBoxTray.exe",,,,,,,,,,,,,18446633084036812800,18446633084036788224,140700131109808,0,471283204096,6380,1763591846684219600,471299260416,471299252224,140700131109808,481308,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6984934Z","2025-11-19 22:37:26.6984934Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\psapi.dll",,,,,,,,,,,,,,,,1763591846698493400,,,,,140712898396160,140712898396160,102773,32768,992462114,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6990224Z","2025-11-19 22:37:26.6990224Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\version.dll",,,,,,,,,,,,,,,,1763591846699022400,,,,,140712753168384,140712753168384,72452,45056,2275202464,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7146538Z","2025-11-19 22:37:26.7146538Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084037562368,18446633084037537792,140712297841152,0,61841944576,9644,1763591846714653900,61859692544,61859688448,140712297841152,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7152683Z","2025-11-19 22:37:26.7152683Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\Windows.Globalization.dll",,,,,,,,,,,,,,,,1763591846715268300,,,,,140712593457152,140712593457152,1640332,1634304,3240919660,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7193732Z","2025-11-19 22:37:26.7193732Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\verifier.dll",,,,,,,,,,,,,,,,1763591846719373200,,,,,140712384724992,140712384724992,444365,466944,1438812236,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7199842Z","2025-11-19 22:37:26.7199842Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\verifier.dll",,,,,,,,,,,,,,,,1763591846719984200,,,,,140712384724992,140712384724992,444365,479232,1438812236,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7200159Z","2025-11-19 22:37:26.7200159Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\psapi.dll",,,,,,,,,,,,,,,,1763591846720015900,,,,,140712898396160,140712898396160,102773,45056,992462114,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7201002Z","2025-11-19 22:37:26.7201002Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\version.dll",,,,,,,,,,,,,,,,1763591846720100200,,,,,140712753168384,140712753168384,72452,57344,2275202464,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7222332Z","2025-11-19 22:37:26.7222332Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846722233200,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7228469Z","2025-11-19 22:37:26.7228469Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846722846900,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7251297Z","2025-11-19 22:37:26.7251297Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\windows.storage.dll",,,,,,,,,,,,,,,,1763591846725129700,,,,,140712812412928,140712812412928,8877403,8769536,3667346596,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7266237Z","2025-11-19 22:37:26.7266237Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\shlwapi.dll",,,,,,,,,,,,,,,,1763591846726623700,,,,,140712868839424,140712868839424,479562,421888,2142510382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7291634Z","2025-11-19 22:37:26.7291634Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846729163400,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7306677Z","2025-11-19 22:37:26.7306677Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846730667700,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7332830Z","2025-11-19 22:37:26.7332830Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846733283000,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7343499Z","2025-11-19 22:37:26.7343499Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846734350000,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7392655Z","2025-11-19 22:37:26.7392655Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\Windows.Globalization.Fontgroups.dll",,,,,,,,,,,,,,,,1763591846739265500,,,,,140712285044736,140712285044736,126310,86016,2401575024,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7397918Z","2025-11-19 22:37:26.7397918Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",7992,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\BCP47Langs.dll",,,,,,,,,,,,,,,,1763591846739791900,,,,,140712631468032,140712631468032,402331,385024,2065030180,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7412504Z","2025-11-19 22:37:26.7412504Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",336,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\fontgroupsoverride.dll",,,,,,,,,,,,,,,,1763591846741250400,,,,,140712536702976,140712536702976,84550,45056,3684684608,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7427338Z","2025-11-19 22:37:26.7427338Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 9692 PerfWatson2.exe",9752,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084037992448,18446633084037967872,140711612509856,0,1046354432000,13872,1763591846742733800,1046352232448,1046352216064,140711612509856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7476332Z","2025-11-19 22:37:26.7476332Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\dcomp.dll",,,,,,,,,,,,,,,,1763591846747633300,,,,,140712789409792,140712789409792,2309196,2240512,1200801128,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7480223Z","2025-11-19 22:37:26.7480223Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",7992,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\Microsoft.Internal.WarpPal.dll",,,,,,,,,,,,,,,,1763591846748022300,,,,,140712769683456,140712769683456,167600,102400,2132685858,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7497547Z","2025-11-19 22:37:26.7497547Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\Windows.Energy.dll",,,,,,,,,,,,,,,,1763591846749754700,,,,,140712294088704,140712294088704,340121,335872,1240800996,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7597159Z","2025-11-19 22:37:26.7597159Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084038049792,18446633084038025216,140712899206080,0,513414856704,1652,1763591846759716000,513420558336,513420525568,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7629745Z","2025-11-19 22:37:26.7629745Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846762974500,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7639048Z","2025-11-19 22:37:26.7639048Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846763904800,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7669394Z","2025-11-19 22:37:26.7669394Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846766939400,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7675500Z","2025-11-19 22:37:26.7675500Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846767550000,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7676165Z","2025-11-19 22:37:26.7676165Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\Windows.ApplicationModel.dll",,,,,,,,,,,,,,,,1763591846767616500,,,,,140712508391424,140712508391424,945679,876544,2857312343,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7682249Z","2025-11-19 22:37:26.7682249Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846768224900,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7683160Z","2025-11-19 22:37:26.7683160Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\Windows.Graphics.dll",,,,,,,,,,,,,,,,1763591846768316100,,,,,140712711225344,140712711225344,669723,593920,1068018205,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7686818Z","2025-11-19 22:37:26.7686818Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846768681800,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7695232Z","2025-11-19 22:37:26.7695232Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846769523200,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7699525Z","2025-11-19 22:37:26.7699525Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846769952500,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7708157Z","2025-11-19 22:37:26.7708157Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,,,,,,,1763591846770815700,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7718337Z","2025-11-19 22:37:26.7718337Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\netprofm.dll",,,,,,,,,,,,,,,,1763591846771833700,,,,,140712762802176,140712762802176,450621,450560,2204449876,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7736710Z","2025-11-19 22:37:26.7736710Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084038164480,18446633084038139904,140712865112144,0,295361253376,1248,1763591846773671100,295364984832,295364976640,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7738817Z","2025-11-19 22:37:26.7738817Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084038193152,18446633084038168576,140712899206080,0,295361261568,10204,1763591846773881700,295365509120,295365500928,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7740150Z","2025-11-19 22:37:26.7740150Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5252 WerFault.exe",10204,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084038221824,18446633084038197248,140712899206080,0,295361269760,8320,1763591846774015000,295366033408,295366025216,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7760840Z","2025-11-19 22:37:26.7760840Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\npmproxy.dll",,,,,,,,,,,,,,,,1763591846776084000,,,,,140712730820608,140712730820608,124253,102400,1533975845,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7785884Z","2025-11-19 22:37:26.7785884Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\netprofm.dll",,,,,,,,,,,,,,,,1763591846778588400,,,,,140712762802176,140712762802176,450621,462848,2204449876,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7786556Z","2025-11-19 22:37:26.7786556Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\npmproxy.dll",,,,,,,,,,,,,,,,1763591846778655700,,,,,140712730820608,140712730820608,124253,114688,1533975845,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7789758Z","2025-11-19 22:37:26.7789758Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\xmllite.dll",,,,,,,,,,,,,,,,1763591846778975800,,,,,140712684027904,140712684027904,342897,274432,974526834,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7804135Z","2025-11-19 22:37:26.7804135Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,,,,,,,1763591846780413500,,,,,140712426930176,140712426930176,1213372,1146880,2699219668,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7810252Z","2025-11-19 22:37:26.7810252Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846781025200,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7817359Z","2025-11-19 22:37:26.7817359Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846781735900,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7817975Z","2025-11-19 22:37:26.7817975Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,,,,,,,1763591846781797500,,,,,140712426930176,140712426930176,1213372,1159168,2699219668,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7824319Z","2025-11-19 22:37:26.7824319Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,,,,,,,1763591846782431900,,,,,140712426930176,140712426930176,1213372,1146880,2699219668,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7839217Z","2025-11-19 22:37:26.7839217Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\WinRtTracing.dll",,,,,,,,,,,,,,,,1763591846783921700,,,,,140712799240192,140712799240192,246648,212992,1391536235,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7848612Z","2025-11-19 22:37:26.7848612Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe\TraceLogging.dll",,,,,,,,,,,,,,,,1763591846784861200,,,,,140712633171968,140712633171968,0,49152,1758293586,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7933603Z","2025-11-19 22:37:26.7933603Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,,,,,,,1763591846793360300,,,,,140712531263488,140712531263488,1042724,999424,915912993,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7980583Z","2025-11-19 22:37:26.7980583Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,,,,,,,1763591846798058400,,,,,140712531263488,140712531263488,1042724,1011712,915912993,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7981935Z","2025-11-19 22:37:26.7981935Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,,,,,,,1763591846798193500,,,,,140712426930176,140712426930176,1213372,1159168,2699219668,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7985225Z","2025-11-19 22:37:26.7985225Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,,,,,,,1763591846798522500,,,,,140712531263488,140712531263488,1042724,999424,915912993,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7996185Z","2025-11-19 22:37:26.7996185Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\Windows.UI.Xaml.Phone.dll",,,,,,,,,,,,,,,,1763591846799618500,,,,,140712592146432,140712592146432,1295254,1273856,3672194386,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8273760Z","2025-11-19 22:37:26.8273760Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\MrmCoreR.dll",,,,,,,,,,,,,,,,1763591846827376000,,,,,140712631926784,140712631926784,1191374,1146880,1078870765,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8276243Z","2025-11-19 22:37:26.8276243Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\UserMgrProxy.dll",,,,,,,,,,,,,,,,1763591846827624300,,,,,140712724660224,140712724660224,390456,393216,1431596644,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8281259Z","2025-11-19 22:37:26.8281259Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\Windows.StateRepositoryClient.dll",,,,,,,,,,,,,,,,1763591846828125900,,,,,140712696610816,140712696610816,303673,290816,424989122,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8294137Z","2025-11-19 22:37:26.8294137Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\BCP47mrm.dll",,,,,,,,,,,,,,,,1763591846829413700,,,,,140712628322304,140712628322304,278903,212992,835504572,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8295620Z","2025-11-19 22:37:26.8295620Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\directmanipulation.dll",,,,,,,,,,,,,,,,1763591846829562000,,,,,140712583036928,140712583036928,714070,667648,3434535107,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8302231Z","2025-11-19 22:37:26.8302231Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084038135808,18446633084038111232,140712583404848,0,61841952768,5400,1763591846830223100,61860741120,61860737024,140712583404848,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8304318Z","2025-11-19 22:37:26.8304318Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3812 calc.exe",6204,,," 3812 calc.exe",,,"C:\Windows\System32\Windows.UI.dll",,,,,,,,,,,,,,,,1763591846830431800,,,,,140712615346176,140712615346176,1414164,1376256,3301850593,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8306661Z","2025-11-19 22:37:26.8306661Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11720,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084038279168,18446633084038254592,140712899206080,0,61841960960,8356,1763591846830666100,61861789696,61861785600,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8317076Z","2025-11-19 22:37:26.8317076Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\threadpoolwinrt.dll",,,,,,,,,,,,,,,,1763591846831707600,,,,,140712555839488,140712555839488,130107,90112,2299561022,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8318294Z","2025-11-19 22:37:26.8318294Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3812 calc.exe",14584,,," 3812 calc.exe",,,,,,,,,,,,,18446633084032331776,18446633084032307200,140712899206080,0,801455407104,14584,1763591846831829400,801457045504,801457037312,140712899206080,3186210,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8318295Z","2025-11-19 22:37:26.8318295Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3812 calc.exe",3100,,," 3812 calc.exe",,,,,,,,,,,,,18446633084033368064,18446633084033343488,140712899206080,0,801455448064,3100,1763591846831829600,801459666944,801459658752,140712899206080,817389,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8318300Z","2025-11-19 22:37:26.8318300Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3812 calc.exe",6196,,," 3812 calc.exe",,,,,,,,,,,,,18446633084032389120,18446633084032364544,140712899206080,0,801455415296,6196,1763591846831830000,801457569792,801457557504,140712899206080,7141150,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8318304Z","2025-11-19 22:37:26.8318304Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3812 calc.exe",6204,,," 3812 calc.exe",,,,,,,,,,,,,18446633084032417792,18446633084032393216,140712891545280,0,801455423488,6204,1763591846831830400,801458094080,801458061312,140712891545280,149400621,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8318384Z","2025-11-19 22:37:26.8318384Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3812 calc.exe",2088,,," 3812 calc.exe",,,,,,,,,,,,,18446633084033224704,18446633084033200128,140712865112144,0,801455431680,2088,1763591846831838400,801458618368,801458610176,140712865112144,228960,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8318411Z","2025-11-19 22:37:26.8318411Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3812 calc.exe",652,,," 3812 calc.exe",,,,,,,,,,,,,18446633084033310720,18446633084033286144,140712899206080,0,801455439872,652,1763591846831841100,801459142656,801459134464,140712899206080,531097,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8318477Z","2025-11-19 22:37:26.8318477Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3812 calc.exe",7976,,," 3812 calc.exe",,,,,,,,,,,,,18446633084032274432,18446633084032249856,140712899206080,0,801455398912,7976,1763591846831847700,801456521216,801456513024,140712899206080,4943957,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8320938Z","2025-11-19 22:37:26.8320938Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084032417792,18446633084032393216,140712899206080,0,61841969152,13376,1763591846832093800,61862838272,61862834176,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8329418Z","2025-11-19 22:37:26.8329418Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\WindowsCodecs.dll",,,,,,,,,,,,,,,,1763591846832941800,,,,,140712775385088,140712775385088,2352359,2293760,3466818398,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8332758Z","2025-11-19 22:37:26.8332758Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3812 calc.exe",10660,,," 3812 calc.exe",,,,,,,,,,,,,18446633084032245760,18446633084032221184,140696878126912,0,801455390720,10660,1763591846833275800,801453899776,801453879296,140696878126912,40536930,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8341599Z","2025-11-19 22:37:26.8341599Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\calc.exe",,,,,,,,,,,,,,,,1763591846834159900,,,,,140696878120960,140696878120960,90741,49152,4001445627,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8341708Z","2025-11-19 22:37:26.8341708Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\ieframe.dll",,,,,,,,,,,,,,,,1763591846834170800,,,,,140710222364672,140710222364672,7531896,7499776,575051316,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8341923Z","2025-11-19 22:37:26.8341923Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\mlang.dll",,,,,,,,,,,,,,,,1763591846834192300,,,,,140712293761024,140712293761024,318858,278528,3734874788,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8342112Z","2025-11-19 22:37:26.8342112Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\twinui.appcore.dll",,,,,,,,,,,,,,,,1763591846834211200,,,,,140712458059776,140712458059776,827472,806912,3228774028,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8342249Z","2025-11-19 22:37:26.8342249Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\edputil.dll",,,,,,,,,,,,,,,,1763591846834224900,,,,,140712471560192,140712471560192,178059,167936,3474529356,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8342332Z","2025-11-19 22:37:26.8342332Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,,,,,,,1763591846834233200,,,,,140712479096832,140712479096832,1613415,1552384,2231457550,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8342381Z","2025-11-19 22:37:26.8342381Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\Windows.UI.dll",,,,,,,,,,,,,,,,1763591846834238100,,,,,140712615346176,140712615346176,1414164,1376256,3301850593,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8342427Z","2025-11-19 22:37:26.8342427Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\BCP47mrm.dll",,,,,,,,,,,,,,,,1763591846834242700,,,,,140712628322304,140712628322304,278903,212992,835504572,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8342483Z","2025-11-19 22:37:26.8342483Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\MrmCoreR.dll",,,,,,,,,,,,,,,,1763591846834248300,,,,,140712631926784,140712631926784,1191374,1146880,1078870765,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8342557Z","2025-11-19 22:37:26.8342557Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\iertutil.dll",,,,,,,,,,,,,,,,1763591846834255700,,,,,140712642805760,140712642805760,2984761,2904064,3815768453,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8342591Z","2025-11-19 22:37:26.8342591Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.7019_none_3e06ffa0e335b8a8\comctl32.dll",,,,,,,,,,,,,,,,1763591846834259100,,,,,140712659910656,140712659910656,2747780,2703360,4095768276,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8342650Z","2025-11-19 22:37:26.8342650Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\srvcli.dll",,,,,,,,,,,,,,,,1763591846834265000,,,,,140712668954624,140712668954624,181029,167936,239922031,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8342711Z","2025-11-19 22:37:26.8342711Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\urlmon.dll",,,,,,,,,,,,,,,,1763591846834271100,,,,,140712669609984,140712669609984,1970671,1957888,260716450,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8342846Z","2025-11-19 22:37:26.8342846Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\wininet.dll",,,,,,,,,,,,,,,,1763591846834284600,,,,,140712675573760,140712675573760,2677835,2658304,2422963474,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8342927Z","2025-11-19 22:37:26.8342927Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,,,,,,,1763591846834292700,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8342974Z","2025-11-19 22:37:26.8342974Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\Windows.StateRepositoryClient.dll",,,,,,,,,,,,,,,,1763591846834297400,,,,,140712696610816,140712696610816,303673,290816,424989122,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8343045Z","2025-11-19 22:37:26.8343045Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\OneCoreUAPCommonProxyStub.dll",,,,,,,,,,,,,,,,1763591846834304500,,,,,140712713977856,140712713977856,6740758,6615040,2011948997,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8343116Z","2025-11-19 22:37:26.8343116Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\AppXDeploymentClient.dll",,,,,,,,,,,,,,,,1763591846834311600,,,,,140712740257792,140712740257792,1575781,1499136,2615972959,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8343190Z","2025-11-19 22:37:26.8343190Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\propsys.dll",,,,,,,,,,,,,,,,1763591846834319000,,,,,140712761491456,140712761491456,1123662,1060864,3228732737,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8343252Z","2025-11-19 22:37:26.8343252Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\secur32.dll",,,,,,,,,,,,,,,,1763591846834325200,,,,,140712800223232,140712800223232,112844,53248,632019051,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8343371Z","2025-11-19 22:37:26.8343371Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\uxtheme.dll",,,,,,,,,,,,,,,,1763591846834337100,,,,,140712802254848,140712802254848,696534,696320,1695798817,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8343517Z","2025-11-19 22:37:26.8343517Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\windows.storage.dll",,,,,,,,,,,,,,,,1763591846834351700,,,,,140712812412928,140712812412928,8877403,8769536,3667346596,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8343585Z","2025-11-19 22:37:26.8343585Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\netutils.dll",,,,,,,,,,,,,,,,1763591846834358600,,,,,140712825847808,140712825847808,80696,53248,865845000,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8343654Z","2025-11-19 22:37:26.8343654Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591846834365400,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8343871Z","2025-11-19 22:37:26.8343871Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\sspicli.dll",,,,,,,,,,,,,,,,1763591846834387100,,,,,140712833384448,140712833384448,339222,299008,3030302172,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8343929Z","2025-11-19 22:37:26.8343929Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\profapi.dll",,,,,,,,,,,,,,,,1763591846834392900,,,,,140712848850944,140712848850944,229548,167936,2447194521,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8344049Z","2025-11-19 22:37:26.8344049Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,,,,,,,1763591846834405000,,,,,140712851341312,140712851341312,1524912,1486848,1404855129,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8344127Z","2025-11-19 22:37:26.8344127Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,,,,,,,1763591846834412700,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8344187Z","2025-11-19 22:37:26.8344187Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591846834418700,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8344239Z","2025-11-19 22:37:26.8344239Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591846834423900,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8344298Z","2025-11-19 22:37:26.8344298Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591846834429800,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8344353Z","2025-11-19 22:37:26.8344353Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591846834435300,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8344426Z","2025-11-19 22:37:26.8344426Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591846834442600,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8344479Z","2025-11-19 22:37:26.8344479Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591846834447900,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8344535Z","2025-11-19 22:37:26.8344535Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,,,,,,,1763591846834453500,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8344592Z","2025-11-19 22:37:26.8344592Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\shlwapi.dll",,,,,,,,,,,,,,,,1763591846834459200,,,,,140712868839424,140712868839424,479562,421888,2142510382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8344711Z","2025-11-19 22:37:26.8344711Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,,,,,,,1763591846834471100,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8344776Z","2025-11-19 22:37:26.8344776Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591846834477600,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8344832Z","2025-11-19 22:37:26.8344832Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\ole32.dll",,,,,,,,,,,,,,,,1763591846834483200,,,,,140712878473216,140712878473216,1689904,1667072,1018821057,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8344890Z","2025-11-19 22:37:26.8344890Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,,,,,,,1763591846834489000,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8344947Z","2025-11-19 22:37:26.8344947Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591846834494700,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8345117Z","2025-11-19 22:37:26.8345117Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591846834511700,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8345179Z","2025-11-19 22:37:26.8345179Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,,,,,,,1763591846834517900,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8345292Z","2025-11-19 22:37:26.8345292Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,,,,,,,1763591846834529200,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8345359Z","2025-11-19 22:37:26.8345359Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591846834536000,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8345417Z","2025-11-19 22:37:26.8345417Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,,,,,,,1763591846834541700,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8345475Z","2025-11-19 22:37:26.8345475Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\imagehlp.dll",,,,,,,,,,,,,,,,1763591846834547500,,,,,140712892760064,140712892760064,200866,131072,2156568970,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8345531Z","2025-11-19 22:37:26.8345531Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591846834553100,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8345583Z","2025-11-19 22:37:26.8345583Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591846834558300,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8345648Z","2025-11-19 22:37:26.8345648Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591846834564800,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8345749Z","2025-11-19 22:37:26.8345749Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"calc.exe",,,,,,,,,,,,,,,,1763591846834574900,,,,,,,,,,134080654471607920,,,,,,,6629,,,,,3268608,3305472,213030484,0,134080654475331992,116,0,1,12,3,0,0 +"2025-11-19 22:37:26.9060086Z","2025-11-19 22:37:26.9060086Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1016 services.exe",6816,,,"12756 svchost.exe",,,"C:\Windows\System32\svchost.exe",,,,,,,,,,,,,,,,1763591846906008600,,,,,,,143552,,14788416,134080654476036389,0,"0x","","",1016,11,6636,1,1,0,0,,,,,,,,,,,, +"2025-11-19 22:37:26.9067020Z","2025-11-19 22:37:26.9067020Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1016 services.exe",6816,,,"12756 svchost.exe",,,,,,,,,,,,,18446633084032274432,18446633084032249856,140696171073504,0,111870410752,13856,1763591846906702000,111867592704,111867576320,140696171073504,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9075850Z","2025-11-19 22:37:26.9075850Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",13856,,,"12756 svchost.exe",,,"C:\Windows\System32\svchost.exe",,,,,,,,,,,,,,,,1763591846907585000,,,,,140696171053056,140696171053056,143552,77824,14788416,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9076055Z","2025-11-19 22:37:26.9076055Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",13856,,,"12756 svchost.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591846907605500,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9131307Z","2025-11-19 22:37:26.9131307Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",13856,,,"12756 svchost.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591846913130700,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9134922Z","2025-11-19 22:37:26.9134922Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",13856,,,"12756 svchost.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591846913492200,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9168346Z","2025-11-19 22:37:26.9168346Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","12756 svchost.exe",13856,,,"12756 svchost.exe",,,,,,,,,,,,,18446633084033310720,18446633084033286144,140712899206080,0,111870418944,7100,1763591846916834600,111868116992,111868084224,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9169070Z","2025-11-19 22:37:26.9169070Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","12756 svchost.exe",7100,,,"12756 svchost.exe",,,,,,,,,,,,,18446633084032389120,18446633084032364544,140712899206080,0,111870427136,4004,1763591846916907000,111871000576,111870967808,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9169866Z","2025-11-19 22:37:26.9169866Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","12756 svchost.exe",4004,,,"12756 svchost.exe",,,,,,,,,,,,,18446633084033368064,18446633084033343488,140712899206080,0,111870435328,3784,1763591846916986600,111871524864,111871492096,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9170807Z","2025-11-19 22:37:26.9170807Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",13856,,,"12756 svchost.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591846917080700,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9173408Z","2025-11-19 22:37:26.9173408Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",7100,,,"12756 svchost.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591846917340800,,,,,1342098243584,1342098243584,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9173915Z","2025-11-19 22:37:26.9173915Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","12756 svchost.exe",7100,,,"12756 svchost.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591846917391500,,,,,1342098243584,1342098243584,1436013,1368064,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9184903Z","2025-11-19 22:37:26.9184903Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",13856,,,"12756 svchost.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,,,,,,,1763591846918490300,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9187403Z","2025-11-19 22:37:26.9187403Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",7100,,,"12756 svchost.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591846918740300,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9199557Z","2025-11-19 22:37:26.9199557Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",13856,,,"12756 svchost.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591846919955700,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9201963Z","2025-11-19 22:37:26.9201963Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",3784,,,"12756 svchost.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591846920196300,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9206793Z","2025-11-19 22:37:26.9206793Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",13856,,,"12756 svchost.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,,,,,,,1763591846920679300,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9216635Z","2025-11-19 22:37:26.9216635Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",13856,,,"12756 svchost.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591846921663500,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9219277Z","2025-11-19 22:37:26.9219277Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",4004,,,"12756 svchost.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591846921927700,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9220195Z","2025-11-19 22:37:26.9220195Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",7100,,,"12756 svchost.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591846922019500,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9222714Z","2025-11-19 22:37:26.9222714Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",3784,,,"12756 svchost.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591846922271400,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9224957Z","2025-11-19 22:37:26.9224957Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",7100,,,"12756 svchost.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591846922495700,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9251239Z","2025-11-19 22:37:26.9251239Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",13856,,,"12756 svchost.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591846925123900,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9264172Z","2025-11-19 22:37:26.9264172Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"12756 svchost.exe",,,,,,,,,,,,,18446633084032331776,18446633084032307200,140712899206080,0,111870443520,12564,1763591846926417200,111872049152,111872016384,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9265408Z","2025-11-19 22:37:26.9265408Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","12756 svchost.exe",13856,,,"12756 svchost.exe",,,,,,,,,,,,,18446633084038365184,18446633084038340608,140712863364608,0,111870451712,4888,1763591846926540800,111872573440,111872540672,140712863364608,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9269983Z","2025-11-19 22:37:26.9269983Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",4888,,,"12756 svchost.exe",,,"C:\Windows\System32\AppXDeploymentServer.dll",,,,,,,,,,,,,,,,1763591846926998300,,,,,140710064095232,140710064095232,6176797,6193152,2731354284,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9272756Z","2025-11-19 22:37:26.9272756Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",7100,,,"12756 svchost.exe",,,"C:\Windows\System32\dbgcore.dll",,,,,,,,,,,,,,,,1763591846927275600,,,,,140712478244864,140712478244864,263772,245760,3120784319,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9273313Z","2025-11-19 22:37:26.9273313Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",3784,,,"12756 svchost.exe",,,"C:\Windows\System32\sspicli.dll",,,,,,,,,,,,,,,,1763591846927331300,,,,,140712833384448,140712833384448,339222,299008,3030302172,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9274382Z","2025-11-19 22:37:26.9274382Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",4004,,,"12756 svchost.exe",,,"C:\Windows\System32\cryptsp.dll",,,,,,,,,,,,,,,,1763591846927438200,,,,,140712839217152,140712839217152,146168,110592,1658328178,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9291663Z","2025-11-19 22:37:26.9291663Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",4888,,,"12756 svchost.exe",,,"C:\Windows\System32\StateRepository.Core.dll",,,,,,,,,,,,,,,,1763591846929166300,,,,,140712689729536,140712689729536,860235,815104,2968648981,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9296418Z","2025-11-19 22:37:26.9296418Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",4888,,,"12756 svchost.exe",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,,,,,,,1763591846929641800,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9301563Z","2025-11-19 22:37:26.9301563Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",4888,,,"12756 svchost.exe",,,"C:\Windows\System32\wevtapi.dll",,,,,,,,,,,,,,,,1763591846930156300,,,,,140712768372736,140712768372736,361437,339968,1592794036,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9305070Z","2025-11-19 22:37:26.9305070Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",4888,,,"12756 svchost.exe",,,"C:\Windows\System32\wer.dll",,,,,,,,,,,,,,,,1763591846930507000,,,,,140712805728256,140712805728256,993632,983040,1987637995,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9314972Z","2025-11-19 22:37:26.9314972Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","12756 svchost.exe",12564,,,"12756 svchost.exe",,,,,,,,,,,,,18446633084038479872,18446633084038455296,140712899206080,9,111870459904,13320,1763591846931497200,111873097728,111873064960,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9317954Z","2025-11-19 22:37:26.9317954Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",4888,,,"12756 svchost.exe",,,"C:\Windows\System32\wtsapi32.dll",,,,,,,,,,,,,,,,1763591846931795400,,,,,140712800288768,140712800288768,202021,172032,1311240630,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9320566Z","2025-11-19 22:37:26.9320566Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",3784,,,"12756 svchost.exe",,,"C:\Windows\System32\crypt32.dll",,,,,,,,,,,,,,,,1763591846932056600,,,,,140712849768448,140712849768448,1584869,1536000,3438168074,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9325878Z","2025-11-19 22:37:26.9325878Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",12564,,,"12756 svchost.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,,,,,,,1763591846932587800,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9330277Z","2025-11-19 22:37:26.9330277Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",4888,,,"12756 svchost.exe",,,"C:\Windows\System32\winsta.dll",,,,,,,,,,,,,,,,1763591846933027700,,,,,140712847343616,140712847343616,420786,405504,560940509,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9339612Z","2025-11-19 22:37:26.9339612Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","12756 svchost.exe",12564,,,"12756 svchost.exe",,,,,,,,,,,,,18446633084038623232,18446633084038598656,140712865112144,9,111870468096,1628,1763591846933961200,111873622016,111873589248,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9343316Z","2025-11-19 22:37:26.9343316Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","12756 svchost.exe",13320,,,"12756 svchost.exe",,,,,,,,,,,,,18446633084038651904,18446633084038627328,140712899206080,9,111868379136,500,1763591846934331600,111874146304,111874113536,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9367046Z","2025-11-19 22:37:26.9367046Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","12756 svchost.exe",12564,,,"12756 svchost.exe",,,"C:\Windows\System32\Windows.StateRepositoryPS.dll",,,,,,,,,,,,,,,,1763591846936704600,,,,,140712490369024,140712490369024,879719,802816,374042279,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9757802Z","2025-11-19 22:37:26.9757802Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11964,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084038680576,18446633084038656000,140712899206080,0,61841977344,9424,1763591846975780200,61863886848,61863882752,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9759165Z","2025-11-19 22:37:26.9759165Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1168 svchost.exe",13524,,," 1168 svchost.exe",,,,,,,,,,,,,18446633084038795264,18446633084038770688,140712899206080,157,641013497856,13336,1763591846975916500,641018626048,641018593280,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9761596Z","2025-11-19 22:37:26.9761596Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",9424,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084038823936,18446633084038799360,140712899206080,0,61841985536,13884,1763591846976159600,61864935424,61864931328,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9762962Z","2025-11-19 22:37:26.9762962Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",13884,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084038852608,18446633084038828032,140712899206080,0,61841993728,13192,1763591846976296200,61865984000,61865979904,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9764557Z","2025-11-19 22:37:26.9764557Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1168 svchost.exe",13336,,," 1168 svchost.exe",,,,,,,,,,,,,18446633084038909952,18446633084038885376,140712899206080,0,641013506048,1052,1763591846976455700,641019674624,641019641856,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9766712Z","2025-11-19 22:37:26.9766712Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\twinapi.dll",,,,,,,,,,,,,,,,1763591846976671200,,,,,140712415789056,140712415789056,924452,868352,2129603828,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9770786Z","2025-11-19 22:37:26.9770786Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\xmllite.dll",,,,,,,,,,,,,,,,1763591846977078600,,,,,140712684027904,140712684027904,342897,274432,974526834,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9808706Z","2025-11-19 22:37:26.9808706Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,,,,,,,1763591846980870600,,,,,140712531263488,140712531263488,1042724,1011712,915912993,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9813933Z","2025-11-19 22:37:26.9813933Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\twinapi.appcore.dll",,,,,,,,,,,,,,,,1763591846981393300,,,,,140712720924672,140712720924672,2401519,2375680,2646458233,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9821193Z","2025-11-19 22:37:26.9821193Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846982119300,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9842337Z","2025-11-19 22:37:26.9842337Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846984233700,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9845394Z","2025-11-19 22:37:26.9845394Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\twinapi.appcore.dll",,,,,,,,,,,,,,,,1763591846984539400,,,,,140712720924672,140712720924672,2401519,2387968,2646458233,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9856297Z","2025-11-19 22:37:26.9856297Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846985629700,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9861865Z","2025-11-19 22:37:26.9861865Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846986186500,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9882883Z","2025-11-19 22:37:26.9882883Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846988288300,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9887666Z","2025-11-19 22:37:26.9887666Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846988766600,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9906594Z","2025-11-19 22:37:26.9906594Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846990659400,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9910998Z","2025-11-19 22:37:26.9910998Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846991099800,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9921663Z","2025-11-19 22:37:26.9921663Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\netprofm.dll",,,,,,,,,,,,,,,,1763591846992166300,,,,,140712762802176,140712762802176,450621,450560,2204449876,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9951086Z","2025-11-19 22:37:26.9951086Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\npmproxy.dll",,,,,,,,,,,,,,,,1763591846995108600,,,,,140712730820608,140712730820608,124253,102400,1533975845,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9964262Z","2025-11-19 22:37:26.9964262Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\netprofm.dll",,,,,,,,,,,,,,,,1763591846996426200,,,,,140712762802176,140712762802176,450621,462848,2204449876,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9964693Z","2025-11-19 22:37:26.9964693Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\npmproxy.dll",,,,,,,,,,,,,,,,1763591846996469300,,,,,140712730820608,140712730820608,124253,114688,1533975845,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9967025Z","2025-11-19 22:37:26.9967025Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\rmclient.dll",,,,,,,,,,,,,,,,1763591846996702500,,,,,140712808808448,140712808808448,282526,221184,1891057501,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9977602Z","2025-11-19 22:37:26.9977602Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084037419008,18446633084037394432,140712806010720,0,295361277952,5544,1763591846997760200,295366557696,295366549504,140712806010720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9983833Z","2025-11-19 22:37:26.9983833Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\Windows.Security.Authentication.OnlineId.dll",,,,,,,,,,,,,,,,1763591846998383300,,,,,140712517107712,140712517107712,983040,942080,2052763288,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9989312Z","2025-11-19 22:37:26.9989312Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846998931200,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9993571Z","2025-11-19 22:37:26.9993571Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,,,,,,,1763591846999357100,,,,,140712851341312,140712851341312,1524912,1486848,1404855129,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9998434Z","2025-11-19 22:37:26.9998434Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591846999843400,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0004491Z","2025-11-19 22:37:27.0004491Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",8320,,," 5252 WerFault.exe",,,"C:\Windows\System32\dpapi.dll",,,,,,,,,,,,,,,,1763591847000449100,,,,,140712845574144,140712845574144,42814,40960,2473566603,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0011253Z","2025-11-19 22:37:27.0011253Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\netprofm.dll",,,,,,,,,,,,,,,,1763591847001125300,,,,,140712762802176,140712762802176,450621,450560,2204449876,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0016801Z","2025-11-19 22:37:27.0016801Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",8320,,," 5252 WerFault.exe",,,"C:\Windows\System32\cryptbase.dll",,,,,,,,,,,,,,,,1763591847001680100,,,,,140712839348224,140712839348224,63718,49152,3897879906,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0027226Z","2025-11-19 22:37:27.0027226Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\OneCoreUAPCommonProxyStub.dll",,,,,,,,,,,,,,,,1763591847002722600,,,,,140712713977856,140712713977856,6740758,6615040,2011948997,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0034230Z","2025-11-19 22:37:27.0034230Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\npmproxy.dll",,,,,,,,,,,,,,,,1763591847003423000,,,,,140712730820608,140712730820608,124253,102400,1533975845,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0043199Z","2025-11-19 22:37:27.0043199Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1776 svchost.exe",9772,,," 1776 svchost.exe",,,,,,,,,,,,,18446633084039024640,18446633084039000064,140712899206080,122,699936964608,6052,1763591847004319900,699937587200,699937554432,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0049592Z","2025-11-19 22:37:27.0049592Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\netprofm.dll",,,,,,,,,,,,,,,,1763591847004959200,,,,,140712762802176,140712762802176,450621,462848,2204449876,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0050763Z","2025-11-19 22:37:27.0050763Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\Windows.Security.Authentication.OnlineId.dll",,,,,,,,,,,,,,,,1763591847005076300,,,,,140712517107712,140712517107712,983040,954368,2052763288,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0051265Z","2025-11-19 22:37:27.0051265Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\npmproxy.dll",,,,,,,,,,,,,,,,1763591847005126500,,,,,140712730820608,140712730820608,124253,114688,1533975845,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0052611Z","2025-11-19 22:37:27.0052611Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\OneCoreUAPCommonProxyStub.dll",,,,,,,,,,,,,,,,1763591847005261100,,,,,140712713977856,140712713977856,6740758,6627328,2011948997,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0053469Z","2025-11-19 22:37:27.0053469Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,,,,,,,1763591847005346900,,,,,140712851341312,140712851341312,1524912,1499136,1404855129,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0060299Z","2025-11-19 22:37:27.0060299Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\netprofm.dll",,,,,,,,,,,,,,,,1763591847006029900,,,,,140712762802176,140712762802176,450621,450560,2204449876,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0064637Z","2025-11-19 22:37:27.0064637Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,,,,,,,1763591847006463800,,,,,140712426930176,140712426930176,1213372,1146880,2699219668,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0072003Z","2025-11-19 22:37:27.0072003Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591847007200300,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0085599Z","2025-11-19 22:37:27.0085599Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",13192,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084039053312,18446633084039028736,140712899206080,0,61842001920,4980,1763591847008559900,61867032576,61867028480,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0088098Z","2025-11-19 22:37:27.0088098Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",4980,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084039081984,18446633084039057408,140712899206080,0,61842010112,4528,1763591847008809800,61868081152,61868077056,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0089567Z","2025-11-19 22:37:27.0089567Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",4528,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084039225344,18446633084039200768,140712899206080,0,61842018304,13000,1763591847008956800,61869129728,61869125632,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0094924Z","2025-11-19 22:37:27.0094924Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\npmproxy.dll",,,,,,,,,,,,,,,,1763591847009492500,,,,,140712730820608,140712730820608,124253,102400,1533975845,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0227855Z","2025-11-19 22:37:27.0227855Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,,,,,,,1763591847022785500,,,,,140712531263488,140712531263488,1042724,999424,915912993,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0294277Z","2025-11-19 22:37:27.0294277Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\netprofm.dll",,,,,,,,,,,,,,,,1763591847029427700,,,,,140712762802176,140712762802176,450621,462848,2204449876,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0295981Z","2025-11-19 22:37:27.0295981Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\npmproxy.dll",,,,,,,,,,,,,,,,1763591847029598100,,,,,140712730820608,140712730820608,124253,114688,1533975845,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0297779Z","2025-11-19 22:37:27.0297779Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,,,,,,,1763591847029777900,,,,,140712531263488,140712531263488,1042724,1011712,915912993,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0299214Z","2025-11-19 22:37:27.0299214Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591847029921400,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0299968Z","2025-11-19 22:37:27.0299968Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,,,,,,,1763591847029996800,,,,,140712426930176,140712426930176,1213372,1159168,2699219668,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0307998Z","2025-11-19 22:37:27.0307998Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,,,,,,,1763591847030799800,,,,,140712531263488,140712531263488,1042724,999424,915912993,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0340864Z","2025-11-19 22:37:27.0340864Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",8260,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084032188416,18446633084032163840,140712891292720,0,199841374208,6804,1763591847034086400,199851245568,199851237376,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0356784Z","2025-11-19 22:37:27.0356784Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1416 ApplicationFrameHost.exe",8260,,," 1416 ApplicationFrameHost.exe",,,"C:\Windows\System32\UIAnimation.dll",,,,,,,,,,,,,,,,1763591847035678400,,,,,140712712863744,140712712863744,393989,348160,2216247055,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0668663Z","2025-11-19 22:37:27.0668663Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3420 ctfmon.exe",8900,,," 3420 ctfmon.exe",,,,,,,,,,,,,18446633084037906432,18446633084037881856,140712865112144,0,619648745472,15352,1763591847066866300,619647205376,619647197184,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0685230Z","2025-11-19 22:37:27.0685230Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084038250496,18446633084038225920,140712899206080,0,61842026496,12060,1763591847068523000,61870178304,61870174208,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0731368Z","2025-11-19 22:37:27.0731368Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\userenv.dll",,,,,,,,,,,,,,,,1763591847073136800,,,,,140712837054464,140712837054464,245008,176128,731547084,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0735931Z","2025-11-19 22:37:27.0735931Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\profext.dll",,,,,,,,,,,,,,,,1763591847073593100,,,,,140712823488512,140712823488512,220952,200704,1125089802,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0828335Z","2025-11-19 22:37:27.0828335Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\rometadata.dll",,,,,,,,,,,,,,,,1763591847082833500,,,,,140712295006208,140712295006208,267714,233472,1750277957,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0834075Z","2025-11-19 22:37:27.0834075Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\WinMetadata\Windows.Foundation.winmd",,,,,,,,,,,,,,,,1763591847083407500,,,,,18014398509481984,2220526534656,134275,69632,1761294834,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0837519Z","2025-11-19 22:37:27.0837519Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\WinMetadata\Windows.UI.winmd",,,,,,,,,,,,,,,,1763591847083752000,,,,,18014398509481984,2220526665728,773504,737280,1761294835,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.1026755Z","2025-11-19 22:37:27.1026755Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6096 svchost.exe",4172,,," 6096 svchost.exe",,,,,,,,,,,,,18446633084032245760,18446633084032221184,140712899206080,25,338488852480,15324,1763591847102675500,338491867136,338491834368,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.1176652Z","2025-11-19 22:37:27.1176652Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6096 svchost.exe",4172,,," 6096 svchost.exe",,,,,,,,,,,,,18446633084033224704,18446633084033200128,140712865112144,25,338488860672,14108,1763591847117665200,338492391424,338492358656,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.1255393Z","2025-11-19 22:37:27.1255393Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2724 svchost.exe",14940,,," 2724 svchost.exe",,,,,,,,,,,,,18446633084039458816,18446633084039434240,140712899206080,232,89489063936,5900,1763591847125539300,89491767296,89491701760,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.1256608Z","2025-11-19 22:37:27.1256608Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2724 svchost.exe",14940,,," 2724 svchost.exe",,,,,,,,,,,,,18446633084039544832,18446633084039520256,140712899206080,232,89489072128,952,1763591847125660800,89492291584,89492258816,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.1267258Z","2025-11-19 22:37:27.1267258Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3256 svchost.exe",4788,,," 3256 svchost.exe",,,,,,,,,,,,,18446633084039630848,18446633084039606272,140712899206080,111,435930234880,3276,1763591847126725800,433794318336,433794285568,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2129195Z","2025-11-19 22:37:27.2129195Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1040 svchost.exe",4220,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\RuntimeBroker.exe",,,,,,,,,,,,,,,,1763591847212919500,,,,,,,148437,,1175682367,134080654479044376,3,"0x","Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe","runtimebroker07f4358a809ac99a64a67c1",1040,13,6637,3,0,0,1,,,,,,,,,,,, +"2025-11-19 22:37:27.2141117Z","2025-11-19 22:37:27.2141117Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",4220,,," 6764 RuntimeBroker.exe",,,,,,,,,,,,,18446633084037963776,18446633084037939200,140699399787184,40,848667435008,11572,1763591847214111700,848666886144,848666836992,140699399787184,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2161048Z","2025-11-19 22:37:27.2161048Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\RuntimeBroker.exe",,,,,,,,,,,,,,,,1763591847216104800,,,,,140699399749632,140699399749632,148437,126976,1175682367,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2161305Z","2025-11-19 22:37:27.2161305Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591847216130500,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2260181Z","2025-11-19 22:37:27.2260181Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591847226018100,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2262028Z","2025-11-19 22:37:27.2262028Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591847226202800,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2276559Z","2025-11-19 22:37:27.2276559Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591847227655900,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2277968Z","2025-11-19 22:37:27.2277968Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,,,,,,,,,,,18446633084039716864,18446633084039692288,140712899206080,0,848667443200,8364,1763591847227796800,848669704192,848669655040,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2278608Z","2025-11-19 22:37:27.2278608Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591847227860800,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2280363Z","2025-11-19 22:37:27.2280363Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,,,,,,,,,,,18446633084039831552,18446633084039806976,140712899206080,0,848667451392,11224,1763591847228036300,848670228480,848670179328,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2287033Z","2025-11-19 22:37:27.2287033Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,,,,,,,1763591847228703300,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2287940Z","2025-11-19 22:37:27.2287940Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591847228794000,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2298203Z","2025-11-19 22:37:27.2298203Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591847229820300,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2299335Z","2025-11-19 22:37:27.2299335Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591847229933500,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2302570Z","2025-11-19 22:37:27.2302570Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,,,,,,,1763591847230257000,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2306900Z","2025-11-19 22:37:27.2306900Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\powrprof.dll",,,,,,,,,,,,,,,,1763591847230690000,,,,,140712848195584,140712848195584,457799,385024,2858637235,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2310038Z","2025-11-19 22:37:27.2310038Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\umpdc.dll",,,,,,,,,,,,,,,,1763591847231003800,,,,,140712848064512,140712848064512,98535,81920,1714427184,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2312370Z","2025-11-19 22:37:27.2312370Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 6764 RuntimeBroker.exe",,,,,,,,,,,,,18446633084039860224,18446633084039835648,140712899206080,0,848667459584,6812,1763591847231237000,848670752768,848670703616,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2313547Z","2025-11-19 22:37:27.2313547Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 6764 RuntimeBroker.exe",,,,,,,,,,,,,18446633084040003584,18446633084039979008,140712899206080,0,848667467776,8708,1763591847231354700,848671277056,848671227904,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2315885Z","2025-11-19 22:37:27.2315885Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591847231588500,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2316863Z","2025-11-19 22:37:27.2316863Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591847231686300,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2317848Z","2025-11-19 22:37:27.2317848Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591847231784800,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2319174Z","2025-11-19 22:37:27.2319174Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591847231917400,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2320674Z","2025-11-19 22:37:27.2320674Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6764 RuntimeBroker.exe",11224,,," 6764 RuntimeBroker.exe",,,,,,,,,,,,,18446633084040060928,18446633084040036352,140712899206080,0,848667475968,13408,1763591847232067400,848671801344,848671752192,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2325139Z","2025-11-19 22:37:27.2325139Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,,,,,,,1763591847232513900,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2345618Z","2025-11-19 22:37:27.2345618Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591847234561800,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2353967Z","2025-11-19 22:37:27.2353967Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,,,,,,,1763591847235396700,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2361031Z","2025-11-19 22:37:27.2361031Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,,,,,,,,,,,18446633084040290304,18446633084040265728,140712865112144,0,848667484160,12020,1763591847236103100,848672325632,848672276480,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2386374Z","2025-11-19 22:37:27.2386374Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",6812,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\twinui.dll",,,,,,,,,,,,,,,,1763591847238637400,,,,,140712339046400,140712339046400,5239409,5242880,279122806,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2387872Z","2025-11-19 22:37:27.2387872Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",6812,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,,,,,,,1763591847238787200,,,,,140712851341312,140712851341312,1524912,1486848,1404855129,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2389686Z","2025-11-19 22:37:27.2389686Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",6812,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,,,,,,,1763591847238968600,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2391386Z","2025-11-19 22:37:27.2391386Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11224,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\mscms.dll",,,,,,,,,,,,,,,,1763591847239138600,,,,,140712711880704,140712711880704,859508,786432,1878966387,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2393067Z","2025-11-19 22:37:27.2393067Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",13408,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\gamemode.dll",,,,,,,,,,,,,,,,1763591847239306700,,,,,140712543387648,140712543387648,164324,114688,328629043,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2394969Z","2025-11-19 22:37:27.2394969Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",6812,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\windows.storage.dll",,,,,,,,,,,,,,,,1763591847239496900,,,,,140712812412928,140712812412928,8877403,8769536,3667346596,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2397690Z","2025-11-19 22:37:27.2397690Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",6812,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591847239769000,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2398445Z","2025-11-19 22:37:27.2398445Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,,,,,,,1763591847239844500,,,,,140712531263488,140712531263488,1042724,1011712,915912993,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2399540Z","2025-11-19 22:37:27.2399540Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",11224,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\DXCore.dll",,,,,,,,,,,,,,,,1763591847239954000,,,,,140712805400576,140712805400576,331386,274432,2354081039,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2401949Z","2025-11-19 22:37:27.2401949Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\twinapi.appcore.dll",,,,,,,,,,,,,,,,1763591847240194900,,,,,140712720924672,140712720924672,2401519,2375680,2646458233,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2406771Z","2025-11-19 22:37:27.2406771Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591847240677100,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2413286Z","2025-11-19 22:37:27.2413286Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",6812,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,,,,,,,1763591847241328600,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2417460Z","2025-11-19 22:37:27.2417460Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591847241746000,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2418193Z","2025-11-19 22:37:27.2418193Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\twinapi.appcore.dll",,,,,,,,,,,,,,,,1763591847241819300,,,,,140712720924672,140712720924672,2401519,2387968,2646458233,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2424991Z","2025-11-19 22:37:27.2424991Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",6812,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\OneCoreUAPCommonProxyStub.dll",,,,,,,,,,,,,,,,1763591847242499100,,,,,140712713977856,140712713977856,6740758,6615040,2011948997,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2427968Z","2025-11-19 22:37:27.2427968Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591847242796800,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2432995Z","2025-11-19 22:37:27.2432995Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591847243299500,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2448516Z","2025-11-19 22:37:27.2448516Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",8708,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,,,,,,,1763591847244851600,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2453058Z","2025-11-19 22:37:27.2453058Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\winhttp.dll",,,,,,,,,,,,,,,,1763591847245305800,,,,,140712750350336,140712750350336,1261038,1212416,84984727,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2455120Z","2025-11-19 22:37:27.2455120Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6764 RuntimeBroker.exe",8708,,," 6764 RuntimeBroker.exe",,,,,,,,,,,,,18446633084040318976,18446633084040294400,140712865112144,0,848667492352,5996,1763591847245512000,848672849920,848672800768,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2460087Z","2025-11-19 22:37:27.2460087Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",5996,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\uxtheme.dll",,,,,,,,,,,,,,,,1763591847246008700,,,,,140712802254848,140712802254848,696534,696320,1695798817,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2461950Z","2025-11-19 22:37:27.2461950Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\ws2_32.dll",,,,,,,,,,,,,,,,1763591847246195000,,,,,140712881094656,140712881094656,513405,475136,3967481067,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2473895Z","2025-11-19 22:37:27.2473895Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5252 WerFault.exe",10204,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084040347648,18446633084040323072,140712899206080,0,295361286144,13268,1763591847247389500,295367081984,295367073792,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2475493Z","2025-11-19 22:37:27.2475493Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\mswsock.dll",,,,,,,,,,,,,,,,1763591847247549300,,,,,140712836333568,140712836333568,491870,438272,897307513,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2481688Z","2025-11-19 22:37:27.2481688Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\IPHLPAPI.DLL",,,,,,,,,,,,,,,,1763591847248168800,,,,,140712824012800,140712824012800,233044,212992,945822897,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2485373Z","2025-11-19 22:37:27.2485373Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\winnsi.dll",,,,,,,,,,,,,,,,1763591847248537300,,,,,140712802975744,140712802975744,95519,61440,2268955118,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2487306Z","2025-11-19 22:37:27.2487306Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\nsi.dll",,,,,,,,,,,,,,,,1763591847248730600,,,,,140712892956672,140712892956672,111648,40960,4223476491,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2489183Z","2025-11-19 22:37:27.2489183Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",5996,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\shlwapi.dll",,,,,,,,,,,,,,,,1763591847248918300,,,,,140712868839424,140712868839424,479562,421888,2142510382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2538985Z","2025-11-19 22:37:27.2538985Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\dhcpcsvc6.dll",,,,,,,,,,,,,,,,1763591847253898600,,,,,140712753233920,140712753233920,145503,122880,2114927498,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2540086Z","2025-11-19 22:37:27.2540086Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",8708,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\twinapi.appcore.dll",,,,,,,,,,,,,,,,1763591847254008700,,,,,140712720924672,140712720924672,2401519,2375680,2646458233,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2546360Z","2025-11-19 22:37:27.2546360Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\dhcpcsvc.dll",,,,,,,,,,,,,,,,1763591847254636100,,,,,140712746024960,140712746024960,184216,143360,916390222,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2557466Z","2025-11-19 22:37:27.2557466Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\webio.dll",,,,,,,,,,,,,,,,1763591847255746600,,,,,140712635531264,140712635531264,873482,827392,338769958,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2562648Z","2025-11-19 22:37:27.2562648Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",5996,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,,,,,,,1763591847256264800,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2567215Z","2025-11-19 22:37:27.2567215Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1660 svchost.exe",5636,,," 1660 svchost.exe",,,,,,,,,,,,,18446633084040376320,18446633084040351744,140712899206080,129,265908367360,8716,1763591847256721500,265905897472,265905864704,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2571899Z","2025-11-19 22:37:27.2571899Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",5996,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\ole32.dll",,,,,,,,,,,,,,,,1763591847257189900,,,,,140712878473216,140712878473216,1689904,1667072,1018821057,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2575332Z","2025-11-19 22:37:27.2575332Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,"C:\Windows\System32\sspicli.dll",,,,,,,,,,,,,,,,1763591847257533200,,,,,140712833384448,140712833384448,339222,299008,3030302172,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2583450Z","2025-11-19 22:37:27.2583450Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",6812,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\cfgmgr32.dll",,,,,,,,,,,,,,,,1763591847258345000,,,,,140712845049856,140712845049856,385808,356352,1737777300,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2589399Z","2025-11-19 22:37:27.2589399Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6764 RuntimeBroker.exe",6812,,," 6764 RuntimeBroker.exe",,,,,,,,,,,,,18446633084040491008,18446633084040466432,140712899206080,0,848667500544,13508,1763591847258939900,848673374208,848673325056,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2590354Z","2025-11-19 22:37:27.2590354Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",5996,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\propsys.dll",,,,,,,,,,,,,,,,1763591847259035500,,,,,140712761491456,140712761491456,1123662,1060864,3228732737,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2616936Z","2025-11-19 22:37:27.2616936Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6764 RuntimeBroker.exe",5996,,," 6764 RuntimeBroker.exe",,,,,,,,,,,,,18446633084040548352,18446633084040523776,140712891292720,0,848667508736,2944,1763591847261693600,848673898496,848673849344,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2626803Z","2025-11-19 22:37:27.2626803Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",10204,,," 5252 WerFault.exe",,,"C:\Windows\System32\dnsapi.dll",,,,,,,,,,,,,,,,1763591847262680300,,,,,140712824274944,140712824274944,1293169,1228800,1381219389,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2635901Z","2025-11-19 22:37:27.2635901Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",10204,,," 5252 WerFault.exe",,,"C:\Windows\System32\rasadhlp.dll",,,,,,,,,,,,,,,,1763591847263590100,,,,,140712730755072,140712730755072,108990,45056,352477361,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2640959Z","2025-11-19 22:37:27.2640959Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",2944,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\Windows.StateRepositoryPS.dll",,,,,,,,,,,,,,,,1763591847264095900,,,,,140712490369024,140712490369024,879719,802816,374042279,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2662240Z","2025-11-19 22:37:27.2662240Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",5996,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,,,,,,,1763591847266224000,,,,,140712479096832,140712479096832,1613415,1552384,2231457550,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2694685Z","2025-11-19 22:37:27.2694685Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",5996,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\OneCoreCommonProxyStub.dll",,,,,,,,,,,,,,,,1763591847269468500,,,,,140712570257408,140712570257408,903222,823296,2010952444,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2703184Z","2025-11-19 22:37:27.2703184Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",13268,,," 5252 WerFault.exe",,,"C:\Windows\System32\FWPUCLNT.DLL",,,,,,,,,,,,,,,,1763591847270318400,,,,,140712731279360,140712731279360,561494,548864,3096342574,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2709280Z","2025-11-19 22:37:27.2709280Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",8708,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\iertutil.dll",,,,,,,,,,,,,,,,1763591847270928000,,,,,140712642805760,140712642805760,2984761,2904064,3815768453,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2711814Z","2025-11-19 22:37:27.2711814Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",13408,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\srvcli.dll",,,,,,,,,,,,,,,,1763591847271181400,,,,,140712668954624,140712668954624,181029,167936,239922031,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2712155Z","2025-11-19 22:37:27.2712155Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",8708,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\netutils.dll",,,,,,,,,,,,,,,,1763591847271215500,,,,,140712825847808,140712825847808,80696,53248,865845000,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2742630Z","2025-11-19 22:37:27.2742630Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",8708,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\Windows.Web.dll",,,,,,,,,,,,,,,,1763591847274263000,,,,,140712467955712,140712467955712,678716,638976,1581530023,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2756130Z","2025-11-19 22:37:27.2756130Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","14660 CalculatorApp.exe",12588,,,"14660 CalculatorApp.exe",,,"C:\Windows\System32\Windows.Web.dll",,,,,,,,,,,,,,,,1763591847275613000,,,,,140712467955712,140712467955712,678716,638976,1581530023,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2822816Z","2025-11-19 22:37:27.2822816Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",8708,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\profapi.dll",,,,,,,,,,,,,,,,1763591847282281600,,,,,140712848850944,140712848850944,229548,167936,2447194521,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2884083Z","2025-11-19 22:37:27.2884083Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",5996,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591847288408300,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2897291Z","2025-11-19 22:37:27.2897291Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",5996,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\bcrypt.dll",,,,,,,,,,,,,,,,1763591847289729100,,,,,140712848654336,140712848654336,206048,172032,2893678010,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2971150Z","2025-11-19 22:37:27.2971150Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 6764 RuntimeBroker.exe",5996,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\ntmarta.dll",,,,,,,,,,,,,,,,1763591847297115000,,,,,140712831811584,140712831811584,265798,221184,3598506564,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.3047289Z","2025-11-19 22:37:27.3047289Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3204 Taskmgr.exe",5876,,," 3204 Taskmgr.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,,,,,,,1763591847304728900,,,,,140712479096832,140712479096832,1613415,1552384,2231457550,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.3053734Z","2025-11-19 22:37:27.3053734Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3204 Taskmgr.exe",5876,,," 3204 Taskmgr.exe",,,"C:\Windows\System32\Windows.System.Launcher.dll",,,,,,,,,,,,,,,,1763591847305373400,,,,,140712479096832,140712479096832,1613415,1564672,2231457550,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.3163515Z","2025-11-19 22:37:27.3163515Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",13876,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084018688000,18446633084018663424,140711613062896,0,1046354382848,13876,1763591847316351500,1046401253376,1046401236992,140711613062896,2715087,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.3958270Z","2025-11-19 22:37:27.3958270Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",8320,,," 5252 WerFault.exe",,,"C:\Windows\System32\schannel.dll",,,,,,,,,,,,,,,,1763591847395827000,,,,,140712828731392,140712828731392,849052,802816,24806266,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.099873500Z","2025-11-19 22:37:27.4122768Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Attack done",,,,,,,,,,,,,,,,,1763591847412276800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4128045Z","2025-11-19 22:37:27.4128045Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591847412804500,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4131942Z","2025-11-19 22:37:27.4131942Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5604 attack-890.exe",8672,,," 5604 attack-890.exe",,,,,,,,,,,,,18446633084029718528,18446633084029693952,140712899206080,0,867488067584,8672,1763591847413194200,867491119104,867491106816,140712899206080,1934283,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4131969Z","2025-11-19 22:37:27.4131969Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5604 attack-890.exe",5960,,," 5604 attack-890.exe",,,,,,,,,,,,,18446633084029747200,18446633084029722624,140712899206080,0,867488059392,5960,1763591847413196900,867490070528,867490062336,140712899206080,2523090,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4132046Z","2025-11-19 22:37:27.4132046Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5604 attack-890.exe",12460,,," 5604 attack-890.exe",,,,,,,,,,,,,18446633084029460480,18446633084029435904,140712899206080,0,867488075776,12460,1763591847413204600,867492167680,867492155392,140712899206080,1586126,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4133776Z","2025-11-19 22:37:27.4133776Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,,,,,,,,,,,18446633084027822080,18446633084027797504,140695618865008,0,867488051200,3452,1763591847413377600,867486007296,867485986816,140695618865008,55165128,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4135007Z","2025-11-19 22:37:27.4135007Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Users\Public\Downloads\attack-890.exe",,,,,,,,,,,,,,,,1763591847413500700,,,,,140695618846720,140695618846720,0,53248,1763491559,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4135055Z","2025-11-19 22:37:27.4135055Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\msvcp140.dll",,,,,,,,,,,,,,,,1763591847413505500,,,,,140711213137920,140711213137920,570439,561152,1564323704,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4135084Z","2025-11-19 22:37:27.4135084Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\vcruntime140.dll",,,,,,,,,,,,,,,,1763591847413508400,,,,,140712353988608,140712353988608,146072,122880,254123393,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4135113Z","2025-11-19 22:37:27.4135113Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\vcruntime140_1.dll",,,,,,,,,,,,,,,,1763591847413511400,,,,,140712354119680,140712354119680,57827,49152,240324076,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4135253Z","2025-11-19 22:37:27.4135253Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\apphelp.dll",,,,,,,,,,,,,,,,1763591847413525300,,,,,140712800485376,140712800485376,675806,651264,4108425587,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4135311Z","2025-11-19 22:37:27.4135311Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591847413531100,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4135386Z","2025-11-19 22:37:27.4135386Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591847413538600,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4135538Z","2025-11-19 22:37:27.4135538Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591847413553800,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4135615Z","2025-11-19 22:37:27.4135615Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591847413561600,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4135675Z","2025-11-19 22:37:27.4135675Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591847413567500,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4135740Z","2025-11-19 22:37:27.4135740Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591847413574000,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4135805Z","2025-11-19 22:37:27.4135805Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591847413580500,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4135873Z","2025-11-19 22:37:27.4135873Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591847413587300,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4135935Z","2025-11-19 22:37:27.4135935Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591847413593500,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4136009Z","2025-11-19 22:37:27.4136009Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"attack-890.exe",,,,,,,,,,,,,,,,1763591847413600900,,,,,,,,,,134080654410040405,,,,,,,6624,,,,,974848,974848,61411560,0,134080654481010332,52,9,0,0,3,48,0 +"2025-11-19 22:37:27.4283262Z","2025-11-19 22:37:27.4283262Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",11288,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084024401920,18446633084024377344,140711613062896,0,1046354407424,11288,1763591847428326200,1046418030592,1046418014208,140711613062896,1935036,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.5078343Z","2025-11-19 22:37:27.5078343Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2572 svchost.exe",13832,,," 2572 svchost.exe",,,,,,,,,,,,,18446633084039372800,18446633084039348224,140712899206080,75,140319780864,11052,1763591847507834300,140320964608,140320931840,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.5256444Z","2025-11-19 22:37:27.5256444Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 4868 svchost.exe",,,,,,,,,,,,,18446633084031901696,18446633084031877120,140712899206080,0,47918891008,11596,1763591847525644400,47920971776,47920939008,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.5258154Z","2025-11-19 22:37:27.5258154Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4868 svchost.exe",11596,,," 4868 svchost.exe",,,,,,,,,,,,,18446633084024401920,18446633084024377344,140712899206080,0,47918899200,2940,1763591847525815400,47921496064,47921463296,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6226062Z","2025-11-19 22:37:27.6226062Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1016 services.exe",6816,,,"13800 svchost.exe",,,"C:\Windows\System32\svchost.exe",,,,,,,,,,,,,,,,1763591847622606300,,,,,,,143552,,14788416,134080654483059795,0,"0x","","",1016,11,6638,1,1,0,0,,,,,,,,,,,, +"2025-11-19 22:37:27.6232926Z","2025-11-19 22:37:27.6232926Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1016 services.exe",6816,,,"13800 svchost.exe",,,,,,,,,,,,,18446633084027822080,18446633084027797504,140696171073504,0,858544685056,15036,1763591847623292600,858547290112,858547273728,140696171073504,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6245554Z","2025-11-19 22:37:27.6245554Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,"C:\Windows\System32\svchost.exe",,,,,,,,,,,,,,,,1763591847624555400,,,,,140696171053056,140696171053056,143552,77824,14788416,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6245778Z","2025-11-19 22:37:27.6245778Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591847624577800,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6277064Z","2025-11-19 22:37:27.6277064Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591847627706400,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6278283Z","2025-11-19 22:37:27.6278283Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591847627828300,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6288348Z","2025-11-19 22:37:27.6288348Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591847628834800,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6289680Z","2025-11-19 22:37:27.6289680Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,,,,,,,,,,,18446633084029747200,18446633084029722624,140712899206080,0,858544693248,9704,1763591847628968000,858547814400,858547781632,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6297035Z","2025-11-19 22:37:27.6297035Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,,,,,,,1763591847629703500,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6297981Z","2025-11-19 22:37:27.6297981Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591847629798100,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6299477Z","2025-11-19 22:37:27.6299477Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,,,,,,,,,,,18446633084029460480,18446633084029435904,140712899206080,0,858544701440,5924,1763591847629947700,858548338688,858548305920,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6308177Z","2025-11-19 22:37:27.6308177Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591847630817700,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6309243Z","2025-11-19 22:37:27.6309243Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591847630924300,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6312752Z","2025-11-19 22:37:27.6312752Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,,,,,,,1763591847631275200,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6319242Z","2025-11-19 22:37:27.6319242Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591847631924200,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6320169Z","2025-11-19 22:37:27.6320169Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591847632016900,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6321329Z","2025-11-19 22:37:27.6321329Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591847632132900,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6322326Z","2025-11-19 22:37:27.6322326Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591847632232600,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6323211Z","2025-11-19 22:37:27.6323211Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591847632321100,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6324486Z","2025-11-19 22:37:27.6324486Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13800 svchost.exe",9704,,,"13800 svchost.exe",,,,,,,,,,,,,18446633084039282688,18446633084039258112,140712899206080,0,858544709632,10468,1763591847632448600,858548862976,858548830208,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6345273Z","2025-11-19 22:37:27.6345273Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591847634527300,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6355634Z","2025-11-19 22:37:27.6355634Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"13800 svchost.exe",,,,,,,,,,,,,18446633084040663040,18446633084040638464,140712899206080,0,858544717824,11472,1763591847635563500,858549387264,858549354496,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6356777Z","2025-11-19 22:37:27.6356777Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,,,,,,,,,,,18446633084040691712,18446633084040667136,140712863364608,0,858544726016,11168,1763591847635677700,858549911552,858549878784,140712863364608,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6360751Z","2025-11-19 22:37:27.6360751Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",11168,,,"13800 svchost.exe",,,"C:\Windows\System32\wdi.dll",,,,,,,,,,,,,,,,1763591847636075100,,,,,140712669413376,140712669413376,172159,126976,589396027,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6374195Z","2025-11-19 22:37:27.6374195Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",11472,,,"13800 svchost.exe",,,"C:\Windows\System32\pcadm.dll",,,,,,,,,,,,,,,,1763591847637419500,,,,,140712372469760,140712372469760,249405,204800,3376468140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6375213Z","2025-11-19 22:37:27.6375213Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",11472,,,"13800 svchost.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591847637521300,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6379013Z","2025-11-19 22:37:27.6379013Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",5924,,,"13800 svchost.exe",,,"C:\Windows\System32\pcacli.dll",,,,,,,,,,,,,,,,1763591847637901300,,,,,140712543977472,140712543977472,146563,102400,3048676746,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6379125Z","2025-11-19 22:37:27.6379125Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",11472,,,"13800 svchost.exe",,,"C:\Windows\System32\aepic.dll",,,,,,,,,,,,,,,,1763591847637912500,,,,,140712428109824,140712428109824,641436,577536,321124434,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6379262Z","2025-11-19 22:37:27.6379262Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",10468,,,"13800 svchost.exe",,,"C:\Windows\System32\wtsapi32.dll",,,,,,,,,,,,,,,,1763591847637926300,,,,,140712800288768,140712800288768,202021,172032,1311240630,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6381998Z","2025-11-19 22:37:27.6381998Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",10468,,,"13800 svchost.exe",,,"C:\Windows\System32\crypt32.dll",,,,,,,,,,,,,,,,1763591847638199800,,,,,140712849768448,140712849768448,1584869,1536000,3438168074,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6382168Z","2025-11-19 22:37:27.6382168Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",11472,,,"13800 svchost.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,,,,,,,1763591847638216800,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6384332Z","2025-11-19 22:37:27.6384332Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",9704,,,"13800 svchost.exe",,,"C:\Windows\System32\sspicli.dll",,,,,,,,,,,,,,,,1763591847638433200,,,,,140712833384448,140712833384448,339222,299008,3030302172,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6386389Z","2025-11-19 22:37:27.6386389Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13800 svchost.exe",5924,,,"13800 svchost.exe",,,"C:\Windows\System32\mpr.dll",,,,,,,,,,,,,,,,1763591847638638900,,,,,140712737832960,140712737832960,203967,135168,2433114060,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6402040Z","2025-11-19 22:37:27.6402040Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13800 svchost.exe",11472,,,"13800 svchost.exe",,,,,,,,,,,,,18446633084040806400,18446633084040781824,140712899206080,0,858544734208,4768,1763591847640204000,858550435840,858550403072,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6406317Z","2025-11-19 22:37:27.6406317Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 5536 svchost.exe",,,,,,,,,,,,,18446633084040835072,18446633084040810496,140712899206080,0,151912235008,3836,1763591847640631700,151921360896,151921328128,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6447936Z","2025-11-19 22:37:27.6447936Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",8320,,," 5252 WerFault.exe",,,"C:\Windows\System32\ncrypt.dll",,,,,,,,,,,,,,,,1763591847644793600,,,,,140712841445376,140712841445376,272959,196608,3912253876,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6450798Z","2025-11-19 22:37:27.6450798Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",8320,,," 5252 WerFault.exe",,,"C:\Windows\System32\ntasn1.dll",,,,,,,,,,,,,,,,1763591847645079800,,,,,140712841117696,140712841117696,300816,258048,2667946327,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6454299Z","2025-11-19 22:37:27.6454299Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",8320,,," 5252 WerFault.exe",,,"C:\Windows\System32\ncryptsslp.dll",,,,,,,,,,,,,,,,1763591847645430000,,,,,140712682061824,140712682061824,310492,270336,4015176457,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6461082Z","2025-11-19 22:37:27.6461082Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",8320,,," 5252 WerFault.exe",,,"C:\Windows\System32\msasn1.dll",,,,,,,,,,,,,,,,1763591847646108200,,,,,140712839675904,140712839675904,150871,77824,2536054058,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6494965Z","2025-11-19 22:37:27.6494965Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",8320,,," 5252 WerFault.exe",,,"C:\Windows\System32\cryptnet.dll",,,,,,,,,,,,,,,,1763591847649496500,,,,,140712595161088,140712595161088,304772,241664,919073152,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6840379Z","2025-11-19 22:37:27.6840379Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13780 WmiPrvSE.exe",4420,,,"13780 WmiPrvSE.exe",,,,,,,,,,,,,18446633084016447488,18446633084016422912,140712899206080,0,157585104896,4420,1763591847684037900,157587341312,157587275776,140712899206080,4863993,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6840511Z","2025-11-19 22:37:27.6840511Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13780 WmiPrvSE.exe",6868,,,"13780 WmiPrvSE.exe",,,,,,,,,,,,,18446633084055474176,18446633084055449600,140712899206080,0,157585096704,6868,1763591847684051100,157586817024,157586751488,140712899206080,5062025,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.9160604Z","2025-11-19 22:37:27.9160604Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084037419008,18446633084037394432,140712806010720,0,295361277952,5544,1763591847916060400,295366557696,295366512640,140712806010720,887249451,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.9166947Z","2025-11-19 22:37:27.9166947Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591847916694700,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.9172748Z","2025-11-19 22:37:27.9172748Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591847917274800,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.9193515Z","2025-11-19 22:37:27.9193515Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591847919351500,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.9199738Z","2025-11-19 22:37:27.9199738Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591847919973800,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.9222210Z","2025-11-19 22:37:27.9222210Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591847922221000,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.9227097Z","2025-11-19 22:37:27.9227097Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5784 svchost.exe",14268,,," 5784 svchost.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591847922709700,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.9529632Z","2025-11-19 22:37:27.9529632Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",8500,,," 1040 svchost.exe",,,,,,,,,,,,,18446633084041007104,18446633084040982528,140712899206080,0,256031072256,13776,1763591847952963200,256038666240,256038633472,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.0426628Z","2025-11-19 22:37:28.0426628Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\rsaenh.dll",,,,,,,,,,,,,,,,1763591848042662900,,,,,140712829976576,140712829976576,300007,237568,1319378437,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.0449576Z","2025-11-19 22:37:28.0449576Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,,,,,,,1763591848044957600,,,,,140712426930176,140712426930176,1213372,1146880,2699219668,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.0455479Z","2025-11-19 22:37:28.0455479Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591848045547900,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.0461797Z","2025-11-19 22:37:28.0461797Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591848046179700,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.0462330Z","2025-11-19 22:37:28.0462330Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,,,,,,,1763591848046233000,,,,,140712426930176,140712426930176,1213372,1159168,2699219668,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.0467594Z","2025-11-19 22:37:28.0467594Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,,,,,,,1763591848046759400,,,,,140712426930176,140712426930176,1213372,1146880,2699219668,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.0594084Z","2025-11-19 22:37:28.0594084Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,,,,,,,1763591848059408400,,,,,140712531263488,140712531263488,1042724,999424,915912993,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.0633692Z","2025-11-19 22:37:28.0633692Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,,,,,,,1763591848063369200,,,,,140712531263488,140712531263488,1042724,1011712,915912993,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.0634911Z","2025-11-19 22:37:28.0634911Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\FlightSettings.dll",,,,,,,,,,,,,,,,1763591848063491100,,,,,140712426930176,140712426930176,1213372,1159168,2699219668,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.0637733Z","2025-11-19 22:37:28.0637733Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,,,,,,,1763591848063773300,,,,,140712531263488,140712531263488,1042724,999424,915912993,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2095024Z","2025-11-19 22:37:28.2095024Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\fcon.dll",,,,,,,,,,,,,,,,1763591848209502400,,,,,140712531263488,140712531263488,1042724,1011712,915912993,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2099766Z","2025-11-19 22:37:28.2099766Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\twinapi.appcore.dll",,,,,,,,,,,,,,,,1763591848209976600,,,,,140712720924672,140712720924672,2401519,2375680,2646458233,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2105757Z","2025-11-19 22:37:28.2105757Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591848210575700,,,,,140712774598656,140712774598656,769657,741376,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2116702Z","2025-11-19 22:37:28.2116702Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591848211670200,,,,,140712774598656,140712774598656,769657,753664,423353507,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2117422Z","2025-11-19 22:37:28.2117422Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\twinapi.appcore.dll",,,,,,,,,,,,,,,,1763591848211742200,,,,,140712720924672,140712720924672,2401519,2387968,2646458233,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2233628Z","2025-11-19 22:37:28.2233628Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5252 WerFault.exe",12628,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084035579904,18446633084035555328,140712899206080,0,295361220608,12628,1763591848223362800,295360462848,295360454656,140712899206080,7179256,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2233643Z","2025-11-19 22:37:28.2233643Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5252 WerFault.exe",8368,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084035608576,18446633084035584000,140712899206080,0,295361228800,8368,1763591848223364300,295363411968,295363403776,140712899206080,8636748,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2233701Z","2025-11-19 22:37:28.2233701Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5252 WerFault.exe",12560,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084036497408,18446633084036472832,140712899206080,0,295361245184,12560,1763591848223370100,295364460544,295364452352,140712899206080,281768,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2233711Z","2025-11-19 22:37:28.2233711Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5252 WerFault.exe",13036,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084035780608,18446633084035756032,140712899206080,0,295361236992,13036,1763591848223371100,295363936256,295363928064,140712899206080,7774840,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2233814Z","2025-11-19 22:37:28.2233814Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5252 WerFault.exe",1248,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084038164480,18446633084038139904,140712865112144,0,295361253376,1248,1763591848223381400,295364984832,295364976640,140712865112144,408507,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2233838Z","2025-11-19 22:37:28.2233838Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5252 WerFault.exe",10204,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084038193152,18446633084038168576,140712899206080,0,295361261568,10204,1763591848223383800,295365509120,295365480448,140712899206080,7920068,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2233994Z","2025-11-19 22:37:28.2233994Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5252 WerFault.exe",8320,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084038221824,18446633084038197248,140712899206080,0,295361269760,8320,1763591848223399400,295366033408,295366012928,140712899206080,49276648,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2233996Z","2025-11-19 22:37:28.2233996Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5252 WerFault.exe",13268,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084040347648,18446633084040323072,140712899206080,0,295361286144,13268,1763591848223399600,295367081984,295367065600,140712899206080,10564243,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2249315Z","2025-11-19 22:37:28.2249315Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084035321856,18446633084035297280,140702556693600,0,295361212416,14976,1763591848224931500,295359938560,295359860736,140702556693600,2468929032,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2260320Z","2025-11-19 22:37:28.2260320Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\WerFault.exe",,,,,,,,,,,,,,,,1763591848226032000,,,,,140702556684288,140702556684288,681036,647168,630084362,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2260414Z","2025-11-19 22:37:28.2260414Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\Faultrep.dll",,,,,,,,,,,,,,,,1763591848226041400,,,,,140712371552256,140712371552256,594974,548864,3149101438,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2260490Z","2025-11-19 22:37:28.2260490Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\aepic.dll",,,,,,,,,,,,,,,,1763591848226049000,,,,,140712428109824,140712428109824,641436,577536,321124434,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2260663Z","2025-11-19 22:37:28.2260663Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\CorePrivacySettingsStore.dll",,,,,,,,,,,,,,,,1763591848226066300,,,,,140712456290304,140712456290304,263379,196608,2978004593,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2260755Z","2025-11-19 22:37:28.2260755Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\DiagnosticDataSettings.dll",,,,,,,,,,,,,,,,1763591848226075500,,,,,140712462319616,140712462319616,108991,61440,3234151774,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2260829Z","2025-11-19 22:37:28.2260829Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\dbgcore.dll",,,,,,,,,,,,,,,,1763591848226082900,,,,,140712478244864,140712478244864,263772,245760,3120784319,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2260902Z","2025-11-19 22:37:28.2260902Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\cryptnet.dll",,,,,,,,,,,,,,,,1763591848226090200,,,,,140712595161088,140712595161088,304772,241664,919073152,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2260971Z","2025-11-19 22:37:28.2260971Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\webio.dll",,,,,,,,,,,,,,,,1763591848226097100,,,,,140712635531264,140712635531264,873482,827392,338769958,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2261005Z","2025-11-19 22:37:28.2261005Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.7019_none_3e06ffa0e335b8a8\comctl32.dll",,,,,,,,,,,,,,,,1763591848226100500,,,,,140712659910656,140712659910656,2747780,2703360,4095768276,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2261070Z","2025-11-19 22:37:28.2261070Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\dbghelp.dll",,,,,,,,,,,,,,,,1763591848226107000,,,,,140712664104960,140712664104960,2282862,2367488,82455296,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2261137Z","2025-11-19 22:37:28.2261137Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\ncryptsslp.dll",,,,,,,,,,,,,,,,1763591848226113700,,,,,140712682061824,140712682061824,310492,270336,4015176457,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2261280Z","2025-11-19 22:37:28.2261280Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\xmllite.dll",,,,,,,,,,,,,,,,1763591848226128000,,,,,140712684027904,140712684027904,342897,274432,974526834,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2261345Z","2025-11-19 22:37:28.2261345Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\netapi32.dll",,,,,,,,,,,,,,,,1763591848226134500,,,,,140712696348672,140712696348672,171999,106496,898597876,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2261415Z","2025-11-19 22:37:28.2261415Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\rasadhlp.dll",,,,,,,,,,,,,,,,1763591848226141500,,,,,140712730755072,140712730755072,108990,45056,352477361,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2261478Z","2025-11-19 22:37:28.2261478Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\FWPUCLNT.DLL",,,,,,,,,,,,,,,,1763591848226147800,,,,,140712731279360,140712731279360,561494,548864,3096342574,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2261544Z","2025-11-19 22:37:28.2261544Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\dhcpcsvc.dll",,,,,,,,,,,,,,,,1763591848226154400,,,,,140712746024960,140712746024960,184216,143360,916390222,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2261596Z","2025-11-19 22:37:28.2261596Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\winhttp.dll",,,,,,,,,,,,,,,,1763591848226159600,,,,,140712750350336,140712750350336,1261038,1212416,84984727,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2261657Z","2025-11-19 22:37:28.2261657Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\dhcpcsvc6.dll",,,,,,,,,,,,,,,,1763591848226165700,,,,,140712753233920,140712753233920,145503,122880,2114927498,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2261716Z","2025-11-19 22:37:28.2261716Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\dsreg.dll",,,,,,,,,,,,,,,,1763591848226171600,,,,,140712764768256,140712764768256,1520707,1466368,4143332483,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2261851Z","2025-11-19 22:37:28.2261851Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\uxtheme.dll",,,,,,,,,,,,,,,,1763591848226185100,,,,,140712802254848,140712802254848,696534,696320,1695798817,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2261926Z","2025-11-19 22:37:28.2261926Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\winnsi.dll",,,,,,,,,,,,,,,,1763591848226192600,,,,,140712802975744,140712802975744,95519,61440,2268955118,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2261994Z","2025-11-19 22:37:28.2261994Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\wer.dll",,,,,,,,,,,,,,,,1763591848226199400,,,,,140712805728256,140712805728256,993632,983040,1987637995,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2262056Z","2025-11-19 22:37:28.2262056Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\rmclient.dll",,,,,,,,,,,,,,,,1763591848226205600,,,,,140712808808448,140712808808448,282526,221184,1891057501,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2262127Z","2025-11-19 22:37:28.2262127Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\windows.storage.dll",,,,,,,,,,,,,,,,1763591848226212700,,,,,140712812412928,140712812412928,8877403,8769536,3667346596,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2262183Z","2025-11-19 22:37:28.2262183Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\IPHLPAPI.DLL",,,,,,,,,,,,,,,,1763591848226218300,,,,,140712824012800,140712824012800,233044,212992,945822897,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2262248Z","2025-11-19 22:37:28.2262248Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\dnsapi.dll",,,,,,,,,,,,,,,,1763591848226224800,,,,,140712824274944,140712824274944,1293169,1228800,1381219389,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2262313Z","2025-11-19 22:37:28.2262313Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\schannel.dll",,,,,,,,,,,,,,,,1763591848226231300,,,,,140712828731392,140712828731392,849052,802816,24806266,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2262373Z","2025-11-19 22:37:28.2262373Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\rsaenh.dll",,,,,,,,,,,,,,,,1763591848226237300,,,,,140712829976576,140712829976576,300007,237568,1319378437,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2262514Z","2025-11-19 22:37:28.2262514Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591848226251400,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2262578Z","2025-11-19 22:37:28.2262578Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\ntmarta.dll",,,,,,,,,,,,,,,,1763591848226257800,,,,,140712831811584,140712831811584,265798,221184,3598506564,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2262643Z","2025-11-19 22:37:28.2262643Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\sspicli.dll",,,,,,,,,,,,,,,,1763591848226264300,,,,,140712833384448,140712833384448,339222,299008,3030302172,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2262707Z","2025-11-19 22:37:28.2262707Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\mswsock.dll",,,,,,,,,,,,,,,,1763591848226270700,,,,,140712836333568,140712836333568,491870,438272,897307513,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2262760Z","2025-11-19 22:37:28.2262760Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\userenv.dll",,,,,,,,,,,,,,,,1763591848226276000,,,,,140712837054464,140712837054464,245008,176128,731547084,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2262818Z","2025-11-19 22:37:28.2262818Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\cryptsp.dll",,,,,,,,,,,,,,,,1763591848226281800,,,,,140712839217152,140712839217152,146168,110592,1658328178,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2262876Z","2025-11-19 22:37:28.2262876Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\cryptbase.dll",,,,,,,,,,,,,,,,1763591848226287600,,,,,140712839348224,140712839348224,63718,49152,3897879906,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2262935Z","2025-11-19 22:37:28.2262935Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\msasn1.dll",,,,,,,,,,,,,,,,1763591848226293500,,,,,140712839675904,140712839675904,150871,77824,2536054058,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2262990Z","2025-11-19 22:37:28.2262990Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\ntasn1.dll",,,,,,,,,,,,,,,,1763591848226299000,,,,,140712841117696,140712841117696,300816,258048,2667946327,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2263115Z","2025-11-19 22:37:28.2263115Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\ncrypt.dll",,,,,,,,,,,,,,,,1763591848226311500,,,,,140712841445376,140712841445376,272959,196608,3912253876,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2263178Z","2025-11-19 22:37:28.2263178Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\cfgmgr32.dll",,,,,,,,,,,,,,,,1763591848226317800,,,,,140712845049856,140712845049856,385808,356352,1737777300,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2263247Z","2025-11-19 22:37:28.2263247Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\dpapi.dll",,,,,,,,,,,,,,,,1763591848226324700,,,,,140712845574144,140712845574144,42814,40960,2473566603,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2263302Z","2025-11-19 22:37:28.2263302Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\umpdc.dll",,,,,,,,,,,,,,,,1763591848226330200,,,,,140712848064512,140712848064512,98535,81920,1714427184,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2263358Z","2025-11-19 22:37:28.2263358Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\powrprof.dll",,,,,,,,,,,,,,,,1763591848226335800,,,,,140712848195584,140712848195584,457799,385024,2858637235,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2263414Z","2025-11-19 22:37:28.2263414Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\bcrypt.dll",,,,,,,,,,,,,,,,1763591848226341400,,,,,140712848654336,140712848654336,206048,172032,2893678010,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2263472Z","2025-11-19 22:37:28.2263472Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\profapi.dll",,,,,,,,,,,,,,,,1763591848226347200,,,,,140712848850944,140712848850944,229548,167936,2447194521,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2263531Z","2025-11-19 22:37:28.2263531Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\crypt32.dll",,,,,,,,,,,,,,,,1763591848226353100,,,,,140712849768448,140712849768448,1584869,1536000,3438168074,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2263591Z","2025-11-19 22:37:28.2263591Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,,,,,,,1763591848226359100,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2263730Z","2025-11-19 22:37:28.2263730Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591848226373000,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2263791Z","2025-11-19 22:37:28.2263791Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591848226379100,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2263858Z","2025-11-19 22:37:28.2263858Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591848226385800,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2263912Z","2025-11-19 22:37:28.2263912Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591848226391200,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2264090Z","2025-11-19 22:37:28.2264090Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591848226409000,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2264151Z","2025-11-19 22:37:28.2264151Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591848226415100,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2264211Z","2025-11-19 22:37:28.2264211Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,,,,,,,1763591848226421100,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2264338Z","2025-11-19 22:37:28.2264338Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\shlwapi.dll",,,,,,,,,,,,,,,,1763591848226433800,,,,,140712868839424,140712868839424,479562,421888,2142510382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2264398Z","2025-11-19 22:37:28.2264398Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591848226439800,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2264462Z","2025-11-19 22:37:28.2264462Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,,,,,,,1763591848226446200,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2264520Z","2025-11-19 22:37:28.2264520Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\ws2_32.dll",,,,,,,,,,,,,,,,1763591848226452000,,,,,140712881094656,140712881094656,513405,475136,3967481067,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2264578Z","2025-11-19 22:37:28.2264578Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591848226457800,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2264630Z","2025-11-19 22:37:28.2264630Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591848226463000,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2264687Z","2025-11-19 22:37:28.2264687Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,,,,,,,1763591848226468700,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2264744Z","2025-11-19 22:37:28.2264744Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,,,,,,,1763591848226474400,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2264800Z","2025-11-19 22:37:28.2264800Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591848226480000,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2264909Z","2025-11-19 22:37:28.2264909Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,,,,,,,1763591848226490900,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2264987Z","2025-11-19 22:37:28.2264987Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\nsi.dll",,,,,,,,,,,,,,,,1763591848226498700,,,,,140712892956672,140712892956672,111648,40960,4223476491,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2265073Z","2025-11-19 22:37:28.2265073Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\msctf.dll",,,,,,,,,,,,,,,,1763591848226507300,,,,,140712893022208,140712893022208,1455420,1433600,4155718050,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2265148Z","2025-11-19 22:37:28.2265148Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591848226514800,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2265371Z","2025-11-19 22:37:28.2265371Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591848226537100,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2265435Z","2025-11-19 22:37:28.2265435Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591848226543500,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2265618Z","2025-11-19 22:37:28.2265618Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"WerFault.exe",,,,,,,,,,,,,,,,1763591848226561800,,,,,,,,,,134080654472445997,,,,,,,6634,,,,,5734400,13971456,3457303163,0,134080654488973699,205,0,83,2286,3,406,81 +"2025-11-19 22:37:28.2299996Z","2025-11-19 22:37:28.2299996Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,,,,,,,,,,,18446633084031987712,18446633084031963136,2513113579520,0,705865949184,14412,1763591848229999600,705865449472,705865428992,2513113579520,45081055,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2302606Z","2025-11-19 22:37:28.2302606Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\whoami.exe",,,,,,,,,,,,,,,,1763591848230260600,,,,,140702344609792,140702344609792,160109,98304,3602411345,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2302692Z","2025-11-19 22:37:28.2302692Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\wkscli.dll",,,,,,,,,,,,,,,,1763591848230269200,,,,,140712738291712,140712738291712,170846,110592,1225555544,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2302764Z","2025-11-19 22:37:28.2302764Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\version.dll",,,,,,,,,,,,,,,,1763591848230276400,,,,,140712753168384,140712753168384,72452,45056,2275202464,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2302833Z","2025-11-19 22:37:28.2302833Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\apphelp.dll",,,,,,,,,,,,,,,,1763591848230283300,,,,,140712800485376,140712800485376,675806,651264,4108425587,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2302892Z","2025-11-19 22:37:28.2302892Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\netutils.dll",,,,,,,,,,,,,,,,1763591848230289200,,,,,140712825847808,140712825847808,80696,53248,865845000,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2303031Z","2025-11-19 22:37:28.2303031Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\authz.dll",,,,,,,,,,,,,,,,1763591848230303100,,,,,140712826241024,140712826241024,372179,327680,771731569,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2303108Z","2025-11-19 22:37:28.2303108Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\sspicli.dll",,,,,,,,,,,,,,,,1763591848230310800,,,,,140712833384448,140712833384448,339222,299008,3030302172,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2303160Z","2025-11-19 22:37:28.2303160Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591848230316000,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2303209Z","2025-11-19 22:37:28.2303209Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591848230320900,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2303256Z","2025-11-19 22:37:28.2303256Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591848230325600,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2303305Z","2025-11-19 22:37:28.2303305Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591848230330500,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2303347Z","2025-11-19 22:37:28.2303347Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591848230334700,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2303393Z","2025-11-19 22:37:28.2303393Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591848230339300,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2303441Z","2025-11-19 22:37:28.2303441Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591848230344100,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2303485Z","2025-11-19 22:37:28.2303485Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\ws2_32.dll",,,,,,,,,,,,,,,,1763591848230348500,,,,,140712881094656,140712881094656,513405,475136,3967481067,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2303531Z","2025-11-19 22:37:28.2303531Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591848230353100,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2303660Z","2025-11-19 22:37:28.2303660Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591848230366000,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2303718Z","2025-11-19 22:37:28.2303718Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,,,,,,,1763591848230371800,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2303766Z","2025-11-19 22:37:28.2303766Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591848230376600,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2303812Z","2025-11-19 22:37:28.2303812Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591848230381200,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2303855Z","2025-11-19 22:37:28.2303855Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591848230385500,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2303897Z","2025-11-19 22:37:28.2303897Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591848230389700,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2303954Z","2025-11-19 22:37:28.2303954Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"whoami.exe",,,,,,,,,,,,,,,,1763591848230395400,,,,,,,,,,134080654423385232,,,,,,,6628,,,,,1265664,1310720,56924383,3221225477,134080654489015372,83,0,1,3,3,0,0 +"2025-11-19 22:37:28.2307155Z","2025-11-19 22:37:28.2307155Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",3864,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028424192,18446633084028399616,140712899206080,0,696750415872,3864,1763591848230715500,696752537600,696752529408,140712899206080,11277899,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2307156Z","2025-11-19 22:37:28.2307156Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028022784,18446633084027998208,140702989817872,0,696750407680,5408,1763591848230715600,696748802048,696748781568,140702989817872,67845830,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2307184Z","2025-11-19 22:37:28.2307184Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",8232,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028223488,18446633084028198912,140712865112144,0,696750440448,8232,1763591848230718400,696755683328,696755675136,140712865112144,269699,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2307232Z","2025-11-19 22:37:28.2307232Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",12624,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028911616,18446633084028887040,140702989233856,0,696750473216,12624,1763591848230723200,696759877632,696759869440,140702989233856,1887132,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2307235Z","2025-11-19 22:37:28.2307235Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",14384,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028510208,18446633084028485632,140712899206080,0,696750432256,14384,1763591848230723500,696754634752,696754622464,140712899206080,8595642,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2307333Z","2025-11-19 22:37:28.2307333Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",9776,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084029231104,18446633084029206528,140702989404080,0,696750489600,9776,1763591848230733300,696761974784,696761962496,140702989404080,957334,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2307340Z","2025-11-19 22:37:28.2307340Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",12484,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028481536,18446633084028456960,140712899206080,0,696750424064,12484,1763591848230734000,696753586176,696753573888,140712899206080,10699281,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2307385Z","2025-11-19 22:37:28.2307385Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",1184,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084035321856,18446633084035297280,140702989086576,0,696750481408,1184,1763591848230738500,696760926208,696760918016,140702989086576,2934612,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2307426Z","2025-11-19 22:37:28.2307426Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",14248,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028538880,18446633084028514304,140712899206080,0,696750448640,14248,1763591848230742600,696756731904,696756690944,140712899206080,21428731,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2307493Z","2025-11-19 22:37:28.2307493Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",10496,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028596224,18446633084028571648,140712899206080,0,696750456832,10496,1763591848230749300,696757780480,696757751808,140712899206080,16702796,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2317641Z","2025-11-19 22:37:28.2317641Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084029116416,18446633084029091840,140702989217024,0,696750465024,8552,1763591848231764100,696758829056,696758800384,140702989217024,18009798,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2326527Z","2025-11-19 22:37:28.2326527Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\OpenConsole.exe",,,,,,,,,,,,,,,,1763591848232652700,,,,,140702989025280,140702989025280,1210794,1159168,1759975785,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2326672Z","2025-11-19 22:37:28.2326672Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\usp10.dll",,,,,,,,,,,,,,,,1763591848232667200,,,,,140711462174720,140711462174720,161304,102400,728066498,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2326761Z","2025-11-19 22:37:28.2326761Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\UIAutomationCore.dll",,,,,,,,,,,,,,,,1763591848232676100,,,,,140712432762880,140712432762880,4328257,4296704,2096711852,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2326830Z","2025-11-19 22:37:28.2326830Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\winmm.dll",,,,,,,,,,,,,,,,1763591848232683000,,,,,140712663842816,140712663842816,263815,217088,2106743460,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2326910Z","2025-11-19 22:37:28.2326910Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,,,,,,,1763591848232691000,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2327022Z","2025-11-19 22:37:28.2327022Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\PackagedCom\OpenConsoleProxy.dll",,,,,,,,,,,,,,,,1763591848232702200,,,,,140712723349504,140712723349504,51292,53248,1759975238,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2327106Z","2025-11-19 22:37:28.2327106Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\propsys.dll",,,,,,,,,,,,,,,,1763591848232710600,,,,,140712761491456,140712761491456,1123662,1060864,3228732737,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2327174Z","2025-11-19 22:37:28.2327174Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\D3DCompiler_47.dll",,,,,,,,,,,,,,,,1763591848232717400,,,,,140712769814528,140712769814528,4685395,4714496,796813953,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2327237Z","2025-11-19 22:37:28.2327237Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\d2d1.dll",,,,,,,,,,,,,,,,1763591848232723700,,,,,140712777744384,140712777744384,6610469,6537216,3013069957,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2327294Z","2025-11-19 22:37:28.2327294Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\DWrite.dll",,,,,,,,,,,,,,,,1763591848232729400,,,,,140712784297984,140712784297984,2543119,2519040,1462185185,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2327341Z","2025-11-19 22:37:28.2327341Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\d3d11.dll",,,,,,,,,,,,,,,,1763591848232734100,,,,,140712786853888,140712786853888,2582658,2498560,2128032819,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2327397Z","2025-11-19 22:37:28.2327397Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\uxtheme.dll",,,,,,,,,,,,,,,,1763591848232739700,,,,,140712802254848,140712802254848,696534,696320,1695798817,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2327454Z","2025-11-19 22:37:28.2327454Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\dxgi.dll",,,,,,,,,,,,,,,,1763591848232745400,,,,,140712803631104,140712803631104,1320096,1282048,1861212996,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2327519Z","2025-11-19 22:37:28.2327519Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\windows.storage.dll",,,,,,,,,,,,,,,,1763591848232751900,,,,,140712812412928,140712812412928,8877403,8769536,3667346596,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2327660Z","2025-11-19 22:37:28.2327660Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591848232766000,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2327719Z","2025-11-19 22:37:28.2327719Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\cryptsp.dll",,,,,,,,,,,,,,,,1763591848232771900,,,,,140712839217152,140712839217152,146168,110592,1658328178,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2327775Z","2025-11-19 22:37:28.2327775Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\umpdc.dll",,,,,,,,,,,,,,,,1763591848232777500,,,,,140712848064512,140712848064512,98535,81920,1714427184,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2327833Z","2025-11-19 22:37:28.2327833Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\powrprof.dll",,,,,,,,,,,,,,,,1763591848232783300,,,,,140712848195584,140712848195584,457799,385024,2858637235,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2327899Z","2025-11-19 22:37:28.2327899Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,,,,,,,1763591848232789900,,,,,140712851341312,140712851341312,1524912,1486848,1404855129,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2327955Z","2025-11-19 22:37:28.2327955Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,,,,,,,1763591848232795500,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2328001Z","2025-11-19 22:37:28.2328001Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591848232800100,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2328042Z","2025-11-19 22:37:28.2328042Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591848232804200,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2328085Z","2025-11-19 22:37:28.2328085Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591848232808500,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2328132Z","2025-11-19 22:37:28.2328132Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591848232813200,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2328254Z","2025-11-19 22:37:28.2328254Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591848232825400,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2328309Z","2025-11-19 22:37:28.2328309Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591848232830900,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2328359Z","2025-11-19 22:37:28.2328359Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,,,,,,,1763591848232835900,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2328415Z","2025-11-19 22:37:28.2328415Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,,,,,,,1763591848232841500,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2328461Z","2025-11-19 22:37:28.2328461Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591848232846100,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2328512Z","2025-11-19 22:37:28.2328512Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,,,,,,,1763591848232851200,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2328555Z","2025-11-19 22:37:28.2328555Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591848232855500,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2328593Z","2025-11-19 22:37:28.2328593Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591848232859300,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2328635Z","2025-11-19 22:37:28.2328635Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,,,,,,,1763591848232863500,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2328690Z","2025-11-19 22:37:28.2328690Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,,,,,,,1763591848232869000,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2328735Z","2025-11-19 22:37:28.2328735Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591848232873500,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2328866Z","2025-11-19 22:37:28.2328866Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,,,,,,,1763591848232886600,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2328921Z","2025-11-19 22:37:28.2328921Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591848232892100,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2328961Z","2025-11-19 22:37:28.2328961Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591848232896100,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2329003Z","2025-11-19 22:37:28.2329003Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591848232900300,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2329108Z","2025-11-19 22:37:28.2329108Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"OpenConsole.ex",,,,,,,,,,,,,,,,1763591848232910800,,,,,,,,,,134080654410427174,,,,,,,6626,,,,,2904064,2949120,170556274,0,134080654489038872,111,0,12,10,3,52,0 +"2025-11-19 22:37:28.2332799Z","2025-11-19 22:37:28.2332799Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13300 conhost.exe",6828,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028309504,18446633084028284928,140712899206080,0,689119428608,6828,1763591848233279900,689122574336,689122566144,140712899206080,96563,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2332863Z","2025-11-19 22:37:28.2332863Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13300 conhost.exe",14856,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028137472,18446633084028112896,140712899206080,0,689119420416,14856,1763591848233286300,689121525760,689121517568,140712899206080,553353,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2333040Z","2025-11-19 22:37:28.2333040Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13300 conhost.exe",3620,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028108800,18446633084028084224,140712865112144,0,689119412224,3620,1763591848233304000,689121001472,689120993280,140712865112144,120327,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2333088Z","2025-11-19 22:37:28.2333088Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13300 conhost.exe",10848,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084027535360,18446633084027510784,140712899206080,0,689119404032,10848,1763591848233308800,689120477184,689120468992,140712899206080,764586,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2333200Z","2025-11-19 22:37:28.2333200Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13300 conhost.exe",6452,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028252160,18446633084028227584,140696384580832,0,689119395840,6452,1763591848233320000,689122050048,689122021376,140696384580832,28729820,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2336004Z","2025-11-19 22:37:28.2336004Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084029374464,18446633084029349888,140696385038832,0,689119436800,4352,1763591848233600400,689123098624,689123086336,140696385038832,745725,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2340005Z","2025-11-19 22:37:28.2340005Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\Windows\System32\conhost.exe",,,,,,,,,,,,,,,,1763591848234000500,,,,,140696384438272,140696384438272,1035098,1028096,2671108986,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2340090Z","2025-11-19 22:37:28.2340090Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,,,,,,,1763591848234009000,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2340120Z","2025-11-19 22:37:28.2340120Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\PackagedCom\OpenConsoleProxy.dll",,,,,,,,,,,,,,,,1763591848234012000,,,,,140712723349504,140712723349504,51292,53248,1759975238,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2340177Z","2025-11-19 22:37:28.2340177Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591848234017700,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2340228Z","2025-11-19 22:37:28.2340228Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,,,,,,,1763591848234022800,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2340271Z","2025-11-19 22:37:28.2340271Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591848234027100,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2340313Z","2025-11-19 22:37:28.2340313Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591848234031300,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2340356Z","2025-11-19 22:37:28.2340356Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591848234035600,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2340403Z","2025-11-19 22:37:28.2340403Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591848234040300,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2340514Z","2025-11-19 22:37:28.2340514Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591848234051400,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2340576Z","2025-11-19 22:37:28.2340576Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591848234057600,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2340631Z","2025-11-19 22:37:28.2340631Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",6612,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029632512,18446633084029607936,140712373211440,0,932562563072,6612,1763591848234063100,932579377152,932579237888,140712373211440,6105737,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2340633Z","2025-11-19 22:37:28.2340633Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,,,,,,,1763591848234063300,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2340679Z","2025-11-19 22:37:28.2340679Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591848234067900,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2340723Z","2025-11-19 22:37:28.2340723Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,,,,,,,1763591848234072300,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2340926Z","2025-11-19 22:37:28.2340926Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591848234092600,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2340973Z","2025-11-19 22:37:28.2340973Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591848234097300,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2341016Z","2025-11-19 22:37:28.2341016Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,,,,,,,1763591848234101600,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2341131Z","2025-11-19 22:37:28.2341131Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,,,,,,,1763591848234113100,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2341189Z","2025-11-19 22:37:28.2341189Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591848234118900,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2341244Z","2025-11-19 22:37:28.2341244Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591848234124400,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2341291Z","2025-11-19 22:37:28.2341291Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591848234129100,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2341330Z","2025-11-19 22:37:28.2341330Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591848234133000,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2341385Z","2025-11-19 22:37:28.2341385Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"conhost.exe",,,,,,,,,,,,,,,,1763591848234138500,,,,,,,,,,134080654410205145,,,,,,,6625,,,,,1556480,1605632,60704691,109,134080654489052028,92,0,5,0,3,0,0 +"2025-11-19 22:37:28.2493114Z","2025-11-19 22:37:28.2493114Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",9352,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029317120,18446633084029292544,140712899206080,0,932562546688,9352,1763591848249311400,932577280000,932577267712,140712899206080,3968522,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493126Z","2025-11-19 22:37:28.2493126Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",13692,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028653568,18446633084028628992,140712865112144,0,932562554880,13692,1763591848249312600,932578328576,932578308096,140712865112144,8869104,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493138Z","2025-11-19 22:37:28.2493138Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",14632,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029947904,18446633084029923328,140712899206080,0,932562579456,14632,1763591848249313800,932581474304,932581453824,140712899206080,2144557027,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493139Z","2025-11-19 22:37:28.2493139Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",13488,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028854272,18446633084028829696,140712604173856,0,932562513920,13488,1763591848249313900,932574134272,932574130176,140712604173856,12990007,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493172Z","2025-11-19 22:37:28.2493172Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028624896,18446633084028600320,140702319920256,0,932562440192,2344,1763591848249317200,932564697088,932564606976,140702319920256,1455950499,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493206Z","2025-11-19 22:37:28.2493206Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",6260,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028882944,18446633084028858368,140712378637616,0,932562571264,6260,1763591848249320600,932580425728,932580397056,140712378637616,74326129,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493288Z","2025-11-19 22:37:28.2493288Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",13068,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084056907776,18446633084056883200,140712899206080,0,932562530304,13068,1763591848249328800,932575182848,932575174656,140712899206080,1442413,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493310Z","2025-11-19 22:37:28.2493310Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",4192,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029173760,18446633084029149184,140712632221632,0,932562522112,4192,1763591848249331000,932573085696,932573073408,140712632221632,3191112,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493327Z","2025-11-19 22:37:28.2493327Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",3424,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029546496,18446633084029521920,140712899206080,0,932562587648,3424,1763591848249332700,932582522880,932582510592,140712899206080,7336541,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493342Z","2025-11-19 22:37:28.2493342Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",14684,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028968960,18446633084028944384,140712899206080,0,932562595840,14684,1763591848249334200,932583571456,932583559168,140712899206080,3853099,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493343Z","2025-11-19 22:37:28.2493343Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",3272,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028682240,18446633084028657664,140712899206080,0,932562456576,3272,1763591848249334300,932566794240,932566781952,140712899206080,18018463,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493346Z","2025-11-19 22:37:28.2493346Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028710912,18446633084028686336,140712899206080,0,932562464768,12328,1763591848249334600,932567842816,932567830528,140712899206080,16404047,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493363Z","2025-11-19 22:37:28.2493363Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",6564,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084030005248,18446633084029980672,140712899206080,0,932562612224,6564,1763591848249336300,932585668608,932585660416,140712899206080,1315295,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493371Z","2025-11-19 22:37:28.2493371Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",12924,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084030033920,18446633084030009344,140712899206080,0,932562620416,12924,1763591848249337100,932586717184,932586708992,140712899206080,807962,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493410Z","2025-11-19 22:37:28.2493410Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",13344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029976576,18446633084029952000,140712899206080,0,932562604032,13344,1763591848249341000,932584620032,932584611840,140712899206080,1766050,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493421Z","2025-11-19 22:37:28.2493421Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",10628,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084010672128,18446633084010647552,140712899206080,0,932562472960,10628,1763591848249342100,932568891392,932568879104,140712899206080,4099788,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493446Z","2025-11-19 22:37:28.2493446Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",11164,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028739584,18446633084028715008,140712865112144,0,932562481152,11164,1763591848249344600,932569939968,932569931776,140712865112144,142205,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493466Z","2025-11-19 22:37:28.2493466Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",6140,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028080128,18446633084028055552,140712899206080,0,932562448384,6140,1763591848249346600,932565745664,932565729280,140712899206080,30190715,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493471Z","2025-11-19 22:37:28.2493471Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",13704,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084030062592,18446633084030038016,140712899206080,0,932562628608,13704,1763591848249347100,932587765760,932587761664,140712899206080,393419,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2494031Z","2025-11-19 22:37:28.2494031Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",11792,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029026304,18446633084029001728,140712891292720,0,932562497536,11792,1763591848249403100,932572037120,932572016640,140712891292720,10320952,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2494319Z","2025-11-19 22:37:28.2494319Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",9736,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028768256,18446633084028743680,140712899206080,0,932562489344,9736,1763591848249431900,932570988544,932570972160,140712899206080,8949073,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2494409Z","2025-11-19 22:37:28.2494409Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",4376,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084027793408,18446633084027768832,140712583404848,0,932562538496,4376,1763591848249440900,932576231424,932576223232,140712583404848,640863,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2560561Z","2025-11-19 22:37:28.2560561Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe",,,,,,,,,,,,,,,,1763591848256056100,,,,,140702319640576,140702319640576,738129,684032,1759975821,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2560635Z","2025-11-19 22:37:28.2560635Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.8_8.2501.31001.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.dll",,,,,,,,,,,,,,,,1763591848256063500,,,,,140710095028224,140710095028224,5866761,5873664,2056920596,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2560673Z","2025-11-19 22:37:28.2560673Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\ProgramData\Microsoft\VisualStudio\Setup\x64\Microsoft.VisualStudio.Setup.Configuration.Native.dll",,,,,,,,,,,,,,,,1763591848256067300,,,,,140711212089344,140711212089344,1007466,1015808,1726088073,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2560707Z","2025-11-19 22:37:28.2560707Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\TerminalApp.dll",,,,,,,,,,,,,,,,1763591848256070700,,,,,140711774912512,140711774912512,3444084,3444736,1759975751,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2560928Z","2025-11-19 22:37:28.2560928Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\msftedit.dll",,,,,,,,,,,,,,,,1763591848256092800,,,,,140712289107968,140712289107968,3297357,3305472,3878106343,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2561168Z","2025-11-19 22:37:28.2561168Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\ExplorerFrame.dll",,,,,,,,,,,,,,,,1763591848256116800,,,,,140712345862144,140712345862144,2919775,2867200,3427672670,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2561213Z","2025-11-19 22:37:28.2561213Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\TerminalConnection.dll",,,,,,,,,,,,,,,,1763591848256121300,,,,,140712372994048,140712372994048,522798,495616,1759975254,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2561296Z","2025-11-19 22:37:28.2561296Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\Microsoft.Terminal.Settings.Model.dll",,,,,,,,,,,,,,,,1763591848256129600,,,,,140712373518336,140712373518336,2281369,2252800,1759975487,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2561330Z","2025-11-19 22:37:28.2561330Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\Microsoft.Terminal.Control.dll",,,,,,,,,,,,,,,,1763591848256133000,,,,,140712378368000,140712378368000,1976337,1986560,1759975378,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2561422Z","2025-11-19 22:37:28.2561422Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\DataExchange.dll",,,,,,,,,,,,,,,,1763591848256142200,,,,,140712406614016,140712406614016,399312,368640,696309968,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2561507Z","2025-11-19 22:37:28.2561507Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\twinapi.dll",,,,,,,,,,,,,,,,1763591848256150700,,,,,140712415789056,140712415789056,924452,868352,2129603828,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2561594Z","2025-11-19 22:37:28.2561594Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\UIAutomationCore.dll",,,,,,,,,,,,,,,,1763591848256159400,,,,,140712432762880,140712432762880,4328257,4296704,2096711852,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2561754Z","2025-11-19 22:37:28.2561754Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\UiaManager.dll",,,,,,,,,,,,,,,,1763591848256175400,,,,,140712461205504,140712461205504,941078,897024,2628067039,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2561838Z","2025-11-19 22:37:28.2561838Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\AppExtension.dll",,,,,,,,,,,,,,,,1763591848256183800,,,,,140712467365888,140712467365888,337294,299008,1656953249,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2561925Z","2025-11-19 22:37:28.2561925Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.StateRepositoryPS.dll",,,,,,,,,,,,,,,,1763591848256192500,,,,,140712490369024,140712490369024,879719,802816,374042279,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2561999Z","2025-11-19 22:37:28.2561999Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.ApplicationModel.dll",,,,,,,,,,,,,,,,1763591848256199900,,,,,140712508391424,140712508391424,945679,876544,2857312343,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2562031Z","2025-11-19 22:37:28.2562031Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\Microsoft.Terminal.UI.dll",,,,,,,,,,,,,,,,1763591848256203100,,,,,140712537882624,140712537882624,255391,258048,1759975265,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2562104Z","2025-11-19 22:37:28.2562104Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\threadpoolwinrt.dll",,,,,,,,,,,,,,,,1763591848256210400,,,,,140712555839488,140712555839488,130107,90112,2299561022,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2562181Z","2025-11-19 22:37:28.2562181Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.UI.Core.TextInput.dll",,,,,,,,,,,,,,,,1763591848256218100,,,,,140712572354560,140712572354560,1511216,1499136,21441667,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2562329Z","2025-11-19 22:37:28.2562329Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\directmanipulation.dll",,,,,,,,,,,,,,,,1763591848256232900,,,,,140712583036928,140712583036928,714070,667648,3434535107,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2562400Z","2025-11-19 22:37:28.2562400Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\InputHost.dll",,,,,,,,,,,,,,,,1763591848256240000,,,,,140712583757824,140712583757824,1989124,1970176,2937052880,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2562470Z","2025-11-19 22:37:28.2562470Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\TextShaping.dll",,,,,,,,,,,,,,,,1763591848256247000,,,,,140712585789440,140712585789440,770155,733184,2109619091,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2562535Z","2025-11-19 22:37:28.2562535Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.UI.Xaml.Controls.dll",,,,,,,,,,,,,,,,1763591848256253500,,,,,140712586575872,140712586575872,3327252,3313664,3689468694,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2562613Z","2025-11-19 22:37:28.2562613Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.Globalization.dll",,,,,,,,,,,,,,,,1763591848256261300,,,,,140712593457152,140712593457152,1640332,1634304,3240919660,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2562695Z","2025-11-19 22:37:28.2562695Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.UI.Immersive.dll",,,,,,,,,,,,,,,,1763591848256269500,,,,,140712595423232,140712595423232,1424120,1372160,1559948871,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2562788Z","2025-11-19 22:37:28.2562788Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.UI.Xaml.dll",,,,,,,,,,,,,,,,1763591848256278900,,,,,140712596865024,140712596865024,17882163,17858560,706442395,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2562998Z","2025-11-19 22:37:28.2562998Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.UI.dll",,,,,,,,,,,,,,,,1763591848256299800,,,,,140712615346176,140712615346176,1414164,1376256,3301850593,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2563109Z","2025-11-19 22:37:28.2563109Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\globinputhost.dll",,,,,,,,,,,,,,,,1763591848256310900,,,,,140712627863552,140712627863552,263563,208896,1786968813,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2563179Z","2025-11-19 22:37:28.2563179Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\BCP47mrm.dll",,,,,,,,,,,,,,,,1763591848256317900,,,,,140712628322304,140712628322304,278903,212992,835504572,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2563247Z","2025-11-19 22:37:28.2563247Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\TextInputFramework.dll",,,,,,,,,,,,,,,,1763591848256324700,,,,,140712628846592,140712628846592,1374424,1339392,3535451269,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2563309Z","2025-11-19 22:37:28.2563309Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\BCP47Langs.dll",,,,,,,,,,,,,,,,1763591848256331000,,,,,140712631468032,140712631468032,402331,385024,2065030180,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2563375Z","2025-11-19 22:37:28.2563375Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\MrmCoreR.dll",,,,,,,,,,,,,,,,1763591848256337500,,,,,140712631926784,140712631926784,1191374,1146880,1078870765,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2563442Z","2025-11-19 22:37:28.2563442Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\iertutil.dll",,,,,,,,,,,,,,,,1763591848256344200,,,,,140712642805760,140712642805760,2984761,2904064,3815768453,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2563598Z","2025-11-19 22:37:28.2563598Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\winmm.dll",,,,,,,,,,,,,,,,1763591848256359800,,,,,140712663842816,140712663842816,263815,217088,2106743460,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2563654Z","2025-11-19 22:37:28.2563654Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\srvcli.dll",,,,,,,,,,,,,,,,1763591848256365400,,,,,140712668954624,140712668954624,181029,167936,239922031,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2563714Z","2025-11-19 22:37:28.2563714Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\urlmon.dll",,,,,,,,,,,,,,,,1763591848256371400,,,,,140712669609984,140712669609984,1970671,1957888,260716450,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2563784Z","2025-11-19 22:37:28.2563784Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\xmllite.dll",,,,,,,,,,,,,,,,1763591848256378400,,,,,140712684027904,140712684027904,342897,274432,974526834,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2563838Z","2025-11-19 22:37:28.2563838Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\icu.dll",,,,,,,,,,,,,,,,1763591848256383800,,,,,140712684617728,140712684617728,2775448,2744320,3611555297,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2563911Z","2025-11-19 22:37:28.2563911Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.StateRepositoryCore.dll",,,,,,,,,,,,,,,,1763591848256391100,,,,,140712689598464,140712689598464,121206,106496,2653287458,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2563973Z","2025-11-19 22:37:28.2563973Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.StateRepositoryClient.dll",,,,,,,,,,,,,,,,1763591848256397300,,,,,140712696610816,140712696610816,303673,290816,424989122,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2564009Z","2025-11-19 22:37:28.2564009Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\TerminalThemeHelpers.dll",,,,,,,,,,,,,,,,1763591848256400900,,,,,140712700477440,140712700477440,93641,61440,1754949712,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2564149Z","2025-11-19 22:37:28.2564149Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Windows.Graphics.dll",,,,,,,,,,,,,,,,1763591848256414900,,,,,140712711225344,140712711225344,669723,593920,1068018205,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2564236Z","2025-11-19 22:37:28.2564236Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\OneCoreUAPCommonProxyStub.dll",,,,,,,,,,,,,,,,1763591848256423700,,,,,140712713977856,140712713977856,6740758,6615040,2011948997,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2564308Z","2025-11-19 22:37:28.2564308Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\twinapi.appcore.dll",,,,,,,,,,,,,,,,1763591848256430800,,,,,140712720924672,140712720924672,2401519,2375680,2646458233,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2564341Z","2025-11-19 22:37:28.2564341Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\PackagedCom\OpenConsoleProxy.dll",,,,,,,,,,,,,,,,1763591848256434100,,,,,140712723349504,140712723349504,51292,53248,1759975238,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2564412Z","2025-11-19 22:37:28.2564412Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\d3d10warp.dll",,,,,,,,,,,,,,,,1763591848256441200,,,,,140712731869184,140712731869184,5958575,5943296,1147803111,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2564473Z","2025-11-19 22:37:28.2564473Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\WindowManagementAPI.dll",,,,,,,,,,,,,,,,1763591848256447300,,,,,140712738422784,140712738422784,1825044,1794048,1605274449,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2564542Z","2025-11-19 22:37:28.2564542Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\CoreUIComponents.dll",,,,,,,,,,,,,,,,1763591848256454200,,,,,140712742944768,140712742944768,3046501,3022848,801552868,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2564597Z","2025-11-19 22:37:28.2564597Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\winhttp.dll",,,,,,,,,,,,,,,,1763591848256459700,,,,,140712750350336,140712750350336,1261038,1212416,84984727,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2564660Z","2025-11-19 22:37:28.2564660Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\directxdatabasehelper.dll",,,,,,,,,,,,,,,,1763591848256466000,,,,,140712752709632,140712752709632,426573,405504,145563491,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2564803Z","2025-11-19 22:37:28.2564803Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\Microsoft.Internal.WarpPal.dll",,,,,,,,,,,,,,,,1763591848256480300,,,,,140712769683456,140712769683456,167600,102400,2132685858,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2564871Z","2025-11-19 22:37:28.2564871Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\D3DCompiler_47.dll",,,,,,,,,,,,,,,,1763591848256487100,,,,,140712769814528,140712769814528,4685395,4714496,796813953,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2564933Z","2025-11-19 22:37:28.2564933Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\WindowsCodecs.dll",,,,,,,,,,,,,,,,1763591848256493300,,,,,140712775385088,140712775385088,2352359,2293760,3466818398,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2564987Z","2025-11-19 22:37:28.2564987Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\d2d1.dll",,,,,,,,,,,,,,,,1763591848256498700,,,,,140712777744384,140712777744384,6610469,6537216,3013069957,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2565040Z","2025-11-19 22:37:28.2565040Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\DWrite.dll",,,,,,,,,,,,,,,,1763591848256504000,,,,,140712784297984,140712784297984,2543119,2519040,1462185185,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2565089Z","2025-11-19 22:37:28.2565089Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\d3d11.dll",,,,,,,,,,,,,,,,1763591848256508900,,,,,140712786853888,140712786853888,2582658,2498560,2128032819,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2565143Z","2025-11-19 22:37:28.2565143Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\dcomp.dll",,,,,,,,,,,,,,,,1763591848256514400,,,,,140712789409792,140712789409792,2309196,2240512,1200801128,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2565205Z","2025-11-19 22:37:28.2565205Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\CoreMessaging.dll",,,,,,,,,,,,,,,,1763591848256520500,,,,,140712796160000,140712796160000,1232710,1208320,2155847221,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2565269Z","2025-11-19 22:37:28.2565269Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\uxtheme.dll",,,,,,,,,,,,,,,,1763591848256526900,,,,,140712802254848,140712802254848,696534,696320,1695798817,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2565393Z","2025-11-19 22:37:28.2565393Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\pfclient.dll",,,,,,,,,,,,,,,,1763591848256539400,,,,,140712803500032,140712803500032,92868,73728,3163590703,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2565450Z","2025-11-19 22:37:28.2565450Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\dxgi.dll",,,,,,,,,,,,,,,,1763591848256545000,,,,,140712803631104,140712803631104,1320096,1282048,1861212996,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2565509Z","2025-11-19 22:37:28.2565509Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\dwmapi.dll",,,,,,,,,,,,,,,,1763591848256550900,,,,,140712805072896,140712805072896,203843,196608,2709117439,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2565557Z","2025-11-19 22:37:28.2565557Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\DXCore.dll",,,,,,,,,,,,,,,,1763591848256555700,,,,,140712805400576,140712805400576,331386,274432,2354081039,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2565627Z","2025-11-19 22:37:28.2565627Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\windows.storage.dll",,,,,,,,,,,,,,,,1763591848256562700,,,,,140712812412928,140712812412928,8877403,8769536,3667346596,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2565689Z","2025-11-19 22:37:28.2565689Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\netutils.dll",,,,,,,,,,,,,,,,1763591848256568900,,,,,140712825847808,140712825847808,80696,53248,865845000,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2565757Z","2025-11-19 22:37:28.2565757Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591848256575700,,,,,140712830631936,140712830631936,158678,110592,3554393863,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2565817Z","2025-11-19 22:37:28.2565817Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\ntmarta.dll",,,,,,,,,,,,,,,,1763591848256581700,,,,,140712831811584,140712831811584,265798,221184,3598506564,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2565880Z","2025-11-19 22:37:28.2565880Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\cryptsp.dll",,,,,,,,,,,,,,,,1763591848256588000,,,,,140712839217152,140712839217152,146168,110592,1658328178,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2565999Z","2025-11-19 22:37:28.2565999Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\cryptbase.dll",,,,,,,,,,,,,,,,1763591848256599900,,,,,140712839348224,140712839348224,63718,49152,3897879906,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2566062Z","2025-11-19 22:37:28.2566062Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\cfgmgr32.dll",,,,,,,,,,,,,,,,1763591848256606200,,,,,140712845049856,140712845049856,385808,356352,1737777300,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2566115Z","2025-11-19 22:37:28.2566115Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\sxs.dll",,,,,,,,,,,,,,,,1763591848256611500,,,,,140712846622720,140712846622720,697955,659456,3834976666,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2566268Z","2025-11-19 22:37:28.2566268Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\umpdc.dll",,,,,,,,,,,,,,,,1763591848256626800,,,,,140712848064512,140712848064512,98535,81920,1714427184,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2566328Z","2025-11-19 22:37:28.2566328Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\powrprof.dll",,,,,,,,,,,,,,,,1763591848256632800,,,,,140712848195584,140712848195584,457799,385024,2858637235,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2566384Z","2025-11-19 22:37:28.2566384Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\bcrypt.dll",,,,,,,,,,,,,,,,1763591848256638400,,,,,140712848654336,140712848654336,206048,172032,2893678010,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2566448Z","2025-11-19 22:37:28.2566448Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\profapi.dll",,,,,,,,,,,,,,,,1763591848256644800,,,,,140712848850944,140712848850944,229548,167936,2447194521,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2566515Z","2025-11-19 22:37:28.2566515Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,,,,,,,1763591848256651500,,,,,140712851341312,140712851341312,1524912,1486848,1404855129,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2566638Z","2025-11-19 22:37:28.2566638Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,,,,,,,1763591848256663800,,,,,140712852848640,140712852848640,741046,675840,2283238626,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2566696Z","2025-11-19 22:37:28.2566696Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591848256669600,,,,,140712854355968,140712854355968,4209945,4161536,2980330054,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2566745Z","2025-11-19 22:37:28.2566745Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591848256674500,,,,,140712858550272,140712858550272,230350,159744,2551303736,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2566803Z","2025-11-19 22:37:28.2566803Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591848256680400,,,,,140712858746880,140712858746880,700029,667648,3371602543,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2566864Z","2025-11-19 22:37:28.2566864Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591848256686400,,,,,140712859467776,140712859467776,1436013,1355776,1441720767,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2566923Z","2025-11-19 22:37:28.2566923Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591848256692300,,,,,140712861433856,140712861433856,1243850,1228800,792084382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2566983Z","2025-11-19 22:37:28.2566983Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591848256698300,,,,,140712863203328,140712863203328,716301,679936,3291623140,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2567042Z","2025-11-19 22:37:28.2567042Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,,,,,,,1763591848256704200,,,,,140712863924224,140712863924224,3798760,3715072,2772520021,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2567100Z","2025-11-19 22:37:28.2567100Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\shlwapi.dll",,,,,,,,,,,,,,,,1763591848256710000,,,,,140712868839424,140712868839424,479562,421888,2142510382,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2567220Z","2025-11-19 22:37:28.2567220Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,,,,,,,1763591848256722000,,,,,140712869888000,140712869888000,7769948,7663616,2341846616,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2567291Z","2025-11-19 22:37:28.2567291Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591848256729100,,,,,140712877621248,140712877621248,885660,823296,2913437033,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2567347Z","2025-11-19 22:37:28.2567347Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\ole32.dll",,,,,,,,,,,,,,,,1763591848256734700,,,,,140712878473216,140712878473216,1689904,1667072,1018821057,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2567407Z","2025-11-19 22:37:28.2567407Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,,,,,,,1763591848256740700,,,,,140712880177152,140712880177152,899838,880640,2878277657,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2567465Z","2025-11-19 22:37:28.2567465Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591848256746500,,,,,140712881618944,140712881618944,761372,737280,71854833,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2567511Z","2025-11-19 22:37:28.2567511Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591848256751100,,,,,140712882405376,140712882405376,230873,176128,527442843,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2567571Z","2025-11-19 22:37:28.2567571Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,,,,,,,1763591848256757100,,,,,140712882601984,140712882601984,233556,200704,1625678811,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2567630Z","2025-11-19 22:37:28.2567630Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,,,,,,,1763591848256763000,,,,,140712888041472,140712888041472,783429,720896,2294669044,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2567687Z","2025-11-19 22:37:28.2567687Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591848256768700,,,,,140712888827904,140712888827904,1923284,1863680,675224942,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2567746Z","2025-11-19 22:37:28.2567746Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,,,,,,,1763591848256774600,,,,,140712891252736,140712891252736,1029623,991232,2858041650,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2567874Z","2025-11-19 22:37:28.2567874Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\msctf.dll",,,,,,,,,,,,,,,,1763591848256787400,,,,,140712893022208,140712893022208,1455420,1433600,4155718050,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2567931Z","2025-11-19 22:37:28.2567931Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591848256793100,,,,,140712894529536,140712894529536,760295,692224,460960534,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2567987Z","2025-11-19 22:37:28.2567987Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591848256798700,,,,,140712897216512,140712897216512,1193108,1146880,4275633056,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2568042Z","2025-11-19 22:37:28.2568042Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591848256804200,,,,,140712898723840,140712898723840,2537167,2523136,2626650689,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2568176Z","2025-11-19 22:37:28.2568176Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"WindowsTermina",,,,,,,,,,,,,,,,1763591848256817600,,,,,,,,,,134080654410898354,,,,,,,6627,,,,,16748544,19189760,3883624426,0,134080654489267736,577,0,60,53,3,7,0 +"2025-11-19 22:37:28.2575230Z","2025-11-19 22:37:28.2575230Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",13872,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084037992448,18446633084037967872,140711612509856,0,1046354432000,13872,1763591848257523000,1046352232448,1046352216064,140711612509856,1922208,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4656761Z","2025-11-19 22:37:28.4656761Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 8476 ServiceHub.IdentityHost.exe",,,,,,,,,,,,,18446633084041035776,18446633084041011200,140712899206080,0,843735072768,3676,1763591848465676100,843738251264,843738247168,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4657535Z","2025-11-19 22:37:28.4657535Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"13072 vctip.exe",,,,,,,,,,,,,18446633084029317120,18446633084029292544,140712899206080,0,941791567872,9260,1763591848465753500,941796360192,941796352000,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4657851Z","2025-11-19 22:37:28.4657851Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1520 powershell.exe",,,,,,,,,,,,,18446633084027793408,18446633084027768832,140712899206080,0,931707506688,1888,1763591848465785100,931708534784,931708526592,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4658205Z","2025-11-19 22:37:28.4658205Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"12052 ServiceHub.TestWindowStoreHost.exe",,,,,,,,,,,,,18446633084055474176,18446633084055449600,140712899206080,0,17905557504,4840,1763591848465820500,17910726656,17910722560,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4658465Z","2025-11-19 22:37:28.4658465Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,18446633084016447488,18446633084016422912,140712899206080,0,46015684608,10824,1763591848465846500,46028292096,46028275712,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4658775Z","2025-11-19 22:37:28.4658775Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"10252 ServiceHub.IndexingService.exe",,,,,,,,,,,,,18446633084028854272,18446633084028829696,140712899206080,0,848613720064,13472,1763591848465877500,848617799680,848617795584,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4659003Z","2025-11-19 22:37:28.4659003Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"10648 ServiceHub.Host.dotnet.x64.exe",,,,,,,,,,,,,18446633084028624896,18446633084028600320,140712899206080,0,515211558912,1976,1763591848465900300,515216769024,515216764928,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4659380Z","2025-11-19 22:37:28.4659380Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"10200 ServiceHub.VSDetouredHost.exe",,,,,,,,,,,,,18446633084030062592,18446633084030038016,140712899206080,0,617597181952,3900,1763591848465938000,617601826816,617601822720,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4659602Z","2025-11-19 22:37:28.4659602Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9988 Microsoft.ServiceHub.Controller.exe",,,,,,,,,,,,,18446633084028739584,18446633084028715008,140712899206080,0,1049753075712,14992,1763591848465960200,1049757745152,1049757741056,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4704807Z","2025-11-19 22:37:28.4704807Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,18446633084028080128,18446633084028055552,140712899206080,0,46015692800,5212,1763591848470480700,46045069312,46045052928,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4905294Z","2025-11-19 22:37:28.4905294Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9280 Greenshot.exe",,,,,,,,,,,,,18446633084028682240,18446633084028657664,140712899206080,0,948118986752,12724,1763591848490529400,948123467776,948123463680,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:29.3932962Z","2025-11-19 22:37:29.3932962Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13072 vctip.exe",8676,,,"13072 vctip.exe",,,,,,,,,,,,,18446633084057079808,18446633084057055232,140712899206080,0,941791477760,8676,1763591849393296200,941795311616,941795303424,140712899206080,210478,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:29.3933765Z","2025-11-19 22:37:29.3933765Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13072 vctip.exe",6088,,,"13072 vctip.exe",,,,,,,,,,,,,18446633084057051136,18446633084057026560,140712899206080,0,941791469568,6088,1763591849393376500,941794263040,941794254848,140712899206080,1198365,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:29.4261435Z","2025-11-19 22:37:29.4261435Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5536 svchost.exe",3836,,," 5536 svchost.exe",,,"C:\Windows\System32\aepic.dll",,,,,,,,,,,,,,,,1763591849426143500,,,,,140712428109824,140712428109824,641436,577536,321124434,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:29.4274126Z","2025-11-19 22:37:29.4274126Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5536 svchost.exe",3836,,," 5536 svchost.exe",,,"C:\Windows\System32\aepic.dll",,,,,,,,,,,,,,,,1763591849427412600,,,,,140712428109824,140712428109824,641436,589824,321124434,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:29.6961056Z","2025-11-19 22:37:29.6961056Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 9920 ServiceHub.IntellicodeModelService.exe",9760,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,18446633084028108800,18446633084028084224,140711612509856,0,46015700992,1468,1763591849696105600,46012694528,46012678144,140711612509856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:29.8394671Z","2025-11-19 22:37:29.8394671Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","10648 ServiceHub.Host.dotnet.x64.exe",10688,,,"10648 ServiceHub.Host.dotnet.x64.exe",,,,,,,,,,,,,18446633084057079808,18446633084057055232,140711121663952,0,515211567104,9320,1763591849839467100,515218341888,515218337792,140711121663952,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:29.8397391Z","2025-11-19 22:37:29.8397391Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","10648 ServiceHub.Host.dotnet.x64.exe",9320,,,"10648 ServiceHub.Host.dotnet.x64.exe",,,,,,,,,,,,,18446633084028395520,18446633084028370944,140711121663952,0,515211575296,11464,1763591849839739100,515219914752,515219910656,140711121663952,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:29.9831575Z","2025-11-19 22:37:29.9831575Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5096 svchost.exe",15108,,," 5096 svchost.exe",,,,,,,,,,,,,18446633084056850432,18446633084056825856,140712865112144,199,667265712128,15108,1763591849983157500,667271823360,667271790592,140712865112144,285541,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:31.0497261Z","2025-11-19 22:37:31.0497261Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8004 svchost.exe",2300,,," 8004 svchost.exe",,,,,,,,,,,,,18446633084004868096,18446633084004843520,140712899206080,0,841719537664,2300,1763591851049726100,841721839616,841721806848,140712899206080,226697,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:31.2092051Z","2025-11-19 22:37:31.2092051Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9920 ServiceHub.IntellicodeModelService.exe",1468,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,18446633084028108800,18446633084028084224,140711612509856,0,46015700992,1468,1763591851209205100,46012694528,46012678144,140711612509856,929799,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:31.6880035Z","2025-11-19 22:37:31.6880035Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13084 MSBuild.exe",12948,,,"13084 MSBuild.exe",,,,,,,,,,,,,18446633084002254848,18446633084002230272,140712899206080,0,911121563648,12948,1763591851688003500,911130755072,911130738688,140712899206080,5634614,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:31.6915761Z","2025-11-19 22:37:31.6915761Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8972 VBoxTray.exe",9020,,," 8972 VBoxTray.exe",,,,,,,,,,,,,18446633084002254848,18446633084002230272,140700131109808,0,471283212288,10176,1763591851691576100,471299260416,471299256320,140700131109808,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:31.6918214Z","2025-11-19 22:37:31.6918214Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8972 VBoxTray.exe",10176,,," 8972 VBoxTray.exe",,,,,,,,,,,,,18446633084002254848,18446633084002230272,140700131109808,0,471283212288,10176,1763591851691821400,471299260416,471299252224,140700131109808,462825,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:32.0530558Z","2025-11-19 22:37:32.0530558Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 8004 svchost.exe",,,,,,,,,,,,,18446633084028538880,18446633084028514304,140712899206080,0,841719545856,11156,1763591852053055800,841721839616,841721806848,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:32.3222797Z","2025-11-19 22:37:32.3222797Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",10448,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084018716672,18446633084018692096,140711613062896,0,1046354366464,10448,1763591852322279700,1046367698944,1046367682560,140711613062896,941871,,,,,,,,,,,,,,,,,,,,,,,,,,,,, diff --git a/EDRi/dumps/Defender-vs-Injector-standard-events-Minimal.csv b/EDRi/dumps/Defender-vs-Injector-standard-events-Minimal.csv index 7110704..87b11e5 100644 --- a/EDRi/dumps/Defender-vs-Injector-standard-events-Minimal.csv +++ b/EDRi/dumps/Defender-vs-Injector-standard-events-Minimal.csv @@ -1,40 +1,39 @@ -timestamp_sys,timestamp_etw,src_type,provider_name,event_id,task_info,process_id,thread_id,ppid,pid,targetpid,targettid,message,filepath,cachename,result,vname,name,sigseq,sigsha,commandline,firstparam,secondparam,timestamp_ns,createtime,flags,imagechecksum,mandatorylabel,packagefullname,packagerelativeappid,parentprocessid,parentprocesssequencenumber,processsequencenumber,processtokenelevationtype,processtokeniselevated,securitymitigations,sessionid,timedatestamp,stackbase,stacklimit,startaddr,subprocesstag,tebbase,threadid,userstackbase,userstacklimit,win32startaddr,cycletime,commitcharge,commitpeak,cpucyclecount,exitcode,exittime,handlecount,hardfaultcount,readoperationcount,readtransferkilobytes,tokenelevationtype,writeoperationcount,writetransferkilobytes"2025-11-19 19:51:16.343730900Z","2025-11-19 19:51:16.3437374Z","myETW","EDRi-Provider",4242,"EDRiTask","12472 EDRi.exe",,,,,,"++ EDRi START MARKER ++",,,,,,,,,,,1763581876343737400,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.287575200Z","2025-11-19 19:51:17.3448096Z","myETW","EDRi-Provider",4242,"EDRiTask","12472 EDRi.exe",,,,,,"++ EDRi START MARKER ++",,,,,,,,,,,1763581877344809600,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.197740800Z","2025-11-19 19:51:18.3561017Z","myETW","EDRi-Provider",4242,"EDRiTask","12472 EDRi.exe",,,,,,"Before decrypting the attack exe from C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\attacks\Injector-standard.exe.enc",,,,,,,,,,,1763581878356101700,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.199912800Z","2025-11-19 19:51:18.3585127Z","myETW","EDRi-Provider",4242,"EDRiTask","12472 EDRi.exe",,,,,,"After decrypting the attack exe",,,,,,,,,,,1763581878358512700,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.108607600Z","2025-11-19 19:51:19.3681762Z","myETW","EDRi-Provider",4242,"EDRiTask","12472 EDRi.exe",,,,,,"Before starting the attack exe",,,,,,,,,,,1763581879368176200,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9763041Z","2025-11-19 19:51:20.9763041Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1040 svchost.exe",2280,,,"11956 smartscreen.exe",,,"C:\Windows\System32\smartscreen.exe",,,,,,,,,,1763581880976304100,134080554805558624,0,664452,"0x","","",1040,13,3391,3,0,0,1,419447766,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0413450Z","2025-11-19 19:51:21.0413450Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 5184 explorer.exe",5116,,," 3348 attack-589.exe",,,"C:\Users\Public\Downloads\attack-589.exe",,,,,,,,,,1763581881041345000,134080554806144016,0,0,"0x","","",5184,140,3392,3,0,0,1,1763491559,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0443828Z","2025-11-19 19:51:21.0443828Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",5116,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581881044382800,,,,,,,,,,,,,,,18446633084044398592,18446633084044374016,140695599400816,0,289797906432,11212,289800192000,289800187904,140695599400816,,,,,,,,,,,,, -"2025-11-19 19:51:21.0568214Z","2025-11-19 19:51:21.0568214Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 3348 attack-589.exe",11212,,," 3100 conhost.exe",,,"C:\Windows\System32\conhost.exe",,,,,,,,,,1763581881056821400,134080554806283315,0,1035098,"0x","","",3348,3392,3393,3,0,0,1,2671108986,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0581639Z","2025-11-19 19:51:21.0581639Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3348 attack-589.exe",11212,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881058163900,,,,,,,,,,,,,,,18446633084006535168,18446633084006510592,140696384751904,0,1013857710080,13484,1013860270080,1013860261888,140696384751904,,,,,,,,,,,,, -"2025-11-19 19:51:20.821877500Z","2025-11-19 19:51:21.2718203Z","myETW","EDRi-Provider",4242,"EDRiTask","12472 EDRi.exe",,,,,,"After starting the attack exe",,,,,,,,,,,1763581881271820300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4388601Z","2025-11-19 19:51:21.4388601Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581881438860100,,,,,,,,,,,,,,,18446633083996708864,18446633083996684288,140712899206080,0,289797914624,11468,289801240576,289801236480,140712899206080,,,,,,,,,,,,, -"2025-11-19 19:51:21.4393533Z","2025-11-19 19:51:21.4393533Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581881439353300,,,,,,,,,,,,,,,18446633084049022976,18446633084048998400,140712899206080,0,289797922816,3088,289802289152,289802285056,140712899206080,,,,,,,,,,,,, -"2025-11-19 19:51:21.4394810Z","2025-11-19 19:51:21.4394810Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3348 attack-589.exe",3088,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581881439481000,,,,,,,,,,,,,,,18446633084049080320,18446633084049055744,140712899206080,0,289797931008,12904,289803337728,289803333632,140712899206080,,,,,,,,,,,,, -"2025-11-19 19:51:20.974665800Z","2025-11-19 19:51:21.4415712Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Injector started with PID 3348",,,,,,,,,,,1763581881441571200,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.852182900Z","2025-11-19 19:51:22.4165908Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Running 'standard' config",,,,,,,,,,,1763581882416590800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.852392100Z","2025-11-19 19:51:22.4168223Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Before starting subprocess to inject to",,,,,,,,,,,1763581882416822300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.4176543Z","2025-11-19 19:51:22.4176543Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 3348 attack-589.exe",11212,,," 1436 whoami.exe",,,"C:\Windows\System32\whoami.exe",,,,,,,,,,1763581882417654300,134080554818530829,0,160109,"0x","","",3348,3392,3396,3,0,0,1,3602411345,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.4206852Z","2025-11-19 19:51:22.4206852Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3348 attack-589.exe",11212,,," 1436 whoami.exe",,,,,,,,,,,,,1763581882420685200,,,,,,,,,,,,,,,18446633084049825792,18446633084049801216,140702344617136,0,521061564416,12400,521063104512,521063096320,140702344617136,,,,,,,,,,,,, -"2025-11-19 19:51:21.858891900Z","2025-11-19 19:51:22.4240441Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"After starting subprocess with PID 1436",,,,,,,,,,,1763581882424044100,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.737817600Z","2025-11-19 19:51:23.4006311Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Before opening process handle",,,,,,,,,,,1763581883400631100,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.738077500Z","2025-11-19 19:51:23.4009294Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"After opening process handle",,,,,,,,,,,1763581883400929400,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.612812600Z","2025-11-19 19:51:24.3728485Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Before allocating memory for shellcode",,,,,,,,,,,1763581884372848500,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.613174800Z","2025-11-19 19:51:24.3732488Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"After allocating memory for shellcode at 000001FF40840000",,,,,,,,,,,1763581884373248800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.486948200Z","2025-11-19 19:51:25.3441106Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Before writing shellcode to process",,,,,,,,,,,1763581885344110600,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.487258200Z","2025-11-19 19:51:25.3444526Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"After writing shellcode to process at 000001FF40840000",,,,,,,,,,,1763581885344452600,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.362253700Z","2025-11-19 19:51:26.3166701Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Before changing memory protection to PAGE_EXECUTE_READ",,,,,,,,,,,1763581886316670100,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.362529500Z","2025-11-19 19:51:26.3169751Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"After changing memory protection to PAGE_EXECUTE_READ",,,,,,,,,,,1763581886316975100,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:26.296106600Z","2025-11-19 19:51:27.3019664Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Before reading memory to verify write",,,,,,,,,,,1763581887301966400,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:26.296340900Z","2025-11-19 19:51:27.3022001Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Before creating remote thread",,,,,,,,,,,1763581887302200100,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3024711Z","2025-11-19 19:51:27.3024711Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3348 attack-589.exe",11212,,," 1436 whoami.exe",,,,,,,,,,,,,1763581887302471100,,,,,,,,,,,,,,,18446633084051144704,18446633084051120128,2195810680832,0,521061572608,6380,521063628800,521063620608,2195810680832,,,,,,,,,,,,, -"2025-11-19 19:51:26.296634600Z","2025-11-19 19:51:27.3024967Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"After creating remote thread",,,,,,,,,,,1763581887302496700,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3158199Z","2025-11-19 19:51:27.3158199Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1436 whoami.exe",6380,,,"11148 calc.exe",,,"C:\Windows\System32\calc.exe",,,,,,,,,,1763581887315819900,134080554863097645,0,90741,"0x","","",1436,3396,3397,3,0,0,1,4001445627,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.261554400Z","2025-11-19 19:51:28.2771678Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Attack done",,,,,,,,,,,1763581888277167800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2782317Z","2025-11-19 19:51:28.2782317Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3348 attack-589.exe",3088,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581888278231700,,,,,,,,,,,,,,,18446633084049022976,18446633084048998400,140712899206080,0,289797922816,3088,289802289152,289802280960,140712899206080,2024057,,,,,,,,,,,, -"2025-11-19 19:51:28.2782317Z","2025-11-19 19:51:28.2782317Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3348 attack-589.exe",12904,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581888278231700,,,,,,,,,,,,,,,18446633084049080320,18446633084049055744,140712899206080,0,289797931008,12904,289803337728,289803329536,140712899206080,1558590,,,,,,,,,,,, -"2025-11-19 19:51:28.2782336Z","2025-11-19 19:51:28.2782336Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3348 attack-589.exe",11468,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581888278233700,,,,,,,,,,,,,,,18446633083996708864,18446633083996684288,140712899206080,0,289797914624,11468,289801240576,289801232384,140712899206080,3363869,,,,,,,,,,,, -"2025-11-19 19:51:28.2783990Z","2025-11-19 19:51:28.2783990Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581888278399000,,,,,,,,,,,,,,,18446633084044398592,18446633084044374016,140695599400816,0,289797906432,11212,289800192000,289800171520,140695599400816,64789380,,,,,,,,,,,, -"2025-11-19 19:51:28.2786366Z","2025-11-19 19:51:28.2786366Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"attack-589.exe",,,,,,,,,,1763581888278636600,134080554806144016,,,,,,,,3392,,,,,,,,,,,,,,,,958464,958464,72053875,0,134080554872628582,52,9,0,0,3,48,0 -"2025-11-19 19:51:29.1708754Z","2025-11-19 19:51:29.1708754Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"whoami.exe",,,,,,,,,,1763581889170875400,134080554818530829,,,,,,,,3396,,,,,,,,,,,,,,,,1257472,1302528,57157118,3221225477,134080554881460737,83,0,1,3,3,0,0 +timestamp_sys,timestamp_etw,src_type,provider_name,event_id,task_info,process_id,thread_id,ppid,pid,targetpid,targettid,message,filepath,cachename,result,vname,name,sigseq,sigsha,commandline,firstparam,secondparam,timestamp_ns,createtime,flags,imagechecksum,mandatorylabel,packagefullname,packagerelativeappid,parentprocessid,parentprocesssequencenumber,processsequencenumber,processtokenelevationtype,processtokeniselevated,securitymitigations,sessionid,timedatestamp,stackbase,stacklimit,startaddr,subprocesstag,tebbase,threadid,userstackbase,userstacklimit,win32startaddr,cycletime,commitcharge,commitpeak,cpucyclecount,exitcode,exittime,handlecount,hardfaultcount,readoperationcount,readtransferkilobytes,tokenelevationtype,writeoperationcount,writetransferkilobytes"2025-11-19 22:37:11.792165000Z","2025-11-19 22:37:11.7170068Z","myETW","EDRi-Provider",4242,"EDRiTask"," 7508 EDRi.exe",,,,,,"++ EDRi START MARKER ++",,,,,,,,,,,1763591831717006800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:16.175848500Z","2025-11-19 22:37:15.7424568Z","myETW","EDRi-Provider",4242,"EDRiTask"," 7508 EDRi.exe",,,,,,"Before decrypting the attack exe from C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\attacks\Injector-standard.exe.enc",,,,,,,,,,,1763591835742456800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:16.182157400Z","2025-11-19 22:37:15.7482493Z","myETW","EDRi-Provider",4242,"EDRiTask"," 7508 EDRi.exe",,,,,,"After decrypting the attack exe",,,,,,,,,,,1763591835748249300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:17.282796100Z","2025-11-19 22:37:16.7589463Z","myETW","EDRi-Provider",4242,"EDRiTask"," 7508 EDRi.exe",,,,,,"Before starting the attack exe",,,,,,,,,,,1763591836758946300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1091605Z","2025-11-19 22:37:20.1091605Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1040 svchost.exe",4480,,,"13388 smartscreen.exe",,,"C:\Windows\System32\smartscreen.exe",,,,,,,,,,1763591840109160500,134080654409311255,0,664452,"0x","","",1040,13,6623,3,0,0,1,419447766,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1761396Z","2025-11-19 22:37:20.1761396Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 5184 explorer.exe",15136,,," 5604 attack-890.exe",,,"C:\Users\Public\Downloads\attack-890.exe",,,,,,,,,,1763591840176139600,134080654410040405,0,0,"0x","","",5184,140,6624,3,0,0,1,1763491559,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1789263Z","2025-11-19 22:37:20.1789263Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",15136,,," 5604 attack-890.exe",,,,,,,,,,,,,1763591840178926300,,,,,,,,,,,,,,,18446633084027822080,18446633084027797504,140695618865008,0,867488051200,3452,867486007296,867486003200,140695618865008,,,,,,,,,,,,, +"2025-11-19 22:37:20.1912674Z","2025-11-19 22:37:20.1912674Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 5604 attack-890.exe",3452,,,"13300 conhost.exe",,,"C:\Windows\System32\conhost.exe",,,,,,,,,,1763591840191267400,134080654410205145,0,1035098,"0x","","",5604,6624,6625,3,0,0,1,2671108986,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1924430Z","2025-11-19 22:37:20.1924430Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5604 attack-890.exe",3452,,,"13300 conhost.exe",,,,,,,,,,,,,1763591840192443000,,,,,,,,,,,,,,,18446633084027535360,18446633084027510784,140696384751904,0,689119371264,4616,689120477184,689120468992,140696384751904,,,,,,,,,,,,, +"2025-11-19 22:37:20.5510805Z","2025-11-19 22:37:20.5510805Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,,,,,,,,,,,1763591840551080500,,,,,,,,,,,,,,,18446633084029747200,18446633084029722624,140712899206080,0,867488059392,5960,867490070528,867490066432,140712899206080,,,,,,,,,,,,, +"2025-11-19 22:37:20.5515459Z","2025-11-19 22:37:20.5515459Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5604 attack-890.exe",5960,,," 5604 attack-890.exe",,,,,,,,,,,,,1763591840551545900,,,,,,,,,,,,,,,18446633084029718528,18446633084029693952,140712899206080,0,867488067584,8672,867491119104,867491115008,140712899206080,,,,,,,,,,,,, +"2025-11-19 22:37:20.5516458Z","2025-11-19 22:37:20.5516458Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5604 attack-890.exe",8672,,," 5604 attack-890.exe",,,,,,,,,,,,,1763591840551645800,,,,,,,,,,,,,,,18446633084029460480,18446633084029435904,140712899206080,0,867488075776,12460,867492167680,867492163584,140712899206080,,,,,,,,,,,,, +"2025-11-19 22:37:21.377891300Z","2025-11-19 22:37:20.5537813Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Injector started with PID 5604",,,,,,,,,,,1763591840553781300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:21.477249300Z","2025-11-19 22:37:20.6551680Z","myETW","EDRi-Provider",4242,"EDRiTask"," 7508 EDRi.exe",,,,,,"After starting the attack exe",,,,,,,,,,,1763591840655168000,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.337559700Z","2025-11-19 22:37:21.5329408Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Running 'standard' config",,,,,,,,,,,1763591841532940800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.337798100Z","2025-11-19 22:37:21.5331820Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Before starting subprocess to inject to",,,,,,,,,,,1763591841533182000,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:21.5339696Z","2025-11-19 22:37:21.5339696Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 5604 attack-890.exe",3452,,," 7284 whoami.exe",,,"C:\Windows\System32\whoami.exe",,,,,,,,,,1763591841533969600,134080654423385232,0,160109,"0x","","",5604,6624,6628,3,0,0,1,3602411345,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:21.5373410Z","2025-11-19 22:37:21.5373410Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5604 attack-890.exe",3452,,," 7284 whoami.exe",,,,,,,,,,,,,1763591841537341000,,,,,,,,,,,,,,,18446633084031127552,18446633084031102976,140702344617136,0,705865940992,14048,705864925184,705864916992,140702344617136,,,,,,,,,,,,, +"2025-11-19 22:37:22.345203800Z","2025-11-19 22:37:21.5407378Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"After starting subprocess with PID 7284",,,,,,,,,,,1763591841540737800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:23.308564200Z","2025-11-19 22:37:22.5236651Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Before opening process handle",,,,,,,,,,,1763591842523665100,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:23.308868400Z","2025-11-19 22:37:22.5239746Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"After opening process handle",,,,,,,,,,,1763591842523974600,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:24.262849900Z","2025-11-19 22:37:23.4973313Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Before allocating memory for shellcode",,,,,,,,,,,1763591843497331300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:24.263130400Z","2025-11-19 22:37:23.4976143Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"After allocating memory for shellcode at 00000249213E0000",,,,,,,,,,,1763591843497614300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:25.227755400Z","2025-11-19 22:37:24.4818310Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Before writing shellcode to process",,,,,,,,,,,1763591844481831000,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:25.228060100Z","2025-11-19 22:37:24.4821409Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"After writing shellcode to process at 00000249213E0000",,,,,,,,,,,1763591844482140900,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.182844300Z","2025-11-19 22:37:25.4563155Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Before changing memory protection to PAGE_EXECUTE_READ",,,,,,,,,,,1763591845456315500,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.183142300Z","2025-11-19 22:37:25.4566185Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"After changing memory protection to PAGE_EXECUTE_READ",,,,,,,,,,,1763591845456618500,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.147034500Z","2025-11-19 22:37:26.4400898Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Before reading memory to verify write",,,,,,,,,,,1763591846440089800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.147308700Z","2025-11-19 22:37:26.4403653Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Before creating remote thread",,,,,,,,,,,1763591846440365300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4406187Z","2025-11-19 22:37:26.4406187Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5604 attack-890.exe",3452,,," 7284 whoami.exe",,,,,,,,,,,,,1763591846440618700,,,,,,,,,,,,,,,18446633084031987712,18446633084031963136,2513113579520,0,705865949184,14412,705865449472,705865441280,2513113579520,,,,,,,,,,,,, +"2025-11-19 22:37:27.147575800Z","2025-11-19 22:37:26.4406370Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"After creating remote thread",,,,,,,,,,,1763591846440637000,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4541760Z","2025-11-19 22:37:26.4541760Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 7284 whoami.exe",14412,,," 3812 calc.exe",,,"C:\Windows\System32\calc.exe",,,,,,,,,,1763591846454176000,134080654471607920,0,90741,"0x","","",7284,6628,6629,3,0,0,1,4001445627,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.099873500Z","2025-11-19 22:37:27.4122768Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Attack done",,,,,,,,,,,1763591847412276800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4131942Z","2025-11-19 22:37:27.4131942Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5604 attack-890.exe",8672,,," 5604 attack-890.exe",,,,,,,,,,,,,1763591847413194200,,,,,,,,,,,,,,,18446633084029718528,18446633084029693952,140712899206080,0,867488067584,8672,867491119104,867491106816,140712899206080,1934283,,,,,,,,,,,, +"2025-11-19 22:37:27.4131969Z","2025-11-19 22:37:27.4131969Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5604 attack-890.exe",5960,,," 5604 attack-890.exe",,,,,,,,,,,,,1763591847413196900,,,,,,,,,,,,,,,18446633084029747200,18446633084029722624,140712899206080,0,867488059392,5960,867490070528,867490062336,140712899206080,2523090,,,,,,,,,,,, +"2025-11-19 22:37:27.4132046Z","2025-11-19 22:37:27.4132046Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5604 attack-890.exe",12460,,," 5604 attack-890.exe",,,,,,,,,,,,,1763591847413204600,,,,,,,,,,,,,,,18446633084029460480,18446633084029435904,140712899206080,0,867488075776,12460,867492167680,867492155392,140712899206080,1586126,,,,,,,,,,,, +"2025-11-19 22:37:27.4133776Z","2025-11-19 22:37:27.4133776Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,,,,,,,,,,,1763591847413377600,,,,,,,,,,,,,,,18446633084027822080,18446633084027797504,140695618865008,0,867488051200,3452,867486007296,867485986816,140695618865008,55165128,,,,,,,,,,,, +"2025-11-19 22:37:27.4136009Z","2025-11-19 22:37:27.4136009Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"attack-890.exe",,,,,,,,,,1763591847413600900,134080654410040405,,,,,,,,6624,,,,,,,,,,,,,,,,974848,974848,61411560,0,134080654481010332,52,9,0,0,3,48,0 +"2025-11-19 22:37:28.2303954Z","2025-11-19 22:37:28.2303954Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"whoami.exe",,,,,,,,,,1763591848230395400,134080654423385232,,,,,,,,6628,,,,,,,,,,,,,,,,1265664,1310720,56924383,3221225477,134080654489015372,83,0,1,3,3,0,0 diff --git a/EDRi/dumps/Defender-vs-Injector-standard-events-Relevant.csv b/EDRi/dumps/Defender-vs-Injector-standard-events-Relevant.csv index 5e67aa3..fe6dd88 100644 --- a/EDRi/dumps/Defender-vs-Injector-standard-events-Relevant.csv +++ b/EDRi/dumps/Defender-vs-Injector-standard-events-Relevant.csv @@ -1,598 +1,580 @@ -timestamp_sys,timestamp_etw,src_type,provider_name,event_id,task_info,process_id,thread_id,ppid,pid,targetpid,targettid,message,filepath,cachename,result,vname,name,sigseq,sigsha,commandline,firstparam,secondparam,timestamp_ns,stackbase,stacklimit,startaddr,subprocesstag,tebbase,threadid,userstackbase,userstacklimit,win32startaddr,cycletime,commitcharge,commitpeak,cpucyclecount,createtime,exitcode,exittime,handlecount,hardfaultcount,processsequencenumber,readoperationcount,readtransferkilobytes,tokenelevationtype,writeoperationcount,writetransferkilobytes,flags,imagechecksum,mandatorylabel,packagefullname,packagerelativeappid,parentprocessid,parentprocesssequencenumber,processtokenelevationtype,processtokeniselevated,securitymitigations,sessionid,timedatestamp,defaultbase,imagebase,imagesize"2025-11-19 19:51:16.343730900Z","2025-11-19 19:51:16.3437374Z","myETW","EDRi-Provider",4242,"EDRiTask","12472 EDRi.exe",,,,,,"++ EDRi START MARKER ++",,,,,,,,,,,1763581876343737400,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.5865091Z","2025-11-19 19:51:16.5865091Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8972 VBoxTray.exe",9020,,," 8972 VBoxTray.exe",,,,,,,,,,,,,1763581876586509100,18446633084041842688,18446633084041818112,140700131109808,0,471284228096,9164,471286677504,471286673408,140700131109808,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.5868139Z","2025-11-19 19:51:16.5868139Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8972 VBoxTray.exe",9164,,," 8972 VBoxTray.exe",,,,,,,,,,,,,1763581876586813900,18446633084041842688,18446633084041818112,140700131109808,0,471284228096,9164,471286677504,471286669312,140700131109808,428122,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.6931597Z","2025-11-19 19:51:16.6931597Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"11648 RuntimeBroker.exe",,,,,,,,,,,,,1763581876693159700,18446633084041842688,18446633084041818112,140712899206080,0,503394820096,3896,503397220352,503397171200,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.6933880Z","2025-11-19 19:51:16.6933880Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11648 RuntimeBroker.exe",3896,,,"11648 RuntimeBroker.exe",,,,,,,,,,,,,1763581876693388000,18446633084040663040,18446633084040638464,140712899206080,0,503394828288,8592,503397744640,503397695488,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.7247840Z","2025-11-19 19:51:16.7247840Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 5664 OpenConsole.exe",,,,,,,,,,,,,1763581876724784000,18446633084041900032,18446633084041875456,140712899206080,0,304352927744,12896,304354426880,304354422784,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9633043Z","2025-11-19 19:51:16.9633043Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13120 ",540,,,"13120 ",,,,,,,,,,,,,1763581876963304300,18446633084052176896,18446633084052152320,140712865112144,0,619234459648,540,619238653952,619238604800,140712865112144,934326,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9633044Z","2025-11-19 19:51:16.9633044Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13120 ",8284,,,"13120 ",,,,,,,,,,,,,1763581876963304400,18446633084051488768,18446633084051464192,140712899206080,0,619236544512,8284,619238129664,619238080512,140712899206080,46624563,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9633055Z","2025-11-19 19:51:16.9633055Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13120 ",12604,,,"13120 ",,,,,,,,,,,,,1763581876963305500,18446633084053524480,18446633084053499904,140712899206080,0,619234476032,12604,619237605376,619237556224,140712899206080,736670,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9633063Z","2025-11-19 19:51:16.9633063Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13120 ",14864,,,"13120 ",,,,,,,,,,,,,1763581876963306300,18446633084043333632,18446633084043309056,140712899206080,0,619236519936,14864,619234000896,619233951744,140712899206080,3646014,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9633083Z","2025-11-19 19:51:16.9633083Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13120 ",15068,,,"13120 ",,,,,,,,,,,,,1763581876963308300,18446633084036870144,18446633084036845568,140699399787184,0,619236216832,15068,619233476608,619233427456,140699399787184,56130748,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9633298Z","2025-11-19 19:51:16.9633298Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13120 ",13920,,,"13120 ",,,,,,,,,,,,,1763581876963329800,18446633084041756672,18446633084041732096,140712865112144,0,619236282368,13920,619240226816,619240177664,140712865112144,120178560,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9634505Z","2025-11-19 19:51:16.9634505Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13120 ",1692,,,"13120 ",,,,,,,,,,,,,1763581876963450500,18446633084024516608,18446633084024492032,140712899206080,0,619234467840,1692,619237081088,619237031936,140712899206080,1102179,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9639407Z","2025-11-19 19:51:16.9639407Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5184 explorer.exe",3712,,," 5184 explorer.exe",,,,,,,,,,,,,1763581876963940700,18446633084022595584,18446633084022571008,140712891292720,0,15220736,3712,467664896,467607552,140712891292720,5481847,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9648012Z","2025-11-19 19:51:16.9648012Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop ","13120 ",1692,,,"13120 ",,,"RuntimeBroker.",,,,,,,,,,1763581876964801200,,,,,,,,,,,3215360,3645440,424320572,134080539436056425,0,134080554769450943,264,0,2861,12,26,3,4,12,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9791067Z","2025-11-19 19:51:16.9791067Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1416 ApplicationFrameHost.exe",11516,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,1763581876979106700,18446633084046409728,18446633084046385152,140712891292720,0,199841775616,11516,199843905536,199843897344,140712891292720,31722890,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9793344Z","2025-11-19 19:51:16.9793344Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4340 sihost.exe",13900,,," 4340 sihost.exe",,,,,,,,,,,,,1763581876979334400,18446633084023111680,18446633084023087104,140712891292720,0,645640536064,13900,645647040512,645647028224,140712891292720,5391318,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9950931Z","2025-11-19 19:51:16.9950931Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4340 sihost.exe",13260,,," 4340 sihost.exe",,,,,,,,,,,,,1763581876995093100,18446633084011245568,18446633084011220992,140712891292720,0,645640544256,13260,645647564800,645647548416,140712891292720,3404229,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:16.9951060Z","2025-11-19 19:51:16.9951060Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1416 ApplicationFrameHost.exe",13876,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,1763581876995106000,18446633084045979648,18446633084045955072,140712891292720,0,199841767424,13876,199842332672,199842316288,140712891292720,181487517,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.0111136Z","2025-11-19 19:51:17.0111136Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1416 ApplicationFrameHost.exe",9424,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,1763581877011113600,18446633083987144704,18446633083987120128,140712891292720,0,199841759232,9424,199839318016,199839297536,140712891292720,65582250,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.0430380Z","2025-11-19 19:51:17.0430380Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5992 svchost.exe",13196,,," 5992 svchost.exe",,,,,,,,,,,,,1763581877043038000,18446633084053237760,18446633084053213184,140712899206080,0,477737390080,13196,477738565632,477738532864,140712899206080,8061896,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.0430460Z","2025-11-19 19:51:17.0430460Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5992 svchost.exe",13756,,," 5992 svchost.exe",,,,,,,,,,,,,1763581877043046100,18446633084028424192,18446633084028399616,140712899206080,0,477737398272,13756,477739089920,477739057152,140712899206080,6557245,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.2923207Z","2025-11-19 19:51:17.2923207Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6500 SearchHost.exe",14484,,," 6500 SearchHost.exe",,,,,,,,,,,,,1763581877292320700,18446633084058714112,18446633084058689536,140712449945792,0,1050565754880,14484,1050568294400,1050568228864,140712449945792,1580469,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.2924784Z","2025-11-19 19:51:17.2924784Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6500 SearchHost.exe",14300,,," 6500 SearchHost.exe",,,,,,,,,,,,,1763581877292478500,18446633084041756672,18446633084041732096,140712449945792,0,1050565763072,11380,1050568294400,1050568228864,140712449945792,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.2967529Z","2025-11-19 19:51:17.2967529Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6500 SearchHost.exe",11380,,," 6500 SearchHost.exe",,,,,,,,,,,,,1763581877296752900,18446633084041756672,18446633084041732096,140712449945792,0,1050565763072,11380,1050568294400,1050568228864,140712449945792,1074644,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.2968507Z","2025-11-19 19:51:17.2968507Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6500 SearchHost.exe",14300,,," 6500 SearchHost.exe",,,,,,,,,,,,,1763581877296850700,18446633084041756672,18446633084041732096,140712449945792,0,1050565771264,14416,1050568294400,1050568228864,140712449945792,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.287575200Z","2025-11-19 19:51:17.3448096Z","myETW","EDRi-Provider",4242,"EDRiTask","12472 EDRi.exe",,,,,,"++ EDRi START MARKER ++",,,,,,,,,,,1763581877344809600,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:17.5841062Z","2025-11-19 19:51:17.5841062Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9920 ServiceHub.IntellicodeModelService.exe",5860,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,1763581877584106200,18446633084005670912,18446633084005646336,140711612509856,0,46014308352,5860,46012694528,46012678144,140711612509856,774012,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.197740800Z","2025-11-19 19:51:18.3561017Z","myETW","EDRi-Provider",4242,"EDRiTask","12472 EDRi.exe",,,,,,"Before decrypting the attack exe from C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\attacks\Injector-standard.exe.enc",,,,,,,,,,,1763581878356101700,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.199912800Z","2025-11-19 19:51:18.3585127Z","myETW","EDRi-Provider",4242,"EDRiTask","12472 EDRi.exe",,,,,,"After decrypting the attack exe",,,,,,,,,,,1763581878358512700,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.3963495Z","2025-11-19 19:51:18.3963495Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3504 svchost.exe",12864,,," 3504 svchost.exe",,,,,,,,,,,,,1763581878396349500,18446633083987144704,18446633083987120128,140712899206080,38,949314420736,8740,949313404928,949313372160,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.4026822Z","2025-11-19 19:51:18.4026822Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3564 MsMpEng.exe",8704,,," 3564 MsMpEng.exe",,,,,,,,,,,,,1763581878402682200,18446633084043333632,18446633084043309056,140712865112144,247,273686036480,12944,273705598976,273705533440,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.4034668Z","2025-11-19 19:51:18.4034668Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1776 svchost.exe",2748,,," 1776 svchost.exe",,,,,,,,,,,,,1763581878403466800,18446633084042158080,18446633084042133504,140712899206080,122,699936538624,1248,699937587200,699937554432,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.4082367Z","2025-11-19 19:51:18.4082367Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2376 svchost.exe",2640,,," 2376 svchost.exe",,,,,,,,,,,,,1763581878408236700,18446633084042186752,18446633084042162176,140712899206080,248,36400259072,2884,36401315840,36401283072,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.4099234Z","2025-11-19 19:51:18.4099234Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2932 svchost.exe",5072,,," 2932 svchost.exe",,,,,,,,,,,,,1763581878409923400,18446633084045979648,18446633084045955072,140712899206080,49,212461367296,14528,212459651072,212459585536,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.4324897Z","2025-11-19 19:51:18.4324897Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3504 svchost.exe",12864,,," 3504 svchost.exe",,,,,,,,,,,,,1763581878432489700,18446633084042100736,18446633084042076160,140712678802768,38,949314428928,6532,949316747264,949316714496,140712678802768,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.7511985Z","2025-11-19 19:51:18.7511985Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1520 powershell.exe",4168,,," 1520 powershell.exe",,,,,,,,,,,,,1763581878751198500,18446633084042129408,18446633084042104832,140712899206080,0,931706306560,6084,931710107648,931710099456,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:18.7512011Z","2025-11-19 19:51:18.7512011Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8916 SecurityHealthService.exe",8952,,," 8916 SecurityHealthService.exe",,,,,,,,,,,,,1763581878751201100,18446633084042330112,18446633084042305536,140712899206080,167,33812795392,13648,33815003136,33814994944,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.0792892Z","2025-11-19 19:51:19.0792892Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 872 wininit.exe",5580,,," 872 wininit.exe",,,,,,,,,,,,,1763581879079289300,18446633084040691712,18446633084040667136,140712899206080,0,97764474880,5580,97765556224,97765498880,140712899206080,268944,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.108607600Z","2025-11-19 19:51:19.3681762Z","myETW","EDRi-Provider",4242,"EDRiTask","12472 EDRi.exe",,,,,,"Before starting the attack exe",,,,,,,,,,,1763581879368176200,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.3794628Z","2025-11-19 19:51:19.3794628Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8448 OneDrive.exe",8496,,," 8448 OneDrive.exe",,,,,,,,,,,,,1763581879379462800,18446633084042072064,18446633084042047488,140712859481984,0,70345129984,12656,70351060992,70351056896,140712859481984,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.3795497Z","2025-11-19 19:51:19.3795497Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8448 OneDrive.exe",8496,,," 8448 OneDrive.exe",,,,,,,,,,,,,1763581879379549700,18446633084040691712,18446633084040667136,140712859481984,0,70345138176,4244,70353158144,70353154048,140712859481984,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.5582180Z","2025-11-19 19:51:19.5582180Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1564 svchost.exe",320,,," 1564 svchost.exe",,,,,,,,,,,,,1763581879558218000,18446633083995705344,18446633083995680768,140712899206080,0,86741528576,320,86739845120,86739812352,140712899206080,348156,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.5582222Z","2025-11-19 19:51:19.5582222Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1676 svchost.exe",14356,,," 1676 svchost.exe",,,,,,,,,,,,,1763581879558222300,18446633084007567360,18446633084007542784,140712899206080,0,289651163136,14356,289649328128,289649295360,140712899206080,294971,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.5582251Z","2025-11-19 19:51:19.5582251Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1388 svchost.exe",7708,,," 1388 svchost.exe",,,,,,,,,,,,,1763581879558225100,18446633083995619328,18446633083995594752,140712899206080,0,867845017600,7708,867846062080,867846029312,140712899206080,442079,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.5582269Z","2025-11-19 19:51:19.5582269Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1796 svchost.exe",13672,,," 1796 svchost.exe",,,,,,,,,,,,,1763581879558226900,18446633084043304960,18446633084043280384,140712899206080,0,708991610880,13672,708990205952,708990173184,140712899206080,218022,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.5582272Z","2025-11-19 19:51:19.5582272Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1660 svchost.exe",10848,,," 1660 svchost.exe",,,,,,,,,,,,,1763581879558227200,18446633084006277120,18446633084006252544,140712899206080,0,265906405376,10848,265905373184,265905340416,140712899206080,567308,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.5582306Z","2025-11-19 19:51:19.5582306Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1580 svchost.exe",11172,,," 1580 svchost.exe",,,,,,,,,,,,,1763581879558230600,18446633083995676672,18446633083995652096,140712899206080,0,966821433344,11172,966823247872,966823215104,140712899206080,442078,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.6057562Z","2025-11-19 19:51:19.6057562Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13112 TimelineExplorer.exe",3660,,,"13112 TimelineExplorer.exe",,,,,,,,,,,,,1763581879605756200,18446633083995676672,18446633083995652096,140710065285584,0,1007263309824,6596,1007268921344,1007268917248,140710065285584,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.6062469Z","2025-11-19 19:51:19.6062469Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13112 TimelineExplorer.exe",6596,,,"13112 TimelineExplorer.exe",,,,,,,,,,,,,1763581879606246900,18446633083995705344,18446633083995680768,140710065285584,0,1007263318016,13176,1007270494208,1007270490112,140710065285584,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.6854481Z","2025-11-19 19:51:19.6854481Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2244 svchost.exe",10872,,," 2244 svchost.exe",,,,,,,,,,,,,1763581879685448100,18446633084007510016,18446633084007485440,140712899206080,0,927664201728,10872,927665225728,927665192960,140712899206080,271962,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.7168967Z","2025-11-19 19:51:19.7168967Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2384 svchost.exe",11224,,," 2384 svchost.exe",,,,,,,,,,,,,1763581879716896700,18446633084007280640,18446633084007256064,140712899206080,0,928822128640,11224,928820035584,928820002816,140712899206080,284409,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.7681200Z","2025-11-19 19:51:19.7681200Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3564 MsMpEng.exe",15092,,," 3564 MsMpEng.exe",,,,,,,,,,,,,1763581879768120000,18446633084007280640,18446633084007256064,140712850417280,247,273686044672,13280,273711366144,273711345664,140712850417280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.7962656Z","2025-11-19 19:51:19.7962656Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2572 svchost.exe",12492,,," 2572 svchost.exe",,,,,,,,,,,,,1763581879796265600,18446633083989929984,18446633083989905408,140712899206080,0,140318752768,12492,140317556736,140317523968,140712899206080,58596122,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.7962861Z","2025-11-19 19:51:19.7962861Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2580 svchost.exe",1592,,," 2580 svchost.exe",,,,,,,,,,,,,1763581879796286100,18446633084006535168,18446633084006510592,140712899206080,0,139709349888,1592,139707613184,139707580416,140712899206080,432271,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.8593797Z","2025-11-19 19:51:19.8593797Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2688 svchost.exe",15088,,," 2688 svchost.exe",,,,,,,,,,,,,1763581879859379700,18446633084017565696,18446633084017541120,140712899206080,0,461861052416,15088,461859520512,461859487744,140712899206080,3639602,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.8593858Z","2025-11-19 19:51:19.8593858Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2824 svchost.exe",14692,,," 2824 svchost.exe",,,,,,,,,,,,,1763581879859385800,18446633084007337984,18446633084007313408,140712899206080,0,912958394368,14692,912960520192,912960487424,140712899206080,190109,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.8593878Z","2025-11-19 19:51:19.8593878Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2924 svchost.exe",15280,,," 2924 svchost.exe",,,,,,,,,,,,,1763581879859387800,18446633084053037056,18446633084053012480,140712899206080,0,22795169792,15280,22796566528,22796533760,140712899206080,320242,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.9394117Z","2025-11-19 19:51:19.9394117Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2724 svchost.exe",13784,,," 2724 svchost.exe",,,,,,,,,,,,,1763581879939411700,18446633084007624704,18446633084007600128,140712899206080,0,89489293312,13784,89490718720,89490685952,140712899206080,388516,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.9713021Z","2025-11-19 19:51:19.9713021Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3316 svchost.exe",15048,,," 3316 svchost.exe",,,,,,,,,,,,,1763581879971302100,18446633084007768064,18446633084007743488,140712899206080,0,725981220864,15048,725982642176,725982609408,140712899206080,116932,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.9713034Z","2025-11-19 19:51:19.9713034Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3256 svchost.exe",14068,,," 3256 svchost.exe",,,,,,,,,,,,,1763581879971303400,18446633084007653376,18446633084007628800,140712899206080,0,435930497024,14068,433793794048,433793761280,140712899206080,313453,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.9713095Z","2025-11-19 19:51:19.9713095Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3456 svchost.exe",11540,,," 3456 svchost.exe",,,,,,,,,,,,,1763581879971309500,18446633084007858176,18446633084007833600,140712899206080,0,94398496768,11540,94400151552,94400118784,140712899206080,179170,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.9713146Z","2025-11-19 19:51:19.9713146Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3000 svchost.exe",11392,,," 3000 svchost.exe",,,,,,,,,,,,,1763581879971314600,18446633084019789824,18446633084019765248,140712899206080,0,1014020698112,11392,1014021750784,1014021718016,140712899206080,198407,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:19.9713249Z","2025-11-19 19:51:19.9713249Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3532 svchost.exe",8628,,," 3532 svchost.exe",,,,,,,,,,,,,1763581879971324900,18446633083996078080,18446633083996053504,140712899206080,0,761505017856,8628,761506299904,761506267136,140712899206080,396438,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.0667475Z","2025-11-19 19:51:20.0667475Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3608 svchost.exe",13932,,," 3608 svchost.exe",,,,,,,,,,,,,1763581880066747500,18446633084007944192,18446633084007919616,140712899206080,0,310404599808,13932,310406807552,310406774784,140712899206080,237636,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.0667560Z","2025-11-19 19:51:20.0667560Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3740 svchost.exe",11332,,," 3740 svchost.exe",,,,,,,,,,,,,1763581880066756000,18446633083981160448,18446633083981135872,140712899206080,0,100414373888,11332,100416356352,100416323584,140712899206080,504693,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.0827302Z","2025-11-19 19:51:20.0827302Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 872 wininit.exe",,,,,,,,,,,,,1763581880082730200,18446633083981160448,18446633083981135872,140712899206080,0,97764483072,1924,97765556224,97765498880,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.2250627Z","2025-11-19 19:51:20.2250627Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4192 svchost.exe",7568,,," 4192 svchost.exe",,,,,,,,,,,,,1763581880225062700,18446633083979362304,18446633083979337728,140712899206080,0,330479362048,7568,330476748800,330476716032,140712899206080,297987,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.5099571Z","2025-11-19 19:51:20.5099571Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","12740 svchost.exe",14676,,,"12740 svchost.exe",,,,,,,,,,,,,1763581880509957100,18446633084011245568,18446633084011220992,140712899206080,9,237559373824,8312,237558366208,237558333440,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.5732911Z","2025-11-19 19:51:20.5732911Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1388 svchost.exe",,,,,,,,,,,,,1763581880573291100,18446633084043304960,18446633084043280384,140712899206080,0,867845025792,11356,867846062080,867846029312,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.5733821Z","2025-11-19 19:51:20.5733821Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1564 svchost.exe",,,,,,,,,,,,,1763581880573382100,18446633083995619328,18446633083995594752,140712899206080,0,86741536768,13068,86739845120,86739812352,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.5734717Z","2025-11-19 19:51:20.5734717Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1676 svchost.exe",,,,,,,,,,,,,1763581880573471700,18446633084006277120,18446633084006252544,140712899206080,0,289651171328,9168,289649328128,289649295360,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.5735685Z","2025-11-19 19:51:20.5735685Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1796 svchost.exe",,,,,,,,,,,,,1763581880573568500,18446633084007567360,18446633084007542784,140712899206080,0,708991619072,8208,708990205952,708990173184,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.5736152Z","2025-11-19 19:51:20.5736152Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1660 svchost.exe",,,,,,,,,,,,,1763581880573615200,18446633084046409728,18446633084046385152,140712899206080,0,265906413568,13016,265905373184,265905340416,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.5737346Z","2025-11-19 19:51:20.5737346Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1580 svchost.exe",,,,,,,,,,,,,1763581880573734600,18446633084041408512,18446633084041383936,140712899206080,0,966821441536,500,966823247872,966823215104,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.7004875Z","2025-11-19 19:51:20.7004875Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 2244 svchost.exe",,,,,,,,,,,,,1763581880700487500,18446633084042616832,18446633084042592256,140712899206080,0,927664209920,5500,927665225728,927665192960,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.7323852Z","2025-11-19 19:51:20.7323852Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 2384 svchost.exe",,,,,,,,,,,,,1763581880732385200,18446633084042645504,18446633084042620928,140712899206080,0,928822153216,12408,928820035584,928820002816,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.7964031Z","2025-11-19 19:51:20.7964031Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 2572 svchost.exe",,,,,,,,,,,,,1763581880796403100,18446633084042702848,18446633084042678272,140712899206080,0,140318842880,1864,140317556736,140317523968,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.7965326Z","2025-11-19 19:51:20.7965326Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 2580 svchost.exe",,,,,,,,,,,,,1763581880796532600,18446633084042731520,18446633084042706944,140712899206080,0,139709366272,11504,139707613184,139707580416,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.8746075Z","2025-11-19 19:51:20.8746075Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 2688 svchost.exe",,,,,,,,,,,,,1763581880874607500,18446633084043046912,18446633084043022336,140712899206080,0,461861085184,12512,461859520512,461859487744,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.8747287Z","2025-11-19 19:51:20.8747287Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 2824 svchost.exe",,,,,,,,,,,,,1763581880874728700,18446633084007624704,18446633084007600128,140712899206080,0,912958402560,4252,912960520192,912960487424,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.8748579Z","2025-11-19 19:51:20.8748579Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 2924 svchost.exe",,,,,,,,,,,,,1763581880874857900,18446633084007510016,18446633084007485440,140712899206080,0,22795177984,10452,22796566528,22796533760,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9540010Z","2025-11-19 19:51:20.9540010Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 2724 svchost.exe",,,,,,,,,,,,,1763581880954001000,18446633084043075584,18446633084043051008,140712899206080,0,89489301504,7700,89490718720,89490685952,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9624111Z","2025-11-19 19:51:20.9624111Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",5020,,," 5184 explorer.exe",,,,,,,,,,,,,1763581880962411100,18446633084043362304,18446633084043337728,140712891545280,0,15286272,5116,467664896,467607552,140712891545280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9698780Z","2025-11-19 19:51:20.9698780Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4608 svchost.exe",11692,,," 4608 svchost.exe",,,,,,,,,,,,,1763581880969878000,18446633084008919040,18446633084008894464,140712899206080,0,287385964544,11692,287387942912,287387910144,140712899206080,352306,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9763041Z","2025-11-19 19:51:20.9763041Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1040 svchost.exe",2280,,,"11956 smartscreen.exe",,,"C:\Windows\System32\smartscreen.exe",,,,,,,,,,1763581880976304100,,,,,,,,,,,,,,134080554805558624,,,,,3391,,,,,,0,664452,"0x","","",1040,13,3,0,0,1,419447766,,, -"2025-11-19 19:51:20.9772717Z","2025-11-19 19:51:20.9772717Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",2280,,,"11956 smartscreen.exe",,,,,,,,,,,,,1763581880977271700,18446633084008919040,18446633084008894464,140696524147856,40,4299116544,12552,4295491584,4295483392,140696524147856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9789415Z","2025-11-19 19:51:20.9789415Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\smartscreen.exe",,,,,,,,,,1763581880978941500,,,,,,,,,,,,,,,,,,,,,,,,,,664452,,,,,,,,,,419447766,140696524029952,140696524029952,614400 -"2025-11-19 19:51:20.9789788Z","2025-11-19 19:51:20.9789788Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581880978978800,,,,,,,,,,,,,,,,,,,,,,,,,,2537167,,,,,,,,,,2626650689,140712898723840,140712898723840,2523136 -"2025-11-19 19:51:20.9823811Z","2025-11-19 19:51:20.9823811Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581880982381100,,,,,,,,,,,,,,,,,,,,,,,,,,885660,,,,,,,,,,2913437033,140712877621248,140712877621248,823296 -"2025-11-19 19:51:20.9825014Z","2025-11-19 19:51:20.9825014Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581880982501400,,,,,,,,,,,,,,,,,,,,,,,,,,4209945,,,,,,,,,,2980330054,140712854355968,140712854355968,4161536 -"2025-11-19 19:51:20.9836941Z","2025-11-19 19:51:20.9836941Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581880983694100,,,,,,,,,,,,,,,,,,,,,,,,,,1436013,,,,,,,,,,1441720767,140712859467776,140712859467776,1355776 -"2025-11-19 19:51:20.9837895Z","2025-11-19 19:51:20.9837895Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,,,,,,,,,,,1763581880983789500,18446633084042788864,18446633084042764288,140712899206080,0,4299124736,6108,4296015872,4296007680,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9838695Z","2025-11-19 19:51:20.9838695Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,1763581880983869500,,,,,,,,,,,,,,,,,,,,,,,,,,3798760,,,,,,,,,,2772520021,140712863924224,140712863924224,3715072 -"2025-11-19 19:51:20.9840834Z","2025-11-19 19:51:20.9840834Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581880984083400,,,,,,,,,,,,,,,,,,,,,,,,,,1193108,,,,,,,,,,4275633056,140712897216512,140712897216512,1146880 -"2025-11-19 19:51:20.9841934Z","2025-11-19 19:51:20.9841934Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,,,,,,,,,,,1763581880984193400,18446633084043190272,18446633084043165696,140712899206080,0,4299132928,6996,4296540160,4296531968,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9842740Z","2025-11-19 19:51:20.9842740Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,1763581880984274000,,,,,,,,,,,,,,,,,,,,,,,,,,1029623,,,,,,,,,,2858041650,140712891252736,140712891252736,991232 -"2025-11-19 19:51:20.9842847Z","2025-11-19 19:51:20.9842847Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,,,,,,,,,,,1763581880984284700,18446633084043247616,18446633084043223040,140712899206080,0,4299141120,204,4297064448,4297056256,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9844610Z","2025-11-19 19:51:20.9844610Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,1763581880984461000,,,,,,,,,,,,,,,,,,,,,,,,,,1923284,,,,,,,,,,675224942,140712888827904,140712888827904,1863680 -"2025-11-19 19:51:20.9846184Z","2025-11-19 19:51:20.9846184Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,1763581880984618400,,,,,,,,,,,,,,,,,,,,,,,,,,230350,,,,,,,,,,2551303736,140712858550272,140712858550272,159744 -"2025-11-19 19:51:20.9847528Z","2025-11-19 19:51:20.9847528Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,"C:\Windows\System32\smartscreen.dll",,,,,,,,,,1763581880984752800,,,,,,,,,,,,,,,,,,,,,,,,,,6028386,,,,,,,,,,1751620389,140712383414272,140712383414272,6057984 -"2025-11-19 19:51:20.9847585Z","2025-11-19 19:51:20.9847585Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,1763581880984758500,,,,,,,,,,,,,,,,,,,,,,,,,,230873,,,,,,,,,,527442843,140712882405376,140712882405376,176128 -"2025-11-19 19:51:20.9849421Z","2025-11-19 19:51:20.9849421Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581880984942100,,,,,,,,,,,,,,,,,,,,,,,,,,761372,,,,,,,,,,71854833,140712881618944,140712881618944,737280 -"2025-11-19 19:51:20.9849424Z","2025-11-19 19:51:20.9849424Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,1763581880984942400,,,,,,,,,,,,,,,,,,,,,,,,,,1243850,,,,,,,,,,792084382,140712861433856,140712861433856,1228800 -"2025-11-19 19:51:20.9851390Z","2025-11-19 19:51:20.9851390Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581880985139000,,,,,,,,,,,,,,,,,,,,,,,,,,700029,,,,,,,,,,3371602543,140712858746880,140712858746880,667648 -"2025-11-19 19:51:20.9851423Z","2025-11-19 19:51:20.9851423Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",204,,,"11956 smartscreen.exe",,,"C:\Windows\System32\winhttp.dll",,,,,,,,,,1763581880985142300,,,,,,,,,,,,,,,,,,,,,,,,,,1261038,,,,,,,,,,84984727,140712750350336,140712750350336,1212416 -"2025-11-19 19:51:20.9851960Z","2025-11-19 19:51:20.9851960Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581880985196000,,,,,,,,,,,,,,,,,,,,,,,,,,760295,,,,,,,,,,460960534,140712894529536,140712894529536,692224 -"2025-11-19 19:51:20.9854024Z","2025-11-19 19:51:20.9854024Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",204,,,"11956 smartscreen.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581880985402400,,,,,,,,,,,,,,,,,,,,,,,,,,716301,,,,,,,,,,3291623140,140712863203328,140712863203328,679936 -"2025-11-19 19:51:20.9854512Z","2025-11-19 19:51:20.9854512Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581880985451200,,,,,,,,,,,,,,,,,,,,,,,,,,716301,,,,,,,,,,3291623140,1646826618880,1646826618880,679936 -"2025-11-19 19:51:20.9854713Z","2025-11-19 19:51:20.9854713Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\crypt32.dll",,,,,,,,,,1763581880985471300,,,,,,,,,,,,,,,,,,,,,,,,,,1584869,,,,,,,,,,3438168074,140712849768448,140712849768448,1536000 -"2025-11-19 19:51:20.9855242Z","2025-11-19 19:51:20.9855242Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581880985524200,,,,,,,,,,,,,,,,,,,,,,,,,,716301,,,,,,,,,,3291623140,1646826618880,1646826618880,692224 -"2025-11-19 19:51:20.9856395Z","2025-11-19 19:51:20.9856395Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,"C:\Windows\System32\ws2_32.dll",,,,,,,,,,1763581880985639500,,,,,,,,,,,,,,,,,,,,,,,,,,513405,,,,,,,,,,3967481067,140712881094656,140712881094656,475136 -"2025-11-19 19:51:20.9856905Z","2025-11-19 19:51:20.9856905Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,1763581880985690500,,,,,,,,,,,,,,,,,,,,,,,,,,899838,,,,,,,,,,2878277657,140712880177152,140712880177152,880640 -"2025-11-19 19:51:20.9858908Z","2025-11-19 19:51:20.9858908Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",204,,,"11956 smartscreen.exe",,,"C:\Windows\System32\cryptsp.dll",,,,,,,,,,1763581880985890800,,,,,,,,,,,,,,,,,,,,,,,,,,146168,,,,,,,,,,1658328178,140712839217152,140712839217152,110592 -"2025-11-19 19:51:20.9859779Z","2025-11-19 19:51:20.9859779Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3316 svchost.exe",,,,,,,,,,,,,1763581880985977900,18446633084043276288,18446633084043251712,140712899206080,0,725981229056,5216,725982642176,725982609408,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9860302Z","2025-11-19 19:51:20.9860302Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,1763581880986030200,,,,,,,,,,,,,,,,,,,,,,,,,,7769948,,,,,,,,,,2341846616,140712869888000,140712869888000,7663616 -"2025-11-19 19:51:20.9860717Z","2025-11-19 19:51:20.9860717Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3256 svchost.exe",,,,,,,,,,,,,1763581880986071700,18446633084043390976,18446633084043366400,140712899206080,0,435930505216,13464,433793794048,433793761280,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9861764Z","2025-11-19 19:51:20.9861764Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3000 svchost.exe",,,,,,,,,,,,,1763581880986176400,18446633084043476992,18446633084043452416,140712899206080,0,1014020706304,13692,1014021750784,1014021718016,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9862140Z","2025-11-19 19:51:20.9862140Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3456 svchost.exe",,,,,,,,,,,,,1763581880986214000,18446633084043538432,18446633084043513856,140712899206080,0,94398504960,12164,94400151552,94400118784,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9863024Z","2025-11-19 19:51:20.9863024Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3532 svchost.exe",,,,,,,,,,,,,1763581880986302400,18446633084043997184,18446633084043972608,140712899206080,0,761505026048,6444,761506299904,761506267136,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9864111Z","2025-11-19 19:51:20.9864111Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",204,,,"11956 smartscreen.exe",,,"C:\Windows\System32\dnsapi.dll",,,,,,,,,,1763581880986411100,,,,,,,,,,,,,,,,,,,,,,,,,,1293169,,,,,,,,,,1381219389,140712824274944,140712824274944,1228800 -"2025-11-19 19:51:20.9864222Z","2025-11-19 19:51:20.9864222Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,1763581880986422200,,,,,,,,,,,,,,,,,,,,,,,,,,1524912,,,,,,,,,,1404855129,140712851341312,140712851341312,1486848 -"2025-11-19 19:51:20.9866834Z","2025-11-19 19:51:20.9866834Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,"C:\Windows\System32\wintrust.dll",,,,,,,,,,1763581880986683400,,,,,,,,,,,,,,,,,,,,,,,,,,590783,,,,,,,,,,452262045,140712860844032,140712860844032,520192 -"2025-11-19 19:51:20.9867955Z","2025-11-19 19:51:20.9867955Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",204,,,"11956 smartscreen.exe",,,"C:\Windows\System32\IPHLPAPI.DLL",,,,,,,,,,1763581880986795500,,,,,,,,,,,,,,,,,,,,,,,,,,233044,,,,,,,,,,945822897,140712824012800,140712824012800,212992 -"2025-11-19 19:51:20.9869651Z","2025-11-19 19:51:20.9869651Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",6996,,,"11956 smartscreen.exe",,,"C:\Windows\System32\ole32.dll",,,,,,,,,,1763581880986965100,,,,,,,,,,,,,,,,,,,,,,,,,,1689904,,,,,,,,,,1018821057,140712878473216,140712878473216,1667072 -"2025-11-19 19:51:20.9890552Z","2025-11-19 19:51:20.9890552Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\nsi.dll",,,,,,,,,,1763581880989055200,,,,,,,,,,,,,,,,,,,,,,,,,,111648,,,,,,,,,,4223476491,140712892956672,140712892956672,40960 -"2025-11-19 19:51:20.9896219Z","2025-11-19 19:51:20.9896219Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,1763581880989621900,,,,,,,,,,,,,,,,,,,,,,,,,,233556,,,,,,,,,,1625678811,140712882601984,140712882601984,200704 -"2025-11-19 19:51:20.9913559Z","2025-11-19 19:51:20.9913559Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\msasn1.dll",,,,,,,,,,1763581880991355900,,,,,,,,,,,,,,,,,,,,,,,,,,150871,,,,,,,,,,2536054058,140712839675904,140712839675904,77824 -"2025-11-19 19:51:20.9921028Z","2025-11-19 19:51:20.9921028Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,,,,,,,,,,,1763581880992102800,18446633084042960896,18446633084042936320,140712387241344,0,4299149312,5980,4299685888,4299677696,140712387241344,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9924315Z","2025-11-19 19:51:20.9924315Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",5980,,,"11956 smartscreen.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,1763581880992431500,,,,,,,,,,,,,,,,,,,,,,,,,,158678,,,,,,,,,,3554393863,140712830631936,140712830631936,110592 -"2025-11-19 19:51:20.9928273Z","2025-11-19 19:51:20.9928273Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,1763581880992827300,,,,,,,,,,,,,,,,,,,,,,,,,,741046,,,,,,,,,,2283238626,140712852848640,140712852848640,675840 -"2025-11-19 19:51:20.9932375Z","2025-11-19 19:51:20.9932375Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"11956 smartscreen.exe",,,,,,,,,,,,,1763581880993237500,18446633084044025856,18446633084044001280,140712899206080,0,4297064448,3708,4300210176,4300201984,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9935171Z","2025-11-19 19:51:20.9935171Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",3708,,,"11956 smartscreen.exe",,,"C:\Windows\System32\wtdsensor.dll",,,,,,,,,,1763581880993517100,,,,,,,,,,,,,,,,,,,,,,,,,,56489,,,,,,,,,,4237415889,140712681996288,140712681996288,45056 -"2025-11-19 19:51:20.9946637Z","2025-11-19 19:51:20.9946637Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,1763581880994663700,,,,,,,,,,,,,,,,,,,,,,,,,,783429,,,,,,,,,,2294669044,140712888041472,140712888041472,720896 -"2025-11-19 19:51:20.9955563Z","2025-11-19 19:51:20.9955563Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11956 smartscreen.exe",12552,,,"11956 smartscreen.exe",,,,,,,,,,,,,1763581880995556300,18446633084044054528,18446633084044029952,140712865112144,0,4297072640,2328,4300734464,4300726272,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9958285Z","2025-11-19 19:51:20.9958285Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11956 smartscreen.exe",3708,,,"11956 smartscreen.exe",,,,,,,,,,,,,1763581880995828500,18446633084044197888,18446633084044173312,140712899206080,0,4297080832,4856,4301258752,4301250560,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9975541Z","2025-11-19 19:51:20.9975541Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11956 smartscreen.exe",3708,,,"11956 smartscreen.exe",,,,,,,,,,,,,1763581880997554100,18446633084044255232,18446633084044230656,140712899206080,0,4297089024,11364,4301783040,4301774848,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.9987968Z","2025-11-19 19:51:20.9987968Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",3708,,,"11956 smartscreen.exe",,,"C:\Windows\System32\smartscreenps.dll",,,,,,,,,,1763581880998796800,,,,,,,,,,,,,,,,,,,,,,,,,,151429,,,,,,,,,,4089359051,140712623865856,140712623865856,122880 -"2025-11-19 19:51:21.0003864Z","2025-11-19 19:51:21.0003864Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",3708,,,"11956 smartscreen.exe",,,"C:\Windows\System32\Windows.Management.Workplace.dll",,,,,,,,,,1763581881000386400,,,,,,,,,,,,,,,,,,,,,,,,,,215437,,,,,,,,,,170946563,140712429879296,140712429879296,204800 -"2025-11-19 19:51:21.0012539Z","2025-11-19 19:51:21.0012539Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","11956 smartscreen.exe",3708,,,"11956 smartscreen.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,1763581881001253900,,,,,,,,,,,,,,,,,,,,,,,,,,769657,,,,,,,,,,423353507,140712774598656,140712774598656,741376 -"2025-11-19 19:51:21.0017586Z","2025-11-19 19:51:21.0017586Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11956 smartscreen.exe",3708,,,"11956 smartscreen.exe",,,,,,,,,,,,,1763581881001758600,18446633084044283904,18446633084044259328,140712387241344,0,4297097216,9852,4302307328,4302299136,140712387241344,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0413450Z","2025-11-19 19:51:21.0413450Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 5184 explorer.exe",5116,,," 3348 attack-589.exe",,,"C:\Users\Public\Downloads\attack-589.exe",,,,,,,,,,1763581881041345000,,,,,,,,,,,,,,134080554806144016,,,,,3392,,,,,,0,0,"0x","","",5184,140,3,0,0,1,1763491559,,, -"2025-11-19 19:51:21.0443828Z","2025-11-19 19:51:21.0443828Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",5116,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581881044382800,18446633084044398592,18446633084044374016,140695599400816,0,289797906432,11212,289800192000,289800187904,140695599400816,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0471547Z","2025-11-19 19:51:21.0471547Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 5536 svchost.exe",,,,,,,,,,,,,1763581881047154700,18446633084043419648,18446633084043395072,140712899206080,0,151912587264,1300,151915069440,151915036672,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0473929Z","2025-11-19 19:51:21.0473929Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5536 svchost.exe",1300,,," 5536 svchost.exe",,,,,,,,,,,,,1763581881047392900,18446633084044513280,18446633084044488704,140712899206080,132,151912595456,7072,151915593728,151915560960,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0503483Z","2025-11-19 19:51:21.0503483Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5536 svchost.exe",11248,,," 5536 svchost.exe",,,,,,,,,,,,,1763581881050348300,18446633084043161600,18446633084043137024,140712899206080,0,151912603648,1620,151916118016,151916085248,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0504664Z","2025-11-19 19:51:21.0504664Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5536 svchost.exe",1620,,," 5536 svchost.exe",,,,,,,,,,,,,1763581881050466400,18446633084044455936,18446633084044431360,140712899206080,0,151912611840,8960,151920836608,151920803840,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0550224Z","2025-11-19 19:51:21.0550224Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Users\Public\Downloads\attack-589.exe",,,,,,,,,,1763581881055022400,,,,,,,,,,,,,,,,,,,,,,,,,,0,,,,,,,,,,1763491559,140695599382528,140695599382528,53248 -"2025-11-19 19:51:21.0550597Z","2025-11-19 19:51:21.0550597Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581881055059700,,,,,,,,,,,,,,,,,,,,,,,,,,2537167,,,,,,,,,,2626650689,140712898723840,140712898723840,2523136 -"2025-11-19 19:51:21.0557966Z","2025-11-19 19:51:21.0557966Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581881055796600,,,,,,,,,,,,,,,,,,,,,,,,,,885660,,,,,,,,,,2913437033,140712877621248,140712877621248,823296 -"2025-11-19 19:51:21.0559164Z","2025-11-19 19:51:21.0559164Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581881055916400,,,,,,,,,,,,,,,,,,,,,,,,,,4209945,,,,,,,,,,2980330054,140712854355968,140712854355968,4161536 -"2025-11-19 19:51:21.0568214Z","2025-11-19 19:51:21.0568214Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 3348 attack-589.exe",11212,,," 3100 conhost.exe",,,"C:\Windows\System32\conhost.exe",,,,,,,,,,1763581881056821400,,,,,,,,,,,,,,134080554806283315,,,,,3393,,,,,,0,1035098,"0x","","",3348,3392,3,0,0,1,2671108986,,, -"2025-11-19 19:51:21.0581639Z","2025-11-19 19:51:21.0581639Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3348 attack-589.exe",11212,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881058163900,18446633084006535168,18446633084006510592,140696384751904,0,1013857710080,13484,1013860270080,1013860261888,140696384751904,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0603778Z","2025-11-19 19:51:21.0603778Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3100 conhost.exe",13484,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881060377800,18446633084044943360,18446633084044918784,140712899206080,0,1013857718272,4844,1013860794368,1013860786176,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0604718Z","2025-11-19 19:51:21.0604718Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3100 conhost.exe",4844,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881060471800,18446633084044570624,18446633084044546048,140712899206080,0,1013857726464,11404,1013861318656,1013861310464,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0649429Z","2025-11-19 19:51:21.0649429Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3100 conhost.exe",13484,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881064942900,18446633084044627968,18446633084044603392,140696384580832,0,1013857734656,6724,1013861842944,1013861834752,140696384580832,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0650293Z","2025-11-19 19:51:21.0650293Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3100 conhost.exe",11404,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881065029300,18446633084044570624,18446633084044546048,140712899206080,0,1013857726464,11404,1013861318656,1013861310464,140712899206080,1647609,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0650435Z","2025-11-19 19:51:21.0650435Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3100 conhost.exe",4844,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881065043500,18446633084044943360,18446633084044918784,140712899206080,0,1013857718272,4844,1013860794368,1013860786176,140712899206080,754023,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0651883Z","2025-11-19 19:51:21.0651883Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3100 conhost.exe",13484,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881065188400,18446633084006535168,18446633084006510592,140696384751904,0,1013857710080,13484,1013860270080,1013860253696,140696384751904,23804713,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0654850Z","2025-11-19 19:51:21.0654850Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3100 conhost.exe",6724,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881065485000,18446633084006535168,18446633084006510592,140712899206080,0,1013857742848,4376,1013860270080,1013860261888,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0707449Z","2025-11-19 19:51:21.0707449Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3100 conhost.exe",6724,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881070744900,18446633084044943360,18446633084044918784,140712865112144,0,1013857751040,2976,1013860794368,1013860786176,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0709822Z","2025-11-19 19:51:21.0709822Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881070982200,18446633084044656640,18446633084044632064,140712899206080,0,1013857759232,9260,1013861318656,1013861310464,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0711453Z","2025-11-19 19:51:21.0711453Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3100 conhost.exe",9260,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881071145300,18446633084044828672,18446633084044804096,140712899206080,0,1013857767424,1400,1013862367232,1013862359040,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0809895Z","2025-11-19 19:51:21.0809895Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3608 svchost.exe",,,,,,,,,,,,,1763581881080989500,18446633084044972032,18446633084044947456,140712899206080,0,310404608000,2980,310406807552,310406774784,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0810351Z","2025-11-19 19:51:21.0810351Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3740 svchost.exe",,,,,,,,,,,,,1763581881081035100,18446633084045029376,18446633084045004800,140712899206080,0,100414390272,14328,100416356352,100416323584,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0819304Z","2025-11-19 19:51:21.0819304Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1040 svchost.exe",2280,,,"13828 OpenConsole.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\OpenConsole.exe",,,,,,,,,,1763581881081930400,,,,,,,,,,,,,,134080554806509408,,,,,3394,,,,,,3,1210794,"0x","Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe","App",1040,13,3,0,0,1,1759975785,,, -"2025-11-19 19:51:21.0828506Z","2025-11-19 19:51:21.0828506Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",2280,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881082850600,18446633084045201408,18446633084045176832,140702989817872,40,132813885440,4736,132815781888,132815777792,140702989817872,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0910041Z","2025-11-19 19:51:21.0910041Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881091004200,18446633084045402112,18446633084045377536,140712899206080,0,132813893632,14136,132816830464,132816826368,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0912384Z","2025-11-19 19:51:21.0912384Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881091238400,18446633084045430784,18446633084045406208,140712899206080,0,132813901824,12136,132817879040,132817874944,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.0913292Z","2025-11-19 19:51:21.0913292Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13828 OpenConsole.exe",12136,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881091329200,18446633084045807616,18446633084045783040,140712899206080,0,132813910016,1824,132818927616,132818923520,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1063298Z","2025-11-19 19:51:21.1063298Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881106329800,18446633084045864960,18446633084045840384,140712865112144,0,132813918208,13020,132819976192,132819968000,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1065155Z","2025-11-19 19:51:21.1065155Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881106515500,18446633084045922304,18446633084045897728,140712899206080,0,132813926400,5064,132821024768,132821020672,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1066984Z","2025-11-19 19:51:21.1066984Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13828 OpenConsole.exe",5064,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881106698400,18446633084045950976,18446633084045926400,140712899206080,0,132813934592,2364,132822073344,132822069248,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1341345Z","2025-11-19 19:51:21.1341345Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1040 svchost.exe",2280,,," 2344 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe",,,,,,,,,,1763581881134134500,,,,,,,,,,,,,,134080554806979193,,,,,3395,,,,,,3,738129,"0x","Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe","App",1040,13,3,0,0,1,1759975821,,, -"2025-11-19 19:51:21.1352167Z","2025-11-19 19:51:21.1352167Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",2280,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881135216700,18446633084046352384,18446633084046327808,140702319920256,40,1068179636224,5964,1068177817600,1068177813504,140702319920256,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1487993Z","2025-11-19 19:51:21.1487993Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881148799300,18446633084046610432,18446633084046585856,140712899206080,0,1068179644416,11152,1068181225472,1068181221376,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1491777Z","2025-11-19 19:51:21.1491777Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881149177700,18446633084046667776,18446633084046643200,140712899206080,0,1068179652608,4348,1068182274048,1068182269952,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1499435Z","2025-11-19 19:51:21.1499435Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",4348,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881149943500,18446633084046725120,18446633084046700544,140712899206080,0,1068179660800,12024,1068183322624,1068183318528,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1630475Z","2025-11-19 19:51:21.1630475Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881163047500,18446633084042817536,18446633084042792960,140712899206080,0,1068179668992,14844,1068184371200,1068184367104,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1658291Z","2025-11-19 19:51:21.1658291Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881165829100,18446633084046983168,18446633084046958592,140712865112144,0,1068179677184,11108,1068185419776,1068185411584,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1661013Z","2025-11-19 19:51:21.1661013Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",14844,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881166101300,18446633084047183872,18446633084047159296,140712899206080,0,1068179685376,8404,1068186468352,1068186464256,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1916998Z","2025-11-19 19:51:21.1916998Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881191699800,18446633084045144064,18446633084045119488,140712891292720,0,1068179693568,6876,1068187516928,1068187512832,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1974505Z","2025-11-19 19:51:21.1974505Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3204 Taskmgr.exe",5876,,," 3204 Taskmgr.exe",,,,,,,,,,,,,1763581881197450500,18446633084047499264,18446633084047474688,140712891292720,0,552496058368,11128,552502034432,552502026240,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1977017Z","2025-11-19 19:51:21.1977017Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881197701700,18446633084047642624,18446633084047618048,140712600145104,0,1068179701760,13936,1068188565504,1068188561408,140712600145104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.1977569Z","2025-11-19 19:51:21.1977569Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881197756900,18446633084047790080,18446633084047765504,140712604173856,0,1068179709952,10116,1068189614080,1068189609984,140712604173856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2126399Z","2025-11-19 19:51:21.2126399Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",13936,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881212639900,18446633084047642624,18446633084047618048,140712600145104,0,1068179701760,13936,1068188565504,1068188536832,140712600145104,46394848,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2137996Z","2025-11-19 19:51:21.2137996Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881213799600,18446633084047642624,18446633084047618048,140712632221632,0,1068179718144,14500,1068188565504,1068188561408,140712632221632,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.2399243Z","2025-11-19 19:51:21.2399243Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 4192 svchost.exe",,,,,,,,,,,,,1763581881239924300,18446633084047818752,18446633084047794176,140712899206080,0,330479370240,10680,330476748800,330476716032,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:20.821877500Z","2025-11-19 19:51:21.2718203Z","myETW","EDRi-Provider",4242,"EDRiTask","12472 EDRi.exe",,,,,,"After starting the attack exe",,,,,,,,,,,1763581881271820300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3039247Z","2025-11-19 19:51:21.3039247Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4440 svchost.exe",15252,,," 4440 svchost.exe",,,,,,,,,,,,,1763581881303924700,18446633084039225344,18446633084039200768,140712899206080,0,985498337280,15252,985501007872,985500975104,140712899206080,3620366,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3351734Z","2025-11-19 19:51:21.3351734Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13828 OpenConsole.exe",2364,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881335173400,18446633084047904768,18446633084047880192,140702989217024,0,132813942784,5760,132823121920,132823117824,140702989217024,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3352289Z","2025-11-19 19:51:21.3352289Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13828 OpenConsole.exe",2364,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881335228900,18446633084039225344,18446633084039200768,140702989233856,0,132813950976,14196,132824170496,132824166400,140702989233856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3369403Z","2025-11-19 19:51:21.3369403Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3100 conhost.exe",6724,,," 3100 conhost.exe",,,,,,,,,,,,,1763581881336940400,18446633084047990784,18446633084047966208,140696385038832,0,1013857775616,11136,1013862891520,1013862883328,140696385038832,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3414284Z","2025-11-19 19:51:21.3414284Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881341428400,18446633084048019456,18446633084047994880,140702989086576,0,132813959168,5520,132825219072,132825214976,140702989086576,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3429436Z","2025-11-19 19:51:21.3429436Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881342943600,18446633084044541952,18446633084044517376,140712583404848,0,1068179726336,11716,1068190662656,1068190658560,140712583404848,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3431486Z","2025-11-19 19:51:21.3431486Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581881343148700,18446633084042874880,18446633084042850304,140702989404080,0,132813967360,12916,132826267648,132826263552,140702989404080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3435982Z","2025-11-19 19:51:21.3435982Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",14844,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881343598200,18446633084047876096,18446633084047851520,140712899206080,0,1068179734528,9740,1068191711232,1068191707136,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3840381Z","2025-11-19 19:51:21.3840381Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8448 OneDrive.exe",12656,,," 8448 OneDrive.exe",,,,,,,,,,,,,1763581881384038100,18446633084042072064,18446633084042047488,140712859481984,0,70345129984,12656,70351060992,70351048704,140712859481984,5254774,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3990087Z","2025-11-19 19:51:21.3990087Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4784 svchost.exe",10016,,," 4784 svchost.exe",,,,,,,,,,,,,1763581881399008700,18446633084049223680,18446633084049199104,140712899206080,0,476842119168,10016,476845178880,476845146112,140712899206080,233109,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3991102Z","2025-11-19 19:51:21.3991102Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4148 svchost.exe",14944,,," 4148 svchost.exe",,,,,,,,,,,,,1763581881399110200,18446633084008603648,18446633084008579072,140712899206080,0,934391029760,14944,934392889344,934392856576,140712899206080,547695,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.3991392Z","2025-11-19 19:51:21.3991392Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4284 svchost.exe",12524,,," 4284 svchost.exe",,,,,,,,,,,,,1763581881399139300,18446633083996708864,18446633083996684288,140712899206080,0,216311418880,12524,216310611968,216310579200,140712899206080,609932,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4014776Z","2025-11-19 19:51:21.4014776Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881401477600,18446633084042072064,18446633084042047488,140712865112144,0,1068179742720,12568,1068192759808,1068192751616,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4298365Z","2025-11-19 19:51:21.4298365Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881429836500,18446633084042932224,18446633084042907648,140712371704112,0,1068179750912,4932,1068193808384,1068193804288,140712371704112,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4299053Z","2025-11-19 19:51:21.4299053Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881429905300,18446633084007337984,18446633084007313408,140712378178864,0,1068179759104,3968,1068194856960,1068194852864,140712378178864,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4330267Z","2025-11-19 19:51:21.4330267Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\apphelp.dll",,,,,,,,,,1763581881433026700,,,,,,,,,,,,,,,,,,,,,,,,,,675806,,,,,,,,,,4108425587,140712800485376,140712800485376,651264 -"2025-11-19 19:51:21.4330576Z","2025-11-19 19:51:21.4330576Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",3968,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881433057600,18446633084048162816,18446633084048138240,140712899206080,0,1068179767296,11960,1068195905536,1068195901440,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4385550Z","2025-11-19 19:51:21.4385550Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581881438555000,,,,,,,,,,,,,,,,,,,,,,,,,,761372,,,,,,,,,,71854833,140712881618944,140712881618944,737280 -"2025-11-19 19:51:21.4386944Z","2025-11-19 19:51:21.4386944Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581881438694400,,,,,,,,,,,,,,,,,,,,,,,,,,760295,,,,,,,,,,460960534,140712894529536,140712894529536,692224 -"2025-11-19 19:51:21.4388601Z","2025-11-19 19:51:21.4388601Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581881438860100,18446633083996708864,18446633083996684288,140712899206080,0,289797914624,11468,289801240576,289801236480,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4389513Z","2025-11-19 19:51:21.4389513Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581881438951300,,,,,,,,,,,,,,,,,,,,,,,,,,716301,,,,,,,,,,3291623140,140712863203328,140712863203328,679936 -"2025-11-19 19:51:21.4391936Z","2025-11-19 19:51:21.4391936Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581881439193600,,,,,,,,,,,,,,,,,,,,,,,,,,1193108,,,,,,,,,,4275633056,140712897216512,140712897216512,1146880 -"2025-11-19 19:51:21.4393533Z","2025-11-19 19:51:21.4393533Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581881439353300,18446633084049022976,18446633084048998400,140712899206080,0,289797922816,3088,289802289152,289802285056,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4394768Z","2025-11-19 19:51:21.4394768Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581881439476800,,,,,,,,,,,,,,,,,,,,,,,,,,1436013,,,,,,,,,,1441720767,140712859467776,140712859467776,1355776 -"2025-11-19 19:51:21.4394810Z","2025-11-19 19:51:21.4394810Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3348 attack-589.exe",3088,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581881439481000,18446633084049080320,18446633084049055744,140712899206080,0,289797931008,12904,289803337728,289803333632,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4397699Z","2025-11-19 19:51:21.4397699Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11468,,," 3348 attack-589.exe",,,"C:\Windows\System32\msvcp140.dll",,,,,,,,,,1763581881439769900,,,,,,,,,,,,,,,,,,,,,,,,,,570439,,,,,,,,,,1564323704,140711213137920,140711213137920,561152 -"2025-11-19 19:51:21.4397897Z","2025-11-19 19:51:21.4397897Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",3088,,," 3348 attack-589.exe",,,"C:\Windows\System32\vcruntime140_1.dll",,,,,,,,,,1763581881439789700,,,,,,,,,,,,,,,,,,,,,,,,,,57827,,,,,,,,,,240324076,140712354119680,140712354119680,49152 -"2025-11-19 19:51:21.4398073Z","2025-11-19 19:51:21.4398073Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",12904,,," 3348 attack-589.exe",,,"C:\Windows\System32\vcruntime140.dll",,,,,,,,,,1763581881439807300,,,,,,,,,,,,,,,,,,,,,,,,,,146072,,,,,,,,,,254123393,140712353988608,140712353988608,122880 -"2025-11-19 19:51:20.974665800Z","2025-11-19 19:51:21.4415712Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Injector started with PID 3348",,,,,,,,,,,1763581881441571200,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.4676380Z","2025-11-19 19:51:21.4676380Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",9740,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881467638000,18446633084049252352,18446633084049227776,140712899206080,0,1068179775488,12140,1068196954112,1068196950016,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5095245Z","2025-11-19 19:51:21.5095245Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881509524500,18446633084044570624,18446633084044546048,140712899206080,0,1068179783680,3600,1068198002688,1068197998592,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5099019Z","2025-11-19 19:51:21.5099019Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",3600,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881509901900,18446633084046180352,18446633084046155776,140712899206080,0,1068179791872,11228,1068199051264,1068199047168,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5101012Z","2025-11-19 19:51:21.5101012Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",11228,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881510101200,18446633084049424384,18446633084049399808,140712899206080,0,1068179800064,1960,1068200099840,1068200095744,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5107492Z","2025-11-19 19:51:21.5107492Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",1960,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881510749200,18446633084049453056,18446633084049428480,140712899206080,0,1068179808256,12764,1068201148416,1068201144320,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5109197Z","2025-11-19 19:51:21.5109197Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2344 WindowsTerminal.exe",12764,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581881510919700,18446633084049481728,18446633084049457152,140712899206080,0,1068179816448,14948,1068202196992,1068202192896,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5586241Z","2025-11-19 19:51:21.5586241Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3564 MsMpEng.exe",15224,,," 3564 MsMpEng.exe",,,,,,,,,,,,,1763581881558624100,18446633084048191488,18446633084048166912,140712899206080,247,273686052864,4152,273715036160,273714970624,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5586910Z","2025-11-19 19:51:21.5586910Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3564 MsMpEng.exe",15224,,," 3564 MsMpEng.exe",,,,,,,,,,,,,1763581881558691000,18446633084049653760,18446633084049629184,140712647800224,247,273686061056,6492,273715560448,273715494912,140712647800224,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5588912Z","2025-11-19 19:51:21.5588912Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3564 MsMpEng.exe",4152,,," 3564 MsMpEng.exe",,,,,,,,,,,,,1763581881558891200,18446633084049739776,18446633084049715200,140712899206080,0,273686069248,908,273716084736,273716019200,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5947441Z","2025-11-19 19:51:21.5947441Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3564 MsMpEng.exe",6492,,," 3564 MsMpEng.exe",,,,,,,,,,,,,1763581881594744200,18446633084049653760,18446633084049629184,140712647800224,247,273686061056,6492,273715560448,273715494912,140712647800224,444719,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5948825Z","2025-11-19 19:51:21.5948825Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3492 svchost.exe",5904,,," 3492 svchost.exe",,,,,,,,,,,,,1763581881594882500,18446633084049653760,18446633084049629184,140712850417280,51,390179405824,6828,390182469632,390182436864,140712850417280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5949276Z","2025-11-19 19:51:21.5949276Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8972 VBoxTray.exe",9020,,," 8972 VBoxTray.exe",,,,,,,,,,,,,1763581881594927600,18446633084049825792,18446633084049801216,140700131109808,0,471284236288,10404,471286677504,471286673408,140700131109808,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.5952887Z","2025-11-19 19:51:21.5952887Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8972 VBoxTray.exe",10404,,," 8972 VBoxTray.exe",,,,,,,,,,,,,1763581881595288800,18446633084049825792,18446633084049801216,140700131109808,0,471284236288,10404,471286677504,471286669312,140700131109808,498282,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.7341752Z","2025-11-19 19:51:21.7341752Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5492 svchost.exe",14880,,," 5492 svchost.exe",,,,,,,,,,,,,1763581881734175200,18446633083981475840,18446633083981451264,140712899206080,0,915765288960,14880,915762446336,915762413568,140712899206080,296102,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.7983187Z","2025-11-19 19:51:21.7983187Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","12224 svchost.exe",9032,,,"12224 svchost.exe",,,,,,,,,,,,,1763581881798318700,18446633084060700672,18446633084060676096,140712899206080,0,706015498240,9032,706018803712,706018770944,140712899206080,8518314,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.7983803Z","2025-11-19 19:51:21.7983803Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","12224 svchost.exe",10960,,,"12224 svchost.exe",,,,,,,,,,,,,1763581881798380300,18446633084060872704,18446633084060848128,140712899206080,0,706015514624,10960,706019852288,706019819520,140712899206080,2446520,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.8777317Z","2025-11-19 19:51:21.8777317Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","12036 svchost.exe",9152,,,"12036 svchost.exe",,,,,,,,,,,,,1763581881877731700,18446633084061933568,18446633084061908992,140712899206080,0,457933398016,9152,457937780736,457937747968,140712899206080,1219109,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.8777978Z","2025-11-19 19:51:21.8777978Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","12036 svchost.exe",1972,,,"12036 svchost.exe",,,,,,,,,,,,,1763581881877797800,18446633084061589504,18446633084061564928,140712899206080,0,457933357056,1972,457935159296,457935126528,140712899206080,44750634,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.8778273Z","2025-11-19 19:51:21.8778273Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","12036 svchost.exe",6012,,,"12036 svchost.exe",,,,,,,,,,,,,1763581881877827300,18446633084061876224,18446633084061851648,140712899206080,0,457933389824,6012,457937256448,457937223680,140712899206080,909052,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.9736609Z","2025-11-19 19:51:21.9736609Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 4608 svchost.exe",,,,,,,,,,,,,1763581881973660900,18446633084061876224,18446633084061851648,140712899206080,0,287385972736,12852,287387942912,287387910144,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.0373099Z","2025-11-19 19:51:22.0373099Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 9692 PerfWatson2.exe",9752,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,1763581882037309900,18446633084061589504,18446633084061564928,140711612509856,0,1046353248256,8132,1046352232448,1046352216064,140711612509856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.0697083Z","2025-11-19 19:51:22.0697083Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6096 svchost.exe",11408,,," 6096 svchost.exe",,,,,,,,,,,,,1763581882069708300,18446633084055818240,18446633084055793664,140712899206080,0,338489364480,11408,338488393728,338488360960,140712899206080,684617,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.1476357Z","2025-11-19 19:51:22.1476357Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9388 devenv.exe",5524,,," 9388 devenv.exe",,,,,,,,,,,,,1763581882147635700,18446633084010299392,18446633084010274816,140711613062896,0,1033376530432,5524,1033400483840,1033400401920,140711613062896,847113123,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.1480054Z","2025-11-19 19:51:22.1480054Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9388 devenv.exe",8848,,," 9388 devenv.exe",,,,,,,,,,,,,1763581882148005400,18446633084060069888,18446633084060045312,140711613062896,0,1033376243712,8848,1033378988032,1033378902016,140711613062896,697768345,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.3061593Z","2025-11-19 19:51:22.3061593Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 4440 svchost.exe",,,,,,,,,,,,,1763581882306159300,18446633084060069888,18446633084060045312,140712899206080,0,985498419200,13764,985501007872,985500975104,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.4015320Z","2025-11-19 19:51:22.4015320Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 4784 svchost.exe",,,,,,,,,,,,,1763581882401532000,18446633084010299392,18446633084010274816,140712899206080,0,476842127360,6624,476845178880,476845146112,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.4016565Z","2025-11-19 19:51:22.4016565Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 4148 svchost.exe",,,,,,,,,,,,,1763581882401656500,18446633084060872704,18446633084060848128,140712899206080,0,934391037952,15288,934392889344,934392856576,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.4017245Z","2025-11-19 19:51:22.4017245Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 4284 svchost.exe",,,,,,,,,,,,,1763581882401724500,18446633084061933568,18446633084061908992,140712899206080,0,216311427072,4948,216310611968,216310579200,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.852182900Z","2025-11-19 19:51:22.4165908Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Running 'standard' config",,,,,,,,,,,1763581882416590800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.852392100Z","2025-11-19 19:51:22.4168223Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Before starting subprocess to inject to",,,,,,,,,,,1763581882416822300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.4176543Z","2025-11-19 19:51:22.4176543Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 3348 attack-589.exe",11212,,," 1436 whoami.exe",,,"C:\Windows\System32\whoami.exe",,,,,,,,,,1763581882417654300,,,,,,,,,,,,,,134080554818530829,,,,,3396,,,,,,0,160109,"0x","","",3348,3392,3,0,0,1,3602411345,,, -"2025-11-19 19:51:22.4206852Z","2025-11-19 19:51:22.4206852Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3348 attack-589.exe",11212,,," 1436 whoami.exe",,,,,,,,,,,,,1763581882420685200,18446633084049825792,18446633084049801216,140702344617136,0,521061564416,12400,521063104512,521063096320,140702344617136,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:21.858891900Z","2025-11-19 19:51:22.4240441Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"After starting subprocess with PID 1436",,,,,,,,,,,1763581882424044100,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.5270232Z","2025-11-19 19:51:22.5270232Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2564 svchost.exe",4464,,," 2564 svchost.exe",,,,,,,,,,,,,1763581882527023200,18446633084007137280,18446633084007112704,140712899206080,0,914261585920,4464,914258788352,914258755584,140712899206080,182942,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.5270233Z","2025-11-19 19:51:22.5270233Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6028 svchost.exe",3044,,," 6028 svchost.exe",,,,,,,,,,,,,1763581882527023300,18446633084008202240,18446633084008177664,140712899206080,0,661507956736,3044,661509373952,661509341184,140712899206080,585791,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.5270234Z","2025-11-19 19:51:22.5270234Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","12708 svchost.exe",7104,,,"12708 svchost.exe",,,,,,,,,,,,,1763581882527023400,18446633083981504512,18446633083981479936,140712899206080,0,305338654720,7104,305336352768,305336320000,140712899206080,235373,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.5270347Z","2025-11-19 19:51:22.5270347Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 7916 svchost.exe",5744,,," 7916 svchost.exe",,,,,,,,,,,,,1763581882527034700,18446633084004753408,18446633084004728832,140712899206080,0,401963933696,5744,401962827776,401962795008,140712899206080,435290,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.5586311Z","2025-11-19 19:51:22.5586311Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1356 CrossDeviceResume.exe",14964,,," 1356 CrossDeviceResume.exe",,,,,,,,,,,,,1763581882558631100,18446633083982278656,18446633083982254080,140712899206080,0,401574907904,14964,399433007104,399433003008,140712899206080,155784,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.7344771Z","2025-11-19 19:51:22.7344771Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 5492 svchost.exe",,,,,,,,,,,,,1763581882734477100,18446633084060700672,18446633084060676096,140712899206080,0,915765297152,2416,915762446336,915762413568,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.7967772Z","2025-11-19 19:51:22.7967772Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",6292,,," 5184 explorer.exe",,,,,,,,,,,,,1763581882796777200,18446633083982278656,18446633083982254080,140712899206080,0,15294464,13628,470876160,470818816,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.8136763Z","2025-11-19 19:51:22.8136763Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"12224 svchost.exe",,,,,,,,,,,,,1763581882813676300,18446633084048994304,18446633084048969728,140712899206080,0,706015555584,2892,706017230848,706017198080,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.8936636Z","2025-11-19 19:51:22.8936636Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"12036 svchost.exe",,,,,,,,,,,,,1763581882893663600,18446633084049969152,18446633084049944576,140712899206080,0,457933406208,2408,457931489280,457931456512,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.9405137Z","2025-11-19 19:51:22.9405137Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1744 svchost.exe",6132,,," 1744 svchost.exe",,,,,,,,,,,,,1763581882940513700,18446633083994210304,18446633083994185728,140712899206080,0,481879539712,6132,481878671360,481878638592,140712899206080,362866,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.9405682Z","2025-11-19 19:51:22.9405682Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1288 mmc.exe",10868,,," 1288 mmc.exe",,,,,,,,,,,,,1763581882940568200,18446633084007137280,18446633084007112704,140711612509856,0,7143424,14856,82575360,82493440,140711612509856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.0825789Z","2025-11-19 19:51:23.0825789Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 6096 svchost.exe",,,,,,,,,,,,,1763581883082578900,18446633083994210304,18446633083994185728,140712899206080,0,338489372672,15276,338488393728,338488360960,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.1468947Z","2025-11-19 19:51:23.1468947Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1520 powershell.exe",14016,,," 1520 powershell.exe",,,,,,,,,,,,,1763581883146894700,18446633084033425408,18446633084033400832,140711613062896,0,931706298368,14016,931709583360,931709571072,140711613062896,897359,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.1469567Z","2025-11-19 19:51:23.1469567Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1520 powershell.exe",7828,,," 1520 powershell.exe",,,,,,,,,,,,,1763581883146956700,18446633084032733184,18446633084032708608,140711613062896,0,931706281984,7828,931709059072,931709046784,140711613062896,2453686,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.2263639Z","2025-11-19 19:51:23.2263639Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8984 svchost.exe",12448,,," 8984 svchost.exe",,,,,,,,,,,,,1763581883226363900,18446633084008632320,18446633084008607744,140712899206080,0,213146189824,12448,213148762112,213148729344,140712899206080,610310,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.737817600Z","2025-11-19 19:51:23.4006311Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Before opening process handle",,,,,,,,,,,1763581883400631100,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:22.738077500Z","2025-11-19 19:51:23.4009294Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"After opening process handle",,,,,,,,,,,1763581883400929400,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.5280186Z","2025-11-19 19:51:23.5280186Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 6028 svchost.exe",,,,,,,,,,,,,1763581883528018700,18446633084050083840,18446633084050059264,140712899206080,0,661507964928,5984,661509373952,661509341184,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.5280753Z","2025-11-19 19:51:23.5280753Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 2564 svchost.exe",,,,,,,,,,,,,1763581883528075300,18446633084033425408,18446633084033400832,140712899206080,0,914261594112,8752,914258788352,914258755584,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.5282059Z","2025-11-19 19:51:23.5282059Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"12708 svchost.exe",,,,,,,,,,,,,1763581883528205900,18446633084050112512,18446633084050087936,140712899206080,0,305338662912,14960,305336352768,305336320000,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.5283076Z","2025-11-19 19:51:23.5283076Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 7916 svchost.exe",,,,,,,,,,,,,1763581883528307600,18446633084050141184,18446633084050116608,140712899206080,0,401963941888,14924,401962827776,401962795008,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.5439313Z","2025-11-19 19:51:23.5439313Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9832 svchost.exe",12936,,," 9832 svchost.exe",,,,,,,,,,,,,1763581883543931300,18446633084008488960,18446633084008464384,140712899206080,0,234793099264,12936,234792878080,234792845312,140712899206080,581642,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.5439491Z","2025-11-19 19:51:23.5439491Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9184 svchost.exe",10120,,," 9184 svchost.exe",,,,,,,,,,,,,1763581883543949100,18446633084007596032,18446633084007571456,140712899206080,0,580428570624,10120,580430856192,580430823424,140712899206080,265172,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.5441731Z","2025-11-19 19:51:23.5441731Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",8132,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,1763581883544173100,18446633084061589504,18446633084061564928,140711612509856,0,1046353248256,8132,1046352232448,1046352216064,140711612509856,1009010,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.5598467Z","2025-11-19 19:51:23.5598467Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1356 CrossDeviceResume.exe",,,,,,,,,,,,,1763581883559846700,18446633084061589504,18446633084061564928,140712899206080,0,401574932480,6020,399433007104,399433003008,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.8464387Z","2025-11-19 19:51:23.8464387Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6588 Widgets.exe",9292,,," 6588 Widgets.exe",,,,,,,,,,,,,1763581883846438700,18446633084009119744,18446633084009095168,140712899206080,0,120133607424,9292,120137449472,120137445376,140712899206080,571457,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.9424379Z","2025-11-19 19:51:23.9424379Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","11528 msedgewebview2.exe",11184,,,"11528 msedgewebview2.exe",,,,,,,,,,,,,1763581883942437900,18446633084001447936,18446633084001423360,140712899206080,0,473244606464,11184,473262194688,473262186496,140712899206080,36366232,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.9425488Z","2025-11-19 19:51:23.9425488Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1744 svchost.exe",,,,,,,,,,,,,1763581883942548800,18446633084009119744,18446633084009095168,140712899206080,0,481879547904,14720,481878671360,481878638592,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.0224211Z","2025-11-19 19:51:24.0224211Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6904 WidgetService.exe",5232,,," 6904 WidgetService.exe",,,,,,,,,,,,,1763581884022421100,18446633084009377792,18446633084009353216,140712899206080,0,274672095232,5232,274673434624,274673430528,140712899206080,283654,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.1338922Z","2025-11-19 19:51:24.1338922Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9324 msedgewebview2.exe",3756,,," 9324 msedgewebview2.exe",,,,,,,,,,,,,1763581884133892200,18446633084009492480,18446633084009467904,140712899206080,0,717035753472,3756,717054017536,717054013440,140712899206080,302513,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.2294186Z","2025-11-19 19:51:24.2294186Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 8984 svchost.exe",,,,,,,,,,,,,1763581884229418600,18446633084008488960,18446633084008464384,140712899206080,0,213146198016,11968,213148762112,213148729344,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.2770172Z","2025-11-19 19:51:24.2770172Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6500 SearchHost.exe",14416,,," 6500 SearchHost.exe",,,,,,,,,,,,,1763581884277017200,18446633084041756672,18446633084041732096,140712449945792,0,1050565771264,14416,1050568294400,1050568228864,140712449945792,1313034,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.2771868Z","2025-11-19 19:51:24.2771868Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6500 SearchHost.exe",11280,,," 6500 SearchHost.exe",,,,,,,,,,,,,1763581884277186800,18446633084041756672,18446633084041732096,140712449945792,0,1050565779456,14564,1050568294400,1050568228864,140712449945792,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.3409661Z","2025-11-19 19:51:24.3409661Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3540 svchost.exe",9968,,," 3540 svchost.exe",,,,,,,,,,,,,1763581884340966100,18446633084035059712,18446633084035035136,140711742624160,249,589657714688,9968,589661470720,589661437952,140711742624160,391728995,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.3409681Z","2025-11-19 19:51:24.3409681Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3540 svchost.exe",1184,,," 3540 svchost.exe",,,,,,,,,,,,,1763581884340968100,18446633084035031040,18446633084035006464,140711742624160,249,589657706496,1184,589660946432,589660913664,140711742624160,10633090708,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.612812600Z","2025-11-19 19:51:24.3728485Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Before allocating memory for shellcode",,,,,,,,,,,1763581884372848500,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:23.613174800Z","2025-11-19 19:51:24.3732488Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"After allocating memory for shellcode at 000001FF40840000",,,,,,,,,,,1763581884373248800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.4527822Z","2025-11-19 19:51:24.4527822Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6424 msedgewebview2.exe",9252,,," 6424 msedgewebview2.exe",,,,,,,,,,,,,1763581884452782200,18446633084056793088,18446633084056768512,140712899206080,0,795610513408,9252,795628011520,795628007424,140712899206080,13231797,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.4528000Z","2025-11-19 19:51:24.4528000Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1768 msedgewebview2.exe",7724,,," 1768 msedgewebview2.exe",,,,,,,,,,,,,1763581884452800000,18446633084009091072,18446633084009066496,140712899206080,0,1047163273216,7724,1047324000256,1047323996160,140712899206080,493756,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.5476392Z","2025-11-19 19:51:24.5476392Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9832 svchost.exe",,,,,,,,,,,,,1763581884547639200,18446633084050571264,18446633084050546688,140712899206080,0,234793107456,4980,234792878080,234792845312,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.5476971Z","2025-11-19 19:51:24.5476971Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9184 svchost.exe",,,,,,,,,,,,,1763581884547697100,18446633084009091072,18446633084009066496,140712899206080,0,580428578816,15320,580430856192,580430823424,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.8347452Z","2025-11-19 19:51:24.8347452Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3628 msedgewebview2.exe",2068,,," 3628 msedgewebview2.exe",,,,,,,,,,,,,1763581884834745200,18446633084009865216,18446633084009840640,140712899206080,0,1084563218432,2068,1084732997632,1084732993536,140712899206080,442456,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.8509683Z","2025-11-19 19:51:24.8509683Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 6588 Widgets.exe",,,,,,,,,,,,,1763581884850968300,18446633084009865216,18446633084009840640,140712899206080,0,120133615616,10764,120137449472,120137445376,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.9462310Z","2025-11-19 19:51:24.9462310Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"11528 msedgewebview2.exe",,,,,,,,,,,,,1763581884946231000,18446633084050599936,18446633084050575360,140712899206080,0,473244639232,14000,473262194688,473262190592,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.9464943Z","2025-11-19 19:51:24.9464943Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1288 mmc.exe",14856,,," 1288 mmc.exe",,,,,,,,,,,,,1763581884946494300,18446633084007137280,18446633084007112704,140711612509856,0,7143424,14856,82575360,82493440,140711612509856,1574057,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.0259698Z","2025-11-19 19:51:25.0259698Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 6904 WidgetService.exe",,,,,,,,,,,,,1763581885025969800,18446633084007137280,18446633084007112704,140712899206080,0,274672103424,12200,274673434624,274673430528,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.1377420Z","2025-11-19 19:51:25.1377420Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9324 msedgewebview2.exe",,,,,,,,,,,,,1763581885137742000,18446633083981475840,18446633083981451264,140712899206080,0,717035761664,1928,717054017536,717054013440,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.486948200Z","2025-11-19 19:51:25.3441106Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Before writing shellcode to process",,,,,,,,,,,1763581885344110600,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:24.487258200Z","2025-11-19 19:51:25.3444526Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"After writing shellcode to process at 000001FF40840000",,,,,,,,,,,1763581885344452600,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.4554544Z","2025-11-19 19:51:25.4554544Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1768 msedgewebview2.exe",,,,,,,,,,,,,1763581885455454400,18446633084050857984,18446633084050833408,140712899206080,0,1047163281408,12460,1047324000256,1047323996160,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.4555172Z","2025-11-19 19:51:25.4555172Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 6424 msedgewebview2.exe",,,,,,,,,,,,,1763581885455517200,18446633084051030016,18446633084051005440,140712899206080,0,795610558464,744,795628011520,795628007424,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.4882512Z","2025-11-19 19:51:25.4882512Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8268 svchost.exe",14888,,," 8268 svchost.exe",,,,,,,,,,,,,1763581885488251200,18446633083999670272,18446633083999645696,140712899206080,0,178507935744,14888,178510102528,178510069760,140712899206080,379840,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.8389195Z","2025-11-19 19:51:25.8389195Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3628 msedgewebview2.exe",,,,,,,,,,,,,1763581885838919500,18446633084050169856,18446633084050145280,140712899206080,0,1084563226624,2912,1084732997632,1084732993536,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.9987993Z","2025-11-19 19:51:25.9987993Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13112 TimelineExplorer.exe",13516,,,"13112 TimelineExplorer.exe",,,,,,,,,,,,,1763581885998799300,18446633083996135424,18446633083996110848,140712899206080,0,1007263227904,13516,1007289368576,1007289360384,140712899206080,343629,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.9989283Z","2025-11-19 19:51:25.9989283Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13112 TimelineExplorer.exe",10004,,,"13112 TimelineExplorer.exe",,,,,,,,,,,,,1763581885998928300,18446633084056133632,18446633084056109056,140712899206080,0,1007263203328,10004,1007284649984,1007284637696,140712899206080,1595177,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:26.0638848Z","2025-11-19 19:51:26.0638848Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5184 explorer.exe",5116,,," 5184 explorer.exe",,,,,,,,,,,,,1763581886063884800,18446633084043362304,18446633084043337728,140712891545280,0,15286272,5116,467664896,467607552,140712891545280,69722029,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:26.0786440Z","2025-11-19 19:51:26.0786440Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 9920 ServiceHub.IntellicodeModelService.exe",9760,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,1763581886078644000,18446633084043362304,18446633084043337728,140711612509856,0,46014316544,11908,46012694528,46012678144,140711612509856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.362253700Z","2025-11-19 19:51:26.3166701Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Before changing memory protection to PAGE_EXECUTE_READ",,,,,,,,,,,1763581886316670100,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:25.362529500Z","2025-11-19 19:51:26.3169751Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"After changing memory protection to PAGE_EXECUTE_READ",,,,,,,,,,,1763581886316975100,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:26.4924720Z","2025-11-19 19:51:26.4924720Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 8268 svchost.exe",,,,,,,,,,,,,1763581886492472000,18446633084051116032,18446633084051091456,140712899206080,0,178507943936,4236,178510102528,178510069760,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:26.6059639Z","2025-11-19 19:51:26.6059639Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8972 VBoxTray.exe",9020,,," 8972 VBoxTray.exe",,,,,,,,,,,,,1763581886605964000,18446633084051144704,18446633084051120128,140700131109808,0,471284244480,3136,471286677504,471286673408,140700131109808,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:26.6062393Z","2025-11-19 19:51:26.6062393Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8972 VBoxTray.exe",3136,,," 8972 VBoxTray.exe",,,,,,,,,,,,,1763581886606239300,18446633084051144704,18446633084051120128,140700131109808,0,471284244480,3136,471286677504,471286669312,140700131109808,649161,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:26.7793053Z","2025-11-19 19:51:26.7793053Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5184 explorer.exe",8788,,," 5184 explorer.exe",,,,,,,,,,,,,1763581886779305300,18446633084051058688,18446633084051034112,140712891292720,0,15097856,8788,214564864,214507520,140712891292720,14753796,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:26.296106600Z","2025-11-19 19:51:27.3019664Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Before reading memory to verify write",,,,,,,,,,,1763581887301966400,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:26.296340900Z","2025-11-19 19:51:27.3022001Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Before creating remote thread",,,,,,,,,,,1763581887302200100,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3024711Z","2025-11-19 19:51:27.3024711Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3348 attack-589.exe",11212,,," 1436 whoami.exe",,,,,,,,,,,,,1763581887302471100,18446633084051144704,18446633084051120128,2195810680832,0,521061572608,6380,521063628800,521063620608,2195810680832,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:26.296634600Z","2025-11-19 19:51:27.3024967Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"After creating remote thread",,,,,,,,,,,1763581887302496700,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3025746Z","2025-11-19 19:51:27.3025746Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\whoami.exe",,,,,,,,,,1763581887302574600,,,,,,,,,,,,,,,,,,,,,,,,,,160109,,,,,,,,,,3602411345,140702344609792,140702344609792,98304 -"2025-11-19 19:51:27.3026097Z","2025-11-19 19:51:27.3026097Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581887302609700,,,,,,,,,,,,,,,,,,,,,,,,,,2537167,,,,,,,,,,2626650689,140712898723840,140712898723840,2523136 -"2025-11-19 19:51:27.3056213Z","2025-11-19 19:51:27.3056213Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581887305621300,,,,,,,,,,,,,,,,,,,,,,,,,,885660,,,,,,,,,,2913437033,140712877621248,140712877621248,823296 -"2025-11-19 19:51:27.3057466Z","2025-11-19 19:51:27.3057466Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581887305746600,,,,,,,,,,,,,,,,,,,,,,,,,,4209945,,,,,,,,,,2980330054,140712854355968,140712854355968,4161536 -"2025-11-19 19:51:27.3071785Z","2025-11-19 19:51:27.3071785Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\apphelp.dll",,,,,,,,,,1763581887307178500,,,,,,,,,,,,,,,,,,,,,,,,,,675806,,,,,,,,,,4108425587,140712800485376,140712800485376,651264 -"2025-11-19 19:51:27.3090501Z","2025-11-19 19:51:27.3090501Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581887309050100,,,,,,,,,,,,,,,,,,,,,,,,,,761372,,,,,,,,,,71854833,140712881618944,140712881618944,737280 -"2025-11-19 19:51:27.3091555Z","2025-11-19 19:51:27.3091555Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581887309155600,,,,,,,,,,,,,,,,,,,,,,,,,,760295,,,,,,,,,,460960534,140712894529536,140712894529536,692224 -"2025-11-19 19:51:27.3092448Z","2025-11-19 19:51:27.3092448Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,,,,,,,,,,,1763581887309244800,18446633084051173376,18446633084051148800,140712899206080,0,521061580800,8880,521064153088,521064144896,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3093136Z","2025-11-19 19:51:27.3093136Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581887309313600,,,,,,,,,,,,,,,,,,,,,,,,,,716301,,,,,,,,,,3291623140,140712863203328,140712863203328,679936 -"2025-11-19 19:51:27.3095347Z","2025-11-19 19:51:27.3095347Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581887309534700,,,,,,,,,,,,,,,,,,,,,,,,,,1193108,,,,,,,,,,4275633056,140712897216512,140712897216512,1146880 -"2025-11-19 19:51:27.3096825Z","2025-11-19 19:51:27.3096825Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,1763581887309682500,,,,,,,,,,,,,,,,,,,,,,,,,,1923284,,,,,,,,,,675224942,140712888827904,140712888827904,1863680 -"2025-11-19 19:51:27.3096888Z","2025-11-19 19:51:27.3096888Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1436 whoami.exe",8880,,," 1436 whoami.exe",,,,,,,,,,,,,1763581887309688800,18446633084051230720,18446633084051206144,140712899206080,0,521061588992,12688,521064677376,521064669184,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3098080Z","2025-11-19 19:51:27.3098080Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3564 MsMpEng.exe",15224,,," 3564 MsMpEng.exe",,,,,,,,,,,,,1763581887309808100,18446633084051259392,18446633084051234816,140712899206080,247,273686077440,11372,273715560448,273715494912,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3099257Z","2025-11-19 19:51:27.3099257Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,1763581887309925700,,,,,,,,,,,,,,,,,,,,,,,,,,230350,,,,,,,,,,2551303736,140712858550272,140712858550272,159744 -"2025-11-19 19:51:27.3101194Z","2025-11-19 19:51:27.3101194Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,1763581887310119400,,,,,,,,,,,,,,,,,,,,,,,,,,230873,,,,,,,,,,527442843,140712882405376,140712882405376,176128 -"2025-11-19 19:51:27.3102504Z","2025-11-19 19:51:27.3102504Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,1763581887310250400,,,,,,,,,,,,,,,,,,,,,,,,,,1243850,,,,,,,,,,792084382,140712861433856,140712861433856,1228800 -"2025-11-19 19:51:27.3103899Z","2025-11-19 19:51:27.3103899Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581887310389900,,,,,,,,,,,,,,,,,,,,,,,,,,700029,,,,,,,,,,3371602543,140712858746880,140712858746880,667648 -"2025-11-19 19:51:27.3105193Z","2025-11-19 19:51:27.3105193Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581887310519300,,,,,,,,,,,,,,,,,,,,,,,,,,1436013,,,,,,,,,,1441720767,140712859467776,140712859467776,1355776 -"2025-11-19 19:51:27.3107041Z","2025-11-19 19:51:27.3107041Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,,,,,,,,,,,1763581887310704100,18446633084051288064,18446633084051263488,140712899206080,0,521061597184,1528,521065201664,521065193472,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3108191Z","2025-11-19 19:51:27.3108191Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\ws2_32.dll",,,,,,,,,,1763581887310819100,,,,,,,,,,,,,,,,,,,,,,,,,,513405,,,,,,,,,,3967481067,140712881094656,140712881094656,475136 -"2025-11-19 19:51:27.3111648Z","2025-11-19 19:51:27.3111648Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\wkscli.dll",,,,,,,,,,1763581887311164800,,,,,,,,,,,,,,,,,,,,,,,,,,170846,,,,,,,,,,1225555544,140712738291712,140712738291712,110592 -"2025-11-19 19:51:27.3111762Z","2025-11-19 19:51:27.3111762Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",1528,,," 1436 whoami.exe",,,"C:\Windows\System32\version.dll",,,,,,,,,,1763581887311176200,,,,,,,,,,,,,,,,,,,,,,,,,,72452,,,,,,,,,,2275202464,140712753168384,140712753168384,45056 -"2025-11-19 19:51:27.3111842Z","2025-11-19 19:51:27.3111842Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",12688,,," 1436 whoami.exe",,,"C:\Windows\System32\authz.dll",,,,,,,,,,1763581887311184200,,,,,,,,,,,,,,,,,,,,,,,,,,372179,,,,,,,,,,771731569,140712826241024,140712826241024,327680 -"2025-11-19 19:51:27.3111842Z","2025-11-19 19:51:27.3111842Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",8880,,," 1436 whoami.exe",,,"C:\Windows\System32\sspicli.dll",,,,,,,,,,1763581887311184200,,,,,,,,,,,,,,,,,,,,,,,,,,339222,,,,,,,,,,3030302172,140712833384448,140712833384448,299008 -"2025-11-19 19:51:27.3115813Z","2025-11-19 19:51:27.3115813Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\netutils.dll",,,,,,,,,,1763581887311581300,,,,,,,,,,,,,,,,,,,,,,,,,,80696,,,,,,,,,,865845000,140712825847808,140712825847808,53248 -"2025-11-19 19:51:27.3132484Z","2025-11-19 19:51:27.3132484Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,1763581887313248400,,,,,,,,,,,,,,,,,,,,,,,,,,233556,,,,,,,,,,1625678811,140712882601984,140712882601984,200704 -"2025-11-19 19:51:27.3158199Z","2025-11-19 19:51:27.3158199Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1436 whoami.exe",6380,,,"11148 calc.exe",,,"C:\Windows\System32\calc.exe",,,,,,,,,,1763581887315819900,,,,,,,,,,,,,,134080554863097645,,,,,3397,,,,,,0,90741,"0x","","",1436,3396,3,0,0,1,4001445627,,, -"2025-11-19 19:51:27.3177666Z","2025-11-19 19:51:27.3177666Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4372 vctip.exe",12540,,," 4372 vctip.exe",,,,,,,,,,,,,1763581887317766600,18446633084051431424,18446633084051406848,140711613062896,0,740355272704,8244,740356521984,740356513792,140711613062896,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3178282Z","2025-11-19 19:51:27.3178282Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4372 vctip.exe",12540,,," 4372 vctip.exe",,,,,,,,,,,,,1763581887317828200,18446633084051488768,18446633084051464192,140711612509856,0,740355280896,3948,740352917504,740352909312,140711612509856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3181875Z","2025-11-19 19:51:27.3181875Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4372 vctip.exe",8244,,," 4372 vctip.exe",,,,,,,,,,,,,1763581887318187500,18446633084051517440,18446633084051492864,140711613062896,0,740355289088,8128,740357570560,740357562368,140711613062896,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3182888Z","2025-11-19 19:51:27.3182888Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4372 vctip.exe",8244,,," 4372 vctip.exe",,,,,,,,,,,,,1763581887318288800,18446633084051546112,18446633084051521536,140711613062896,0,740355297280,6044,740358619136,740358610944,140711613062896,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3183397Z","2025-11-19 19:51:27.3183397Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1436 whoami.exe",6380,,,"11148 calc.exe",,,,,,,,,,,,,1763581887318339700,18446633084051058688,18446633084051034112,140696878126912,0,728547835904,4224,728545624064,728545615872,140696878126912,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3194990Z","2025-11-19 19:51:27.3194990Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4372 vctip.exe",8244,,," 4372 vctip.exe",,,,,,,,,,,,,1763581887319499000,18446633084051603456,18446633084051578880,140711613062896,0,740355305472,14984,740361764864,740361756672,140711613062896,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3250774Z","2025-11-19 19:51:27.3250774Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11148 calc.exe",4224,,,"11148 calc.exe",,,,,,,,,,,,,1763581887325077400,18446633084051718144,18446633084051693568,140712899206080,0,728547844096,5464,728546148352,728546140160,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3251688Z","2025-11-19 19:51:27.3251688Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11148 calc.exe",5464,,,"11148 calc.exe",,,,,,,,,,,,,1763581887325168800,18446633084051746816,18446633084051722240,140712899206080,0,728547852288,12924,728549031936,728549023744,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3258220Z","2025-11-19 19:51:27.3258220Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11148 calc.exe",5464,,,"11148 calc.exe",,,,,,,,,,,,,1763581887325822000,18446633084051804160,18446633084051779584,140712899206080,0,728547860480,14656,728549556224,728549548032,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3319762Z","2025-11-19 19:51:27.3319762Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11148 calc.exe",4224,,,"11148 calc.exe",,,,,,,,,,,,,1763581887331976200,18446633084051861504,18446633084051836928,140712891545280,0,728547868672,8768,728550080512,728550072320,140712891545280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3324057Z","2025-11-19 19:51:27.3324057Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1436 whoami.exe",12688,,," 1436 whoami.exe",,,,,,,,,,,,,1763581887332405700,18446633084051230720,18446633084051206144,140712899206080,0,521061588992,12688,521064677376,521064669184,140712899206080,4300456,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3324064Z","2025-11-19 19:51:27.3324064Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1436 whoami.exe",12400,,," 1436 whoami.exe",,,,,,,,,,,,,1763581887332406400,18446633084049825792,18446633084049801216,140702344617136,0,521061564416,12400,521063104512,521063096320,140702344617136,33571,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3324102Z","2025-11-19 19:51:27.3324102Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1436 whoami.exe",8880,,," 1436 whoami.exe",,,,,,,,,,,,,1763581887332410200,18446633084051173376,18446633084051148800,140712899206080,0,521061580800,8880,521064153088,521064144896,140712899206080,4289897,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3324118Z","2025-11-19 19:51:27.3324118Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1436 whoami.exe",1528,,," 1436 whoami.exe",,,,,,,,,,,,,1763581887332411800,18446633084051288064,18446633084051263488,140712899206080,0,521061597184,1528,521065201664,521065193472,140712899206080,2544210,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3353689Z","2025-11-19 19:51:27.3353689Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1016 services.exe",15196,,,"13688 svchost.exe",,,"C:\Windows\System32\svchost.exe",,,,,,,,,,1763581887335369000,,,,,,,,,,,,,,134080554863291166,,,,,3398,,,,,,0,143552,"0x","","",1016,11,1,1,0,0,14788416,,, -"2025-11-19 19:51:27.3360542Z","2025-11-19 19:51:27.3360542Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1016 services.exe",15196,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887336054200,18446633084051230720,18446633084051206144,140696171073504,0,780822601728,14412,780821725184,780821708800,140696171073504,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3416650Z","2025-11-19 19:51:27.3416650Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13688 svchost.exe",14412,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887341665000,18446633084049825792,18446633084049801216,140712899206080,0,780822609920,9652,780824739840,780824707072,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3436525Z","2025-11-19 19:51:27.3436525Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887343652500,18446633084051288064,18446633084051263488,140712899206080,0,780822618112,628,780825264128,780825231360,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3437598Z","2025-11-19 19:51:27.3437598Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13688 svchost.exe",14412,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887343759800,18446633084051173376,18446633084051148800,140712863364608,0,780822626304,12520,780825788416,780825755648,140712863364608,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3442471Z","2025-11-19 19:51:27.3442471Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13688 svchost.exe",9652,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887344247200,18446633084051918848,18446633084051894272,140712899206080,0,780822634496,6208,780826312704,780826279936,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3443117Z","2025-11-19 19:51:27.3443117Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13688 svchost.exe",6208,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887344311700,18446633084051976192,18446633084051951616,140712899206080,0,780822642688,14796,780826836992,780826804224,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3477126Z","2025-11-19 19:51:27.3477126Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13688 svchost.exe",12520,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887347712600,18446633084052119552,18446633084052094976,140709772859968,243,780822650880,1108,780827361280,780827328512,140709772859968,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3481994Z","2025-11-19 19:51:27.3481994Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13688 svchost.exe",12520,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887348199400,18446633084052148224,18446633084052123648,140709772762688,243,780822659072,15312,780827885568,780827852800,140709772762688,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3484052Z","2025-11-19 19:51:27.3484052Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13688 svchost.exe",12520,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887348405200,18446633084051173376,18446633084051148800,140712863364608,0,780822626304,12520,780825788416,780825755648,140712863364608,10191193,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3571880Z","2025-11-19 19:51:27.3571880Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start ","13688 svchost.exe",628,,," 3864 WerFault.exe",,,"C:\Windows\System32\WerFault.exe",,,,,,,,,,1763581887357188000,,,,,,,,,,,,,,134080554863507391,,,,,3399,,,,,,0,681036,"0x","","",13688,3398,1,1,0,0,630084362,,, -"2025-11-19 19:51:27.3587974Z","2025-11-19 19:51:27.3587974Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13688 svchost.exe",628,,," 3864 WerFault.exe",,,,,,,,,,,,,1763581887358797400,18446633084051173376,18446633084051148800,140702556693600,243,400613777408,2088,400611737600,400611729408,140702556693600,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3643485Z","2025-11-19 19:51:27.3643485Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,,,,,,,,,,,1763581887364348500,18446633084052176896,18446633084052152320,140712899206080,0,400613785600,7460,400612261888,400612253696,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3644418Z","2025-11-19 19:51:27.3644418Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3864 WerFault.exe",7460,,," 3864 WerFault.exe",,,,,,,,,,,,,1763581887364441800,18446633084052205568,18446633084052180992,140712899206080,0,400613793792,9616,400615276544,400615268352,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3649326Z","2025-11-19 19:51:27.3649326Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3864 WerFault.exe",9616,,," 3864 WerFault.exe",,,,,,,,,,,,,1763581887364932600,18446633084052320256,18446633084052295680,140712899206080,0,400613801984,15292,400615800832,400615792640,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3649542Z","2025-11-19 19:51:27.3649542Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11148 calc.exe",8768,,,"11148 calc.exe",,,,,,,,,,,,,1763581887364954200,18446633084052348928,18446633084052324352,140712865112144,0,728547876864,13680,728550604800,728550596608,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3651576Z","2025-11-19 19:51:27.3651576Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"11148 calc.exe",,,,,,,,,,,,,1763581887365157600,18446633084052377600,18446633084052353024,140712899206080,0,728547885056,4656,728551129088,728551120896,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3652972Z","2025-11-19 19:51:27.3652972Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","11148 calc.exe",4656,,,"11148 calc.exe",,,,,,,,,,,,,1763581887365297200,18446633084052406272,18446633084052381696,140712899206080,0,728547893248,11220,728551653376,728551645184,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3655048Z","2025-11-19 19:51:27.3655048Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",4600,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,1763581887365504800,18446633084039716864,18446633084039692288,140711613062896,0,1046353240064,4600,1046401253376,1046401236992,140711613062896,1088976,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3662762Z","2025-11-19 19:51:27.3662762Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887366276200,18446633084039716864,18446633084039692288,140712899206080,0,780822667264,13720,780825788416,780825755648,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3812649Z","2025-11-19 19:51:27.3812649Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",14368,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,1763581887381264900,18446633084052434944,18446633084052410368,140712891545280,0,199839866880,11156,199839318016,199839309824,140712891545280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3823710Z","2025-11-19 19:51:27.3823710Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3532 svchost.exe",,,,,,,,,,,,,1763581887382371000,18446633084052578304,18446633084052553728,140712899206080,0,761505034240,3332,761506824192,761506791424,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3824362Z","2025-11-19 19:51:27.3824362Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4404 svchost.exe",12560,,," 4404 svchost.exe",,,,,,,,,,,,,1763581887382436200,18446633084052750336,18446633084052725760,140712865112144,98,679905837056,13712,679909261312,679909228544,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3862869Z","2025-11-19 19:51:27.3862869Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3864 WerFault.exe",9616,,," 3864 WerFault.exe",,,,,,,,,,,,,1763581887386286900,18446633084052205568,18446633084052180992,140712899206080,0,400613793792,9616,400615276544,400615264256,140712899206080,6645135,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3862920Z","2025-11-19 19:51:27.3862920Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3864 WerFault.exe",15292,,," 3864 WerFault.exe",,,,,,,,,,,,,1763581887386292000,18446633084052320256,18446633084052295680,140712899206080,0,400613801984,15292,400615800832,400615792640,140712899206080,7320318,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3863070Z","2025-11-19 19:51:27.3863070Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3864 WerFault.exe",7460,,," 3864 WerFault.exe",,,,,,,,,,,,,1763581887386307000,18446633084052176896,18446633084052152320,140712899206080,0,400613785600,7460,400612261888,400612253696,140712899206080,8436825,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3868922Z","2025-11-19 19:51:27.3868922Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,,,,,,,,,,,1763581887386892200,18446633084051173376,18446633084051148800,140702556693600,0,400613777408,2088,400611737600,400611696640,140702556693600,88862289,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3874280Z","2025-11-19 19:51:27.3874280Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 3864 WerFault.exe",2088,,," 3864 WerFault.exe",,,"WerFault.exe",,,,,,,,,,1763581887387428000,,,,,,,,,,,1851392,1888256,113864608,134080554863507391,0,134080554863803366,64,0,3399,1,5,1,0,0,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3884600Z","2025-11-19 19:51:27.3884600Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",11156,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,1763581887388460000,18446633084052320256,18446633084052295680,140712891292720,0,199839875072,10204,199842332672,199842324480,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3891231Z","2025-11-19 19:51:27.3891231Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",11156,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,1763581887389123100,18446633084051173376,18446633084051148800,140712891292720,0,199839883264,1424,199843381248,199843373056,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3897882Z","2025-11-19 19:51:27.3897882Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",15228,,," 2456 Memory Compression",,,,,,,,,,,,,1763581887389788300,18446633084052205568,18446633084052180992,18446735306729542320,0,0,11548,0,0,18446735306729542320,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3898079Z","2025-11-19 19:51:27.3898079Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",15228,,," 2456 Memory Compression",,,,,,,,,,,,,1763581887389807900,18446633084052807680,18446633084052783104,18446735306729542320,0,0,636,0,0,18446735306729542320,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3898424Z","2025-11-19 19:51:27.3898424Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",15228,,," 2456 Memory Compression",,,,,,,,,,,,,1763581887389842400,18446633084052922368,18446633084052897792,18446735306728238208,0,0,13072,0,0,18446735306728238208,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3898960Z","2025-11-19 19:51:27.3898960Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",15228,,," 2456 Memory Compression",,,,,,,,,,,,,1763581887389896000,18446633084053008384,18446633084052983808,18446735306729822480,0,0,13508,0,0,18446735306729822480,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3902495Z","2025-11-19 19:51:27.3902495Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 6028 svchost.exe",15228,,,"13736 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe\CalculatorApp.exe",,,,,,,,,,1763581887390249500,,,,,,,,,,,,,,134080554863834658,,,,,3401,,,,,,3,0,"0x","Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe","App",4340,106,3,0,0,1,1758293941,,, -"2025-11-19 19:51:27.3906927Z","2025-11-19 19:51:27.3906927Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4404 svchost.exe",11720,,," 4404 svchost.exe",,,,,,,,,,,,,1763581887390692700,18446633084053065728,18446633084053041152,140712899206080,0,679905845248,14572,679909785600,679909752832,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3912189Z","2025-11-19 19:51:27.3912189Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",15228,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887391218900,18446633084050886656,18446633084050862080,140700165242880,5,320273809408,6548,320276004864,320276000768,140700165242880,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3959109Z","2025-11-19 19:51:27.3959109Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887395910900,18446633084053323776,18446633084053299200,140712899206080,0,320273817600,14660,320277053440,320277049344,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3977969Z","2025-11-19 19:51:27.3977969Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",14660,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887397796900,18446633084053237760,18446633084053213184,140712899206080,0,320273825792,6780,320278102016,320278097920,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.3980521Z","2025-11-19 19:51:27.3980521Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887398052100,18446633084053610496,18446633084053585920,140712899206080,0,320273833984,8620,320279150592,320279146496,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4011829Z","2025-11-19 19:51:27.4011829Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start ","13688 svchost.exe",628,,," 3676 WerFault.exe",,,"C:\Windows\System32\WerFault.exe",,,,,,,,,,1763581887401182900,,,,,,,,,,,,,,134080554863942943,,,,,3402,,,,,,0,681036,"0x","","",1436,3396,3,0,0,1,630084362,,, -"2025-11-19 19:51:27.4030141Z","2025-11-19 19:51:27.4030141Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13688 svchost.exe",628,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581887403014100,18446633084051374080,18446633084051349504,140702556693600,243,859767218176,14180,859767832576,859767824384,140702556693600,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4032996Z","2025-11-19 19:51:27.4032996Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",6292,,," 5184 explorer.exe",,,,,,,,,,,,,1763581887403299600,18446633084053667840,18446633084053643264,140712891292720,0,15302656,6204,214564864,214507520,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4037373Z","2025-11-19 19:51:27.4037373Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887403737300,18446633084053696512,18446633084053671936,140712899206080,0,320273842176,9360,320280199168,320280195072,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4056941Z","2025-11-19 19:51:27.4056941Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887405694100,18446633084053839872,18446633084053815296,140711792263472,0,320273850368,10884,320281247744,320281243648,140711792263472,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4068904Z","2025-11-19 19:51:27.4068904Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581887406890400,18446633084053581824,18446633084053557248,140712899206080,0,859767226368,13460,859768356864,859768348672,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4069840Z","2025-11-19 19:51:27.4069840Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3676 WerFault.exe",13460,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581887406984000,18446633084053868544,18446633084053843968,140712899206080,0,859767234560,8356,859768881152,859768872960,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4073300Z","2025-11-19 19:51:27.4073300Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581887407330100,18446633084053897216,18446633084053872640,140712899206080,0,859767242752,11036,859769405440,859769397248,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4077531Z","2025-11-19 19:51:27.4077531Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",10204,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,1763581887407753100,18446633084053925888,18446633084053901312,140712899206080,0,199839891456,4732,199843905536,199843897344,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4109892Z","2025-11-19 19:51:27.4109892Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",1424,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,1763581887410989200,18446633084053954560,18446633084053929984,140712891292720,0,199839899648,13520,199847051264,199847043072,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4122533Z","2025-11-19 19:51:27.4122533Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887412253300,18446633084053409792,18446633084053385216,140712865112144,0,320273858560,14384,320282296320,320282288128,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4125886Z","2025-11-19 19:51:27.4125886Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",9360,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887412588700,18446633084053983232,18446633084053958656,140712899206080,0,320273866752,14544,320283344896,320283340800,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4222062Z","2025-11-19 19:51:27.4222062Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",6548,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887422206200,18446633084054126592,18446633084054102016,140712891545280,0,320273874944,7540,320284393472,320284389376,140712891545280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4302869Z","2025-11-19 19:51:27.4302869Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887430286900,18446633084053524480,18446633084053499904,140712600145104,0,320273883136,8000,320285442048,320285437952,140712600145104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4303353Z","2025-11-19 19:51:27.4303353Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887430335300,18446633084054011904,18446633084053987328,140712604173856,0,320273891328,4596,320286490624,320286486528,140712604173856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4487221Z","2025-11-19 19:51:27.4487221Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"13688 svchost.exe",,,,,,,,,,,,,1763581887448722100,18446633084054241280,18446633084054216704,140712899206080,0,780822675456,5172,780828409856,780828377088,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4535033Z","2025-11-19 19:51:27.4535033Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13736 CalculatorApp.exe",8000,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887453503300,18446633084053524480,18446633084053499904,140712600145104,0,320273883136,8000,320285442048,320285413376,140712600145104,59889936,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4549744Z","2025-11-19 19:51:27.4549744Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 7916 svchost.exe",,,,,,,,,,,,,1763581887454974400,18446633084054040576,18446633084054016000,140712899206080,0,401963950080,5540,401965842432,401965809664,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4551451Z","2025-11-19 19:51:27.4551451Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 7916 svchost.exe",5540,,," 7916 svchost.exe",,,,,,,,,,,,,1763581887455145100,18446633084054212608,18446633084054188032,140712899206080,90,401963958272,1484,401966366720,401966333952,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4578509Z","2025-11-19 19:51:27.4578509Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",6292,,," 5184 explorer.exe",,,,,,,,,,,,,1763581887457850900,18446633084053037056,18446633084053012480,140712891292720,0,15310848,3032,467664896,467607552,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4594189Z","2025-11-19 19:51:27.4594189Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887459418900,18446633084053524480,18446633084053499904,140712632221632,0,320273899520,11208,320285442048,320285437952,140712632221632,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4806572Z","2025-11-19 19:51:27.4806572Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2992 svchost.exe",14592,,," 2992 svchost.exe",,,,,,,,,,,,,1763581887480657200,18446633084053639168,18446633084053614592,140712899206080,186,170617987072,6428,170619043840,170619011072,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4833157Z","2025-11-19 19:51:27.4833157Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2960 svchost.exe",13820,,," 2960 svchost.exe",,,,,,,,,,,,,1763581887483315700,18446633084054470656,18446633084054446080,140712891292720,287,403329781760,2140,403332661248,403332628480,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4880926Z","2025-11-19 19:51:27.4880926Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2992 svchost.exe",4396,,," 2992 svchost.exe",,,,,,,,,,,,,1763581887488092600,18446633084054441984,18446633084054417408,140712899206080,186,170615898112,13424,170620092416,170620059648,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.4993768Z","2025-11-19 19:51:27.4993768Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581887499376800,18446633084054069248,18446633084054044672,140712899206080,0,859767250944,456,859769929728,859769921536,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5036392Z","2025-11-19 19:51:27.5036392Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887503639200,18446633084054880256,18446633084054855680,140712891292720,0,320273907712,14028,320287539200,320287535104,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5074843Z","2025-11-19 19:51:27.5074843Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4340 sihost.exe",4288,,," 4340 sihost.exe",,,,,,,,,,,,,1763581887507484300,18446633084054736896,18446633084054712320,140712891292720,0,645640560640,12684,645647040512,645647032320,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5249959Z","2025-11-19 19:51:27.5249959Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",8472,,," 1040 svchost.exe",,,,,,,,,,,,,1763581887524995900,18446633084054822912,18446633084054798336,140712899206080,0,256030941184,13368,256038141952,256038109184,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5251521Z","2025-11-19 19:51:27.5251521Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",14544,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887525152100,18446633084054851584,18446633084054827008,140712899206080,0,320273915904,8232,320288587776,320288583680,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5301687Z","2025-11-19 19:51:27.5301687Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887530168700,18446633084054183936,18446633084054159360,140712865112144,0,320273924096,12316,320289636352,320289628160,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5490372Z","2025-11-19 19:51:27.5490372Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",8232,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887549037200,18446633084053782528,18446633084053757952,140712899206080,0,320273932288,4792,320290684928,320290680832,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5528390Z","2025-11-19 19:51:27.5528390Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887552839000,18446633084054298624,18446633084054274048,140712297841152,0,320273940480,1904,320291733504,320291729408,140712297841152,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.5890217Z","2025-11-19 19:51:27.5890217Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9920 ServiceHub.IntellicodeModelService.exe",11908,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,1763581887589021700,18446633084043362304,18446633084043337728,140711612509856,0,46014316544,11908,46012694528,46012678144,140711612509856,1303981,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6078731Z","2025-11-19 19:51:27.6078731Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581887607873100,18446633084043362304,18446633084043337728,140712865112144,0,859767259136,7032,859770454016,859770445824,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6081019Z","2025-11-19 19:51:27.6081019Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581887608101900,18446633084054708224,18446633084054683648,140712899206080,0,859767267328,3716,859770978304,859770970112,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6082851Z","2025-11-19 19:51:27.6082851Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3676 WerFault.exe",3716,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581887608285100,18446633084054908928,18446633084054884352,140712899206080,0,859767275520,12996,859771502592,859771494400,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6552156Z","2025-11-19 19:51:27.6552156Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887655215600,18446633084054966272,18446633084054941696,140712583404848,0,320273948672,4172,320292782080,320292777984,140712583404848,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6556590Z","2025-11-19 19:51:27.6556590Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",8232,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887655659000,18446633084055023616,18446633084054999040,140712899206080,0,320273956864,11028,320293830656,320293826560,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6564440Z","2025-11-19 19:51:27.6564440Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","11148 calc.exe",8768,,,"11148 calc.exe",,,,,,,,,,,,,1763581887656444000,18446633084051861504,18446633084051836928,140712891545280,0,728547868672,8768,728550080512,728550047744,140712891545280,153309545,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6564444Z","2025-11-19 19:51:27.6564444Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","11148 calc.exe",13680,,,"11148 calc.exe",,,,,,,,,,,,,1763581887656444400,18446633084052348928,18446633084052324352,140712865112144,0,728547876864,13680,728550604800,728550596608,140712865112144,185583,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6564455Z","2025-11-19 19:51:27.6564455Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","11148 calc.exe",11220,,,"11148 calc.exe",,,,,,,,,,,,,1763581887656445500,18446633084052406272,18446633084052381696,140712899206080,0,728547893248,11220,728551653376,728551645184,140712899206080,861901,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6564455Z","2025-11-19 19:51:27.6564455Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","11148 calc.exe",4656,,,"11148 calc.exe",,,,,,,,,,,,,1763581887656445500,18446633084052377600,18446633084052353024,140712899206080,0,728547885056,4656,728551129088,728551120896,140712899206080,508465,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6564713Z","2025-11-19 19:51:27.6564713Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","11148 calc.exe",14656,,,"11148 calc.exe",,,,,,,,,,,,,1763581887656471300,18446633084051804160,18446633084051779584,140712899206080,0,728547860480,14656,728549556224,728549548032,140712899206080,2722632,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6564795Z","2025-11-19 19:51:27.6564795Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","11148 calc.exe",12924,,,"11148 calc.exe",,,,,,,,,,,,,1763581887656479500,18446633084051746816,18446633084051722240,140712899206080,0,728547852288,12924,728549031936,728549023744,140712899206080,4240860,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6564840Z","2025-11-19 19:51:27.6564840Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","11148 calc.exe",5464,,,"11148 calc.exe",,,,,,,,,,,,,1763581887656484000,18446633084051718144,18446633084051693568,140712899206080,0,728547844096,5464,728546148352,728546136064,140712899206080,6521410,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6571683Z","2025-11-19 19:51:27.6571683Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",7540,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887657168300,18446633084051861504,18446633084051836928,140712899206080,0,320273965056,13636,320294879232,320294875136,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6578769Z","2025-11-19 19:51:27.6578769Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","11148 calc.exe",4224,,,"11148 calc.exe",,,,,,,,,,,,,1763581887657876900,18446633084051058688,18446633084051034112,140696878126912,0,728547835904,4224,728545624064,728545603584,140696878126912,36933534,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.6592157Z","2025-11-19 19:51:27.6592157Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop ","11148 calc.exe",4224,,,"11148 calc.exe",,,"calc.exe",,,,,,,,,,1763581887659215700,,,,,,,,,,,3203072,3239936,214335219,134080554863097645,0,134080554866492537,116,0,3397,1,12,3,0,0,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.7973948Z","2025-11-19 19:51:27.7973948Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",9360,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887797394800,18446633084050915328,18446633084050890752,140712899206080,0,320273973248,13212,320295927808,320295923712,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.7978389Z","2025-11-19 19:51:27.7978389Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",13212,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887797838900,18446633084051058688,18446633084051034112,140712899206080,0,320273981440,2940,320296976384,320296972288,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.7980763Z","2025-11-19 19:51:27.7980763Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",2940,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887798076300,18446633084051746816,18446633084051722240,140712899206080,0,320273989632,6112,320298024960,320298020864,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.7982318Z","2025-11-19 19:51:27.7982318Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1168 svchost.exe",9264,,," 1168 svchost.exe",,,,,,,,,,,,,1763581887798231800,18446633084051718144,18446633084051693568,140712899206080,157,641014476800,8364,641021247488,641021214720,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8197198Z","2025-11-19 19:51:27.8197198Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",6112,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887819719900,18446633084052377600,18446633084052353024,140712899206080,0,320273997824,14224,320299073536,320299069440,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8199462Z","2025-11-19 19:51:27.8199462Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",14224,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887819946200,18446633084052348928,18446633084052324352,140712899206080,0,320274006016,13984,320300122112,320300118016,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8347693Z","2025-11-19 19:51:27.8347693Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",11156,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,1763581887834769300,18446633084054269952,18446633084054245376,140712891292720,0,199839907840,11824,199852294144,199852285952,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8471695Z","2025-11-19 19:51:27.8471695Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2960 svchost.exe",14536,,," 2960 svchost.exe",,,,,,,,,,,,,1763581887847169500,18446633084051804160,18446633084051779584,140712899206080,287,403329789952,4884,403333185536,403333152768,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8573941Z","2025-11-19 19:51:27.8573941Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1040 svchost.exe",13300,,," 5316 RuntimeBroker.exe",,,"C:\Windows\System32\RuntimeBroker.exe",,,,,,,,,,1763581887857394100,,,,,,,,,,,,,,134080554868459116,,,,,3403,,,,,,3,148437,"0x","Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe","runtimebroker07f4358a809ac99a64a67c1",1040,13,3,0,0,1,1175682367,,, -"2025-11-19 19:51:27.8582768Z","2025-11-19 19:51:27.8582768Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",13300,,," 5316 RuntimeBroker.exe",,,,,,,,,,,,,1763581887858276800,18446633084055273472,18446633084055248896,140699399787184,40,1098350678016,7040,1098352427008,1098352377856,140699399787184,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8666770Z","2025-11-19 19:51:27.8666770Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,,,,,,,,,,,1763581887866677000,18446633084055330816,18446633084055306240,140712899206080,0,1098350686208,9964,1098352951296,1098352902144,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8677378Z","2025-11-19 19:51:27.8677378Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,,,,,,,,,,,1763581887867737800,18446633084054499328,18446633084054474752,140712899206080,0,1098350694400,13000,1098353475584,1098353426432,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8701475Z","2025-11-19 19:51:27.8701475Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 5316 RuntimeBroker.exe",,,,,,,,,,,,,1763581887870147500,18446633084055187456,18446633084055162880,140712899206080,0,1098350702592,13676,1098353999872,1098353950720,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8702475Z","2025-11-19 19:51:27.8702475Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 5316 RuntimeBroker.exe",,,,,,,,,,,,,1763581887870247500,18446633084055359488,18446633084055334912,140712899206080,0,1098350710784,2076,1098354524160,1098354475008,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8710273Z","2025-11-19 19:51:27.8710273Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5316 RuntimeBroker.exe",13000,,," 5316 RuntimeBroker.exe",,,,,,,,,,,,,1763581887871027300,18446633084055388160,18446633084055363584,140712899206080,0,1098350718976,15148,1098355048448,1098354999296,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8753174Z","2025-11-19 19:51:27.8753174Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5316 RuntimeBroker.exe",7040,,," 5316 RuntimeBroker.exe",,,,,,,,,,,,,1763581887875317400,18446633084055416832,18446633084055392256,140712865112144,0,1098350727168,5804,1098355572736,1098355523584,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8776426Z","2025-11-19 19:51:27.8776426Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581887877642600,18446633084055445504,18446633084055420928,140712806010720,0,859767283712,4060,859772026880,859772018688,140712806010720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8781009Z","2025-11-19 19:51:27.8781009Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5316 RuntimeBroker.exe",2076,,," 5316 RuntimeBroker.exe",,,,,,,,,,,,,1763581887878100900,18446633084055474176,18446633084055449600,140712899206080,0,1098350735360,12556,1098356097024,1098356047872,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8799559Z","2025-11-19 19:51:27.8799559Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",13636,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581887879955900,18446633084055502848,18446633084055478272,140712899206080,0,320274014208,14648,320301170688,320301166592,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8855369Z","2025-11-19 19:51:27.8855369Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5316 RuntimeBroker.exe",12556,,," 5316 RuntimeBroker.exe",,,,,,,,,,,,,1763581887885536900,18446633084054413312,18446633084054388736,140712865112144,0,1098350743552,9412,1098356621312,1098356572160,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.8976135Z","2025-11-19 19:51:27.8976135Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5316 RuntimeBroker.exe",9412,,," 5316 RuntimeBroker.exe",,,,,,,,,,,,,1763581887897613500,18446633084052406272,18446633084052381696,140712891292720,0,1098350751744,2008,1098357145600,1098357096448,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9230450Z","2025-11-19 19:51:27.9230450Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6096 svchost.exe",8040,,," 6096 svchost.exe",,,,,,,,,,,,,1763581887923045000,18446633084055560192,18446633084055535616,140712899206080,25,338489380864,8508,338491342848,338491310080,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9502687Z","2025-11-19 19:51:27.9502687Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2724 svchost.exe",3692,,," 2724 svchost.exe",,,,,,,,,,,,,1763581887950268700,18446633084056133632,18446633084056109056,140712899206080,232,89489309696,7980,89491243008,89491177472,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.9503755Z","2025-11-19 19:51:27.9503755Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2724 svchost.exe",3692,,," 2724 svchost.exe",,,,,,,,,,,,,1763581887950375500,18446633084053151744,18446633084053127168,140712899206080,232,89489317888,14444,89492291584,89492258816,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.1387808Z","2025-11-19 19:51:28.1387808Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3676 WerFault.exe",3716,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581888138780800,18446633084055674880,18446633084055650304,140712899206080,0,859767291904,1844,859772551168,859772542976,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2219561Z","2025-11-19 19:51:28.2219561Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13736 CalculatorApp.exe",14224,,,"13736 CalculatorApp.exe",,,,,,,,,,,,,1763581888221956100,18446633084055703552,18446633084055678976,140712899206080,0,320274022400,8572,320302219264,320302215168,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:27.261554400Z","2025-11-19 19:51:28.2771678Z","myETW","Attack-Provider",1337,"AttackTask"," 3348 attack-589.exe",,,,,,"Attack done",,,,,,,,,,,1763581888277167800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2777846Z","2025-11-19 19:51:28.2777846Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,1763581888277784600,,,,,,,,,,,,,,,,,,,,,,,,,,158678,,,,,,,,,,3554393863,140712830631936,140712830631936,110592 -"2025-11-19 19:51:28.2782317Z","2025-11-19 19:51:28.2782317Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3348 attack-589.exe",3088,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581888278231700,18446633084049022976,18446633084048998400,140712899206080,0,289797922816,3088,289802289152,289802280960,140712899206080,2024057,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2782317Z","2025-11-19 19:51:28.2782317Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3348 attack-589.exe",12904,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581888278231700,18446633084049080320,18446633084049055744,140712899206080,0,289797931008,12904,289803337728,289803329536,140712899206080,1558590,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2782336Z","2025-11-19 19:51:28.2782336Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3348 attack-589.exe",11468,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581888278233700,18446633083996708864,18446633083996684288,140712899206080,0,289797914624,11468,289801240576,289801232384,140712899206080,3363869,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2783990Z","2025-11-19 19:51:28.2783990Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,,,,,,,,,,,1763581888278399000,18446633084044398592,18446633084044374016,140695599400816,0,289797906432,11212,289800192000,289800171520,140695599400816,64789380,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.2785133Z","2025-11-19 19:51:28.2785133Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Users\Public\Downloads\attack-589.exe",,,,,,,,,,1763581888278513300,,,,,,,,,,,,,,,,,,,,,,,,,,0,,,,,,,,,,1763491559,140695599382528,140695599382528,53248 -"2025-11-19 19:51:28.2785202Z","2025-11-19 19:51:28.2785202Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\msvcp140.dll",,,,,,,,,,1763581888278520200,,,,,,,,,,,,,,,,,,,,,,,,,,570439,,,,,,,,,,1564323704,140711213137920,140711213137920,561152 -"2025-11-19 19:51:28.2785241Z","2025-11-19 19:51:28.2785241Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\vcruntime140.dll",,,,,,,,,,1763581888278524100,,,,,,,,,,,,,,,,,,,,,,,,,,146072,,,,,,,,,,254123393,140712353988608,140712353988608,122880 -"2025-11-19 19:51:28.2785276Z","2025-11-19 19:51:28.2785276Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\vcruntime140_1.dll",,,,,,,,,,1763581888278527600,,,,,,,,,,,,,,,,,,,,,,,,,,57827,,,,,,,,,,240324076,140712354119680,140712354119680,49152 -"2025-11-19 19:51:28.2785509Z","2025-11-19 19:51:28.2785509Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\apphelp.dll",,,,,,,,,,1763581888278550900,,,,,,,,,,,,,,,,,,,,,,,,,,675806,,,,,,,,,,4108425587,140712800485376,140712800485376,651264 -"2025-11-19 19:51:28.2785585Z","2025-11-19 19:51:28.2785585Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,1763581888278558500,,,,,,,,,,,,,,,,,,,,,,,,,,158678,,,,,,,,,,3554393863,140712830631936,140712830631936,110592 -"2025-11-19 19:51:28.2785670Z","2025-11-19 19:51:28.2785670Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581888278567000,,,,,,,,,,,,,,,,,,,,,,,,,,4209945,,,,,,,,,,2980330054,140712854355968,140712854355968,4161536 -"2025-11-19 19:51:28.2785759Z","2025-11-19 19:51:28.2785759Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581888278575900,,,,,,,,,,,,,,,,,,,,,,,,,,1436013,,,,,,,,,,1441720767,140712859467776,140712859467776,1355776 -"2025-11-19 19:51:28.2785835Z","2025-11-19 19:51:28.2785835Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581888278583500,,,,,,,,,,,,,,,,,,,,,,,,,,716301,,,,,,,,,,3291623140,140712863203328,140712863203328,679936 -"2025-11-19 19:51:28.2785901Z","2025-11-19 19:51:28.2785901Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581888278590100,,,,,,,,,,,,,,,,,,,,,,,,,,885660,,,,,,,,,,2913437033,140712877621248,140712877621248,823296 -"2025-11-19 19:51:28.2786055Z","2025-11-19 19:51:28.2786055Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581888278605500,,,,,,,,,,,,,,,,,,,,,,,,,,761372,,,,,,,,,,71854833,140712881618944,140712881618944,737280 -"2025-11-19 19:51:28.2786133Z","2025-11-19 19:51:28.2786133Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581888278613300,,,,,,,,,,,,,,,,,,,,,,,,,,760295,,,,,,,,,,460960534,140712894529536,140712894529536,692224 -"2025-11-19 19:51:28.2786208Z","2025-11-19 19:51:28.2786208Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581888278620800,,,,,,,,,,,,,,,,,,,,,,,,,,1193108,,,,,,,,,,4275633056,140712897216512,140712897216512,1146880 -"2025-11-19 19:51:28.2786279Z","2025-11-19 19:51:28.2786279Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581888278627900,,,,,,,,,,,,,,,,,,,,,,,,,,2537167,,,,,,,,,,2626650689,140712898723840,140712898723840,2523136 -"2025-11-19 19:51:28.2786366Z","2025-11-19 19:51:28.2786366Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 3348 attack-589.exe",11212,,," 3348 attack-589.exe",,,"attack-589.exe",,,,,,,,,,1763581888278636600,,,,,,,,,,,958464,958464,72053875,134080554806144016,0,134080554872628582,52,9,3392,0,0,3,48,0,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.3902746Z","2025-11-19 19:51:28.3902746Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1288 mmc.exe",,,,,,,,,,,,,1763581888390274600,18446633084049080320,18446633084049055744,140712899206080,0,7151616,8412,548274176,548192256,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.3904146Z","2025-11-19 19:51:28.3904146Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4868 svchost.exe",6388,,," 4868 svchost.exe",,,,,,,,,,,,,1763581888390414600,18446633083996708864,18446633083996684288,140712899206080,0,47919407104,14244,47921496064,47921463296,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.3905737Z","2025-11-19 19:51:28.3905737Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1288 mmc.exe",8412,,," 1288 mmc.exe",,,,,,,,,,,,,1763581888390573700,18446633084049022976,18446633084048998400,140712899206080,0,7159808,7028,548798464,548716544,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.4693653Z","2025-11-19 19:51:28.4693653Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 4192 svchost.exe",,,,,,,,,,,,,1763581888469365300,18446633084055875584,18446633084055851008,140712899206080,0,330479378432,15260,330477273088,330477240320,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.4695259Z","2025-11-19 19:51:28.4695259Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4192 svchost.exe",15260,,," 4192 svchost.exe",,,,,,,,,,,,,1763581888469525900,18446633084055904256,18446633084055879680,140712899206080,0,330479386624,11272,330480222208,330480189440,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.4698578Z","2025-11-19 19:51:28.4698578Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5536 svchost.exe",7072,,," 5536 svchost.exe",,,,,,,,,,,,,1763581888469857800,18446633084055932928,18446633084055908352,140712899206080,132,151912620032,13504,151921360896,151921328128,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.8201829Z","2025-11-19 19:51:28.8201829Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4372 vctip.exe",3948,,," 4372 vctip.exe",,,,,,,,,,,,,1763581888820182900,18446633084051488768,18446633084051464192,140711612509856,0,740355280896,3948,740352917504,740352909312,140711612509856,820035,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:28.8211588Z","2025-11-19 19:51:28.8211588Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3676 WerFault.exe",4060,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581888821158800,18446633084055445504,18446633084055420928,140712806010720,0,859767283712,4060,859772026880,859771981824,140712806010720,967555353,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1636841Z","2025-11-19 19:51:29.1636841Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3676 WerFault.exe",13460,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581889163684100,18446633084053581824,18446633084053557248,140712899206080,0,859767226368,13460,859768356864,859768344576,140712899206080,11957619,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1636865Z","2025-11-19 19:51:29.1636865Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3676 WerFault.exe",8356,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581889163686500,18446633084053868544,18446633084053843968,140712899206080,0,859767234560,8356,859768881152,859768868864,140712899206080,7043082,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1636930Z","2025-11-19 19:51:29.1636930Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3676 WerFault.exe",11036,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581889163693000,18446633084053897216,18446633084053872640,140712899206080,0,859767242752,11036,859769405440,859769397248,140712899206080,9124852,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1636935Z","2025-11-19 19:51:29.1636935Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3676 WerFault.exe",7032,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581889163693500,18446633084043362304,18446633084043337728,140712865112144,0,859767259136,7032,859770454016,859770445824,140712865112144,363244,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1636952Z","2025-11-19 19:51:29.1636952Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3676 WerFault.exe",456,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581889163695300,18446633084054069248,18446633084054044672,140712899206080,0,859767250944,456,859769929728,859769921536,140712899206080,310812,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1637012Z","2025-11-19 19:51:29.1637012Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3676 WerFault.exe",3716,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581889163701200,18446633084054708224,18446633084054683648,140712899206080,0,859767267328,3716,859770978304,859770953728,140712899206080,52584328,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1637054Z","2025-11-19 19:51:29.1637054Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3676 WerFault.exe",1844,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581889163705400,18446633084055674880,18446633084055650304,140712899206080,0,859767291904,1844,859772551168,859772522496,140712899206080,16559079,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1637161Z","2025-11-19 19:51:29.1637161Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3676 WerFault.exe",12996,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581889163716100,18446633084054908928,18446633084054884352,140712899206080,0,859767275520,12996,859771502592,859771482112,140712899206080,7689979,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1651994Z","2025-11-19 19:51:29.1651994Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,,,,,,,,,,,1763581889165199400,18446633084051374080,18446633084051349504,140702556693600,0,859767218176,14180,859767832576,859767754752,140702556693600,2657930717,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1669895Z","2025-11-19 19:51:29.1669895Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 3676 WerFault.exe",14180,,," 3676 WerFault.exe",,,"WerFault.exe",,,,,,,,,,1763581889166989600,,,,,,,,,,,4272128,14024704,3739576266,134080554863942943,0,134080554881418238,203,0,3402,85,2343,3,406,81,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1675068Z","2025-11-19 19:51:29.1675068Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1660 svchost.exe",11196,,," 1660 svchost.exe",,,,,,,,,,,,,1763581889167506900,18446633084053581824,18446633084053557248,140712899206080,0,265906421760,7712,265905897472,265905864704,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1704217Z","2025-11-19 19:51:29.1704217Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,,,,,,,,,,,1763581889170421700,18446633084051144704,18446633084051120128,2195810680832,0,521061572608,6380,521063628800,521063608320,2195810680832,45706462,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1706933Z","2025-11-19 19:51:29.1706933Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\whoami.exe",,,,,,,,,,1763581889170693300,,,,,,,,,,,,,,,,,,,,,,,,,,160109,,,,,,,,,,3602411345,140702344609792,140702344609792,98304 -"2025-11-19 19:51:29.1707129Z","2025-11-19 19:51:29.1707129Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\wkscli.dll",,,,,,,,,,1763581889170712900,,,,,,,,,,,,,,,,,,,,,,,,,,170846,,,,,,,,,,1225555544,140712738291712,140712738291712,110592 -"2025-11-19 19:51:29.1707242Z","2025-11-19 19:51:29.1707242Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\version.dll",,,,,,,,,,1763581889170724200,,,,,,,,,,,,,,,,,,,,,,,,,,72452,,,,,,,,,,2275202464,140712753168384,140712753168384,45056 -"2025-11-19 19:51:29.1707328Z","2025-11-19 19:51:29.1707328Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\apphelp.dll",,,,,,,,,,1763581889170732800,,,,,,,,,,,,,,,,,,,,,,,,,,675806,,,,,,,,,,4108425587,140712800485376,140712800485376,651264 -"2025-11-19 19:51:29.1707405Z","2025-11-19 19:51:29.1707405Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\netutils.dll",,,,,,,,,,1763581889170740500,,,,,,,,,,,,,,,,,,,,,,,,,,80696,,,,,,,,,,865845000,140712825847808,140712825847808,53248 -"2025-11-19 19:51:29.1707478Z","2025-11-19 19:51:29.1707478Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\authz.dll",,,,,,,,,,1763581889170747800,,,,,,,,,,,,,,,,,,,,,,,,,,372179,,,,,,,,,,771731569,140712826241024,140712826241024,327680 -"2025-11-19 19:51:29.1707558Z","2025-11-19 19:51:29.1707558Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\sspicli.dll",,,,,,,,,,1763581889170755800,,,,,,,,,,,,,,,,,,,,,,,,,,339222,,,,,,,,,,3030302172,140712833384448,140712833384448,299008 -"2025-11-19 19:51:29.1707624Z","2025-11-19 19:51:29.1707624Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,1763581889170762400,,,,,,,,,,,,,,,,,,,,,,,,,,4209945,,,,,,,,,,2980330054,140712854355968,140712854355968,4161536 -"2025-11-19 19:51:29.1707770Z","2025-11-19 19:51:29.1707770Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,1763581889170777100,,,,,,,,,,,,,,,,,,,,,,,,,,230350,,,,,,,,,,2551303736,140712858550272,140712858550272,159744 -"2025-11-19 19:51:29.1707839Z","2025-11-19 19:51:29.1707839Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,1763581889170783900,,,,,,,,,,,,,,,,,,,,,,,,,,700029,,,,,,,,,,3371602543,140712858746880,140712858746880,667648 -"2025-11-19 19:51:29.1707901Z","2025-11-19 19:51:29.1707901Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,1763581889170790100,,,,,,,,,,,,,,,,,,,,,,,,,,1436013,,,,,,,,,,1441720767,140712859467776,140712859467776,1355776 -"2025-11-19 19:51:29.1707963Z","2025-11-19 19:51:29.1707963Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,1763581889170796400,,,,,,,,,,,,,,,,,,,,,,,,,,1243850,,,,,,,,,,792084382,140712861433856,140712861433856,1228800 -"2025-11-19 19:51:29.1708021Z","2025-11-19 19:51:29.1708021Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,1763581889170802200,,,,,,,,,,,,,,,,,,,,,,,,,,716301,,,,,,,,,,3291623140,140712863203328,140712863203328,679936 -"2025-11-19 19:51:29.1708087Z","2025-11-19 19:51:29.1708087Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,1763581889170808700,,,,,,,,,,,,,,,,,,,,,,,,,,885660,,,,,,,,,,2913437033,140712877621248,140712877621248,823296 -"2025-11-19 19:51:29.1708158Z","2025-11-19 19:51:29.1708158Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\ws2_32.dll",,,,,,,,,,1763581889170815800,,,,,,,,,,,,,,,,,,,,,,,,,,513405,,,,,,,,,,3967481067,140712881094656,140712881094656,475136 -"2025-11-19 19:51:29.1708219Z","2025-11-19 19:51:29.1708219Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,1763581889170821900,,,,,,,,,,,,,,,,,,,,,,,,,,761372,,,,,,,,,,71854833,140712881618944,140712881618944,737280 -"2025-11-19 19:51:29.1708353Z","2025-11-19 19:51:29.1708353Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,1763581889170835300,,,,,,,,,,,,,,,,,,,,,,,,,,230873,,,,,,,,,,527442843,140712882405376,140712882405376,176128 -"2025-11-19 19:51:29.1708422Z","2025-11-19 19:51:29.1708422Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,1763581889170842200,,,,,,,,,,,,,,,,,,,,,,,,,,233556,,,,,,,,,,1625678811,140712882601984,140712882601984,200704 -"2025-11-19 19:51:29.1708492Z","2025-11-19 19:51:29.1708492Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,1763581889170849200,,,,,,,,,,,,,,,,,,,,,,,,,,1923284,,,,,,,,,,675224942,140712888827904,140712888827904,1863680 -"2025-11-19 19:51:29.1708555Z","2025-11-19 19:51:29.1708555Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,1763581889170855500,,,,,,,,,,,,,,,,,,,,,,,,,,760295,,,,,,,,,,460960534,140712894529536,140712894529536,692224 -"2025-11-19 19:51:29.1708613Z","2025-11-19 19:51:29.1708613Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,1763581889170861300,,,,,,,,,,,,,,,,,,,,,,,,,,1193108,,,,,,,,,,4275633056,140712897216512,140712897216512,1146880 -"2025-11-19 19:51:29.1708672Z","2025-11-19 19:51:29.1708672Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,1763581889170867200,,,,,,,,,,,,,,,,,,,,,,,,,,2537167,,,,,,,,,,2626650689,140712898723840,140712898723840,2523136 -"2025-11-19 19:51:29.1708754Z","2025-11-19 19:51:29.1708754Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 1436 whoami.exe",6380,,," 1436 whoami.exe",,,"whoami.exe",,,,,,,,,,1763581889170875400,,,,,,,,,,,1257472,1302528,57157118,134080554818530829,3221225477,134080554881460737,83,0,3396,1,3,3,0,0,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1712017Z","2025-11-19 19:51:29.1712017Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",14196,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889171201700,18446633084039225344,18446633084039200768,140702989233856,0,132813950976,14196,132824170496,132824162304,140702989233856,1237595,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1712021Z","2025-11-19 19:51:29.1712021Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",5064,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889171202100,18446633084045922304,18446633084045897728,140712899206080,0,132813926400,5064,132821024768,132821016576,140712899206080,512990,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1712022Z","2025-11-19 19:51:29.1712022Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",13020,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889171202200,18446633084045864960,18446633084045840384,140712865112144,0,132813918208,13020,132819976192,132819968000,140712865112144,214628,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1712025Z","2025-11-19 19:51:29.1712025Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",5520,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889171202500,18446633084017422336,18446633084017397760,140702989086576,0,132813959168,5520,132825219072,132825210880,140702989086576,4438889,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1712026Z","2025-11-19 19:51:29.1712026Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",4736,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889171202600,18446633084045201408,18446633084045176832,140702989817872,0,132813885440,4736,132815781888,132815761408,140702989817872,67793028,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1712036Z","2025-11-19 19:51:29.1712036Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",12136,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889171203600,18446633084045430784,18446633084045406208,140712899206080,0,132813901824,12136,132817879040,132817870848,140712899206080,12037587,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1712126Z","2025-11-19 19:51:29.1712126Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",12916,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889171212600,18446633084042874880,18446633084042850304,140702989404080,0,132813967360,12916,132826267648,132826255360,140702989404080,1037678,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1712275Z","2025-11-19 19:51:29.1712275Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",14136,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889171227500,18446633084045402112,18446633084045377536,140712899206080,0,132813893632,14136,132816830464,132816822272,140712899206080,8912478,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1712302Z","2025-11-19 19:51:29.1712302Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",2364,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889171230200,18446633084045950976,18446633084045926400,140712899206080,0,132813934592,2364,132822073344,132822032384,140712899206080,41279257,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1712388Z","2025-11-19 19:51:29.1712388Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",1824,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889171238800,18446633084045807616,18446633084045783040,140712899206080,0,132813910016,1824,132818927616,132818915328,140712899206080,9551452,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1723363Z","2025-11-19 19:51:29.1723363Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,,,,,,,,,,,1763581889172336300,18446633084047904768,18446633084047880192,140702989217024,0,132813942784,5760,132823121920,132823093248,140702989217024,23273616,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1735274Z","2025-11-19 19:51:29.1735274Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop ","13828 OpenConsole.exe",5760,,,"13828 OpenConsole.exe",,,"OpenConsole.ex",,,,,,,,,,1763581889173527400,,,,,,,,,,,2887680,2940928,176179930,134080554806509408,0,134080554881486007,111,0,3394,12,7,3,52,0,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1738607Z","2025-11-19 19:51:29.1738607Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3100 conhost.exe",1400,,," 3100 conhost.exe",,,,,,,,,,,,,1763581889173860700,18446633084044828672,18446633084044804096,140712899206080,0,1013857767424,1400,1013862367232,1013862359040,140712899206080,175021,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1738641Z","2025-11-19 19:51:29.1738641Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3100 conhost.exe",9260,,," 3100 conhost.exe",,,,,,,,,,,,,1763581889173864100,18446633084044656640,18446633084044632064,140712899206080,0,1013857759232,9260,1013861318656,1013861310464,140712899206080,523176,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1738680Z","2025-11-19 19:51:29.1738680Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3100 conhost.exe",2976,,," 3100 conhost.exe",,,,,,,,,,,,,1763581889173868000,18446633084044943360,18446633084044918784,140712865112144,0,1013857751040,2976,1013860794368,1013860786176,140712865112144,139564,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1738783Z","2025-11-19 19:51:29.1738783Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3100 conhost.exe",6724,,," 3100 conhost.exe",,,,,,,,,,,,,1763581889173878300,18446633084044627968,18446633084044603392,140696384580832,0,1013857734656,6724,1013861842944,1013861818368,140696384580832,33378427,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1738825Z","2025-11-19 19:51:29.1738825Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3100 conhost.exe",4376,,," 3100 conhost.exe",,,,,,,,,,,,,1763581889173882500,18446633084006535168,18446633084006510592,140712899206080,0,1013857742848,4376,1013860270080,1013860261888,140712899206080,858507,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1741667Z","2025-11-19 19:51:29.1741667Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,,,,,,,,,,,1763581889174166700,18446633084047990784,18446633084047966208,140696385038832,0,1013857775616,11136,1013862891520,1013862879232,140696385038832,732523,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1746376Z","2025-11-19 19:51:29.1746376Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",4932,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889174637600,18446633084042932224,18446633084042907648,140712371704112,0,1068179750912,4932,1068193808384,1068193669120,140712371704112,6957459,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1746466Z","2025-11-19 19:51:29.1746466Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 3100 conhost.exe",11136,,," 3100 conhost.exe",,,"conhost.exe",,,,,,,,,,1763581889174646600,,,,,,,,,,,1503232,1552384,66220850,134080554806283315,109,134080554881498658,93,0,3393,5,0,3,0,0,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1871394Z","2025-11-19 19:51:29.1871394Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",6876,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187139500,18446633084045144064,18446633084045119488,140712891292720,0,1068179693568,6876,1068187516928,1068187496448,140712891292720,12018349,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1871396Z","2025-11-19 19:51:29.1871396Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",14948,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187139600,18446633084049481728,18446633084049457152,140712899206080,0,1068179816448,14948,1068202196992,1068202188800,140712899206080,346270,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1871397Z","2025-11-19 19:51:29.1871397Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",5964,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187139700,18446633084046352384,18446633084046327808,140702319920256,0,1068179636224,5964,1068177817600,1068177727488,140702319920256,1443654158,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1871409Z","2025-11-19 19:51:29.1871409Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",11716,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187140900,18446633084044541952,18446633084044517376,140712583404848,0,1068179726336,11716,1068190662656,1068190654464,140712583404848,1102557,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1871452Z","2025-11-19 19:51:29.1871452Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",3968,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187145200,18446633084007337984,18446633084007313408,140712378178864,0,1068179759104,3968,1068194856960,1068194828288,140712378178864,69473835,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1871491Z","2025-11-19 19:51:29.1871491Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",8404,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187149200,18446633084047183872,18446633084047159296,140712899206080,0,1068179685376,8404,1068186468352,1068186451968,140712899206080,8231254,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1871524Z","2025-11-19 19:51:29.1871524Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",9740,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187152400,18446633084047876096,18446633084047851520,140712899206080,0,1068179734528,9740,1068191711232,1068191694848,140712899206080,7053264,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1871535Z","2025-11-19 19:51:29.1871535Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",11228,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187153500,18446633084046180352,18446633084046155776,140712899206080,0,1068179791872,11228,1068199051264,1068199043072,140712899206080,1385833,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1871773Z","2025-11-19 19:51:29.1871773Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",12764,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187177300,18446633084049453056,18446633084049428480,140712899206080,0,1068179808256,12764,1068201148416,1068201140224,140712899206080,780050,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1872444Z","2025-11-19 19:51:29.1872444Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",1960,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187244400,18446633084049424384,18446633084049399808,140712899206080,0,1068179800064,1960,1068200099840,1068200091648,140712899206080,1114250,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1872641Z","2025-11-19 19:51:29.1872641Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",3600,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187264100,18446633084044570624,18446633084044546048,140712899206080,0,1068179783680,3600,1068198002688,1068197990400,140712899206080,4580339,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1872760Z","2025-11-19 19:51:29.1872760Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",12568,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187276000,18446633084042072064,18446633084042047488,140712865112144,0,1068179742720,12568,1068192759808,1068192739328,140712865112144,7322583,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1872767Z","2025-11-19 19:51:29.1872767Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",12140,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187276700,18446633084049252352,18446633084049227776,140712899206080,0,1068179775488,12140,1068196954112,1068196945920,140712899206080,3097568,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1872895Z","2025-11-19 19:51:29.1872895Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",14500,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187289500,18446633084047642624,18446633084047618048,140712632221632,0,1068179718144,14500,1068188565504,1068188553216,140712632221632,3940609,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1873052Z","2025-11-19 19:51:29.1873052Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",14844,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187305200,18446633084042817536,18446633084042792960,140712899206080,0,1068179668992,14844,1068184371200,1068184358912,140712899206080,6994044,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1873232Z","2025-11-19 19:51:29.1873232Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",12024,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187323200,18446633084046725120,18446633084046700544,140712899206080,0,1068179660800,12024,1068183322624,1068183314432,140712899206080,26231986,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1873245Z","2025-11-19 19:51:29.1873245Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",4348,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187324500,18446633084046667776,18446633084046643200,140712899206080,0,1068179652608,4348,1068182274048,1068182261760,140712899206080,20408407,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1873476Z","2025-11-19 19:51:29.1873476Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",11152,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187347600,18446633084046610432,18446633084046585856,140712899206080,0,1068179644416,11152,1068181225472,1068181209088,140712899206080,21606025,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1873670Z","2025-11-19 19:51:29.1873670Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",11960,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187367000,18446633084048162816,18446633084048138240,140712899206080,0,1068179767296,11960,1068195905536,1068195885056,140712899206080,1970379630,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1873893Z","2025-11-19 19:51:29.1873893Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",11108,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187389300,18446633084046983168,18446633084046958592,140712865112144,0,1068179677184,11108,1068185419776,1068185411584,140712865112144,197276,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1878454Z","2025-11-19 19:51:29.1878454Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,,,,,,,,,,,1763581889187845400,18446633084047790080,18446633084047765504,140712604173856,0,1068179709952,10116,1068189614080,1068189605888,140712604173856,13884359,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.1949230Z","2025-11-19 19:51:29.1949230Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 2344 WindowsTerminal.exe",10116,,," 2344 WindowsTerminal.exe",,,"WindowsTermina",,,,,,,,,,1763581889194923100,,,,,,,,,,,16732160,19222528,3702983350,134080554806979193,0,134080554881691430,577,0,3395,60,52,3,7,0,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.2994897Z","2025-11-19 19:51:29.2994897Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6220 svchost.exe",1512,,," 6220 svchost.exe",,,,,,,,,,,,,1763581889299489800,18446633084047761408,18446633084047736832,140712865112144,278,101940486144,1512,101943607296,101943574528,140712865112144,4277070,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.3321791Z","2025-11-19 19:51:29.3321791Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 8476 ServiceHub.IdentityHost.exe",,,,,,,,,,,,,1763581889332179100,18446633084047761408,18446633084047736832,140712899206080,0,843736039424,14488,843738251264,843738247168,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.3322610Z","2025-11-19 19:51:29.3322610Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1956 MSBuild.exe",,,,,,,,,,,,,1763581889332261100,18446633084055846912,18446633084055822336,140712899206080,0,641477595136,11260,641487339520,641487323136,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.3323015Z","2025-11-19 19:51:29.3323015Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 4372 vctip.exe",,,,,,,,,,,,,1763581889332301600,18446633084048019456,18446633084047994880,140712899206080,0,740355313664,12168,740362813440,740362805248,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.3323369Z","2025-11-19 19:51:29.3323369Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"12052 ServiceHub.TestWindowStoreHost.exe",,,,,,,,,,,,,1763581889332336900,18446633084017422336,18446633084017397760,140712899206080,0,17906528256,14160,17910726656,17910722560,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.3323724Z","2025-11-19 19:51:29.3323724Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,1763581889332372400,18446633084042932224,18446633084042907648,140712899206080,0,46014324736,13904,46028292096,46028275712,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.3324120Z","2025-11-19 19:51:29.3324120Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"10252 ServiceHub.IndexingService.exe",,,,,,,,,,,,,1763581889332412000,18446633084039225344,18446633084039200768,140712899206080,0,848612728832,13908,848617799680,848617795584,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.3324467Z","2025-11-19 19:51:29.3324467Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"10648 ServiceHub.Host.dotnet.x64.exe",,,,,,,,,,,,,1763581889332446700,18446633084045807616,18446633084045783040,140712899206080,0,515212726272,7132,515219914752,515219910656,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.3324957Z","2025-11-19 19:51:29.3324957Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"10200 ServiceHub.VSDetouredHost.exe",,,,,,,,,,,,,1763581889332495700,18446633084044943360,18446633084044918784,140712899206080,0,617596755968,7544,617601826816,617601822720,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.3325408Z","2025-11-19 19:51:29.3325408Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9988 Microsoft.ServiceHub.Controller.exe",,,,,,,,,,,,,1763581889332540800,18446633084046180352,18446633084046155776,140712899206080,0,1049753657344,10460,1049757745152,1049757741056,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:29.3325713Z","2025-11-19 19:51:29.3325713Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9280 Greenshot.exe",,,,,,,,,,,,,1763581889332571300,18446633084049481728,18446633084049457152,140712899206080,0,948118790144,1372,948122419200,948122415104,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:31.6121866Z","2025-11-19 19:51:31.6121866Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8972 VBoxTray.exe",9020,,," 8972 VBoxTray.exe",,,,,,,,,,,,,1763581891612186600,18446633084053868544,18446633084053843968,140700131109808,0,471284252672,11456,471286677504,471286673408,140700131109808,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:31.6124072Z","2025-11-19 19:51:31.6124072Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8972 VBoxTray.exe",11456,,," 8972 VBoxTray.exe",,,,,,,,,,,,,1763581891612407200,18446633084053868544,18446633084053843968,140700131109808,0,471284252672,11456,471286677504,471286669312,140700131109808,433403,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:32.3106101Z","2025-11-19 19:51:32.3106101Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",15084,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,1763581892310610100,18446633084039487488,18446633084039462912,140711613062896,0,1046353207296,15084,1046367698944,1046367674368,140711613062896,4399662,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:32.3106424Z","2025-11-19 19:51:32.3106424Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",12628,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,1763581892310642400,18446633084005355520,18446633084005330944,140711613062896,0,1046353223680,12628,1046388670464,1046388654080,140711613062896,853227,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:32.3427056Z","2025-11-19 19:51:32.3427056Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",11644,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,1763581892342705600,18446633084038852608,18446633084038828032,140711613062896,0,1046353231872,11644,1046392864768,1046392844288,140711613062896,653688,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:32.3427596Z","2025-11-19 19:51:32.3427596Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",14980,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,1763581892342759600,18446633084038365184,18446633084038340608,140711613062896,0,1046353215488,14980,1046371893248,1046371876864,140711613062896,958462,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:33.3438855Z","2025-11-19 19:51:33.3438855Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4832 WmiPrvSE.exe",12044,,," 4832 WmiPrvSE.exe",,,,,,,,,,,,,1763581893343885500,18446633084035751936,18446633084035727360,140712899206080,0,525413761024,12044,525414694912,525414629376,140712899206080,1823386,,,,,,,,,,,,,,,,,,,,,,,,,,,,, -"2025-11-19 19:51:33.3438935Z","2025-11-19 19:51:33.3438935Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4832 WmiPrvSE.exe",13316,,," 4832 WmiPrvSE.exe",,,,,,,,,,,,,1763581893343893500,18446633084035637248,18446633084035612672,140712899206080,0,525413744640,13316,525411221504,525411155968,140712899206080,5525225,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +timestamp_sys,timestamp_etw,src_type,provider_name,event_id,task_info,process_id,thread_id,ppid,pid,targetpid,targettid,message,filepath,cachename,result,vname,name,sigseq,sigsha,commandline,firstparam,secondparam,stackbase,stacklimit,startaddr,subprocesstag,tebbase,threadid,timestamp_ns,userstackbase,userstacklimit,win32startaddr,cycletime,createtime,flags,imagechecksum,mandatorylabel,packagefullname,packagerelativeappid,parentprocessid,parentprocesssequencenumber,processsequencenumber,processtokenelevationtype,processtokeniselevated,securitymitigations,sessionid,timedatestamp,defaultbase,imagebase,imagesize,commitcharge,commitpeak,cpucyclecount,exitcode,exittime,handlecount,hardfaultcount,readoperationcount,readtransferkilobytes,tokenelevationtype,writeoperationcount,writetransferkilobytes"2025-11-19 22:37:11.1915649Z","2025-11-19 22:37:11.1915649Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 6096 svchost.exe",,,,,,,,,,,,,18446633084024459264,18446633084024434688,140712899206080,0,338488844288,636,1763591831191564900,338488393728,338488360960,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.1916937Z","2025-11-19 22:37:11.1916937Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9920 ServiceHub.IntellicodeModelService.exe",12960,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,18446633083978407936,18446633083978383360,140711612509856,0,46015668224,12960,1763591831191693700,46012694528,46012678144,140711612509856,862657,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.2048364Z","2025-11-19 22:37:11.2048364Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",4060,,," 5184 explorer.exe",,,,,,,,,,,,,18446633084024315904,18446633084024291328,140712899206080,0,15343616,1708,1763591831204836400,515375104,515317760,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.3509174Z","2025-11-19 22:37:11.3509174Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8984 svchost.exe",11892,,," 8984 svchost.exe",,,,,,,,,,,,,18446633084049739776,18446633084049715200,140712899206080,0,213147869184,11892,1763591831350917400,213148762112,213148729344,140712899206080,303269,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.5426966Z","2025-11-19 22:37:11.5426966Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"11648 RuntimeBroker.exe",,,,,,,,,,,,,18446633084049739776,18446633084049715200,140712899206080,0,503394197504,7460,1763591831542696600,503396696064,503396646912,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.6406757Z","2025-11-19 22:37:11.6406757Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8972 VBoxTray.exe",9020,,," 8972 VBoxTray.exe",,,,,,,,,,,,,18446633084024516608,18446633084024492032,140700131109808,0,471283179520,1480,1763591831640675700,471299260416,471299256320,140700131109808,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.6409261Z","2025-11-19 22:37:11.6409261Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8972 VBoxTray.exe",1480,,," 8972 VBoxTray.exe",,,,,,,,,,,,,18446633084024516608,18446633084024492032,140700131109808,0,471283179520,1480,1763591831640926100,471299260416,471299252224,140700131109808,560897,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.792165000Z","2025-11-19 22:37:11.7170068Z","myETW","EDRi-Provider",4242,"EDRiTask"," 7508 EDRi.exe",,,,,,"++ EDRi START MARKER ++",,,,,,,,,,,,,,,,,1763591831717006800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.7170149Z","2025-11-19 22:37:11.7170149Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9832 svchost.exe",11208,,," 9832 svchost.exe",,,,,,,,,,,,,18446633084050743296,18446633084050718720,140712899206080,0,234794704896,11208,1763591831717014900,234792878080,234792845312,140712899206080,383989,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:11.9502056Z","2025-11-19 22:37:11.9502056Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",2956,,," 5184 explorer.exe",,,,,,,,,,,,,18446633084024545280,18446633084024520704,140712899206080,0,15351808,13348,1763591831950205600,515899392,515842048,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:12.2126523Z","2025-11-19 22:37:12.2126523Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 9692 PerfWatson2.exe",12736,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084023541760,18446633084023517184,140711613062896,0,1046354399232,11240,1763591832212652300,1046413836288,1046413819904,140711613062896,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:12.3065571Z","2025-11-19 22:37:12.3065571Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","11904 msedgewebview2.exe",8860,,,"11904 msedgewebview2.exe",,,,,,,,,,,,,18446633083980414976,18446633083980390400,140712899206080,0,667618459648,8860,1763591832306557100,665728319488,665728315392,140712899206080,357587,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:12.3133629Z","2025-11-19 22:37:12.3133629Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 9692 PerfWatson2.exe",12616,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084024401920,18446633084024377344,140711613062896,0,1046354407424,11288,1763591832313362900,1046418030592,1046418014208,140711613062896,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:12.3544946Z","2025-11-19 22:37:12.3544946Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9324 msedgewebview2.exe",4216,,," 9324 msedgewebview2.exe",,,,,,,,,,,,,18446633083980595200,18446633083980570624,140712899206080,0,717037178880,4216,1763591832354494600,717054017536,717054013440,140712899206080,351927,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:12.3545599Z","2025-11-19 22:37:12.3545599Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 8984 svchost.exe",,,,,,,,,,,,,18446633084024057856,18446633084024033280,140712899206080,0,213147877376,276,1763591832354559900,213148762112,213148729344,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:12.5148249Z","2025-11-19 22:37:12.5148249Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9388 devenv.exe",12204,,," 9388 devenv.exe",,,,,,,,,,,,,18446633083985420288,18446633083985395712,140711613062896,0,1033377087488,12204,1763591832514824900,1033415163904,1033415143424,140711613062896,125044070,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:12.7208620Z","2025-11-19 22:37:12.7208620Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9832 svchost.exe",,,,,,,,,,,,,18446633083980414976,18446633083980390400,140712899206080,0,234794721280,11672,1763591832720862100,234792878080,234792845312,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:12.9904828Z","2025-11-19 22:37:12.9904828Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 7884 msedgewebview2.exe",5984,,," 7884 msedgewebview2.exe",,,,,,,,,,,,,18446633083980652544,18446633083980627968,140712899206080,0,139211661312,5984,1763591832990482800,139246698496,139246694400,140712899206080,266303,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:12.9904834Z","2025-11-19 22:37:12.9904834Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 7956 msedgewebview2.exe",504,,," 7956 msedgewebview2.exe",,,,,,,,,,,,,18446633084048707584,18446633084048683008,140712899206080,0,334435393536,504,1763591832990483400,334462189568,334462181376,140712899206080,245557,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.2297646Z","2025-11-19 22:37:13.2297646Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",2776,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084047761408,18446633084047736832,140711612509856,0,1046354391040,2776,1763591833229764600,1046352232448,1046352216064,140711612509856,1727953,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.2614302Z","2025-11-19 22:37:13.2614302Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13084 MSBuild.exe",2512,,,"13084 MSBuild.exe",,,,,,,,,,,,,18446633084004839424,18446633084004814848,140711613062896,0,911121752064,2512,1763591833261430200,911223029760,911223013376,140711613062896,1215338,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.2614809Z","2025-11-19 22:37:13.2614809Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13084 MSBuild.exe",12292,,,"13084 MSBuild.exe",,,,,,,,,,,,,18446633084004552704,18446633084004528128,140711613062896,0,911121727488,12292,1763591833261480900,911210446848,911210430464,140711613062896,2454817,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3089749Z","2025-11-19 22:37:13.3089749Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13084 MSBuild.exe",1488,,,"13084 MSBuild.exe",,,,,,,,,,,,,18446633084004638720,18446633084004614144,140711613062896,0,911121735680,1488,1763591833308974900,911214641152,911214624768,140711613062896,3342749,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3090104Z","2025-11-19 22:37:13.3090104Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13084 MSBuild.exe",14060,,,"13084 MSBuild.exe",,,,,,,,,,,,,18446633084004495360,18446633084004470784,140711613062896,0,911121719296,14060,1763591833309010400,911206252544,911206236160,140711613062896,2587216,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3090477Z","2025-11-19 22:37:13.3090477Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13084 MSBuild.exe",12864,,,"13084 MSBuild.exe",,,,,,,,,,,,,18446633084003921920,18446633084003897344,140711613062896,0,911121661952,12864,1763591833309047700,911176892416,911176876032,140711613062896,7149828,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3090782Z","2025-11-19 22:37:13.3090782Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"11904 msedgewebview2.exe",,,,,,,,,,,,,18446633084004552704,18446633084004528128,140712899206080,0,667618467840,7748,1763591833309078300,665728319488,665728315392,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3091086Z","2025-11-19 22:37:13.3091086Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13084 MSBuild.exe",9556,,,"13084 MSBuild.exe",,,,,,,,,,,,,18446633084004810752,18446633084004786176,140711613062896,0,911121743872,9556,1763591833309108600,911218835456,911218819072,140711613062896,1270411,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3091215Z","2025-11-19 22:37:13.3091215Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13084 MSBuild.exe",4244,,,"13084 MSBuild.exe",,,,,,,,,,,,,18446633084003979264,18446633084003954688,140711613062896,0,911121670144,4244,1763591833309121500,911181086720,911181066240,140711613062896,4226150,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3091312Z","2025-11-19 22:37:13.3091312Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","10648 ServiceHub.Host.dotnet.x64.exe",9652,,,"10648 ServiceHub.Host.dotnet.x64.exe",,,,,,,,,,,,,18446633083986194432,18446633083986169856,140711121663952,0,515211550720,9652,1763591833309131200,515230924800,515230879744,140711121663952,150560519,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3091350Z","2025-11-19 22:37:13.3091350Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13084 MSBuild.exe",13796,,,"13084 MSBuild.exe",,,,,,,,,,,,,18446633084004380672,18446633084004356096,140711613062896,0,911121711104,13796,1763591833309135000,911202058240,911202041856,140711613062896,3047023,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3091895Z","2025-11-19 22:37:13.3091895Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","10252 ServiceHub.IndexingService.exe",2196,,,"10252 ServiceHub.IndexingService.exe",,,,,,,,,,,,,18446633083984613376,18446633083984588800,140711121663952,0,848613646336,2196,1763591833309189500,848619372544,848619352064,140711121663952,39058301,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3092519Z","2025-11-19 22:37:13.3092519Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","10252 ServiceHub.IndexingService.exe",12808,,,"10252 ServiceHub.IndexingService.exe",,,,,,,,,,,,,18446633083985076224,18446633083985051648,140711121663952,0,848613662720,12808,1763591833309251900,848627761152,848627744768,140711121663952,23238547,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3093391Z","2025-11-19 22:37:13.3093391Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","10252 ServiceHub.IndexingService.exe",3892,,,"10252 ServiceHub.IndexingService.exe",,,,,,,,,,,,,18446633083986423808,18446633083986399232,140711121663952,0,848613687296,3892,1763591833309339100,848635625472,848635600896,140711121663952,49327209,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.3567871Z","2025-11-19 22:37:13.3567871Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9324 msedgewebview2.exe",,,,,,,,,,,,,18446633084004638720,18446633084004614144,140712899206080,0,717037187072,8800,1763591833356787100,717054017536,717054013440,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.7697452Z","2025-11-19 22:37:13.7697452Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8268 svchost.exe",7544,,," 8268 svchost.exe",,,,,,,,,,,,,18446633084022276096,18446633084022251520,140712899206080,0,178507522048,7544,1763591833769745200,178510102528,178510069760,140712899206080,191618,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.9920204Z","2025-11-19 22:37:13.9920204Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 7884 msedgewebview2.exe",,,,,,,,,,,,,18446633083985420288,18446633083985395712,140712899206080,0,139211669504,5744,1763591833992020400,139246698496,139246694400,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:13.9921417Z","2025-11-19 22:37:13.9921417Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 7956 msedgewebview2.exe",,,,,,,,,,,,,18446633084025638912,18446633084025614336,140712899206080,0,334435401728,12716,1763591833992141700,334462189568,334462185472,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:14.0077231Z","2025-11-19 22:37:14.0077231Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5884 SearchProtocolHost.exe",14676,,," 5884 SearchProtocolHost.exe",,,,,,,,,,,,,18446633084009955328,18446633084009930752,140712899206080,0,100230639616,14676,1763591834007723100,100232331264,100232298496,140712899206080,4036415,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:14.0077232Z","2025-11-19 22:37:14.0077232Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5884 SearchProtocolHost.exe",8420,,," 5884 SearchProtocolHost.exe",,,,,,,,,,,,,18446633084010127360,18446633084010102784,140712899206080,0,100230647808,8420,1763591834007723200,100232855552,100232822784,140712899206080,1875060,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:14.0077273Z","2025-11-19 22:37:14.0077273Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5884 SearchProtocolHost.exe",7836,,," 5884 SearchProtocolHost.exe",,,,,,,,,,,,,18446633083987718144,18446633083987693568,140712899206080,0,100230656000,7836,1763591834007727300,100233379840,100233347072,140712899206080,74308,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:14.7714898Z","2025-11-19 22:37:14.7714898Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8916 SecurityHealthService.exe",2640,,," 8916 SecurityHealthService.exe",,,,,,,,,,,,,18446633083981217792,18446633083981193216,140712899206080,0,33814335488,2640,1763591834771489900,33812054016,33812045824,140712899206080,256119,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:14.7715058Z","2025-11-19 22:37:14.7715058Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 8268 svchost.exe",,,,,,,,,,,,,18446633084010127360,18446633084010102784,140712899206080,0,178507530240,4892,1763591834771505800,178510102528,178510069760,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:15.2004649Z","2025-11-19 22:37:15.2004649Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 700 lsass.exe",3660,,," 700 lsass.exe",,,,,,,,,,,,,18446633084010872832,18446633084010848256,140712850417280,0,81706889216,3660,1763591835200464900,81709760512,81709740032,140712850417280,513746,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:16.175848500Z","2025-11-19 22:37:15.7424568Z","myETW","EDRi-Provider",4242,"EDRiTask"," 7508 EDRi.exe",,,,,,"Before decrypting the attack exe from C:\Users\hacker\source\repos\EDR-Introspection\x64\Release\attacks\Injector-standard.exe.enc",,,,,,,,,,,,,,,,,1763591835742456800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:16.182157400Z","2025-11-19 22:37:15.7482493Z","myETW","EDRi-Provider",4242,"EDRiTask"," 7508 EDRi.exe",,,,,,"After decrypting the attack exe",,,,,,,,,,,,,,,,,1763591835748249300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:15.7731036Z","2025-11-19 22:37:15.7731036Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 8916 SecurityHealthService.exe",,,,,,,,,,,,,18446633083980652544,18446633083980627968,140712899206080,0,33814343680,12872,1763591835773103700,33812054016,33812045824,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:16.1094589Z","2025-11-19 22:37:16.1094589Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 9692 PerfWatson2.exe",9752,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084025667584,18446633084025643008,140711612509856,0,1046354415616,1060,1763591836109458900,1046352232448,1046352216064,140711612509856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:16.6517984Z","2025-11-19 22:37:16.6517984Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8972 VBoxTray.exe",9020,,," 8972 VBoxTray.exe",,,,,,,,,,,,,18446633084025724928,18446633084025700352,140700131109808,0,471283187712,6728,1763591836651798400,471299260416,471299256320,140700131109808,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:16.6520139Z","2025-11-19 22:37:16.6520139Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8972 VBoxTray.exe",6728,,," 8972 VBoxTray.exe",,,,,,,,,,,,,18446633084025724928,18446633084025700352,140700131109808,0,471283187712,6728,1763591836652013900,471299260416,471299252224,140700131109808,456412,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:17.282796100Z","2025-11-19 22:37:16.7589463Z","myETW","EDRi-Provider",4242,"EDRiTask"," 7508 EDRi.exe",,,,,,"Before starting the attack exe",,,,,,,,,,,,,,,,,1763591836758946300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:17.4750774Z","2025-11-19 22:37:17.4750774Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1520 powershell.exe",2068,,," 1520 powershell.exe",,,,,,,,,,,,,18446633084010586112,18446633084010561536,140711613062896,0,931707432960,2068,1763591837475077400,931708534784,931708522496,140711613062896,2147777,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:17.4751035Z","2025-11-19 22:37:17.4751035Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1520 powershell.exe",13452,,," 1520 powershell.exe",,,,,,,,,,,,,18446633084010672128,18446633084010647552,140711613062896,0,931707449344,13452,1763591837475103500,931709059072,931709046784,140711613062896,1240989,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:17.4751539Z","2025-11-19 22:37:17.4751539Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1520 powershell.exe",7756,,," 1520 powershell.exe",,,,,,,,,,,,,18446633084000100352,18446633084000075776,140711613062896,0,931707490304,7756,1763591837475153900,931710107648,931710091264,140711613062896,1639311,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:17.4752016Z","2025-11-19 22:37:17.4752016Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 1520 powershell.exe",9588,,," 1520 powershell.exe",,,,,,,,,,,,,18446633083999985664,18446633083999961088,140711613062896,0,931707482112,9588,1763591837475201600,931709583360,931709571072,140711613062896,1332647,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:17.6179244Z","2025-11-19 22:37:17.6179244Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",1060,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084025667584,18446633084025643008,140711612509856,0,1046354415616,1060,1763591837617924400,1046352232448,1046352216064,140711612509856,1229672,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:18.1080912Z","2025-11-19 22:37:18.1080912Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2376 svchost.exe",10840,,," 2376 svchost.exe",,,,,,,,,,,,,18446633084000100352,18446633084000075776,140712899206080,0,36399751168,5764,1763591838108091200,36401315840,36401283072,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:18.1082195Z","2025-11-19 22:37:18.1082195Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2376 svchost.exe",5764,,," 2376 svchost.exe",,,,,,,,,,,,,18446633084010586112,18446633084010561536,140712899206080,248,36399759360,7176,1763591838108219500,36401840128,36401807360,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:18.1091428Z","2025-11-19 22:37:18.1091428Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2932 svchost.exe",6236,,," 2932 svchost.exe",,,,,,,,,,,,,18446633084026470400,18446633084026445824,140712899206080,49,212462006272,4884,1763591838109142800,212464566272,212464500736,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:18.1100127Z","2025-11-19 22:37:18.1100127Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2376 svchost.exe",5764,,," 2376 svchost.exe",,,,,,,,,,,,,18446633084026499072,18446633084026474496,140712899206080,248,36399767552,3700,1763591838110012700,36402364416,36402331648,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:18.1100995Z","2025-11-19 22:37:18.1100995Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2376 svchost.exe",3700,,," 2376 svchost.exe",,,,,,,,,,,,,18446633084026585088,18446633084026560512,140712899206080,0,36399775744,8648,1763591838110099500,36402888704,36402855936,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:18.1101842Z","2025-11-19 22:37:18.1101842Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2376 svchost.exe",8648,,," 2376 svchost.exe",,,,,,,,,,,,,18446633084026613760,18446633084026589184,140712899206080,0,36399783936,12324,1763591838110184200,36403412992,36403380224,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:18.1102113Z","2025-11-19 22:37:18.1102113Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2080 svchost.exe",11748,,," 2080 svchost.exe",,,,,,,,,,,,,18446633084026675200,18446633084026650624,140712899206080,57,246078193664,4500,1763591838110211300,246081912832,246081880064,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:18.8842832Z","2025-11-19 22:37:18.8842832Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3540 svchost.exe",1372,,," 3540 svchost.exe",,,,,,,,,,,,,18446633084056907776,18446633084056883200,140711742624160,249,589657747456,1372,1763591838884283200,589660946432,589660913664,140711742624160,10493143486,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:18.8843028Z","2025-11-19 22:37:18.8843028Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3540 svchost.exe",2056,,," 3540 svchost.exe",,,,,,,,,,,,,18446633084013084672,18446633084013060096,140711742624160,249,589657755648,2056,1763591838884302800,589661470720,589661437952,140711742624160,413754083,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:18.9486568Z","2025-11-19 22:37:18.9486568Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8448 OneDrive.exe",14752,,," 8448 OneDrive.exe",,,,,,,,,,,,,18446633083984125952,18446633083984101376,140712859481984,0,70346272768,14752,1763591838948656800,70353158144,70353149952,140712859481984,764961,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:19.6822614Z","2025-11-19 22:37:19.6822614Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 9920 ServiceHub.IntellicodeModelService.exe",9760,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,18446633084027449344,18446633084027424768,140711612509856,0,46015676416,4196,1763591839682261400,46012694528,46012678144,140711612509856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:19.8417299Z","2025-11-19 22:37:19.8417299Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","10648 ServiceHub.Host.dotnet.x64.exe",7644,,,"10648 ServiceHub.Host.dotnet.x64.exe",,,,,,,,,,,,,18446633083985477632,18446633083985453056,140711121663952,0,515211534336,7644,1763591839841729900,515226206208,515226185728,140711121663952,242289127,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:19.8417852Z","2025-11-19 22:37:19.8417852Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","10648 ServiceHub.Host.dotnet.x64.exe",13156,,,"10648 ServiceHub.Host.dotnet.x64.exe",,,,,,,,,,,,,18446633084058513408,18446633084058488832,140711121663952,0,515213594624,13156,1763591839841785200,515234070528,515234017280,140711121663952,314582142,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.0924127Z","2025-11-19 22:37:20.0924127Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",5020,,," 5184 explorer.exe",,,,,,,,,,,,,18446633084027592704,18446633084027568128,140712891545280,0,15360000,15136,1763591840092412700,470351872,470294528,140712891545280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1091605Z","2025-11-19 22:37:20.1091605Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1040 svchost.exe",4480,,,"13388 smartscreen.exe",,,"C:\Windows\System32\smartscreen.exe",,,,,,,,,,,,,,,,1763591840109160500,,,,,134080654409311255,0,664452,"0x","","",1040,13,6623,3,0,0,1,419447766,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1098332Z","2025-11-19 22:37:20.1098332Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",4480,,,"13388 smartscreen.exe",,,,,,,,,,,,,18446633083984125952,18446633083984101376,140696524147856,40,184868757504,12744,1763591840109833200,184867422208,184867414016,140696524147856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1113626Z","2025-11-19 22:37:20.1113626Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\smartscreen.exe",,,,,,,,,,,,,,,,1763591840111362600,,,,,,,664452,,,,,,,,,,,419447766,140696524029952,140696524029952,614400,,,,,,,,,,,, +"2025-11-19 22:37:20.1113736Z","2025-11-19 22:37:20.1113736Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591840111373600,,,,,,,2537167,,,,,,,,,,,2626650689,140712898723840,140712898723840,2523136,,,,,,,,,,,, +"2025-11-19 22:37:20.1148161Z","2025-11-19 22:37:20.1148161Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591840114816100,,,,,,,885660,,,,,,,,,,,2913437033,140712877621248,140712877621248,823296,,,,,,,,,,,, +"2025-11-19 22:37:20.1149453Z","2025-11-19 22:37:20.1149453Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591840114945300,,,,,,,4209945,,,,,,,,,,,2980330054,140712854355968,140712854355968,4161536,,,,,,,,,,,, +"2025-11-19 22:37:20.1160739Z","2025-11-19 22:37:20.1160739Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591840116073900,,,,,,,1436013,,,,,,,,,,,1441720767,140712859467776,140712859467776,1355776,,,,,,,,,,,, +"2025-11-19 22:37:20.1161632Z","2025-11-19 22:37:20.1161632Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,,,,,,,,,,,18446633084027420672,18446633084027396096,140712899206080,0,184868765696,7684,1763591840116163200,184867946496,184867938304,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1162258Z","2025-11-19 22:37:20.1162258Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\combase.dll",,,,,,,,,,,,,,,,1763591840116225800,,,,,,,3798760,,,,,,,,,,,2772520021,140712863924224,140712863924224,3715072,,,,,,,,,,,, +"2025-11-19 22:37:20.1163609Z","2025-11-19 22:37:20.1163609Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591840116360900,,,,,,,1193108,,,,,,,,,,,4275633056,140712897216512,140712897216512,1146880,,,,,,,,,,,, +"2025-11-19 22:37:20.1164719Z","2025-11-19 22:37:20.1164719Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,,,,,,,,,,,18446633084058513408,18446633084058488832,140712899206080,0,184868773888,3956,1763591840116471900,184870764544,184870756352,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1165504Z","2025-11-19 22:37:20.1165504Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,,,,,,,,,,,18446633083985477632,18446633083985453056,140712899206080,0,184868782080,11600,1763591840116550400,184871288832,184871280640,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1165516Z","2025-11-19 22:37:20.1165516Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\SHCore.dll",,,,,,,,,,,,,,,,1763591840116551600,,,,,,,1029623,,,,,,,,,,,2858041650,140712891252736,140712891252736,991232,,,,,,,,,,,, +"2025-11-19 22:37:20.1167496Z","2025-11-19 22:37:20.1167496Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591840116749600,,,,,,,1923284,,,,,,,,,,,675224942,140712888827904,140712888827904,1863680,,,,,,,,,,,, +"2025-11-19 22:37:20.1169151Z","2025-11-19 22:37:20.1169151Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591840116915100,,,,,,,230350,,,,,,,,,,,2551303736,140712858550272,140712858550272,159744,,,,,,,,,,,, +"2025-11-19 22:37:20.1170578Z","2025-11-19 22:37:20.1170578Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,"C:\Windows\System32\smartscreen.dll",,,,,,,,,,,,,,,,1763591840117057800,,,,,,,6028386,,,,,,,,,,,1751620389,140711778385920,140711778385920,6057984,,,,,,,,,,,, +"2025-11-19 22:37:20.1170667Z","2025-11-19 22:37:20.1170667Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591840117066700,,,,,,,230873,,,,,,,,,,,527442843,140712882405376,140712882405376,176128,,,,,,,,,,,, +"2025-11-19 22:37:20.1172650Z","2025-11-19 22:37:20.1172650Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591840117265000,,,,,,,761372,,,,,,,,,,,71854833,140712881618944,140712881618944,737280,,,,,,,,,,,, +"2025-11-19 22:37:20.1172844Z","2025-11-19 22:37:20.1172844Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591840117284400,,,,,,,1243850,,,,,,,,,,,792084382,140712861433856,140712861433856,1228800,,,,,,,,,,,, +"2025-11-19 22:37:20.1174617Z","2025-11-19 22:37:20.1174617Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",7684,,,"13388 smartscreen.exe",,,"C:\Windows\System32\winhttp.dll",,,,,,,,,,,,,,,,1763591840117461700,,,,,,,1261038,,,,,,,,,,,84984727,140712750350336,140712750350336,1212416,,,,,,,,,,,, +"2025-11-19 22:37:20.1174902Z","2025-11-19 22:37:20.1174902Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591840117490200,,,,,,,760295,,,,,,,,,,,460960534,140712894529536,140712894529536,692224,,,,,,,,,,,, +"2025-11-19 22:37:20.1175715Z","2025-11-19 22:37:20.1175715Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591840117571500,,,,,,,700029,,,,,,,,,,,3371602543,140712858746880,140712858746880,667648,,,,,,,,,,,, +"2025-11-19 22:37:20.1177224Z","2025-11-19 22:37:20.1177224Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",7684,,,"13388 smartscreen.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591840117722400,,,,,,,716301,,,,,,,,,,,3291623140,140712863203328,140712863203328,679936,,,,,,,,,,,, +"2025-11-19 22:37:20.1177989Z","2025-11-19 22:37:20.1177989Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591840117798900,,,,,,,716301,,,,,,,,,,,3291623140,2261897052160,2261897052160,679936,,,,,,,,,,,, +"2025-11-19 22:37:20.1178688Z","2025-11-19 22:37:20.1178688Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\crypt32.dll",,,,,,,,,,,,,,,,1763591840117868800,,,,,,,1584869,,,,,,,,,,,3438168074,140712849768448,140712849768448,1536000,,,,,,,,,,,, +"2025-11-19 22:37:20.1178750Z","2025-11-19 22:37:20.1178750Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591840117875000,,,,,,,716301,,,,,,,,,,,3291623140,2261897052160,2261897052160,692224,,,,,,,,,,,, +"2025-11-19 22:37:20.1180529Z","2025-11-19 22:37:20.1180529Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,"C:\Windows\System32\ws2_32.dll",,,,,,,,,,,,,,,,1763591840118052900,,,,,,,513405,,,,,,,,,,,3967481067,140712881094656,140712881094656,475136,,,,,,,,,,,, +"2025-11-19 22:37:20.1180716Z","2025-11-19 22:37:20.1180716Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\oleaut32.dll",,,,,,,,,,,,,,,,1763591840118071600,,,,,,,899838,,,,,,,,,,,2878277657,140712880177152,140712880177152,880640,,,,,,,,,,,, +"2025-11-19 22:37:20.1183282Z","2025-11-19 22:37:20.1183282Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",7684,,,"13388 smartscreen.exe",,,"C:\Windows\System32\cryptsp.dll",,,,,,,,,,,,,,,,1763591840118328200,,,,,,,146168,,,,,,,,,,,1658328178,140712839217152,140712839217152,110592,,,,,,,,,,,, +"2025-11-19 22:37:20.1184654Z","2025-11-19 22:37:20.1184654Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,"C:\Windows\System32\shell32.dll",,,,,,,,,,,,,,,,1763591840118465400,,,,,,,7769948,,,,,,,,,,,2341846616,140712869888000,140712869888000,7663616,,,,,,,,,,,, +"2025-11-19 22:37:20.1186873Z","2025-11-19 22:37:20.1186873Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",7684,,,"13388 smartscreen.exe",,,"C:\Windows\System32\dnsapi.dll",,,,,,,,,,,,,,,,1763591840118687300,,,,,,,1293169,,,,,,,,,,,1381219389,140712824274944,140712824274944,1228800,,,,,,,,,,,, +"2025-11-19 22:37:20.1187105Z","2025-11-19 22:37:20.1187105Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,"C:\Windows\System32\WinTypes.dll",,,,,,,,,,,,,,,,1763591840118710500,,,,,,,1524912,,,,,,,,,,,1404855129,140712851341312,140712851341312,1486848,,,,,,,,,,,, +"2025-11-19 22:37:20.1189211Z","2025-11-19 22:37:20.1189211Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,"C:\Windows\System32\wintrust.dll",,,,,,,,,,,,,,,,1763591840118921100,,,,,,,590783,,,,,,,,,,,452262045,140712860844032,140712860844032,520192,,,,,,,,,,,, +"2025-11-19 22:37:20.1190908Z","2025-11-19 22:37:20.1190908Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",11600,,,"13388 smartscreen.exe",,,"C:\Windows\System32\IPHLPAPI.DLL",,,,,,,,,,,,,,,,1763591840119090800,,,,,,,233044,,,,,,,,,,,945822897,140712824012800,140712824012800,212992,,,,,,,,,,,, +"2025-11-19 22:37:20.1191038Z","2025-11-19 22:37:20.1191038Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",3956,,,"13388 smartscreen.exe",,,"C:\Windows\System32\ole32.dll",,,,,,,,,,,,,,,,1763591840119103800,,,,,,,1689904,,,,,,,,,,,1018821057,140712878473216,140712878473216,1667072,,,,,,,,,,,, +"2025-11-19 22:37:20.1211887Z","2025-11-19 22:37:20.1211887Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\nsi.dll",,,,,,,,,,,,,,,,1763591840121188700,,,,,,,111648,,,,,,,,,,,4223476491,140712892956672,140712892956672,40960,,,,,,,,,,,, +"2025-11-19 22:37:20.1217296Z","2025-11-19 22:37:20.1217296Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,,,,,,,1763591840121729600,,,,,,,233556,,,,,,,,,,,1625678811,140712882601984,140712882601984,200704,,,,,,,,,,,, +"2025-11-19 22:37:20.1234427Z","2025-11-19 22:37:20.1234427Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\msasn1.dll",,,,,,,,,,,,,,,,1763591840123442700,,,,,,,150871,,,,,,,,,,,2536054058,140712839675904,140712839675904,77824,,,,,,,,,,,, +"2025-11-19 22:37:20.1241762Z","2025-11-19 22:37:20.1241762Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,,,,,,,,,,,18446633084027277312,18446633084027252736,140711782212992,0,184868790272,3760,1763591840124176200,184871813120,184871804928,140711782212992,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1244097Z","2025-11-19 22:37:20.1244097Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",3760,,,"13388 smartscreen.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591840124409700,,,,,,,158678,,,,,,,,,,,3554393863,140712830631936,140712830631936,110592,,,,,,,,,,,, +"2025-11-19 22:37:20.1247167Z","2025-11-19 22:37:20.1247167Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\bcryptprimitives.dll",,,,,,,,,,,,,,,,1763591840124716700,,,,,,,741046,,,,,,,,,,,2283238626,140712852848640,140712852848640,675840,,,,,,,,,,,, +"2025-11-19 22:37:20.1250862Z","2025-11-19 22:37:20.1250862Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"13388 smartscreen.exe",,,,,,,,,,,,,18446633084027650048,18446633084027625472,140712899206080,0,184868798464,14596,1763591840125086200,184872337408,184872329216,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1253125Z","2025-11-19 22:37:20.1253125Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",14596,,,"13388 smartscreen.exe",,,"C:\Windows\System32\wtdsensor.dll",,,,,,,,,,,,,,,,1763591840125312500,,,,,,,56489,,,,,,,,,,,4237415889,140712681996288,140712681996288,45056,,,,,,,,,,,, +"2025-11-19 22:37:20.1267405Z","2025-11-19 22:37:20.1267405Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,"C:\Windows\System32\clbcatq.dll",,,,,,,,,,,,,,,,1763591840126740500,,,,,,,783429,,,,,,,,,,,2294669044,140712888041472,140712888041472,720896,,,,,,,,,,,, +"2025-11-19 22:37:20.1275908Z","2025-11-19 22:37:20.1275908Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13388 smartscreen.exe",12744,,,"13388 smartscreen.exe",,,,,,,,,,,,,18446633084013084672,18446633084013060096,140712865112144,0,184868806656,13360,1763591840127590800,184872861696,184872853504,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1278602Z","2025-11-19 22:37:20.1278602Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13388 smartscreen.exe",14596,,,"13388 smartscreen.exe",,,,,,,,,,,,,18446633084027764736,18446633084027740160,140712899206080,0,184868814848,6860,1763591840127860200,184873385984,184873377792,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1303812Z","2025-11-19 22:37:20.1303812Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",14596,,,"13388 smartscreen.exe",,,"C:\Windows\System32\smartscreenps.dll",,,,,,,,,,,,,,,,1763591840130381200,,,,,,,151429,,,,,,,,,,,4089359051,140712623865856,140712623865856,122880,,,,,,,,,,,, +"2025-11-19 22:37:20.1319012Z","2025-11-19 22:37:20.1319012Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",14596,,,"13388 smartscreen.exe",,,"C:\Windows\System32\Windows.Management.Workplace.dll",,,,,,,,,,,,,,,,1763591840131901200,,,,,,,215437,,,,,,,,,,,170946563,140712429879296,140712429879296,204800,,,,,,,,,,,, +"2025-11-19 22:37:20.1326328Z","2025-11-19 22:37:20.1326328Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info ","13388 smartscreen.exe",14596,,,"13388 smartscreen.exe",,,"C:\Windows\System32\policymanager.dll",,,,,,,,,,,,,,,,1763591840132632800,,,,,,,769657,,,,,,,,,,,423353507,140712774598656,140712774598656,741376,,,,,,,,,,,, +"2025-11-19 22:37:20.1331654Z","2025-11-19 22:37:20.1331654Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13388 smartscreen.exe",14596,,,"13388 smartscreen.exe",,,,,,,,,,,,,18446633084027478016,18446633084027453440,140711782212992,0,184868823040,11928,1763591840133165400,184873910272,184873902080,140711782212992,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1334794Z","2025-11-19 22:37:20.1334794Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13388 smartscreen.exe",6860,,,"13388 smartscreen.exe",,,,,,,,,,,,,18446633084027736064,18446633084027711488,140712899206080,0,184868831232,8216,1763591840133479400,184874434560,184874426368,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1761396Z","2025-11-19 22:37:20.1761396Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 5184 explorer.exe",15136,,," 5604 attack-890.exe",,,"C:\Users\Public\Downloads\attack-890.exe",,,,,,,,,,,,,,,,1763591840176139600,,,,,134080654410040405,0,0,"0x","","",5184,140,6624,3,0,0,1,1763491559,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1789263Z","2025-11-19 22:37:20.1789263Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",15136,,," 5604 attack-890.exe",,,,,,,,,,,,,18446633084027822080,18446633084027797504,140695618865008,0,867488051200,3452,1763591840178926300,867486007296,867486003200,140695618865008,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1817085Z","2025-11-19 22:37:20.1817085Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5536 svchost.exe",13256,,," 5536 svchost.exe",,,,,,,,,,,,,18446633084027908096,18446633084027883520,140712899206080,132,151912210432,14100,1763591840181708500,151915593728,151915560960,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1844108Z","2025-11-19 22:37:20.1844108Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5536 svchost.exe",13256,,," 5536 svchost.exe",,,,,,,,,,,,,18446633084027879424,18446633084027854848,140712899206080,132,151912218624,2184,1763591840184410800,151916118016,151916085248,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1844961Z","2025-11-19 22:37:20.1844961Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5536 svchost.exe",2184,,," 5536 svchost.exe",,,,,,,,,,,,,18446633084027994112,18446633084027969536,140712899206080,0,151912226816,9180,1763591840184496100,151920836608,151920803840,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1893585Z","2025-11-19 22:37:20.1893585Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Users\Public\Downloads\attack-890.exe",,,,,,,,,,,,,,,,1763591840189358600,,,,,,,0,,,,,,,,,,,1763491559,140695618846720,140695618846720,53248,,,,,,,,,,,, +"2025-11-19 22:37:20.1893886Z","2025-11-19 22:37:20.1893886Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591840189388600,,,,,,,2537167,,,,,,,,,,,2626650689,140712898723840,140712898723840,2523136,,,,,,,,,,,, +"2025-11-19 22:37:20.1901610Z","2025-11-19 22:37:20.1901610Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591840190161000,,,,,,,885660,,,,,,,,,,,2913437033,140712877621248,140712877621248,823296,,,,,,,,,,,, +"2025-11-19 22:37:20.1902585Z","2025-11-19 22:37:20.1902585Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591840190258500,,,,,,,4209945,,,,,,,,,,,2980330054,140712854355968,140712854355968,4161536,,,,,,,,,,,, +"2025-11-19 22:37:20.1912674Z","2025-11-19 22:37:20.1912674Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 5604 attack-890.exe",3452,,,"13300 conhost.exe",,,"C:\Windows\System32\conhost.exe",,,,,,,,,,,,,,,,1763591840191267400,,,,,134080654410205145,0,1035098,"0x","","",5604,6624,6625,3,0,0,1,2671108986,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1924430Z","2025-11-19 22:37:20.1924430Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5604 attack-890.exe",3452,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084027535360,18446633084027510784,140696384751904,0,689119371264,4616,1763591840192443000,689120477184,689120468992,140696384751904,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1947313Z","2025-11-19 22:37:20.1947313Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13300 conhost.exe",4616,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028108800,18446633084028084224,140712899206080,0,689119379456,12308,1763591840194731300,689121001472,689120993280,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1948066Z","2025-11-19 22:37:20.1948066Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13300 conhost.exe",12308,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028137472,18446633084028112896,140712899206080,0,689119387648,3500,1763591840194806600,689121525760,689121517568,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1989205Z","2025-11-19 22:37:20.1989205Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13300 conhost.exe",4616,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028252160,18446633084028227584,140696384580832,0,689119395840,6452,1763591840198920500,689122050048,689122041856,140696384580832,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1990028Z","2025-11-19 22:37:20.1990028Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13300 conhost.exe",3500,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028137472,18446633084028112896,140712899206080,0,689119387648,3500,1763591840199002800,689121525760,689121517568,140712899206080,1810182,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1990139Z","2025-11-19 22:37:20.1990139Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13300 conhost.exe",12308,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028108800,18446633084028084224,140712899206080,0,689119379456,12308,1763591840199013900,689121001472,689120993280,140712899206080,569572,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1991188Z","2025-11-19 22:37:20.1991188Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13300 conhost.exe",4616,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084027535360,18446633084027510784,140696384751904,0,689119371264,4616,1763591840199118900,689120477184,689120460800,140696384751904,22444533,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.1994019Z","2025-11-19 22:37:20.1994019Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13300 conhost.exe",6452,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084027535360,18446633084027510784,140712899206080,0,689119404032,10848,1763591840199401900,689120477184,689120468992,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2042774Z","2025-11-19 22:37:20.2042774Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13300 conhost.exe",6452,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028108800,18446633084028084224,140712865112144,0,689119412224,3620,1763591840204277400,689121001472,689120993280,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2044792Z","2025-11-19 22:37:20.2044792Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028137472,18446633084028112896,140712899206080,0,689119420416,14856,1763591840204479200,689121525760,689121517568,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2046406Z","2025-11-19 22:37:20.2046406Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13300 conhost.exe",14856,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028309504,18446633084028284928,140712899206080,0,689119428608,6828,1763591840204640600,689122574336,689122566144,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2084663Z","2025-11-19 22:37:20.2084663Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2992 svchost.exe",8856,,," 2992 svchost.exe",,,,,,,,,,,,,18446633084028338176,18446633084028313600,140712899206080,186,170617454592,14440,1763591840208466300,170615767040,170615734272,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2118325Z","2025-11-19 22:37:20.2118325Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1040 svchost.exe",4480,,," 632 OpenConsole.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\OpenConsole.exe",,,,,,,,,,,,,,,,1763591840211832500,,,,,134080654410427174,3,1210794,"0x","Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe","App",1040,13,6626,3,0,0,1,1759975785,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2124452Z","2025-11-19 22:37:20.2124452Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",4480,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028022784,18446633084027998208,140702989817872,40,696750407680,5408,1763591840212445200,696748802048,696748797952,140702989817872,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2146117Z","2025-11-19 22:37:20.2146117Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1040 svchost.exe",,,,,,,,,,,,,18446633084028366848,18446633084028342272,140712899206080,0,256031023104,9432,1763591840214611700,256033947648,256033914880,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2198977Z","2025-11-19 22:37:20.2198977Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028424192,18446633084028399616,140712899206080,0,696750415872,3864,1763591840219897700,696752537600,696752533504,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2201168Z","2025-11-19 22:37:20.2201168Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028481536,18446633084028456960,140712899206080,0,696750424064,12484,1763591840220116800,696753586176,696753582080,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2202127Z","2025-11-19 22:37:20.2202127Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 632 OpenConsole.exe",12484,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028510208,18446633084028485632,140712899206080,0,696750432256,14384,1763591840220212700,696754634752,696754630656,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2353969Z","2025-11-19 22:37:20.2353969Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028223488,18446633084028198912,140712865112144,0,696750440448,8232,1763591840235396900,696755683328,696755675136,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2356120Z","2025-11-19 22:37:20.2356120Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028538880,18446633084028514304,140712899206080,0,696750448640,14248,1763591840235612000,696756731904,696756727808,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2357894Z","2025-11-19 22:37:20.2357894Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 632 OpenConsole.exe",14248,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028596224,18446633084028571648,140712899206080,0,696750456832,10496,1763591840235789400,696757780480,696757776384,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2599092Z","2025-11-19 22:37:20.2599092Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1040 svchost.exe",4480,,,"13248 WindowsTerminal.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe",,,,,,,,,,,,,,,,1763591840259909200,,,,,134080654410898354,3,738129,"0x","Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe","App",1040,13,6627,3,0,0,1,1759975821,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2605834Z","2025-11-19 22:37:20.2605834Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",4480,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028624896,18446633084028600320,140702319920256,40,932562440192,2344,1763591840260583400,932564697088,932564692992,140702319920256,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2738132Z","2025-11-19 22:37:20.2738132Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028080128,18446633084028055552,140712899206080,0,932562448384,6140,1763591840273813200,932565745664,932565741568,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2742321Z","2025-11-19 22:37:20.2742321Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028682240,18446633084028657664,140712899206080,0,932562456576,3272,1763591840274232100,932566794240,932566790144,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2752392Z","2025-11-19 22:37:20.2752392Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",3272,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028710912,18446633084028686336,140712899206080,0,932562464768,12328,1763591840275239200,932567842816,932567838720,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2876075Z","2025-11-19 22:37:20.2876075Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084010672128,18446633084010647552,140712899206080,0,932562472960,10628,1763591840287607500,932568891392,932568887296,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2899172Z","2025-11-19 22:37:20.2899172Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028739584,18446633084028715008,140712865112144,0,932562481152,11164,1763591840289917200,932569939968,932569931776,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.2901850Z","2025-11-19 22:37:20.2901850Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",10628,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028768256,18446633084028743680,140712899206080,0,932562489344,9736,1763591840290185100,932570988544,932570984448,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3093537Z","2025-11-19 22:37:20.3093537Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3204 Taskmgr.exe",5876,,," 3204 Taskmgr.exe",,,,,,,,,,,,,18446633084027248640,18446633084027224064,140712891292720,0,552496762880,15292,1763591840309353700,552499937280,552499929088,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3148892Z","2025-11-19 22:37:20.3148892Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4340 sihost.exe",10460,,," 4340 sihost.exe",,,,,,,,,,,,,18446633084028825600,18446633084028801024,140712899206080,0,645639995392,13916,1763591840314889200,645642321920,645642313728,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3153193Z","2025-11-19 22:37:20.3153193Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029026304,18446633084029001728,140712891292720,0,932562497536,11792,1763591840315319300,932572037120,932572033024,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3206848Z","2025-11-19 22:37:20.3206848Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029173760,18446633084029149184,140712600145104,0,932562505728,7808,1763591840320684800,932573085696,932573081600,140712600145104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3207124Z","2025-11-19 22:37:20.3207124Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028854272,18446633084028829696,140712604173856,0,932562513920,13488,1763591840320712400,932574134272,932574130176,140712604173856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3350748Z","2025-11-19 22:37:20.3350748Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",7808,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029173760,18446633084029149184,140712600145104,0,932562505728,7808,1763591840335074800,932573085696,932573057024,140712600145104,47684873,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.3353558Z","2025-11-19 22:37:20.3353558Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029173760,18446633084029149184,140712632221632,0,932562522112,4192,1763591840335355800,932573085696,932573081600,140712632221632,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4409754Z","2025-11-19 22:37:20.4409754Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 632 OpenConsole.exe",14248,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084029116416,18446633084029091840,140702989217024,0,696750465024,8552,1763591840440975400,696758829056,696758824960,140702989217024,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4410144Z","2025-11-19 22:37:20.4410144Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 632 OpenConsole.exe",14248,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028911616,18446633084028887040,140702989233856,0,696750473216,12624,1763591840441014400,696759877632,696759873536,140702989233856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4411382Z","2025-11-19 22:37:20.4411382Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084056907776,18446633084056883200,140712899206080,0,932562530304,13068,1763591840441138200,932575182848,932575178752,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4421089Z","2025-11-19 22:37:20.4421089Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13300 conhost.exe",6452,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084029374464,18446633084029349888,140696385038832,0,689119436800,4352,1763591840442108900,689123098624,689123090432,140696385038832,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4439257Z","2025-11-19 22:37:20.4439257Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028395520,18446633084028370944,140702989086576,0,696750481408,1184,1763591840443925700,696760926208,696760922112,140702989086576,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4452004Z","2025-11-19 22:37:20.4452004Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084029231104,18446633084029206528,140702989404080,0,696750489600,9776,1763591840445200400,696761974784,696761970688,140702989404080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4464556Z","2025-11-19 22:37:20.4464556Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084027793408,18446633084027768832,140712583404848,0,932562538496,4376,1763591840446455600,932576231424,932576227328,140712583404848,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4469069Z","2025-11-19 22:37:20.4469069Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",13068,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029317120,18446633084029292544,140712899206080,0,932562546688,9352,1763591840446906900,932577280000,932577275904,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.4800926Z","2025-11-19 22:37:20.4800926Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9388 devenv.exe",6884,,," 9388 devenv.exe",,,,,,,,,,,,,18446633083996995584,18446633083996971008,140712899206080,0,1033377136640,6884,1763591840480092600,1033431941120,1033431932928,140712899206080,158801,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5057422Z","2025-11-19 22:37:20.5057422Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028653568,18446633084028628992,140712865112144,0,932562554880,13692,1763591840505742200,932578328576,932578320384,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5442487Z","2025-11-19 22:37:20.5442487Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029632512,18446633084029607936,140712373211440,0,932562563072,6612,1763591840544248700,932579377152,932579373056,140712373211440,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5443223Z","2025-11-19 22:37:20.5443223Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028882944,18446633084028858368,140712378637616,0,932562571264,6260,1763591840544322300,932580425728,932580421632,140712378637616,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5475582Z","2025-11-19 22:37:20.5475582Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\apphelp.dll",,,,,,,,,,,,,,,,1763591840547558200,,,,,,,675806,,,,,,,,,,,4108425587,140712800485376,140712800485376,651264,,,,,,,,,,,, +"2025-11-19 22:37:20.5478450Z","2025-11-19 22:37:20.5478450Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",6260,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029947904,18446633084029923328,140712899206080,0,932562579456,14632,1763591840547845000,932581474304,932581470208,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5508273Z","2025-11-19 22:37:20.5508273Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591840550827300,,,,,,,761372,,,,,,,,,,,71854833,140712881618944,140712881618944,737280,,,,,,,,,,,, +"2025-11-19 22:37:20.5509553Z","2025-11-19 22:37:20.5509553Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591840550955300,,,,,,,760295,,,,,,,,,,,460960534,140712894529536,140712894529536,692224,,,,,,,,,,,, +"2025-11-19 22:37:20.5510805Z","2025-11-19 22:37:20.5510805Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,,,,,,,,,,,18446633084029747200,18446633084029722624,140712899206080,0,867488059392,5960,1763591840551080500,867490070528,867490066432,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5511743Z","2025-11-19 22:37:20.5511743Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591840551174300,,,,,,,716301,,,,,,,,,,,3291623140,140712863203328,140712863203328,679936,,,,,,,,,,,, +"2025-11-19 22:37:20.5513846Z","2025-11-19 22:37:20.5513846Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591840551384600,,,,,,,1193108,,,,,,,,,,,4275633056,140712897216512,140712897216512,1146880,,,,,,,,,,,, +"2025-11-19 22:37:20.5515459Z","2025-11-19 22:37:20.5515459Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5604 attack-890.exe",5960,,," 5604 attack-890.exe",,,,,,,,,,,,,18446633084029718528,18446633084029693952,140712899206080,0,867488067584,8672,1763591840551545900,867491119104,867491115008,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5515805Z","2025-11-19 22:37:20.5515805Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591840551580500,,,,,,,1436013,,,,,,,,,,,1441720767,140712859467776,140712859467776,1355776,,,,,,,,,,,, +"2025-11-19 22:37:20.5516458Z","2025-11-19 22:37:20.5516458Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5604 attack-890.exe",8672,,," 5604 attack-890.exe",,,,,,,,,,,,,18446633084029460480,18446633084029435904,140712899206080,0,867488075776,12460,1763591840551645800,867492167680,867492163584,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.5518883Z","2025-11-19 22:37:20.5518883Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",8672,,," 5604 attack-890.exe",,,"C:\Windows\System32\msvcp140.dll",,,,,,,,,,,,,,,,1763591840551888300,,,,,,,570439,,,,,,,,,,,1564323704,140711213137920,140711213137920,561152,,,,,,,,,,,, +"2025-11-19 22:37:20.5518888Z","2025-11-19 22:37:20.5518888Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",12460,,," 5604 attack-890.exe",,,"C:\Windows\System32\vcruntime140.dll",,,,,,,,,,,,,,,,1763591840551888800,,,,,,,146072,,,,,,,,,,,254123393,140712353988608,140712353988608,122880,,,,,,,,,,,, +"2025-11-19 22:37:20.5518982Z","2025-11-19 22:37:20.5518982Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\vcruntime140_1.dll",,,,,,,,,,,,,,,,1763591840551898200,,,,,,,57827,,,,,,,,,,,240324076,140712354119680,140712354119680,49152,,,,,,,,,,,, +"2025-11-19 22:37:21.377891300Z","2025-11-19 22:37:20.5537813Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Injector started with PID 5604",,,,,,,,,,,,,,,,,1763591840553781300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.6045242Z","2025-11-19 22:37:20.6045242Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",10628,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029546496,18446633084029521920,140712899206080,0,932562587648,3424,1763591840604524200,932582522880,932582518784,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.6242698Z","2025-11-19 22:37:20.6242698Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028968960,18446633084028944384,140712899206080,0,932562595840,14684,1763591840624269800,932583571456,932583567360,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.6245269Z","2025-11-19 22:37:20.6245269Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",14684,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029976576,18446633084029952000,140712899206080,0,932562604032,13344,1763591840624526900,932584620032,932584615936,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.6247078Z","2025-11-19 22:37:20.6247078Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",13344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084030005248,18446633084029980672,140712899206080,0,932562612224,6564,1763591840624707800,932585668608,932585664512,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.6252373Z","2025-11-19 22:37:20.6252373Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",6564,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084030033920,18446633084030009344,140712899206080,0,932562620416,12924,1763591840625237300,932586717184,932586713088,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.6254041Z","2025-11-19 22:37:20.6254041Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13248 WindowsTerminal.exe",12924,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084030062592,18446633084030038016,140712899206080,0,932562628608,13704,1763591840625404100,932587765760,932587761664,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:21.477249300Z","2025-11-19 22:37:20.6551680Z","myETW","EDRi-Provider",4242,"EDRiTask"," 7508 EDRi.exe",,,,,,"After starting the attack exe",,,,,,,,,,,,,,,,,1763591840655168000,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.6886346Z","2025-11-19 22:37:20.6886346Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4392 MsMpEng.exe",5064,,," 4392 MsMpEng.exe",,,,,,,,,,,,,18446633084030177280,18446633084030152704,140712899206080,247,389820030976,14760,1763591840688634600,389842731008,389842665472,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.6886949Z","2025-11-19 22:37:20.6886949Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4392 MsMpEng.exe",5064,,," 4392 MsMpEng.exe",,,,,,,,,,,,,18446633084030205952,18446633084030181376,140712647800224,247,389820039168,8032,1763591840688695000,389849022464,389848956928,140712647800224,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.6889335Z","2025-11-19 22:37:20.6889335Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4392 MsMpEng.exe",14760,,," 4392 MsMpEng.exe",,,,,,,,,,,,,18446633084030263296,18446633084030238720,140712899206080,0,389820047360,4232,1763591840688933500,389849546752,389849481216,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.7236916Z","2025-11-19 22:37:20.7236916Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 4392 MsMpEng.exe",8032,,," 4392 MsMpEng.exe",,,,,,,,,,,,,18446633084030205952,18446633084030181376,140712647800224,247,389820039168,8032,1763591840723691600,389849022464,389848956928,140712647800224,428874,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.7244852Z","2025-11-19 22:37:20.7244852Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3492 svchost.exe",5904,,," 3492 svchost.exe",,,,,,,,,,,,,18446633084030492672,18446633084030468096,140712850417280,51,390180667392,11232,1763591840724485200,390182993920,390182961152,140712850417280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:20.8298783Z","2025-11-19 22:37:20.8298783Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 9692 PerfWatson2.exe",9752,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084030607360,18446633084030582784,140711612509856,0,1046354423808,12036,1763591840829878300,1046352232448,1046352216064,140711612509856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:21.1973315Z","2025-11-19 22:37:21.1973315Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9920 ServiceHub.IntellicodeModelService.exe",4196,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,18446633084027449344,18446633084027424768,140711612509856,0,46015676416,4196,1763591841197331500,46012694528,46012678144,140711612509856,1084450,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.337559700Z","2025-11-19 22:37:21.5329408Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Running 'standard' config",,,,,,,,,,,,,,,,,1763591841532940800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.337798100Z","2025-11-19 22:37:21.5331820Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Before starting subprocess to inject to",,,,,,,,,,,,,,,,,1763591841533182000,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:21.5339696Z","2025-11-19 22:37:21.5339696Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 5604 attack-890.exe",3452,,," 7284 whoami.exe",,,"C:\Windows\System32\whoami.exe",,,,,,,,,,,,,,,,1763591841533969600,,,,,134080654423385232,0,160109,"0x","","",5604,6624,6628,3,0,0,1,3602411345,,,,,,,,,,,,,,, +"2025-11-19 22:37:21.5373410Z","2025-11-19 22:37:21.5373410Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5604 attack-890.exe",3452,,," 7284 whoami.exe",,,,,,,,,,,,,18446633084031127552,18446633084031102976,140702344617136,0,705865940992,14048,1763591841537341000,705864925184,705864916992,140702344617136,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.345203800Z","2025-11-19 22:37:21.5407378Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"After starting subprocess with PID 7284",,,,,,,,,,,,,,,,,1763591841540737800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:21.6656904Z","2025-11-19 22:37:21.6656904Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8972 VBoxTray.exe",9020,,," 8972 VBoxTray.exe",,,,,,,,,,,,,18446633084031156224,18446633084031131648,140700131109808,0,471283195904,13812,1763591841665690400,471299260416,471299256320,140700131109808,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:21.6659145Z","2025-11-19 22:37:21.6659145Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8972 VBoxTray.exe",13812,,," 8972 VBoxTray.exe",,,,,,,,,,,,,18446633084031156224,18446633084031131648,140700131109808,0,471283195904,13812,1763591841665914500,471299260416,471299252224,140700131109808,462070,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:21.7818665Z","2025-11-19 22:37:21.7818665Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5884 SearchProtocolHost.exe",2628,,," 5884 SearchProtocolHost.exe",,,,,,,,,,,,,18446633084030406656,18446633084030382080,140712899206080,0,100230713344,14588,1763591841781866500,100232331264,100232298496,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.1405740Z","2025-11-19 22:37:22.1405740Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","12492 vcpkgsrv.exe",5660,,,"12492 vcpkgsrv.exe",,,,,,,,,,,,,18446633083994841088,18446633083994816512,1996775712,0,2646016,5660,1763591842140574000,82115456,82083840,1996775712,8294629,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.1405740Z","2025-11-19 22:37:22.1405740Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","12492 vcpkgsrv.exe",11756,,,"12492 vcpkgsrv.exe",,,,,,,,,,,,,18446633083994554368,18446633083994529792,1996775712,0,2678784,11756,1763591842140574000,82639744,82608128,1996775712,7370867,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.1405831Z","2025-11-19 22:37:22.1405831Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","12492 vcpkgsrv.exe",12180,,,"12492 vcpkgsrv.exe",,,,,,,,,,,,,18446633083994812416,18446633083994787840,1996775712,0,2662400,12180,1763591842140583100,82377600,82345984,1996775712,6546307,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.1562316Z","2025-11-19 22:37:22.1562316Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6836 vcpkgsrv.exe",7868,,," 6836 vcpkgsrv.exe",,,,,,,,,,,,,18446633083994869760,18446633083994845184,1996775712,0,3006464,7868,1763591842156231600,92011392,91979776,1996775712,9602384,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.1562444Z","2025-11-19 22:37:22.1562444Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6836 vcpkgsrv.exe",9036,,," 6836 vcpkgsrv.exe",,,,,,,,,,,,,18446633083993722880,18446633083993698304,1996775712,0,2990080,9036,1763591842156244400,87554944,87523328,1996775712,7058542,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.1562554Z","2025-11-19 22:37:22.1562554Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6836 vcpkgsrv.exe",5384,,," 6836 vcpkgsrv.exe",,,,,,,,,,,,,18446633083994296320,18446633083994271744,1996775712,0,2973696,5384,1763591842156255400,81066880,81035264,1996775712,4502262,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.3316961Z","2025-11-19 22:37:22.3316961Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",12036,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084030607360,18446633084030582784,140711612509856,0,1046354423808,12036,1763591842331696100,1046352232448,1046352216064,140711612509856,931306,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:23.308564200Z","2025-11-19 22:37:22.5236651Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Before opening process handle",,,,,,,,,,,,,,,,,1763591842523665100,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:23.308868400Z","2025-11-19 22:37:22.5239746Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"After opening process handle",,,,,,,,,,,,,,,,,1763591842523974600,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.8295591Z","2025-11-19 22:37:22.8295591Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 9388 devenv.exe",9392,,," 9388 devenv.exe",,,,,,,,,,,,,18446633084031385600,18446633084031361024,140711613062896,0,1033377177600,7724,1763591842829559100,1033415163904,1033415155712,140711613062896,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:22.8335220Z","2025-11-19 22:37:22.8335220Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9388 devenv.exe",7724,,," 9388 devenv.exe",,,,,,,,,,,,,18446633084031385600,18446633084031361024,140711613062896,0,1033377177600,7724,1763591842833522000,1033415163904,1033415143424,140711613062896,14353592,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:24.262849900Z","2025-11-19 22:37:23.4973313Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Before allocating memory for shellcode",,,,,,,,,,,,,,,,,1763591843497331300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:24.263130400Z","2025-11-19 22:37:23.4976143Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"After allocating memory for shellcode at 00000249213E0000",,,,,,,,,,,,,,,,,1763591843497614300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:25.227755400Z","2025-11-19 22:37:24.4818310Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Before writing shellcode to process",,,,,,,,,,,,,,,,,1763591844481831000,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:25.228060100Z","2025-11-19 22:37:24.4821409Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"After writing shellcode to process at 00000249213E0000",,,,,,,,,,,,,,,,,1763591844482140900,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:25.2014730Z","2025-11-19 22:37:25.2014730Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5184 explorer.exe",15136,,," 5184 explorer.exe",,,,,,,,,,,,,18446633084027592704,18446633084027568128,140712891545280,0,15360000,15136,1763591845201473000,470351872,470294528,140712891545280,63346597,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:25.3923641Z","2025-11-19 22:37:25.3923641Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","10404 NisSrv.exe",4312,,,"10404 NisSrv.exe",,,,,,,,,,,,,18446633083999313920,18446633083999289344,140712899206080,0,792924913664,4312,1763591845392364100,792924389376,792924323840,140712899206080,494887,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:25.3923667Z","2025-11-19 22:37:25.3923667Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3604 dllhost.exe",11476,,," 3604 dllhost.exe",,,,,,,,,,,,,18446633083999285248,18446633083999260672,140712899206080,0,256852123648,11476,1763591845392366700,256853934080,256853901312,140712899206080,241408,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.182844300Z","2025-11-19 22:37:25.4563155Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Before changing memory protection to PAGE_EXECUTE_READ",,,,,,,,,,,,,,,,,1763591845456315500,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.183142300Z","2025-11-19 22:37:25.4566185Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"After changing memory protection to PAGE_EXECUTE_READ",,,,,,,,,,,,,,,,,1763591845456618500,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:25.6312786Z","2025-11-19 22:37:25.6312786Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3232 dllhost.exe",8960,,," 3232 dllhost.exe",,,,,,,,,,,,,18446633084035751936,18446633084035727360,140712899206080,0,493780983808,8960,1763591845631278600,493783875584,493783842816,140712899206080,221416,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4082033Z","2025-11-19 22:37:26.4082033Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"10404 NisSrv.exe",,,,,,,,,,,,,18446633083999313920,18446633083999289344,140712899206080,0,792924921856,6856,1763591846408203300,792924389376,792924323840,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4083766Z","2025-11-19 22:37:26.4083766Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3604 dllhost.exe",,,,,,,,,,,,,18446633084031959040,18446633084031934464,140712899206080,0,256852131840,8832,1763591846408376600,256853934080,256853901312,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.147034500Z","2025-11-19 22:37:26.4400898Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Before reading memory to verify write",,,,,,,,,,,,,,,,,1763591846440089800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.147308700Z","2025-11-19 22:37:26.4403653Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Before creating remote thread",,,,,,,,,,,,,,,,,1763591846440365300,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4406187Z","2025-11-19 22:37:26.4406187Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5604 attack-890.exe",3452,,," 7284 whoami.exe",,,,,,,,,,,,,18446633084031987712,18446633084031963136,2513113579520,0,705865949184,14412,1763591846440618700,705865449472,705865441280,2513113579520,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.147575800Z","2025-11-19 22:37:26.4406370Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"After creating remote thread",,,,,,,,,,,,,,,,,1763591846440637000,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4407225Z","2025-11-19 22:37:26.4407225Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\whoami.exe",,,,,,,,,,,,,,,,1763591846440722500,,,,,,,160109,,,,,,,,,,,3602411345,140702344609792,140702344609792,98304,,,,,,,,,,,, +"2025-11-19 22:37:26.4407621Z","2025-11-19 22:37:26.4407621Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591846440762100,,,,,,,2537167,,,,,,,,,,,2626650689,140712898723840,140712898723840,2523136,,,,,,,,,,,, +"2025-11-19 22:37:26.4441987Z","2025-11-19 22:37:26.4441987Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591846444198700,,,,,,,885660,,,,,,,,,,,2913437033,140712877621248,140712877621248,823296,,,,,,,,,,,, +"2025-11-19 22:37:26.4443217Z","2025-11-19 22:37:26.4443217Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591846444321700,,,,,,,4209945,,,,,,,,,,,2980330054,140712854355968,140712854355968,4161536,,,,,,,,,,,, +"2025-11-19 22:37:26.4457000Z","2025-11-19 22:37:26.4457000Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\apphelp.dll",,,,,,,,,,,,,,,,1763591846445700000,,,,,,,675806,,,,,,,,,,,4108425587,140712800485376,140712800485376,651264,,,,,,,,,,,, +"2025-11-19 22:37:26.4474777Z","2025-11-19 22:37:26.4474777Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591846447477700,,,,,,,761372,,,,,,,,,,,71854833,140712881618944,140712881618944,737280,,,,,,,,,,,, +"2025-11-19 22:37:26.4475785Z","2025-11-19 22:37:26.4475785Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591846447578500,,,,,,,760295,,,,,,,,,,,460960534,140712894529536,140712894529536,692224,,,,,,,,,,,, +"2025-11-19 22:37:26.4476640Z","2025-11-19 22:37:26.4476640Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,,,,,,,,,,,18446633084032073728,18446633084032049152,140712899206080,0,705865957376,2340,1763591846447664000,705868333056,705868324864,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4477295Z","2025-11-19 22:37:26.4477295Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591846447729500,,,,,,,716301,,,,,,,,,,,3291623140,140712863203328,140712863203328,679936,,,,,,,,,,,, +"2025-11-19 22:37:26.4479501Z","2025-11-19 22:37:26.4479501Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591846447950100,,,,,,,1193108,,,,,,,,,,,4275633056,140712897216512,140712897216512,1146880,,,,,,,,,,,, +"2025-11-19 22:37:26.4481009Z","2025-11-19 22:37:26.4481009Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 7284 whoami.exe",2340,,," 7284 whoami.exe",,,,,,,,,,,,,18446633084032102400,18446633084032077824,140712899206080,0,705865965568,10456,1763591846448100900,705868857344,705868849152,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4481023Z","2025-11-19 22:37:26.4481023Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591846448102300,,,,,,,1923284,,,,,,,,,,,675224942,140712888827904,140712888827904,1863680,,,,,,,,,,,, +"2025-11-19 22:37:26.4483317Z","2025-11-19 22:37:26.4483317Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591846448331700,,,,,,,230350,,,,,,,,,,,2551303736,140712858550272,140712858550272,159744,,,,,,,,,,,, +"2025-11-19 22:37:26.4484701Z","2025-11-19 22:37:26.4484701Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591846448470100,,,,,,,230873,,,,,,,,,,,527442843,140712882405376,140712882405376,176128,,,,,,,,,,,, +"2025-11-19 22:37:26.4485775Z","2025-11-19 22:37:26.4485775Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591846448577500,,,,,,,1243850,,,,,,,,,,,792084382,140712861433856,140712861433856,1228800,,,,,,,,,,,, +"2025-11-19 22:37:26.4486883Z","2025-11-19 22:37:26.4486883Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591846448688300,,,,,,,700029,,,,,,,,,,,3371602543,140712858746880,140712858746880,667648,,,,,,,,,,,, +"2025-11-19 22:37:26.4487781Z","2025-11-19 22:37:26.4487781Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591846448778100,,,,,,,1436013,,,,,,,,,,,1441720767,140712859467776,140712859467776,1355776,,,,,,,,,,,, +"2025-11-19 22:37:26.4489528Z","2025-11-19 22:37:26.4489528Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 7284 whoami.exe",10456,,," 7284 whoami.exe",,,,,,,,,,,,,18446633084032131072,18446633084032106496,140712899206080,0,705865973760,14716,1763591846448952800,705869381632,705869373440,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4489859Z","2025-11-19 22:37:26.4489859Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\ws2_32.dll",,,,,,,,,,,,,,,,1763591846448985900,,,,,,,513405,,,,,,,,,,,3967481067,140712881094656,140712881094656,475136,,,,,,,,,,,, +"2025-11-19 22:37:26.4490753Z","2025-11-19 22:37:26.4490753Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4392 MsMpEng.exe",4916,,," 4392 MsMpEng.exe",,,,,,,,,,,,,18446633084032159744,18446633084032135168,140712899206080,0,389820055552,1844,1763591846449075300,389849022464,389848956928,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4493466Z","2025-11-19 22:37:26.4493466Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",10456,,," 7284 whoami.exe",,,"C:\Windows\System32\version.dll",,,,,,,,,,,,,,,,1763591846449346600,,,,,,,72452,,,,,,,,,,,2275202464,140712753168384,140712753168384,45056,,,,,,,,,,,, +"2025-11-19 22:37:26.4493531Z","2025-11-19 22:37:26.4493531Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14716,,," 7284 whoami.exe",,,"C:\Windows\System32\authz.dll",,,,,,,,,,,,,,,,1763591846449353100,,,,,,,372179,,,,,,,,,,,771731569,140712826241024,140712826241024,327680,,,,,,,,,,,, +"2025-11-19 22:37:26.4493680Z","2025-11-19 22:37:26.4493680Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\wkscli.dll",,,,,,,,,,,,,,,,1763591846449368000,,,,,,,170846,,,,,,,,,,,1225555544,140712738291712,140712738291712,110592,,,,,,,,,,,, +"2025-11-19 22:37:26.4494965Z","2025-11-19 22:37:26.4494965Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",2340,,," 7284 whoami.exe",,,"C:\Windows\System32\sspicli.dll",,,,,,,,,,,,,,,,1763591846449496500,,,,,,,339222,,,,,,,,,,,3030302172,140712833384448,140712833384448,299008,,,,,,,,,,,, +"2025-11-19 22:37:26.4498152Z","2025-11-19 22:37:26.4498152Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",10456,,," 7284 whoami.exe",,,"C:\Windows\System32\netutils.dll",,,,,,,,,,,,,,,,1763591846449815200,,,,,,,80696,,,,,,,,,,,865845000,140712825847808,140712825847808,53248,,,,,,,,,,,, +"2025-11-19 22:37:26.4515038Z","2025-11-19 22:37:26.4515038Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,,,,,,,1763591846451503800,,,,,,,233556,,,,,,,,,,,1625678811,140712882601984,140712882601984,200704,,,,,,,,,,,, +"2025-11-19 22:37:26.4541760Z","2025-11-19 22:37:26.4541760Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 7284 whoami.exe",14412,,," 3812 calc.exe",,,"C:\Windows\System32\calc.exe",,,,,,,,,,,,,,,,1763591846454176000,,,,,134080654471607920,0,90741,"0x","","",7284,6628,6629,3,0,0,1,4001445627,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4568912Z","2025-11-19 22:37:26.4568912Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 7284 whoami.exe",14412,,," 3812 calc.exe",,,,,,,,,,,,,18446633084032245760,18446633084032221184,140696878126912,0,801455390720,10660,1763591846456891200,801453899776,801453891584,140696878126912,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4644282Z","2025-11-19 22:37:26.4644282Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3812 calc.exe",10660,,," 3812 calc.exe",,,,,,,,,,,,,18446633084032274432,18446633084032249856,140712899206080,0,801455398912,7976,1763591846464428200,801456521216,801456513024,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4645279Z","2025-11-19 22:37:26.4645279Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3812 calc.exe",7976,,," 3812 calc.exe",,,,,,,,,,,,,18446633084032331776,18446633084032307200,140712899206080,0,801455407104,14584,1763591846464527900,801457045504,801457037312,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4650967Z","2025-11-19 22:37:26.4650967Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3812 calc.exe",14584,,," 3812 calc.exe",,,,,,,,,,,,,18446633084032389120,18446633084032364544,140712899206080,0,801455415296,6196,1763591846465096700,801457569792,801457561600,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4718323Z","2025-11-19 22:37:26.4718323Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3812 calc.exe",10660,,," 3812 calc.exe",,,,,,,,,,,,,18446633084032417792,18446633084032393216,140712891545280,0,801455423488,6204,1763591846471832300,801458094080,801458085888,140712891545280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4722524Z","2025-11-19 22:37:26.4722524Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 7284 whoami.exe",14716,,," 7284 whoami.exe",,,,,,,,,,,,,18446633084032131072,18446633084032106496,140712899206080,0,705865973760,14716,1763591846472252400,705869381632,705869373440,140712899206080,2406535,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4722566Z","2025-11-19 22:37:26.4722566Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 7284 whoami.exe",2340,,," 7284 whoami.exe",,,,,,,,,,,,,18446633084032073728,18446633084032049152,140712899206080,0,705865957376,2340,1763591846472256600,705868333056,705868320768,140712899206080,4734616,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4722886Z","2025-11-19 22:37:26.4722886Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 7284 whoami.exe",10456,,," 7284 whoami.exe",,,,,,,,,,,,,18446633084032102400,18446633084032077824,140712899206080,0,705865965568,10456,1763591846472288600,705868857344,705868849152,140712899206080,4410225,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4723088Z","2025-11-19 22:37:26.4723088Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 7284 whoami.exe",14048,,," 7284 whoami.exe",,,,,,,,,,,,,18446633084031127552,18446633084031102976,140702344617136,0,705865940992,14048,1763591846472308800,705864925184,705864916992,140702344617136,41492,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4728396Z","2025-11-19 22:37:26.4728396Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 700 lsass.exe",1344,,," 700 lsass.exe",,,,,,,,,,,,,18446633084031127552,18446633084031102976,140712899206080,0,81706905600,12956,1763591846472839600,81709760512,81709711360,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4748159Z","2025-11-19 22:37:26.4748159Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1016 services.exe",2816,,," 5784 svchost.exe",,,"C:\Windows\System32\svchost.exe",,,,,,,,,,,,,,,,1763591846474815900,,,,,134080654471810362,0,143552,"0x","","",1016,11,6630,1,1,0,0,14788416,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4754583Z","2025-11-19 22:37:26.4754583Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1016 services.exe",2816,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084032217088,18446633084032192512,140696171073504,0,513414782976,14348,1763591846475458300,513413939200,513413922816,140696171073504,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4816419Z","2025-11-19 22:37:26.4816419Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5784 svchost.exe",14348,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084032102400,18446633084032077824,140712899206080,0,513414791168,12200,1763591846481641900,513416888320,513416855552,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4835328Z","2025-11-19 22:37:26.4835328Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1016 services.exe",,,,,,,,,,,,,18446633084032073728,18446633084032049152,140712899206080,0,156998295552,6816,1763591846483532800,156996403200,156996370432,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4837740Z","2025-11-19 22:37:26.4837740Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084032131072,18446633084032106496,140712899206080,0,513414799360,5288,1763591846483774000,513417412608,513417379840,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4839041Z","2025-11-19 22:37:26.4839041Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5784 svchost.exe",14348,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084032503808,18446633084032479232,140712863364608,0,513414807552,8604,1763591846483904100,513417936896,513417904128,140712863364608,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4844347Z","2025-11-19 22:37:26.4844347Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5784 svchost.exe",12200,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084032532480,18446633084032507904,140712899206080,0,513414815744,2748,1763591846484434700,513418461184,513418428416,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4845003Z","2025-11-19 22:37:26.4845003Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5784 svchost.exe",2748,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084032589824,18446633084032565248,140712899206080,0,513414823936,8772,1763591846484500300,513418985472,513418952704,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4877533Z","2025-11-19 22:37:26.4877533Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5784 svchost.exe",8604,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084032618496,18446633084032593920,140712378178112,243,513414832128,3068,1763591846487753300,513419509760,513419476992,140712378178112,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4882101Z","2025-11-19 22:37:26.4882101Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5784 svchost.exe",8604,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084032675840,18446633084032651264,140712378080832,243,513414840320,14092,1763591846488210100,513420034048,513420001280,140712378080832,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4883853Z","2025-11-19 22:37:26.4883853Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5784 svchost.exe",8604,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084032503808,18446633084032479232,140712863364608,0,513414807552,8604,1763591846488385300,513417936896,513417904128,140712863364608,9893579,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4969809Z","2025-11-19 22:37:26.4969809Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 5784 svchost.exe",5288,,,"13020 WerFault.exe",,,"C:\Windows\System32\WerFault.exe",,,,,,,,,,,,,,,,1763591846496980900,,,,,134080654472027581,0,681036,"0x","","",5784,6630,6631,1,1,0,0,630084362,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.4984170Z","2025-11-19 22:37:26.4984170Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5784 svchost.exe",5288,,,"13020 WerFault.exe",,,,,,,,,,,,,18446633084032704512,18446633084032679936,140702556693600,243,4297187328,14996,1763591846498417000,4295491584,4295483392,140702556693600,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5034888Z","2025-11-19 22:37:26.5034888Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",13052,,," 1040 svchost.exe",,,,,,,,,,,,,18446633084032733184,18446633084032708608,140712899206080,0,256031031296,8500,1763591846503488800,256034471936,256034439168,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5037125Z","2025-11-19 22:37:26.5037125Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",8500,,," 1040 svchost.exe",,,,,,,,,,,,,18446633084032790528,18446633084032765952,140712899206080,0,256031047680,12540,1763591846503712500,256035520512,256035487744,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5037392Z","2025-11-19 22:37:26.5037392Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1016 services.exe",2816,,," 1016 services.exe",,,,,,,,,,,,,18446633084032819200,18446633084032794624,140712899206080,0,156998303744,11304,1763591846503739200,156999614464,156999581696,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5038480Z","2025-11-19 22:37:26.5038480Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,,,,,,,,,,,18446633084032847872,18446633084032823296,140712899206080,0,4297195520,9800,1763591846503848000,4296015872,4296007680,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5039283Z","2025-11-19 22:37:26.5039283Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13020 WerFault.exe",9800,,,"13020 WerFault.exe",,,,,,,,,,,,,18446633084032876544,18446633084032851968,140712899206080,0,4297203712,8392,1763591846503928300,4296540160,4296531968,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5042908Z","2025-11-19 22:37:26.5042908Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084032966656,18446633084032942080,140712899206080,0,513414848512,14268,1763591846504290800,513417936896,513417904128,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5044925Z","2025-11-19 22:37:26.5044925Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13020 WerFault.exe",8392,,,"13020 WerFault.exe",,,,,,,,,,,,,18446633084033167360,18446633084033142784,140712899206080,0,4297211904,11612,1763591846504492500,4297064448,4297056256,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5050066Z","2025-11-19 22:37:26.5050066Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3812 calc.exe",6204,,," 3812 calc.exe",,,,,,,,,,,,,18446633084033224704,18446633084033200128,140712865112144,0,801455431680,2088,1763591846505006600,801458618368,801458610176,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5052250Z","2025-11-19 22:37:26.5052250Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3812 calc.exe",,,,,,,,,,,,,18446633084033310720,18446633084033286144,140712899206080,0,801455439872,652,1763591846505225000,801459142656,801459134464,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5053978Z","2025-11-19 22:37:26.5053978Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3812 calc.exe",652,,," 3812 calc.exe",,,,,,,,,,,,,18446633084033368064,18446633084033343488,140712899206080,0,801455448064,3100,1763591846505397800,801459666944,801459658752,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5152530Z","2025-11-19 22:37:26.5152530Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1984 svchost.exe",12532,,," 1984 svchost.exe",,,,,,,,,,,,,18446633084033511424,18446633084033486848,140712899206080,210,1068662685696,5024,1763591846515253000,1068666191872,1068666159104,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5170650Z","2025-11-19 22:37:26.5170650Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",9432,,," 1040 svchost.exe",,,,,,,,,,,,,18446633084033568768,18446633084033544192,140712899206080,0,256031055872,4220,1763591846517065000,256037617664,256037584896,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5171078Z","2025-11-19 22:37:26.5171078Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2228 svchost.exe",14732,,," 2228 svchost.exe",,,,,,,,,,,,,18446633084033626112,18446633084033601536,140712899206080,191,717848268800,12692,1763591846517107800,717850935296,717850902528,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5196294Z","2025-11-19 22:37:26.5196294Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084033712128,18446633084033687552,140712899206080,0,199841259520,8664,1763591846519629400,199839318016,199839309824,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5198874Z","2025-11-19 22:37:26.5198874Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",8664,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084033798144,18446633084033773568,140712899206080,0,199841267712,14376,1763591846519887500,199842856960,199842848768,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5199855Z","2025-11-19 22:37:26.5199855Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",8664,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084033912832,18446633084033888256,140712891545280,0,199841275904,8260,1763591846519985500,199843381248,199843373056,140712891545280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5201152Z","2025-11-19 22:37:26.5201152Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4340 sihost.exe",1696,,," 4340 sihost.exe",,,,,,,,,,,,,18446633084034056192,18446633084034031616,140712899206080,0,645640011776,7292,1763591846520115200,645644943360,645644935168,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5204931Z","2025-11-19 22:37:26.5204931Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4404 svchost.exe",4644,,," 4404 svchost.exe",,,,,,,,,,,,,18446633084034170880,18446633084034146304,140712865112144,98,679905755136,9140,1763591846520493100,679908737024,679908704256,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5211322Z","2025-11-19 22:37:26.5211322Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",14912,,," 6028 svchost.exe",,,,,,,,,,,,,18446633084034314240,18446633084034289664,140712899206080,5,661507424256,14032,1763591846521132200,661510422528,661510389760,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5222504Z","2025-11-19 22:37:26.5222504Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4404 svchost.exe",5524,,," 4404 svchost.exe",,,,,,,,,,,,,18446633084034371584,18446633084034347008,140712899206080,0,679905763328,1300,1763591846522250400,679909261312,679909228544,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5234656Z","2025-11-19 22:37:26.5234656Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13020 WerFault.exe",11612,,,"13020 WerFault.exe",,,,,,,,,,,,,18446633084033167360,18446633084033142784,140712899206080,0,4297211904,11612,1763591846523465600,4297064448,4297056256,140712899206080,6532729,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5234671Z","2025-11-19 22:37:26.5234671Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13020 WerFault.exe",8392,,,"13020 WerFault.exe",,,,,,,,,,,,,18446633084032876544,18446633084032851968,140712899206080,0,4297203712,8392,1763591846523467100,4296540160,4296523776,140712899206080,8081892,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5234695Z","2025-11-19 22:37:26.5234695Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13020 WerFault.exe",9800,,,"13020 WerFault.exe",,,,,,,,,,,,,18446633084032847872,18446633084032823296,140712899206080,0,4297195520,9800,1763591846523469500,4296015872,4296007680,140712899206080,7302586,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5237811Z","2025-11-19 22:37:26.5237811Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",8260,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084032847872,18446633084032823296,140712865112144,0,199841284096,7648,1763591846523781100,199843905536,199843897344,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5240969Z","2025-11-19 22:37:26.5240969Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",8260,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084033167360,18446633084033142784,140712891292720,0,199841292288,4796,1763591846524096900,199844429824,199844421632,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5242561Z","2025-11-19 22:37:26.5242561Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,,,,,,,,,,,18446633084032704512,18446633084032679936,140702556693600,0,4297187328,14996,1763591846524256100,4295491584,4295450624,140702556693600,79585807,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5244263Z","2025-11-19 22:37:26.5244263Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",8260,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084032016384,18446633084031991808,140712891292720,0,199841300480,13628,1763591846524426300,199844954112,199844945920,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5248036Z","2025-11-19 22:37:26.5248036Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop ","13020 WerFault.exe",14996,,,"13020 WerFault.exe",,,"WerFault.exe",,,,,,,,,,,,,,,,1763591846524803600,,,,,134080654472027581,,,,,,,,6631,,,,,,,,,1810432,1847296,101743666,0,134080654472296792,64,0,1,5,1,0,0 +"2025-11-19 22:37:26.5251511Z","2025-11-19 22:37:26.5251511Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",14376,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084034457600,18446633084034433024,140712899206080,0,199841308672,13944,1763591846525151100,199845478400,199845470208,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5272308Z","2025-11-19 22:37:26.5272308Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",14376,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084032704512,18446633084032679936,140712899206080,0,199841316864,8372,1763591846527230900,199846002688,199845994496,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5282052Z","2025-11-19 22:37:26.5282052Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",8260,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084032045056,18446633084032020480,140712899206080,0,199841325056,14436,1763591846528205200,199846526976,199846518784,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5284531Z","2025-11-19 22:37:26.5284531Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",8260,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084034629632,18446633084034605056,140712899206080,0,199841333248,11504,1763591846528453100,199847051264,199847043072,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5292181Z","2025-11-19 22:37:26.5292181Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",14912,,," 2456 Memory Compression",,,,,,,,,,,,,18446633084034801664,18446633084034777088,18446735306729542320,0,0,9992,1763591846529218100,0,0,18446735306729542320,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5292346Z","2025-11-19 22:37:26.5292346Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",14912,,," 2456 Memory Compression",,,,,,,,,,,,,18446633084034973696,18446633084034949120,18446735306729542320,0,0,13288,1763591846529234700,0,0,18446735306729542320,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5292738Z","2025-11-19 22:37:26.5292738Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",14912,,," 2456 Memory Compression",,,,,,,,,,,,,18446633084035002368,18446633084034977792,18446735306728238208,0,0,12392,1763591846529273800,0,0,18446735306728238208,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5293277Z","2025-11-19 22:37:26.5293277Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",14912,,," 2456 Memory Compression",,,,,,,,,,,,,18446633084035031040,18446633084035006464,18446735306729822480,0,0,13828,1763591846529327700,0,0,18446735306729822480,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5295885Z","2025-11-19 22:37:26.5295885Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 6028 svchost.exe",14912,,,"14660 CalculatorApp.exe",,,"C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe\CalculatorApp.exe",,,,,,,,,,,,,,,,1763591846529588500,,,,,134080654472346829,3,0,"0x","Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe","App",4340,106,6633,3,0,0,1,1758293941,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5305120Z","2025-11-19 22:37:26.5305120Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6028 svchost.exe",14912,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084035059712,18446633084035035136,140700165242880,5,61841813504,11616,1763591846530512000,61843963904,61843959808,140700165242880,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5393979Z","2025-11-19 22:37:26.5393979Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",6292,,," 5184 explorer.exe",,,,,,,,,,,,,18446633084032876544,18446633084032851968,140712891292720,0,15368192,10612,1763591846539397900,470351872,470294528,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5396692Z","2025-11-19 22:37:26.5396692Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 5784 svchost.exe",5288,,," 5252 WerFault.exe",,,"C:\Windows\System32\WerFault.exe",,,,,,,,,,,,,,,,1763591846539669200,,,,,134080654472445997,0,681036,"0x","","",7284,6628,6634,3,0,0,1,630084362,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5412000Z","2025-11-19 22:37:26.5412000Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5784 svchost.exe",5288,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084035321856,18446633084035297280,140702556693600,243,295361212416,14976,1763591846541200000,295359938560,295359930368,140702556693600,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5448212Z","2025-11-19 22:37:26.5448212Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084035551232,18446633084035526656,140712899206080,0,61841821696,7992,1763591846544821300,61845012480,61845008384,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5450078Z","2025-11-19 22:37:26.5450078Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084035579904,18446633084035555328,140712899206080,0,295361220608,12628,1763591846545007800,295360462848,295360454656,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5451022Z","2025-11-19 22:37:26.5451022Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5252 WerFault.exe",12628,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084035608576,18446633084035584000,140712899206080,0,295361228800,8368,1763591846545102200,295363411968,295363403776,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5452382Z","2025-11-19 22:37:26.5452382Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",7992,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084035637248,18446633084035612672,140712899206080,0,61841829888,4128,1763591846545238200,61846061056,61846056960,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5454506Z","2025-11-19 22:37:26.5454506Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084035665920,18446633084035641344,140712899206080,0,61841838080,13260,1763591846545450600,61847109632,61847105536,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5459013Z","2025-11-19 22:37:26.5459013Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",13628,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084035694592,18446633084035670016,140712899206080,0,199841341440,11828,1763591846545901300,199847575552,199847567360,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5463071Z","2025-11-19 22:37:26.5463071Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",4796,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084035809280,18446633084035784704,140712891292720,0,199841349632,10832,1763591846546307100,199848099840,199848091648,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5464045Z","2025-11-19 22:37:26.5464045Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5252 WerFault.exe",8368,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084035780608,18446633084035756032,140712899206080,0,295361236992,13036,1763591846546404500,295363936256,295363928064,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5495929Z","2025-11-19 22:37:26.5495929Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084035751936,18446633084035727360,140712899206080,0,61841846272,11964,1763591846549592900,61848158208,61848154112,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5510549Z","2025-11-19 22:37:26.5510549Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084035952640,18446633084035928064,140712281948464,0,61841854464,12508,1763591846551054900,61849206784,61849202688,140712281948464,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5537087Z","2025-11-19 22:37:26.5537087Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1016 services.exe",6816,,," 6616 svchost.exe",,,"C:\Windows\System32\svchost.exe",,,,,,,,,,,,,,,,1763591846553708700,,,,,134080654472583582,0,143552,"0x","","",1016,11,6635,1,1,0,0,14788416,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5542305Z","2025-11-19 22:37:26.5542305Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",14436,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084036096000,18446633084036071424,140712899206080,0,199841357824,5004,1763591846554230500,199849148416,199849140224,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5542583Z","2025-11-19 22:37:26.5542583Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1016 services.exe",6816,,," 6616 svchost.exe",,,,,,,,,,,,,18446633084036009984,18446633084035985408,140696171073504,0,816038653952,5908,1763591846554258300,816037298176,816037281792,140696171073504,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5583165Z","2025-11-19 22:37:26.5583165Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084036182016,18446633084036157440,140712865112144,0,61841862656,956,1763591846558316500,61850255360,61850247168,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5587337Z","2025-11-19 22:37:26.5587337Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11964,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084032503808,18446633084032479232,140712899206080,0,61841870848,11720,1763591846558733800,61851303936,61851299840,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5639203Z","2025-11-19 22:37:26.5639203Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6616 svchost.exe",5908,,," 6616 svchost.exe",,,,,,,,,,,,,18446633084034744320,18446633084034719744,140712899206080,0,816038662144,12396,1763591846563920300,816040116224,816040083456,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5639954Z","2025-11-19 22:37:26.5639954Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6616 svchost.exe",12396,,," 6616 svchost.exe",,,,,,,,,,,,,18446633084031729664,18446633084031705088,140712899206080,0,816038670336,13720,1763591846563995400,816040640512,816040607744,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5640851Z","2025-11-19 22:37:26.5640851Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6616 svchost.exe",13720,,," 6616 svchost.exe",,,,,,,,,,,,,18446633084036268032,18446633084036243456,140712899206080,0,816038678528,10796,1763591846564085200,816041164800,816041132032,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5651222Z","2025-11-19 22:37:26.5651222Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",8664,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084036325376,18446633084036300800,140712899206080,0,199841366016,4344,1763591846565122200,199849672704,199849664512,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5657805Z","2025-11-19 22:37:26.5657805Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11964,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084035866624,18446633084035842048,140712899206080,0,61841879040,496,1763591846565780500,61852352512,61852348416,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5673494Z","2025-11-19 22:37:26.5673494Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2688 svchost.exe",14020,,," 2688 svchost.exe",,,,,,,,,,,,,18446633084036354048,18446633084036329472,140712899206080,13,461860601856,4036,1763591846567349400,461863124992,461863059456,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5685445Z","2025-11-19 22:37:26.5685445Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11616,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084036698112,18446633084036673536,140712891545280,0,61841887232,11644,1763591846568544500,61853401088,61853396992,140712891545280,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5725585Z","2025-11-19 22:37:26.5725585Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5184 explorer.exe",12432,,," 5184 explorer.exe",,,,,,,,,,,,,18446633084036382720,18446633084036358144,140712891292720,0,15376384,5476,1763591846572558500,470876160,470818816,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5758335Z","2025-11-19 22:37:26.5758335Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1016 services.exe",2816,,," 1016 services.exe",,,,,,,,,,,,,18446633084035379200,18446633084035354624,140712899206080,0,156998311936,13420,1763591846575833500,157000663040,157000630272,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5761292Z","2025-11-19 22:37:26.5761292Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 6616 svchost.exe",,,,,,,,,,,,,18446633084027592704,18446633084027568128,140712899206080,0,816038686720,14644,1763591846576129200,816041689088,816041656320,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5762722Z","2025-11-19 22:37:26.5762722Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6616 svchost.exe",5908,,," 6616 svchost.exe",,,,,,,,,,,,,18446633084036870144,18446633084036845568,140712863364608,0,816038694912,6360,1763591846576272200,816042213376,816042180608,140712863364608,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5790575Z","2025-11-19 22:37:26.5790575Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084036726784,18446633084036702208,140712600145104,0,61841895424,11252,1763591846579057600,61854449664,61854445568,140712600145104,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5791074Z","2025-11-19 22:37:26.5791074Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084036841472,18446633084036816896,140712604173856,0,61841903616,12480,1763591846579107400,61855498240,61855494144,140712604173856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5819795Z","2025-11-19 22:37:26.5819795Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6616 svchost.exe",14644,,," 6616 svchost.exe",,,,,,,,,,,,,18446633084037246976,18446633084037222400,140712899206080,31,816038703104,7752,1763591846581979500,816042737664,816042704896,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.5822357Z","2025-11-19 22:37:26.5822357Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 6616 svchost.exe",6360,,," 6616 svchost.exe",,,,,,,,,,,,,18446633084036870144,18446633084036845568,140712863364608,0,816038694912,6360,1763591846582235700,816042213376,816042180608,140712863364608,10158747,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6008547Z","2025-11-19 22:37:26.6008547Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","14660 CalculatorApp.exe",11252,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084036726784,18446633084036702208,140712600145104,0,61841895424,11252,1763591846600854700,61854449664,61854420992,140712600145104,59786572,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6041470Z","2025-11-19 22:37:26.6041470Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 7916 svchost.exe",,,,,,,,,,,,,18446633084036726784,18446633084036702208,140712899206080,0,401963515904,13956,1763591846604147000,401965842432,401965809664,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6044711Z","2025-11-19 22:37:26.6044711Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 7916 svchost.exe",13956,,," 7916 svchost.exe",,,,,,,,,,,,,18446633084037013504,18446633084036988928,140712899206080,90,401963524096,14624,1763591846604471100,401966366720,401966333952,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6060394Z","2025-11-19 22:37:26.6060394Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2992 svchost.exe",8856,,," 2992 svchost.exe",,,,,,,,,,,,,18446633084036612096,18446633084036587520,140712899206080,186,170617462784,332,1763591846606039500,170619568128,170619535360,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6061470Z","2025-11-19 22:37:26.6061470Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084037304320,18446633084037279744,140712632221632,0,61841911808,12900,1763591846606147000,61854449664,61854445568,140712632221632,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6179798Z","2025-11-19 22:37:26.6179798Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2960 svchost.exe",4584,,," 2960 svchost.exe",,,,,,,,,,,,,18446633084037156864,18446633084037132288,140712899206080,287,403329839104,11740,1763591846617979800,403332661248,403332628480,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6188438Z","2025-11-19 22:37:26.6188438Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2960 svchost.exe",11740,,," 2960 svchost.exe",,,,,,,,,,,,,18446633084031815680,18446633084031791104,140712899206080,287,403329847296,13172,1763591846618843800,403333185536,403333152768,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6189176Z","2025-11-19 22:37:26.6189176Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2960 svchost.exe",11740,,," 2960 svchost.exe",,,,,,,,,,,,,18446633084037332992,18446633084037308416,140712891292720,287,403329855488,11772,1763591846618917600,403333709824,403333677056,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6193177Z","2025-11-19 22:37:26.6193177Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2992 svchost.exe",14440,,," 2992 svchost.exe",,,,,,,,,,,,,18446633084037476352,18446633084037451776,140712899206080,186,170617470976,11856,1763591846619317700,170620092416,170620059648,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6422521Z","2025-11-19 22:37:26.6422521Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084036497408,18446633084036472832,140712899206080,0,295361245184,12560,1763591846642252100,295364460544,295364452352,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6467946Z","2025-11-19 22:37:26.6467946Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 3232 dllhost.exe",,,,,,,,,,,,,18446633084037763072,18446633084037738496,140712899206080,0,493780992000,10288,1763591846646794600,493783875584,493783842816,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6496679Z","2025-11-19 22:37:26.6496679Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084037533696,18446633084037509120,140712891292720,0,61841920000,12588,1763591846649667900,61856546816,61856542720,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6528598Z","2025-11-19 22:37:26.6528598Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4340 sihost.exe",4288,,," 4340 sihost.exe",,,,,,,,,,,,,18446633083999285248,18446633083999260672,140712891292720,0,645640036352,4748,1763591846652859800,645646516224,645646508032,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6791641Z","2025-11-19 22:37:26.6791641Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",8500,,," 1040 svchost.exe",,,,,,,,,,,,,18446633084036870144,18446633084036845568,140712899206080,0,256031064064,12504,1763591846679164100,256038141952,256038109184,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6794671Z","2025-11-19 22:37:26.6794671Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084036669440,18446633084036644864,140712899206080,0,61841928192,11328,1763591846679467100,61857595392,61857591296,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6832366Z","2025-11-19 22:37:26.6832366Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084037619712,18446633084037595136,140712865112144,0,61841936384,336,1763591846683236600,61858643968,61858635776,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6839927Z","2025-11-19 22:37:26.6839927Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8972 VBoxTray.exe",9020,,," 8972 VBoxTray.exe",,,,,,,,,,,,,18446633084036812800,18446633084036788224,140700131109808,0,471283204096,6380,1763591846683992700,471299260416,471299256320,140700131109808,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.6842196Z","2025-11-19 22:37:26.6842196Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8972 VBoxTray.exe",6380,,," 8972 VBoxTray.exe",,,,,,,,,,,,,18446633084036812800,18446633084036788224,140700131109808,0,471283204096,6380,1763591846684219600,471299260416,471299252224,140700131109808,481308,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7146538Z","2025-11-19 22:37:26.7146538Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084037562368,18446633084037537792,140712297841152,0,61841944576,9644,1763591846714653900,61859692544,61859688448,140712297841152,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7427338Z","2025-11-19 22:37:26.7427338Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 9692 PerfWatson2.exe",9752,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084037992448,18446633084037967872,140711612509856,0,1046354432000,13872,1763591846742733800,1046352232448,1046352216064,140711612509856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7597159Z","2025-11-19 22:37:26.7597159Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 5784 svchost.exe",,,,,,,,,,,,,18446633084038049792,18446633084038025216,140712899206080,0,513414856704,1652,1763591846759716000,513420558336,513420525568,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7736710Z","2025-11-19 22:37:26.7736710Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084038164480,18446633084038139904,140712865112144,0,295361253376,1248,1763591846773671100,295364984832,295364976640,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7738817Z","2025-11-19 22:37:26.7738817Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084038193152,18446633084038168576,140712899206080,0,295361261568,10204,1763591846773881700,295365509120,295365500928,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.7740150Z","2025-11-19 22:37:26.7740150Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5252 WerFault.exe",10204,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084038221824,18446633084038197248,140712899206080,0,295361269760,8320,1763591846774015000,295366033408,295366025216,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8302231Z","2025-11-19 22:37:26.8302231Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084038135808,18446633084038111232,140712583404848,0,61841952768,5400,1763591846830223100,61860741120,61860737024,140712583404848,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8306661Z","2025-11-19 22:37:26.8306661Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11720,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084038279168,18446633084038254592,140712899206080,0,61841960960,8356,1763591846830666100,61861789696,61861785600,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8318294Z","2025-11-19 22:37:26.8318294Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3812 calc.exe",14584,,," 3812 calc.exe",,,,,,,,,,,,,18446633084032331776,18446633084032307200,140712899206080,0,801455407104,14584,1763591846831829400,801457045504,801457037312,140712899206080,3186210,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8318295Z","2025-11-19 22:37:26.8318295Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3812 calc.exe",3100,,," 3812 calc.exe",,,,,,,,,,,,,18446633084033368064,18446633084033343488,140712899206080,0,801455448064,3100,1763591846831829600,801459666944,801459658752,140712899206080,817389,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8318300Z","2025-11-19 22:37:26.8318300Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3812 calc.exe",6196,,," 3812 calc.exe",,,,,,,,,,,,,18446633084032389120,18446633084032364544,140712899206080,0,801455415296,6196,1763591846831830000,801457569792,801457557504,140712899206080,7141150,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8318304Z","2025-11-19 22:37:26.8318304Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3812 calc.exe",6204,,," 3812 calc.exe",,,,,,,,,,,,,18446633084032417792,18446633084032393216,140712891545280,0,801455423488,6204,1763591846831830400,801458094080,801458061312,140712891545280,149400621,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8318384Z","2025-11-19 22:37:26.8318384Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3812 calc.exe",2088,,," 3812 calc.exe",,,,,,,,,,,,,18446633084033224704,18446633084033200128,140712865112144,0,801455431680,2088,1763591846831838400,801458618368,801458610176,140712865112144,228960,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8318411Z","2025-11-19 22:37:26.8318411Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3812 calc.exe",652,,," 3812 calc.exe",,,,,,,,,,,,,18446633084033310720,18446633084033286144,140712899206080,0,801455439872,652,1763591846831841100,801459142656,801459134464,140712899206080,531097,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8318477Z","2025-11-19 22:37:26.8318477Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3812 calc.exe",7976,,," 3812 calc.exe",,,,,,,,,,,,,18446633084032274432,18446633084032249856,140712899206080,0,801455398912,7976,1763591846831847700,801456521216,801456513024,140712899206080,4943957,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8320938Z","2025-11-19 22:37:26.8320938Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084032417792,18446633084032393216,140712899206080,0,61841969152,13376,1763591846832093800,61862838272,61862834176,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8332758Z","2025-11-19 22:37:26.8332758Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 3812 calc.exe",10660,,," 3812 calc.exe",,,,,,,,,,,,,18446633084032245760,18446633084032221184,140696878126912,0,801455390720,10660,1763591846833275800,801453899776,801453879296,140696878126912,40536930,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.8345749Z","2025-11-19 22:37:26.8345749Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 3812 calc.exe",10660,,," 3812 calc.exe",,,"calc.exe",,,,,,,,,,,,,,,,1763591846834574900,,,,,134080654471607920,,,,,,,,6629,,,,,,,,,3268608,3305472,213030484,0,134080654475331992,116,0,1,12,3,0,0 +"2025-11-19 22:37:26.9060086Z","2025-11-19 22:37:26.9060086Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1016 services.exe",6816,,,"12756 svchost.exe",,,"C:\Windows\System32\svchost.exe",,,,,,,,,,,,,,,,1763591846906008600,,,,,134080654476036389,0,143552,"0x","","",1016,11,6636,1,1,0,0,14788416,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9067020Z","2025-11-19 22:37:26.9067020Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1016 services.exe",6816,,,"12756 svchost.exe",,,,,,,,,,,,,18446633084032274432,18446633084032249856,140696171073504,0,111870410752,13856,1763591846906702000,111867592704,111867576320,140696171073504,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9168346Z","2025-11-19 22:37:26.9168346Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","12756 svchost.exe",13856,,,"12756 svchost.exe",,,,,,,,,,,,,18446633084033310720,18446633084033286144,140712899206080,0,111870418944,7100,1763591846916834600,111868116992,111868084224,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9169070Z","2025-11-19 22:37:26.9169070Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","12756 svchost.exe",7100,,,"12756 svchost.exe",,,,,,,,,,,,,18446633084032389120,18446633084032364544,140712899206080,0,111870427136,4004,1763591846916907000,111871000576,111870967808,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9169866Z","2025-11-19 22:37:26.9169866Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","12756 svchost.exe",4004,,,"12756 svchost.exe",,,,,,,,,,,,,18446633084033368064,18446633084033343488,140712899206080,0,111870435328,3784,1763591846916986600,111871524864,111871492096,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9264172Z","2025-11-19 22:37:26.9264172Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"12756 svchost.exe",,,,,,,,,,,,,18446633084032331776,18446633084032307200,140712899206080,0,111870443520,12564,1763591846926417200,111872049152,111872016384,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9265408Z","2025-11-19 22:37:26.9265408Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","12756 svchost.exe",13856,,,"12756 svchost.exe",,,,,,,,,,,,,18446633084038365184,18446633084038340608,140712863364608,0,111870451712,4888,1763591846926540800,111872573440,111872540672,140712863364608,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9314972Z","2025-11-19 22:37:26.9314972Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","12756 svchost.exe",12564,,,"12756 svchost.exe",,,,,,,,,,,,,18446633084038479872,18446633084038455296,140712899206080,9,111870459904,13320,1763591846931497200,111873097728,111873064960,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9339612Z","2025-11-19 22:37:26.9339612Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","12756 svchost.exe",12564,,,"12756 svchost.exe",,,,,,,,,,,,,18446633084038623232,18446633084038598656,140712865112144,9,111870468096,1628,1763591846933961200,111873622016,111873589248,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9343316Z","2025-11-19 22:37:26.9343316Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","12756 svchost.exe",13320,,,"12756 svchost.exe",,,,,,,,,,,,,18446633084038651904,18446633084038627328,140712899206080,9,111868379136,500,1763591846934331600,111874146304,111874113536,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9757802Z","2025-11-19 22:37:26.9757802Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11964,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084038680576,18446633084038656000,140712899206080,0,61841977344,9424,1763591846975780200,61863886848,61863882752,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9759165Z","2025-11-19 22:37:26.9759165Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1168 svchost.exe",13524,,," 1168 svchost.exe",,,,,,,,,,,,,18446633084038795264,18446633084038770688,140712899206080,157,641013497856,13336,1763591846975916500,641018626048,641018593280,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9761596Z","2025-11-19 22:37:26.9761596Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",9424,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084038823936,18446633084038799360,140712899206080,0,61841985536,13884,1763591846976159600,61864935424,61864931328,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9762962Z","2025-11-19 22:37:26.9762962Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",13884,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084038852608,18446633084038828032,140712899206080,0,61841993728,13192,1763591846976296200,61865984000,61865979904,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9764557Z","2025-11-19 22:37:26.9764557Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1168 svchost.exe",13336,,," 1168 svchost.exe",,,,,,,,,,,,,18446633084038909952,18446633084038885376,140712899206080,0,641013506048,1052,1763591846976455700,641019674624,641019641856,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:26.9977602Z","2025-11-19 22:37:26.9977602Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084037419008,18446633084037394432,140712806010720,0,295361277952,5544,1763591846997760200,295366557696,295366549504,140712806010720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0043199Z","2025-11-19 22:37:27.0043199Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1776 svchost.exe",9772,,," 1776 svchost.exe",,,,,,,,,,,,,18446633084039024640,18446633084039000064,140712899206080,122,699936964608,6052,1763591847004319900,699937587200,699937554432,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0085599Z","2025-11-19 22:37:27.0085599Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",13192,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084039053312,18446633084039028736,140712899206080,0,61842001920,4980,1763591847008559900,61867032576,61867028480,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0088098Z","2025-11-19 22:37:27.0088098Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",4980,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084039081984,18446633084039057408,140712899206080,0,61842010112,4528,1763591847008809800,61868081152,61868077056,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0089567Z","2025-11-19 22:37:27.0089567Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",4528,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084039225344,18446633084039200768,140712899206080,0,61842018304,13000,1763591847008956800,61869129728,61869125632,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0340864Z","2025-11-19 22:37:27.0340864Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1416 ApplicationFrameHost.exe",8260,,," 1416 ApplicationFrameHost.exe",,,,,,,,,,,,,18446633084032188416,18446633084032163840,140712891292720,0,199841374208,6804,1763591847034086400,199851245568,199851237376,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0668663Z","2025-11-19 22:37:27.0668663Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3420 ctfmon.exe",8900,,," 3420 ctfmon.exe",,,,,,,,,,,,,18446633084037906432,18446633084037881856,140712865112144,0,619648745472,15352,1763591847066866300,619647205376,619647197184,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.0685230Z","2025-11-19 22:37:27.0685230Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","14660 CalculatorApp.exe",11644,,,"14660 CalculatorApp.exe",,,,,,,,,,,,,18446633084038250496,18446633084038225920,140712899206080,0,61842026496,12060,1763591847068523000,61870178304,61870174208,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.1026755Z","2025-11-19 22:37:27.1026755Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6096 svchost.exe",4172,,," 6096 svchost.exe",,,,,,,,,,,,,18446633084032245760,18446633084032221184,140712899206080,25,338488852480,15324,1763591847102675500,338491867136,338491834368,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.1176652Z","2025-11-19 22:37:27.1176652Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6096 svchost.exe",4172,,," 6096 svchost.exe",,,,,,,,,,,,,18446633084033224704,18446633084033200128,140712865112144,25,338488860672,14108,1763591847117665200,338492391424,338492358656,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.1255393Z","2025-11-19 22:37:27.1255393Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2724 svchost.exe",14940,,," 2724 svchost.exe",,,,,,,,,,,,,18446633084039458816,18446633084039434240,140712899206080,232,89489063936,5900,1763591847125539300,89491767296,89491701760,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.1256608Z","2025-11-19 22:37:27.1256608Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2724 svchost.exe",14940,,," 2724 svchost.exe",,,,,,,,,,,,,18446633084039544832,18446633084039520256,140712899206080,232,89489072128,952,1763591847125660800,89492291584,89492258816,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.1267258Z","2025-11-19 22:37:27.1267258Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 3256 svchost.exe",4788,,," 3256 svchost.exe",,,,,,,,,,,,,18446633084039630848,18446633084039606272,140712899206080,111,435930234880,3276,1763591847126725800,433794318336,433794285568,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2129195Z","2025-11-19 22:37:27.2129195Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1040 svchost.exe",4220,,," 6764 RuntimeBroker.exe",,,"C:\Windows\System32\RuntimeBroker.exe",,,,,,,,,,,,,,,,1763591847212919500,,,,,134080654479044376,3,148437,"0x","Microsoft.WindowsCalculator_11.2508.1.0_x64__8wekyb3d8bbwe","runtimebroker07f4358a809ac99a64a67c1",1040,13,6637,3,0,0,1,1175682367,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2141117Z","2025-11-19 22:37:27.2141117Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",4220,,," 6764 RuntimeBroker.exe",,,,,,,,,,,,,18446633084037963776,18446633084037939200,140699399787184,40,848667435008,11572,1763591847214111700,848666886144,848666836992,140699399787184,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2277968Z","2025-11-19 22:37:27.2277968Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,,,,,,,,,,,18446633084039716864,18446633084039692288,140712899206080,0,848667443200,8364,1763591847227796800,848669704192,848669655040,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2280363Z","2025-11-19 22:37:27.2280363Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,,,,,,,,,,,18446633084039831552,18446633084039806976,140712899206080,0,848667451392,11224,1763591847228036300,848670228480,848670179328,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2312370Z","2025-11-19 22:37:27.2312370Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 6764 RuntimeBroker.exe",,,,,,,,,,,,,18446633084039860224,18446633084039835648,140712899206080,0,848667459584,6812,1763591847231237000,848670752768,848670703616,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2313547Z","2025-11-19 22:37:27.2313547Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 6764 RuntimeBroker.exe",,,,,,,,,,,,,18446633084040003584,18446633084039979008,140712899206080,0,848667467776,8708,1763591847231354700,848671277056,848671227904,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2320674Z","2025-11-19 22:37:27.2320674Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6764 RuntimeBroker.exe",11224,,," 6764 RuntimeBroker.exe",,,,,,,,,,,,,18446633084040060928,18446633084040036352,140712899206080,0,848667475968,13408,1763591847232067400,848671801344,848671752192,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2361031Z","2025-11-19 22:37:27.2361031Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6764 RuntimeBroker.exe",11572,,," 6764 RuntimeBroker.exe",,,,,,,,,,,,,18446633084040290304,18446633084040265728,140712865112144,0,848667484160,12020,1763591847236103100,848672325632,848672276480,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2455120Z","2025-11-19 22:37:27.2455120Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6764 RuntimeBroker.exe",8708,,," 6764 RuntimeBroker.exe",,,,,,,,,,,,,18446633084040318976,18446633084040294400,140712865112144,0,848667492352,5996,1763591847245512000,848672849920,848672800768,140712865112144,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2473895Z","2025-11-19 22:37:27.2473895Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 5252 WerFault.exe",10204,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084040347648,18446633084040323072,140712899206080,0,295361286144,13268,1763591847247389500,295367081984,295367073792,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2567215Z","2025-11-19 22:37:27.2567215Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1660 svchost.exe",5636,,," 1660 svchost.exe",,,,,,,,,,,,,18446633084040376320,18446633084040351744,140712899206080,129,265908367360,8716,1763591847256721500,265905897472,265905864704,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2589399Z","2025-11-19 22:37:27.2589399Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6764 RuntimeBroker.exe",6812,,," 6764 RuntimeBroker.exe",,,,,,,,,,,,,18446633084040491008,18446633084040466432,140712899206080,0,848667500544,13508,1763591847258939900,848673374208,848673325056,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.2616936Z","2025-11-19 22:37:27.2616936Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 6764 RuntimeBroker.exe",5996,,," 6764 RuntimeBroker.exe",,,,,,,,,,,,,18446633084040548352,18446633084040523776,140712891292720,0,848667508736,2944,1763591847261693600,848673898496,848673849344,140712891292720,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.3163515Z","2025-11-19 22:37:27.3163515Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",13876,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084018688000,18446633084018663424,140711613062896,0,1046354382848,13876,1763591847316351500,1046401253376,1046401236992,140711613062896,2715087,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.099873500Z","2025-11-19 22:37:27.4122768Z","myETW","Attack-Provider",1337,"AttackTask"," 5604 attack-890.exe",,,,,,"Attack done",,,,,,,,,,,,,,,,,1763591847412276800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4128045Z","2025-11-19 22:37:27.4128045Z","ETW","Microsoft-Windows-Kernel-Process",5,"ImageLoad Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591847412804500,,,,,,,158678,,,,,,,,,,,3554393863,140712830631936,140712830631936,110592,,,,,,,,,,,, +"2025-11-19 22:37:27.4131942Z","2025-11-19 22:37:27.4131942Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5604 attack-890.exe",8672,,," 5604 attack-890.exe",,,,,,,,,,,,,18446633084029718528,18446633084029693952,140712899206080,0,867488067584,8672,1763591847413194200,867491119104,867491106816,140712899206080,1934283,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4131969Z","2025-11-19 22:37:27.4131969Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5604 attack-890.exe",5960,,," 5604 attack-890.exe",,,,,,,,,,,,,18446633084029747200,18446633084029722624,140712899206080,0,867488059392,5960,1763591847413196900,867490070528,867490062336,140712899206080,2523090,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4132046Z","2025-11-19 22:37:27.4132046Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5604 attack-890.exe",12460,,," 5604 attack-890.exe",,,,,,,,,,,,,18446633084029460480,18446633084029435904,140712899206080,0,867488075776,12460,1763591847413204600,867492167680,867492155392,140712899206080,1586126,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4133776Z","2025-11-19 22:37:27.4133776Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,,,,,,,,,,,18446633084027822080,18446633084027797504,140695618865008,0,867488051200,3452,1763591847413377600,867486007296,867485986816,140695618865008,55165128,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.4135007Z","2025-11-19 22:37:27.4135007Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Users\Public\Downloads\attack-890.exe",,,,,,,,,,,,,,,,1763591847413500700,,,,,,,0,,,,,,,,,,,1763491559,140695618846720,140695618846720,53248,,,,,,,,,,,, +"2025-11-19 22:37:27.4135055Z","2025-11-19 22:37:27.4135055Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\msvcp140.dll",,,,,,,,,,,,,,,,1763591847413505500,,,,,,,570439,,,,,,,,,,,1564323704,140711213137920,140711213137920,561152,,,,,,,,,,,, +"2025-11-19 22:37:27.4135084Z","2025-11-19 22:37:27.4135084Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\vcruntime140.dll",,,,,,,,,,,,,,,,1763591847413508400,,,,,,,146072,,,,,,,,,,,254123393,140712353988608,140712353988608,122880,,,,,,,,,,,, +"2025-11-19 22:37:27.4135113Z","2025-11-19 22:37:27.4135113Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\vcruntime140_1.dll",,,,,,,,,,,,,,,,1763591847413511400,,,,,,,57827,,,,,,,,,,,240324076,140712354119680,140712354119680,49152,,,,,,,,,,,, +"2025-11-19 22:37:27.4135253Z","2025-11-19 22:37:27.4135253Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\apphelp.dll",,,,,,,,,,,,,,,,1763591847413525300,,,,,,,675806,,,,,,,,,,,4108425587,140712800485376,140712800485376,651264,,,,,,,,,,,, +"2025-11-19 22:37:27.4135311Z","2025-11-19 22:37:27.4135311Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\kernel.appcore.dll",,,,,,,,,,,,,,,,1763591847413531100,,,,,,,158678,,,,,,,,,,,3554393863,140712830631936,140712830631936,110592,,,,,,,,,,,, +"2025-11-19 22:37:27.4135386Z","2025-11-19 22:37:27.4135386Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591847413538600,,,,,,,4209945,,,,,,,,,,,2980330054,140712854355968,140712854355968,4161536,,,,,,,,,,,, +"2025-11-19 22:37:27.4135538Z","2025-11-19 22:37:27.4135538Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591847413553800,,,,,,,1436013,,,,,,,,,,,1441720767,140712859467776,140712859467776,1355776,,,,,,,,,,,, +"2025-11-19 22:37:27.4135615Z","2025-11-19 22:37:27.4135615Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591847413561600,,,,,,,716301,,,,,,,,,,,3291623140,140712863203328,140712863203328,679936,,,,,,,,,,,, +"2025-11-19 22:37:27.4135675Z","2025-11-19 22:37:27.4135675Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591847413567500,,,,,,,885660,,,,,,,,,,,2913437033,140712877621248,140712877621248,823296,,,,,,,,,,,, +"2025-11-19 22:37:27.4135740Z","2025-11-19 22:37:27.4135740Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591847413574000,,,,,,,761372,,,,,,,,,,,71854833,140712881618944,140712881618944,737280,,,,,,,,,,,, +"2025-11-19 22:37:27.4135805Z","2025-11-19 22:37:27.4135805Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591847413580500,,,,,,,760295,,,,,,,,,,,460960534,140712894529536,140712894529536,692224,,,,,,,,,,,, +"2025-11-19 22:37:27.4135873Z","2025-11-19 22:37:27.4135873Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591847413587300,,,,,,,1193108,,,,,,,,,,,4275633056,140712897216512,140712897216512,1146880,,,,,,,,,,,, +"2025-11-19 22:37:27.4135935Z","2025-11-19 22:37:27.4135935Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591847413593500,,,,,,,2537167,,,,,,,,,,,2626650689,140712898723840,140712898723840,2523136,,,,,,,,,,,, +"2025-11-19 22:37:27.4136009Z","2025-11-19 22:37:27.4136009Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 5604 attack-890.exe",3452,,," 5604 attack-890.exe",,,"attack-890.exe",,,,,,,,,,,,,,,,1763591847413600900,,,,,134080654410040405,,,,,,,,6624,,,,,,,,,974848,974848,61411560,0,134080654481010332,52,9,0,0,3,48,0 +"2025-11-19 22:37:27.4283262Z","2025-11-19 22:37:27.4283262Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",11288,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084024401920,18446633084024377344,140711613062896,0,1046354407424,11288,1763591847428326200,1046418030592,1046418014208,140711613062896,1935036,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.5078343Z","2025-11-19 22:37:27.5078343Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 2572 svchost.exe",13832,,," 2572 svchost.exe",,,,,,,,,,,,,18446633084039372800,18446633084039348224,140712899206080,75,140319780864,11052,1763591847507834300,140320964608,140320931840,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.5256444Z","2025-11-19 22:37:27.5256444Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 4868 svchost.exe",,,,,,,,,,,,,18446633084031901696,18446633084031877120,140712899206080,0,47918891008,11596,1763591847525644400,47920971776,47920939008,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.5258154Z","2025-11-19 22:37:27.5258154Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4868 svchost.exe",11596,,," 4868 svchost.exe",,,,,,,,,,,,,18446633084024401920,18446633084024377344,140712899206080,0,47918899200,2940,1763591847525815400,47921496064,47921463296,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6226062Z","2025-11-19 22:37:27.6226062Z","ETW","Microsoft-Windows-Kernel-Process",1,"ProcessStart Start "," 1016 services.exe",6816,,,"13800 svchost.exe",,,"C:\Windows\System32\svchost.exe",,,,,,,,,,,,,,,,1763591847622606300,,,,,134080654483059795,0,143552,"0x","","",1016,11,6638,1,1,0,0,14788416,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6232926Z","2025-11-19 22:37:27.6232926Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1016 services.exe",6816,,,"13800 svchost.exe",,,,,,,,,,,,,18446633084027822080,18446633084027797504,140696171073504,0,858544685056,15036,1763591847623292600,858547290112,858547273728,140696171073504,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6289680Z","2025-11-19 22:37:27.6289680Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,,,,,,,,,,,18446633084029747200,18446633084029722624,140712899206080,0,858544693248,9704,1763591847628968000,858547814400,858547781632,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6299477Z","2025-11-19 22:37:27.6299477Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,,,,,,,,,,,18446633084029460480,18446633084029435904,140712899206080,0,858544701440,5924,1763591847629947700,858548338688,858548305920,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6324486Z","2025-11-19 22:37:27.6324486Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13800 svchost.exe",9704,,,"13800 svchost.exe",,,,,,,,,,,,,18446633084039282688,18446633084039258112,140712899206080,0,858544709632,10468,1763591847632448600,858548862976,858548830208,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6355634Z","2025-11-19 22:37:27.6355634Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"13800 svchost.exe",,,,,,,,,,,,,18446633084040663040,18446633084040638464,140712899206080,0,858544717824,11472,1763591847635563500,858549387264,858549354496,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6356777Z","2025-11-19 22:37:27.6356777Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13800 svchost.exe",15036,,,"13800 svchost.exe",,,,,,,,,,,,,18446633084040691712,18446633084040667136,140712863364608,0,858544726016,11168,1763591847635677700,858549911552,858549878784,140712863364608,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6402040Z","2025-11-19 22:37:27.6402040Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","13800 svchost.exe",11472,,,"13800 svchost.exe",,,,,,,,,,,,,18446633084040806400,18446633084040781824,140712899206080,0,858544734208,4768,1763591847640204000,858550435840,858550403072,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6406317Z","2025-11-19 22:37:27.6406317Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 5536 svchost.exe",,,,,,,,,,,,,18446633084040835072,18446633084040810496,140712899206080,0,151912235008,3836,1763591847640631700,151921360896,151921328128,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6840379Z","2025-11-19 22:37:27.6840379Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13780 WmiPrvSE.exe",4420,,,"13780 WmiPrvSE.exe",,,,,,,,,,,,,18446633084016447488,18446633084016422912,140712899206080,0,157585104896,4420,1763591847684037900,157587341312,157587275776,140712899206080,4863993,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.6840511Z","2025-11-19 22:37:27.6840511Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13780 WmiPrvSE.exe",6868,,,"13780 WmiPrvSE.exe",,,,,,,,,,,,,18446633084055474176,18446633084055449600,140712899206080,0,157585096704,6868,1763591847684051100,157586817024,157586751488,140712899206080,5062025,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.9160604Z","2025-11-19 22:37:27.9160604Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5252 WerFault.exe",5544,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084037419008,18446633084037394432,140712806010720,0,295361277952,5544,1763591847916060400,295366557696,295366512640,140712806010720,887249451,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:27.9529632Z","2025-11-19 22:37:27.9529632Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 1040 svchost.exe",8500,,," 1040 svchost.exe",,,,,,,,,,,,,18446633084041007104,18446633084040982528,140712899206080,0,256031072256,13776,1763591847952963200,256038666240,256038633472,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2233628Z","2025-11-19 22:37:28.2233628Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5252 WerFault.exe",12628,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084035579904,18446633084035555328,140712899206080,0,295361220608,12628,1763591848223362800,295360462848,295360454656,140712899206080,7179256,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2233643Z","2025-11-19 22:37:28.2233643Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5252 WerFault.exe",8368,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084035608576,18446633084035584000,140712899206080,0,295361228800,8368,1763591848223364300,295363411968,295363403776,140712899206080,8636748,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2233701Z","2025-11-19 22:37:28.2233701Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5252 WerFault.exe",12560,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084036497408,18446633084036472832,140712899206080,0,295361245184,12560,1763591848223370100,295364460544,295364452352,140712899206080,281768,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2233711Z","2025-11-19 22:37:28.2233711Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5252 WerFault.exe",13036,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084035780608,18446633084035756032,140712899206080,0,295361236992,13036,1763591848223371100,295363936256,295363928064,140712899206080,7774840,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2233814Z","2025-11-19 22:37:28.2233814Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5252 WerFault.exe",1248,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084038164480,18446633084038139904,140712865112144,0,295361253376,1248,1763591848223381400,295364984832,295364976640,140712865112144,408507,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2233838Z","2025-11-19 22:37:28.2233838Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5252 WerFault.exe",10204,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084038193152,18446633084038168576,140712899206080,0,295361261568,10204,1763591848223383800,295365509120,295365480448,140712899206080,7920068,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2233994Z","2025-11-19 22:37:28.2233994Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5252 WerFault.exe",8320,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084038221824,18446633084038197248,140712899206080,0,295361269760,8320,1763591848223399400,295366033408,295366012928,140712899206080,49276648,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2233996Z","2025-11-19 22:37:28.2233996Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5252 WerFault.exe",13268,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084040347648,18446633084040323072,140712899206080,0,295361286144,13268,1763591848223399600,295367081984,295367065600,140712899206080,10564243,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2249315Z","2025-11-19 22:37:28.2249315Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,,,,,,,,,,,18446633084035321856,18446633084035297280,140702556693600,0,295361212416,14976,1763591848224931500,295359938560,295359860736,140702556693600,2468929032,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2265618Z","2025-11-19 22:37:28.2265618Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 5252 WerFault.exe",14976,,," 5252 WerFault.exe",,,"WerFault.exe",,,,,,,,,,,,,,,,1763591848226561800,,,,,134080654472445997,,,,,,,,6634,,,,,,,,,5734400,13971456,3457303163,0,134080654488973699,205,0,83,2286,3,406,81 +"2025-11-19 22:37:28.2299996Z","2025-11-19 22:37:28.2299996Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,,,,,,,,,,,18446633084031987712,18446633084031963136,2513113579520,0,705865949184,14412,1763591848229999600,705865449472,705865428992,2513113579520,45081055,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2302606Z","2025-11-19 22:37:28.2302606Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\whoami.exe",,,,,,,,,,,,,,,,1763591848230260600,,,,,,,160109,,,,,,,,,,,3602411345,140702344609792,140702344609792,98304,,,,,,,,,,,, +"2025-11-19 22:37:28.2302692Z","2025-11-19 22:37:28.2302692Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\wkscli.dll",,,,,,,,,,,,,,,,1763591848230269200,,,,,,,170846,,,,,,,,,,,1225555544,140712738291712,140712738291712,110592,,,,,,,,,,,, +"2025-11-19 22:37:28.2302764Z","2025-11-19 22:37:28.2302764Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\version.dll",,,,,,,,,,,,,,,,1763591848230276400,,,,,,,72452,,,,,,,,,,,2275202464,140712753168384,140712753168384,45056,,,,,,,,,,,, +"2025-11-19 22:37:28.2302833Z","2025-11-19 22:37:28.2302833Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\apphelp.dll",,,,,,,,,,,,,,,,1763591848230283300,,,,,,,675806,,,,,,,,,,,4108425587,140712800485376,140712800485376,651264,,,,,,,,,,,, +"2025-11-19 22:37:28.2302892Z","2025-11-19 22:37:28.2302892Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\netutils.dll",,,,,,,,,,,,,,,,1763591848230289200,,,,,,,80696,,,,,,,,,,,865845000,140712825847808,140712825847808,53248,,,,,,,,,,,, +"2025-11-19 22:37:28.2303031Z","2025-11-19 22:37:28.2303031Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\authz.dll",,,,,,,,,,,,,,,,1763591848230303100,,,,,,,372179,,,,,,,,,,,771731569,140712826241024,140712826241024,327680,,,,,,,,,,,, +"2025-11-19 22:37:28.2303108Z","2025-11-19 22:37:28.2303108Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\sspicli.dll",,,,,,,,,,,,,,,,1763591848230310800,,,,,,,339222,,,,,,,,,,,3030302172,140712833384448,140712833384448,299008,,,,,,,,,,,, +"2025-11-19 22:37:28.2303160Z","2025-11-19 22:37:28.2303160Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\KernelBase.dll",,,,,,,,,,,,,,,,1763591848230316000,,,,,,,4209945,,,,,,,,,,,2980330054,140712854355968,140712854355968,4161536,,,,,,,,,,,, +"2025-11-19 22:37:28.2303209Z","2025-11-19 22:37:28.2303209Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\win32u.dll",,,,,,,,,,,,,,,,1763591848230320900,,,,,,,230350,,,,,,,,,,,2551303736,140712858550272,140712858550272,159744,,,,,,,,,,,, +"2025-11-19 22:37:28.2303256Z","2025-11-19 22:37:28.2303256Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\msvcp_win.dll",,,,,,,,,,,,,,,,1763591848230325600,,,,,,,700029,,,,,,,,,,,3371602543,140712858746880,140712858746880,667648,,,,,,,,,,,, +"2025-11-19 22:37:28.2303305Z","2025-11-19 22:37:28.2303305Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\ucrtbase.dll",,,,,,,,,,,,,,,,1763591848230330500,,,,,,,1436013,,,,,,,,,,,1441720767,140712859467776,140712859467776,1355776,,,,,,,,,,,, +"2025-11-19 22:37:28.2303347Z","2025-11-19 22:37:28.2303347Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\gdi32full.dll",,,,,,,,,,,,,,,,1763591848230334700,,,,,,,1243850,,,,,,,,,,,792084382,140712861433856,140712861433856,1228800,,,,,,,,,,,, +"2025-11-19 22:37:28.2303393Z","2025-11-19 22:37:28.2303393Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\sechost.dll",,,,,,,,,,,,,,,,1763591848230339300,,,,,,,716301,,,,,,,,,,,3291623140,140712863203328,140712863203328,679936,,,,,,,,,,,, +"2025-11-19 22:37:28.2303441Z","2025-11-19 22:37:28.2303441Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\kernel32.dll",,,,,,,,,,,,,,,,1763591848230344100,,,,,,,885660,,,,,,,,,,,2913437033,140712877621248,140712877621248,823296,,,,,,,,,,,, +"2025-11-19 22:37:28.2303485Z","2025-11-19 22:37:28.2303485Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\ws2_32.dll",,,,,,,,,,,,,,,,1763591848230348500,,,,,,,513405,,,,,,,,,,,3967481067,140712881094656,140712881094656,475136,,,,,,,,,,,, +"2025-11-19 22:37:28.2303531Z","2025-11-19 22:37:28.2303531Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\advapi32.dll",,,,,,,,,,,,,,,,1763591848230353100,,,,,,,761372,,,,,,,,,,,71854833,140712881618944,140712881618944,737280,,,,,,,,,,,, +"2025-11-19 22:37:28.2303660Z","2025-11-19 22:37:28.2303660Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\gdi32.dll",,,,,,,,,,,,,,,,1763591848230366000,,,,,,,230873,,,,,,,,,,,527442843,140712882405376,140712882405376,176128,,,,,,,,,,,, +"2025-11-19 22:37:28.2303718Z","2025-11-19 22:37:28.2303718Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\imm32.dll",,,,,,,,,,,,,,,,1763591848230371800,,,,,,,233556,,,,,,,,,,,1625678811,140712882601984,140712882601984,200704,,,,,,,,,,,, +"2025-11-19 22:37:28.2303766Z","2025-11-19 22:37:28.2303766Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\user32.dll",,,,,,,,,,,,,,,,1763591848230376600,,,,,,,1923284,,,,,,,,,,,675224942,140712888827904,140712888827904,1863680,,,,,,,,,,,, +"2025-11-19 22:37:28.2303812Z","2025-11-19 22:37:28.2303812Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\msvcrt.dll",,,,,,,,,,,,,,,,1763591848230381200,,,,,,,760295,,,,,,,,,,,460960534,140712894529536,140712894529536,692224,,,,,,,,,,,, +"2025-11-19 22:37:28.2303855Z","2025-11-19 22:37:28.2303855Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\rpcrt4.dll",,,,,,,,,,,,,,,,1763591848230385500,,,,,,,1193108,,,,,,,,,,,4275633056,140712897216512,140712897216512,1146880,,,,,,,,,,,, +"2025-11-19 22:37:28.2303897Z","2025-11-19 22:37:28.2303897Z","ETW","Microsoft-Windows-Kernel-Process",6,"ImageUnload Info "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"C:\Windows\System32\ntdll.dll",,,,,,,,,,,,,,,,1763591848230389700,,,,,,,2537167,,,,,,,,,,,2626650689,140712898723840,140712898723840,2523136,,,,,,,,,,,, +"2025-11-19 22:37:28.2303954Z","2025-11-19 22:37:28.2303954Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 7284 whoami.exe",14412,,," 7284 whoami.exe",,,"whoami.exe",,,,,,,,,,,,,,,,1763591848230395400,,,,,134080654423385232,,,,,,,,6628,,,,,,,,,1265664,1310720,56924383,3221225477,134080654489015372,83,0,1,3,3,0,0 +"2025-11-19 22:37:28.2307155Z","2025-11-19 22:37:28.2307155Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",3864,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028424192,18446633084028399616,140712899206080,0,696750415872,3864,1763591848230715500,696752537600,696752529408,140712899206080,11277899,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2307156Z","2025-11-19 22:37:28.2307156Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",5408,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028022784,18446633084027998208,140702989817872,0,696750407680,5408,1763591848230715600,696748802048,696748781568,140702989817872,67845830,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2307184Z","2025-11-19 22:37:28.2307184Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",8232,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028223488,18446633084028198912,140712865112144,0,696750440448,8232,1763591848230718400,696755683328,696755675136,140712865112144,269699,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2307232Z","2025-11-19 22:37:28.2307232Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",12624,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028911616,18446633084028887040,140702989233856,0,696750473216,12624,1763591848230723200,696759877632,696759869440,140702989233856,1887132,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2307235Z","2025-11-19 22:37:28.2307235Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",14384,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028510208,18446633084028485632,140712899206080,0,696750432256,14384,1763591848230723500,696754634752,696754622464,140712899206080,8595642,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2307333Z","2025-11-19 22:37:28.2307333Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",9776,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084029231104,18446633084029206528,140702989404080,0,696750489600,9776,1763591848230733300,696761974784,696761962496,140702989404080,957334,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2307340Z","2025-11-19 22:37:28.2307340Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",12484,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028481536,18446633084028456960,140712899206080,0,696750424064,12484,1763591848230734000,696753586176,696753573888,140712899206080,10699281,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2307385Z","2025-11-19 22:37:28.2307385Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",1184,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084035321856,18446633084035297280,140702989086576,0,696750481408,1184,1763591848230738500,696760926208,696760918016,140702989086576,2934612,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2307426Z","2025-11-19 22:37:28.2307426Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",14248,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028538880,18446633084028514304,140712899206080,0,696750448640,14248,1763591848230742600,696756731904,696756690944,140712899206080,21428731,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2307493Z","2025-11-19 22:37:28.2307493Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",10496,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084028596224,18446633084028571648,140712899206080,0,696750456832,10496,1763591848230749300,696757780480,696757751808,140712899206080,16702796,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2317641Z","2025-11-19 22:37:28.2317641Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,,,,,,,,,,,18446633084029116416,18446633084029091840,140702989217024,0,696750465024,8552,1763591848231764100,696758829056,696758800384,140702989217024,18009798,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2329108Z","2025-11-19 22:37:28.2329108Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop "," 632 OpenConsole.exe",8552,,," 632 OpenConsole.exe",,,"OpenConsole.ex",,,,,,,,,,,,,,,,1763591848232910800,,,,,134080654410427174,,,,,,,,6626,,,,,,,,,2904064,2949120,170556274,0,134080654489038872,111,0,12,10,3,52,0 +"2025-11-19 22:37:28.2332799Z","2025-11-19 22:37:28.2332799Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13300 conhost.exe",6828,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028309504,18446633084028284928,140712899206080,0,689119428608,6828,1763591848233279900,689122574336,689122566144,140712899206080,96563,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2332863Z","2025-11-19 22:37:28.2332863Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13300 conhost.exe",14856,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028137472,18446633084028112896,140712899206080,0,689119420416,14856,1763591848233286300,689121525760,689121517568,140712899206080,553353,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2333040Z","2025-11-19 22:37:28.2333040Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13300 conhost.exe",3620,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028108800,18446633084028084224,140712865112144,0,689119412224,3620,1763591848233304000,689121001472,689120993280,140712865112144,120327,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2333088Z","2025-11-19 22:37:28.2333088Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13300 conhost.exe",10848,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084027535360,18446633084027510784,140712899206080,0,689119404032,10848,1763591848233308800,689120477184,689120468992,140712899206080,764586,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2333200Z","2025-11-19 22:37:28.2333200Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13300 conhost.exe",6452,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084028252160,18446633084028227584,140696384580832,0,689119395840,6452,1763591848233320000,689122050048,689122021376,140696384580832,28729820,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2336004Z","2025-11-19 22:37:28.2336004Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,,,,,,,,,,,18446633084029374464,18446633084029349888,140696385038832,0,689119436800,4352,1763591848233600400,689123098624,689123086336,140696385038832,745725,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2340631Z","2025-11-19 22:37:28.2340631Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",6612,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029632512,18446633084029607936,140712373211440,0,932562563072,6612,1763591848234063100,932579377152,932579237888,140712373211440,6105737,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2341385Z","2025-11-19 22:37:28.2341385Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop ","13300 conhost.exe",4352,,,"13300 conhost.exe",,,"conhost.exe",,,,,,,,,,,,,,,,1763591848234138500,,,,,134080654410205145,,,,,,,,6625,,,,,,,,,1556480,1605632,60704691,109,134080654489052028,92,0,5,0,3,0,0 +"2025-11-19 22:37:28.2493114Z","2025-11-19 22:37:28.2493114Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",9352,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029317120,18446633084029292544,140712899206080,0,932562546688,9352,1763591848249311400,932577280000,932577267712,140712899206080,3968522,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493126Z","2025-11-19 22:37:28.2493126Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",13692,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028653568,18446633084028628992,140712865112144,0,932562554880,13692,1763591848249312600,932578328576,932578308096,140712865112144,8869104,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493138Z","2025-11-19 22:37:28.2493138Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",14632,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029947904,18446633084029923328,140712899206080,0,932562579456,14632,1763591848249313800,932581474304,932581453824,140712899206080,2144557027,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493139Z","2025-11-19 22:37:28.2493139Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",13488,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028854272,18446633084028829696,140712604173856,0,932562513920,13488,1763591848249313900,932574134272,932574130176,140712604173856,12990007,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493172Z","2025-11-19 22:37:28.2493172Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",2344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028624896,18446633084028600320,140702319920256,0,932562440192,2344,1763591848249317200,932564697088,932564606976,140702319920256,1455950499,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493206Z","2025-11-19 22:37:28.2493206Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",6260,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028882944,18446633084028858368,140712378637616,0,932562571264,6260,1763591848249320600,932580425728,932580397056,140712378637616,74326129,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493288Z","2025-11-19 22:37:28.2493288Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",13068,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084056907776,18446633084056883200,140712899206080,0,932562530304,13068,1763591848249328800,932575182848,932575174656,140712899206080,1442413,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493310Z","2025-11-19 22:37:28.2493310Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",4192,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029173760,18446633084029149184,140712632221632,0,932562522112,4192,1763591848249331000,932573085696,932573073408,140712632221632,3191112,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493327Z","2025-11-19 22:37:28.2493327Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",3424,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029546496,18446633084029521920,140712899206080,0,932562587648,3424,1763591848249332700,932582522880,932582510592,140712899206080,7336541,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493342Z","2025-11-19 22:37:28.2493342Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",14684,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028968960,18446633084028944384,140712899206080,0,932562595840,14684,1763591848249334200,932583571456,932583559168,140712899206080,3853099,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493343Z","2025-11-19 22:37:28.2493343Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",3272,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028682240,18446633084028657664,140712899206080,0,932562456576,3272,1763591848249334300,932566794240,932566781952,140712899206080,18018463,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493346Z","2025-11-19 22:37:28.2493346Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028710912,18446633084028686336,140712899206080,0,932562464768,12328,1763591848249334600,932567842816,932567830528,140712899206080,16404047,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493363Z","2025-11-19 22:37:28.2493363Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",6564,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084030005248,18446633084029980672,140712899206080,0,932562612224,6564,1763591848249336300,932585668608,932585660416,140712899206080,1315295,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493371Z","2025-11-19 22:37:28.2493371Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",12924,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084030033920,18446633084030009344,140712899206080,0,932562620416,12924,1763591848249337100,932586717184,932586708992,140712899206080,807962,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493410Z","2025-11-19 22:37:28.2493410Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",13344,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029976576,18446633084029952000,140712899206080,0,932562604032,13344,1763591848249341000,932584620032,932584611840,140712899206080,1766050,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493421Z","2025-11-19 22:37:28.2493421Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",10628,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084010672128,18446633084010647552,140712899206080,0,932562472960,10628,1763591848249342100,932568891392,932568879104,140712899206080,4099788,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493446Z","2025-11-19 22:37:28.2493446Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",11164,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028739584,18446633084028715008,140712865112144,0,932562481152,11164,1763591848249344600,932569939968,932569931776,140712865112144,142205,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493466Z","2025-11-19 22:37:28.2493466Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",6140,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028080128,18446633084028055552,140712899206080,0,932562448384,6140,1763591848249346600,932565745664,932565729280,140712899206080,30190715,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2493471Z","2025-11-19 22:37:28.2493471Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",13704,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084030062592,18446633084030038016,140712899206080,0,932562628608,13704,1763591848249347100,932587765760,932587761664,140712899206080,393419,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2494031Z","2025-11-19 22:37:28.2494031Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",11792,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084029026304,18446633084029001728,140712891292720,0,932562497536,11792,1763591848249403100,932572037120,932572016640,140712891292720,10320952,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2494319Z","2025-11-19 22:37:28.2494319Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",9736,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084028768256,18446633084028743680,140712899206080,0,932562489344,9736,1763591848249431900,932570988544,932570972160,140712899206080,8949073,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2494409Z","2025-11-19 22:37:28.2494409Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13248 WindowsTerminal.exe",4376,,,"13248 WindowsTerminal.exe",,,,,,,,,,,,,18446633084027793408,18446633084027768832,140712583404848,0,932562538496,4376,1763591848249440900,932576231424,932576223232,140712583404848,640863,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.2568176Z","2025-11-19 22:37:28.2568176Z","ETW","Microsoft-Windows-Kernel-Process",2,"ProcessStop Stop ","13248 WindowsTerminal.exe",12328,,,"13248 WindowsTerminal.exe",,,"WindowsTermina",,,,,,,,,,,,,,,,1763591848256817600,,,,,134080654410898354,,,,,,,,6627,,,,,,,,,16748544,19189760,3883624426,0,134080654489267736,577,0,60,53,3,7,0 +"2025-11-19 22:37:28.2575230Z","2025-11-19 22:37:28.2575230Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",13872,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084037992448,18446633084037967872,140711612509856,0,1046354432000,13872,1763591848257523000,1046352232448,1046352216064,140711612509856,1922208,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4656761Z","2025-11-19 22:37:28.4656761Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 8476 ServiceHub.IdentityHost.exe",,,,,,,,,,,,,18446633084041035776,18446633084041011200,140712899206080,0,843735072768,3676,1763591848465676100,843738251264,843738247168,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4657535Z","2025-11-19 22:37:28.4657535Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"13072 vctip.exe",,,,,,,,,,,,,18446633084029317120,18446633084029292544,140712899206080,0,941791567872,9260,1763591848465753500,941796360192,941796352000,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4657851Z","2025-11-19 22:37:28.4657851Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 1520 powershell.exe",,,,,,,,,,,,,18446633084027793408,18446633084027768832,140712899206080,0,931707506688,1888,1763591848465785100,931708534784,931708526592,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4658205Z","2025-11-19 22:37:28.4658205Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"12052 ServiceHub.TestWindowStoreHost.exe",,,,,,,,,,,,,18446633084055474176,18446633084055449600,140712899206080,0,17905557504,4840,1763591848465820500,17910726656,17910722560,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4658465Z","2025-11-19 22:37:28.4658465Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,18446633084016447488,18446633084016422912,140712899206080,0,46015684608,10824,1763591848465846500,46028292096,46028275712,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4658775Z","2025-11-19 22:37:28.4658775Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"10252 ServiceHub.IndexingService.exe",,,,,,,,,,,,,18446633084028854272,18446633084028829696,140712899206080,0,848613720064,13472,1763591848465877500,848617799680,848617795584,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4659003Z","2025-11-19 22:37:28.4659003Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"10648 ServiceHub.Host.dotnet.x64.exe",,,,,,,,,,,,,18446633084028624896,18446633084028600320,140712899206080,0,515211558912,1976,1763591848465900300,515216769024,515216764928,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4659380Z","2025-11-19 22:37:28.4659380Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,,"10200 ServiceHub.VSDetouredHost.exe",,,,,,,,,,,,,18446633084030062592,18446633084030038016,140712899206080,0,617597181952,3900,1763591848465938000,617601826816,617601822720,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4659602Z","2025-11-19 22:37:28.4659602Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9988 Microsoft.ServiceHub.Controller.exe",,,,,,,,,,,,,18446633084028739584,18446633084028715008,140712899206080,0,1049753075712,14992,1763591848465960200,1049757745152,1049757741056,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4704807Z","2025-11-19 22:37:28.4704807Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,18446633084028080128,18446633084028055552,140712899206080,0,46015692800,5212,1763591848470480700,46045069312,46045052928,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:28.4905294Z","2025-11-19 22:37:28.4905294Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 9280 Greenshot.exe",,,,,,,,,,,,,18446633084028682240,18446633084028657664,140712899206080,0,948118986752,12724,1763591848490529400,948123467776,948123463680,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:29.3932962Z","2025-11-19 22:37:29.3932962Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13072 vctip.exe",8676,,,"13072 vctip.exe",,,,,,,,,,,,,18446633084057079808,18446633084057055232,140712899206080,0,941791477760,8676,1763591849393296200,941795311616,941795303424,140712899206080,210478,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:29.3933765Z","2025-11-19 22:37:29.3933765Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13072 vctip.exe",6088,,,"13072 vctip.exe",,,,,,,,,,,,,18446633084057051136,18446633084057026560,140712899206080,0,941791469568,6088,1763591849393376500,941794263040,941794254848,140712899206080,1198365,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:29.6961056Z","2025-11-19 22:37:29.6961056Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 9920 ServiceHub.IntellicodeModelService.exe",9760,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,18446633084028108800,18446633084028084224,140711612509856,0,46015700992,1468,1763591849696105600,46012694528,46012678144,140711612509856,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:29.8394671Z","2025-11-19 22:37:29.8394671Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","10648 ServiceHub.Host.dotnet.x64.exe",10688,,,"10648 ServiceHub.Host.dotnet.x64.exe",,,,,,,,,,,,,18446633084057079808,18446633084057055232,140711121663952,0,515211567104,9320,1763591849839467100,515218341888,515218337792,140711121663952,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:29.8397391Z","2025-11-19 22:37:29.8397391Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start ","10648 ServiceHub.Host.dotnet.x64.exe",9320,,,"10648 ServiceHub.Host.dotnet.x64.exe",,,,,,,,,,,,,18446633084028395520,18446633084028370944,140711121663952,0,515211575296,11464,1763591849839739100,515219914752,515219910656,140711121663952,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:29.9831575Z","2025-11-19 22:37:29.9831575Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 5096 svchost.exe",15108,,," 5096 svchost.exe",,,,,,,,,,,,,18446633084056850432,18446633084056825856,140712865112144,199,667265712128,15108,1763591849983157500,667271823360,667271790592,140712865112144,285541,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:31.0497261Z","2025-11-19 22:37:31.0497261Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8004 svchost.exe",2300,,," 8004 svchost.exe",,,,,,,,,,,,,18446633084004868096,18446633084004843520,140712899206080,0,841719537664,2300,1763591851049726100,841721839616,841721806848,140712899206080,226697,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:31.2092051Z","2025-11-19 22:37:31.2092051Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9920 ServiceHub.IntellicodeModelService.exe",1468,,," 9920 ServiceHub.IntellicodeModelService.exe",,,,,,,,,,,,,18446633084028108800,18446633084028084224,140711612509856,0,46015700992,1468,1763591851209205100,46012694528,46012678144,140711612509856,929799,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:31.6880035Z","2025-11-19 22:37:31.6880035Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop ","13084 MSBuild.exe",12948,,,"13084 MSBuild.exe",,,,,,,,,,,,,18446633084002254848,18446633084002230272,140712899206080,0,911121563648,12948,1763591851688003500,911130755072,911130738688,140712899206080,5634614,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:31.6915761Z","2025-11-19 22:37:31.6915761Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 8972 VBoxTray.exe",9020,,," 8972 VBoxTray.exe",,,,,,,,,,,,,18446633084002254848,18446633084002230272,140700131109808,0,471283212288,10176,1763591851691576100,471299260416,471299256320,140700131109808,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:31.6918214Z","2025-11-19 22:37:31.6918214Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 8972 VBoxTray.exe",10176,,," 8972 VBoxTray.exe",,,,,,,,,,,,,18446633084002254848,18446633084002230272,140700131109808,0,471283212288,10176,1763591851691821400,471299260416,471299252224,140700131109808,462825,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:32.0530558Z","2025-11-19 22:37:32.0530558Z","ETW","Microsoft-Windows-Kernel-Process",3,"ThreadStart Start "," 4 System",104,,," 8004 svchost.exe",,,,,,,,,,,,,18446633084028538880,18446633084028514304,140712899206080,0,841719545856,11156,1763591852053055800,841721839616,841721806848,140712899206080,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, +"2025-11-19 22:37:32.3222797Z","2025-11-19 22:37:32.3222797Z","ETW","Microsoft-Windows-Kernel-Process",4,"ThreadStop Stop "," 9692 PerfWatson2.exe",10448,,," 9692 PerfWatson2.exe",,,,,,,,,,,,,18446633084018716672,18446633084018692096,140711613062896,0,1046354366464,10448,1763591852322279700,1046367698944,1046367682560,140711613062896,941871,,,,,,,,,,,,,,,,,,,,,,,,,,,,, diff --git a/x64/Release/EDRi.exe b/x64/Release/EDRi.exe index a852c59ecd1619d9387c4c4105a23ad09ba1106b..b79b3128859fc9a293bf7796b20573100ddb8bd8 100644 GIT binary patch delta 80898 zcma%k34DxK_y62G36V%9!4MH7F$jXh8X_blOqkeX4PsYokl2}Mgv4YB53VXjDOzf& zR!}OarLBskwRA&i`@~XPEw#=6d+sw6slM;~`{(nS``ml(JA@;ywXgP;&iQvw7ozjxK4H3ZN;Ni#r725T`O3?BxTq?mbh@5syGmJs zia(Vvklx$S>%^1pwik<6E+HSN_<4i%R;8^sv7YGN5VY4LU9Fr&I!j?bBx?lHR?1+c zfyxpeAbg}8@gao!03A?*4TR7Q=`3X~(qv^9(pJhfq~PESgb$UrzLJBlWYq$GZh1raKzk6E6IL>zNKIngi@q6obzZYQU?D+0K0=F{OQcciXp`X$!;MaTHw4w;kBiE)g}uJM!H&A zf^?R07-_O{A89KkIFt~&g#ux@@^&a8>;mY3at$dQxDFx2B83AZ1qY;X;5tB9rtrFw zLtV)MDL5bn2c+PD6ddZ+VIfMVdJWkmWhT-i%2uT1lppIgMH{~`Y7>hzP?;DeiM}63 zM9%_rKw){u1Dry=Qf zNkbxZ80l)|KHy1;IXn`+GB+HoQ9WQ1P!lI5j4EkBk!&}MIK|bksOM zrsCfihFPq1Z%l^S(wGc$tub--YeJl3k%lP~k(O1~H-V^&lygl;RMwP4jX;{K3`ROu zS%TD}97YK8f z7A+E(mlD#lFFUNvY8lUL%8{0#Y>0BJWp`FxX&p6yomEyx#j|&nU!(f6Zc3|GWB8+N z<-=Cp*)HWpt9Uk3X&c>_MJTJIyYTx9lsnN?eHyieC_zq9;uZha?bs3}xpg)6zB03Q zN7j7z@zw^0%Y`-#^{mqFQtgr$o2w+peG1?3i*L(|GL)qFdZe0osT!nE4N|D4y;KcS zs0Jxi(|#P=t{6JR!X3MHAa|ULw3V_8X`phg16*y6QqD}S7HcLCnP?^#IB6yqU;@6o(jYZl@nTRw{S>G9=PFK!#CIr@n5F(JSRt6)T zr7S_3tQfBPYGQX*s4SW|05RtF#CX<8X*8)XTq}3d z7z~4_lX}4aER*9|J!R?SzWmw%<<8{JaLiU|)eOISm2k;NUdmf(ZQAfpFzYl-3d+!`oTBq)AuA@9w71IMNoYyMU@uMjoDo)lJ92GURin2<#8G&(wvy%yHw_luO-3+uvLw=6tLA;Ol#zEO_Y zLfI$EE!$as?+@jRToe02xt?2-eW{eO*JOK?hDf(4Nl2F}Gm*|x*4y{NGW{2gV3U<2 zi-xi)O0C7o?8xrS#VZ)wtpqITg&{g|2@S0ENW+w~NXsg0DaLfH(r77->A_2BOfOkF zj&)WXOJm{2u?pNcMwz6L8?RT$jn5)ot*~X}#t}%9mBC0`DNB$BDu+G+jk+e=u#vS$4!S0(GNz0m%8fMk72Spp7!Xca*{QL$UA*rps_ z5m@`KR^dw(nOa4zi$f152fKIHZZ~0PZ1V1!IA5G9k#+ zr%YvJ{3+v$%y~?Ew@M>(92sTZ%Ub!lUaYGJ3(EhwJX>Fh%@Njm>>7U&B8G&qTI@TK z6UKV7=Hizy){Xrp!t1j^EKB6oN2#&+wLUYmoB8z`u(ob&bN={7tUBi1{6$UK9md|t zpVgct=vfzWyd{ffe)(=uEY5>%%TH*>+Ax-zpA*Njd{`-A=)rcdUipW5uK4ZvfLX)<85I$V{wEe$Ro-o3oi>ND3Rv+UFOhFkYIq6X!;aY;T`|Io!NtTjypWDREWg`* zR>_Sm%YW+;>%!SavF{1{nH|p;PuYiznetBxLmW@@~7=#f}k?)(FNtX!9%Kkc}N(ux~>oP{sIPG`2sg6%I$&hR|5Z9v9|IBas}w|2vpr+S=DXUQ3BiqwRPGsS39 zSxjaN1nwGZ*ps9qDOy4bD~VCIZwV=yxC+IrET$M2V>38|&aE=$6QCr;wD&YclC`I) zp%$HPUV&j=D^Hy+HeSNapNy+>kXExs2!^C*ow%FmDhFPN(RJES%!CPuz_+?3q(J zex4(}MWXGMp*pPFh1|jj#i$wYky{i>xA+!g6LsVk@Q@as}P%=D57{335p~lb2%FeCDymATi;u?)t zx{KFX$;%NN*}igml%aYIjoW$9AE8OdPa?-(2ekh$$FB-8E5P3~^Ud6(X(*Qvh_r#K9s%A6VLbT5mo9sKd6n*Wvz(P^^v zNp&x^w4Ee^DXJHImkM@cBC6HZR3|34V->8EH7t`8D-AVpDDV#$E6EL|;bl)$)qeGf z#2GU@vkyF4oe@mK;VMYRER;=7s?A+Z3e{v;tIB~KXNshe9A`39(iKDb&m8HluX5bu zw6XjP02s@E5d5EG`8pg>j^)ahoHS6Np!Rw+gY>PA&f)yUcnAyzky^u?S*ETfM)W-| zjA$vljE3mIdqLD8QgE`HRPgNgq2NBloNBwMejMOZT0JySTWd85w(nJ?xW=7oOjKjF zolLNOr%o@fdj2EGd7`TEx!Aob+{SFT=i#D`g(#S5+H8C2NU+b(i^sAtCyQ#(z#l%~ zFq+otb$PbgD>Dljx)C1V_^Wtm(7t@-Ybp+7X=-G)X_!OJUTzk9{Z@BDI%k{s-NW5v zbr=`FM`6r8@*yrcS%i&w(US9l4qQ%Tc_4KIY(G?tW{D{dV>3dqNioesySX_fHtWB( z*Z}Y95$iZZp(zDpS`CSDI4BIs)(+$OHN-2UAH0>cL**q(eChdK9BT=wvjnT2lD zm&SW9E% zwFx4~IhThUe05+JWbifn8vGK&EjcN^<`XggBv&j1!FoZeA5rv; zH2BR{4Zf+qSRSN5{TB`2oY^bIu0R%G?VRCo97jj>`+~qgEqub^yXY1O0GT@c^mx3A z`DRZg!yb!iRBW~(yQgVXf~|u`VonE4&vB+ynsHNAH&CL{rmD|IYU3_Qz30qf5|X)M z1G~Yn-f$Cf)5AU3+Mp$z({5h}2^_}5t4a4x=SfC^h^DFwK|oF?MVrtJE?4=(myV3+ z24iGUUkVuXqS73JJzT6w)*&=tK;yDo0?62Y%n zwLx!Gj;G4Z_-x-22>l4=I8FnGn6Y@(I?9xl(4PUU!9srDD=y5Yw12Jx&LuhXYYG2Af-lUKp51L~gk)D*(l`+|ei93nmT6cBYr zTPPRtZ+`?06Cykc69ddR-5~>Zfx1FRo<2#;?9NSWoLJW#ip>xQyYqV1WkJ-rGZcdM zRiNxs^U!LVr<{><-<7E&ddvGJ$DQ5TJf&7(DyxW6E)J<^_St3nhOmPtr)k(sE zzD^>0%ZtH1cokMfqO-R|!=AiR;5X?~g!EeG%;PcUsPsP!S);Ijr3n*!dh$xvl>?y6 z1luWfZH!L07qLWFbO}jDbW7}`vDp4hvQ0WcO4(LkQ;OaA$xLTgKCD)(veV@#dkMNO z`-Ebw_s7c+wX=J{%y1andG+VA)BwI?{P8hr#-k=dluzOn%EkAiA!B?GVDj4by|kDe zT~&jZJFUU10fS=p3H8flDRrUxxt2Ml9%%#d<>YKjtWNRKPvj0W7~JATFYdut4iwD?@Ho-2H?P4AVtj8NHhAGQ!lxXx|}aI_u*k(%b>?N zLnEe`ebgg$X0kB#-5XUUWurLk6l_L+a{fz1SW<^XqG>XQv*V23~g*rL7VMY{C+!mB@T#P5#R>=5elrX7xp zk^Omi*~F8M!{4$!SKet7S=%wJA$R-h@d7MsAKW6lrt6Fo+P(zyjYP2SgfZXSM8A zAfBcy4YY9@;x8y;pcQ)uZOdYGB5VLJ!$yi`1NcaO#VFPeK!^`0*4-9Nfd3dO;x7!9 zOBgD1X1+O8^3=LFxXyO8=q%g~0*swR0?>dP0xGb;yORO1Md!+kRMPY^v?0A`ro)&O zgf+A}^Z;x>qd19`aDXq5I996Jn$~LYx@Hs|5%d&6{2# zgWICNk{5};T{s5u2Hf$MSUZRtD@6W_z=gL&pA>GgrVJoE?Syd#A_qI|MYg||Er6Q( zP?k1H7cn)!z@t#kj#n}0lL_%2TDv0$#HYw|Eei~zqrXJ-P~X!K4XDbF4|N$hg-$C| z_m#?^!M|Ft!F()*!ofVu+D}?0F)qXhCiO+JR zmu_58wBCECm_Zw>&l}P?DRxNF{v;<7xIy8<3|N7h6e@Gl*BW$lS(wV7O$xSv2dJARbSeMDbEOhxNq$N_O0vV&zdi}VTH z{#3Ht>8MV9V$duHP4H$d@pf|>226U=Mihs#j6Hv!BPaoVzq(X==DH8B>o%)n;J9%P0jxz@OuhGpZ8-r9g4ewXZjX% zRP^D|IDVKnsucN6(&P4u{B#V1Z)gXt+tR*fyF6R{0duwKHm6hAZHxZKpKONwuH2KALw& zuxmDk*D`mdUSvk6;6gmyW2kIDNR1ORpAzVq#pc}-P)pQTQ`;tHePx)Zxq2W@{tK`s zr~T^9@5IJ2Jj`z+t+_IzKgC5-TPCiJ!G2_scrpgVdy1$u7X8^qi=WKs1GvaWt3|i5 z+-O~aGVzE8kF+4OJ+Q@V`kvomTw`MxY_500ocYv|<}b%S+=>KMZSk)hw&O(?p~_g> zBNsFs&{*5Cq5^<3qC*noUSzvecTW?}IZms}b6Q(Hm4O;J(9~t6ij}qxHq_RzPkxa* zk(INs-*#TG)+yk7yf_ zP)X`y@qH9AryVQf>xh+&{`yR7q!Y8pVH&;PLHJGJ#wh2GyvA=7<(z%E@Hb&Bzvr}W z?;BKfFBm0tdCDPg%qYOmJnxNrT6z4TNlOfd*=e5tDc? zezh&RR-m;U7B9s_;-J5S-bHZ&O+7URFfIKocx3W zRXQ>-;vDHN@(`&pnb~gq@_=TZCP4VN5gT}Et#muJR%Ou&{lvih1cSx7Gq?L<)~C(6 zk61jJ*Yu98iAHK8nTCnOlX-(iRfEt&x`!SgW47G~+g93Q|Ef9}Q6Eu}4t`d`&U6Gt zhXsKmIE^se6B&YFK-pgJ?ioOvar17Y-$*)1{#qBiiAGU?MnHjy8dXG`! zzLLuJ*`S<=Us9ww^BHO7Z^Ti%2v5gZQH)4T=RvJ$2@AwZxJbk&a>)wB*9d(WHRazZP55c~k2P3|njsQ!ttTjV!HuMj`*mnNLOU?^7QBHcg%Il6)H_ z%)ap}ZSHH^137*j+OI(l`r3l*DlNMcn1ZtQ#Jy@W4RJHd+3}ZLb9Sitgcvl1d*e`X z+!UV5){0-I@UU(_Xe)1>`qm4WhE5VfojULHqjSP;gVSWWYIB_=&}g{%wY>F<)4r=M z;nO%NPmCc$w-x=Tax;#jHcsVr_@M6Mtd&<_m&LVd+}QYfABc$a)|m+9#pkV^320Bu zSBC>iE9{(jQGDFGON341f$f{fqnrVoDbQVNLB7z_6eN#Z18x;Z008K?b#FHr0n#GK zaq9g{<2$iAiDnRsrtwyMNH-}H|LLSC$lw(kZ>QBHgqnj%q*$nKaypk$2%e%81y3n3I#m+3DCvE-!kMd}Hx!I&bXxM6TW-b$ii#2Cwg#;ZiL&OEY+T zKCO$^^#{jg*R30=m+1PkrzN^R(nVwrpz{2?ggw5dgP@%D9vQ9i?8e)8(7|HE`DoH+ zv#qm-nka8R4nUz$z2B^)LK>@YN_@667D9t&B9^c1tO-?F6RL@qQ>f3Mln`oBPp7^< z0Q60v?gxlFGkKLkX*i$3p}gep{}2BC{&4o5?IC*rQw=|wKK zSzwD!Z<4Y_3we>9UM>9Q@GyS2lUO?o=X;_5qKR{*IlQsgLPDWlU;ayc0F2T#;6+7? zo{L>pUX3^Fr0HPi5vhafb;e2x-NvJj|LC?C4uV{! z-qEOJx9?wnv)izkl}E4v;*1r`+l%5*20~E;*&8BE$IMbJf~Bjo7ei^jp<6#CTz`jX zkii4%H7MH<(liC zye|+_moA22PA%yIedW23Ceh3Ak`lG~^-W#;Y{szbF_)Y8XJ$>PhEAdONuz(Gp1of} zsEwVSLVXVCn+hpiQmEdDYbAwRC=Z)7p&I-{s8lSh{&|DU2SQoNFSCX|bvPoc9%zg? zcHTVAN87qYXdy+AUO5nMNYdDiZnBo1Bn)_6-9}c^is;c-az#{aB-TBDhZ2%p)^@(4 zW$ngK(LlX|8mp|js5U9C+OrN-$518LGDQWC$m33{`Z{Ea_|3Szx)~mCP#?&Hr`LC& zE~-~?5(4J;Ps=+{7ge7#G*<%mMCcp1dx~+ba$ZQhsBYAdKXW0UD|8~;-b9{JjO@Z4 zrQuF@;jVDuc6k%G^_#d>HB3W}b|Lq3A(wv>nZJpw-oxPuddyt7)m*q2YroOs<2arw zdB5(W`l-aV8jpSJRM)Skojrc{P2`3DLZ(w2FwSw|ZgSxcdK0(vzi?Y=xQP-s2C5(J zLay;9a=CvY>ojCP7vl!v=Xtzu==>AX;RX$Z@3gGtayW;vBA#U>55w{nE!65_U>4?* zlVW)mZ-Se@UuW@pubJkM)`lJ=ZRu8B^^G{SG~=VD2Jw~Auy0&b`< zu>sbtxQUU9$4aK*8N}1-kNd>p1w63KeF}(CRUdQ}pDuvBOU11PyjG7Y%d!2yb2w&m z=26^ateS~d>F*F;;y$XW`a?X>vVKgPgeA=d%12#E!!y{O{MD;;ChK)LN3t6mVMBbYCo)TrQ7zS^XVAlT4x^#3%QcdyE}ZHz zqjhoGKBMMU>=Lm(E5e12KCl6L6^s^kVExy9q7;V&Jw+=V}hx{G*XKl>q2#2PwC-5LaR+6)Bk{|;0M z7^C85Epo>EFKL_-VCa`zcWTipt{Z~iH2f(4AAjQPB5v^+go8=#_!kSr)1uyD9_+U5 z6Rs0i7x8GHwISGMn28%|2a0!5%UX$pi+RT~-t<;Qy{fOGg>N3O%Z7-kJRazFFxp)w z)(>X>dRtW?rsVPFtWa#v<9O0u+|J`|^R zukpM5-+rRoQeL^zC-UUOT~8!)@IdZSyzCv+|ETbbViknD!YZ=CV%t*Q#FG3u375E7 z?E!zt!zK<-m=!u7IJ+Vr$20C*B%2gUm&uF80gOFyhpOx=Zhx2FWZiIEFYp#lNSi;g zbdTNZE6r()5EA#UYOYSsl(g8KIeRm0e3KSiAQU~c&;T``G?3YL*nWwZ3aix113=d{ z(0Fl$lgI;-QF0$eIg9NyX2(L1y$hg0Est7`==I^iAEa z*CphXj?bCuk3+F?b}DrU!b7W}20w1jNxXYJ{s|*84&%p3#MyoRW~~jfHTFwn$*&M2 zA_4mnTVg}n_hG}kjCU%N1}MdrvEuMD9?Kq!t;=}>R!=lqj>z_YVZIyp|=?XsC;ZLF96S3qiaMV~2Xn503z4F$|(4bDA zY6B!lZMX{(#`G{}-VQR`E}Lyf@Zfa3RYWw!0rBr0q=nkh=}-wrr}$%c{~HH?(xpK- z2ahftK1v;R{-Hh?+>1dVZ`OwC5&3|T@wEVJcm7*|&*l(q(X=V|^XR1sVHNMa&-;ry z8@MkE5-m6Ih92SQm%9HwE)M_7{444|ft2V$4tsorLD8X9yHHHnfIasfv3LXT$lwwi zFbBJdM;ma6SV~mi$ma#_L+@f9A7cqQrObG4-kj#Wp9s@T*iszY$O9^7%G0selp~3< zXa3!d*oo8*ElXq1z0OQhRTrqDw8MC+onH6&C<7&GN}&*eauaV=>w7vFs&@nj>ZJ{D zUzX-{-$k&@=)<_kgX8rb#KCR6a{V1d(77C#0VY^{p2s8G+B*Q{@x-=oarKX0LjN&u z9;{I+@1$gWh{GeyIxpmz5}o(FE$VIN(Phg@(iHq#dWnr6^OlBhu$rgngeObw-qW{= zJ0J5VR!`ZntZig`ylRze%AkJN1Q>CEumfD#6xE<*o#HYL^`;Zmc7h&xyb5eQ^5~04 z9`Sz5^+89~Rrg-H<}Yah%!?5}=Nrm|#zXd0=Z6ZEQ=QP%9JnJjX)@CG%rXc-}O zS<&$J3{97V36>c>5f`b;ZsMmcymABav8GGefx1%E|D;P&`UbV5 zG>apu8aE&VeQqPLR6wILuN+G3yXD2-o47%&`;eFQJ@ZvbRnGWO90aie(H^oh^FMOx zl8jLYFsCA`X<4U+eYM7ZTeZfT_6q)`y$}C%YEQJ<#Ou{OhP8#JjxxorwVq&^(YtVw z>R2LHe*|?@C%d>@YqaG3pVYAqEY)vHi}Ra!vyg{vB`Lj=l<_*s(8X;6Ll-G{HZN)` zd@GEkmddGHTBL2}Eqo81D5;URHcO3I!%9hwM7uQN?7I5Ex{ne@ z+}j&U>gVde^t14GN$;WuL*YbeCg0w85A3SwvWffG`XJV&v)99MF2ORRm*66GHZfM% z(YC>k4@)Smqm=ExDs8K~R9cPmF_PAGT%-dXMFvVcMPRA4?(XDlt;$*?aT-&e?wZ!t z9xJJ}gby^Wm35O{uZr6&CCB6=eX-VVy0R(i6)o%3+F6vKwR8W6)<)m_Ked+C=HFTy zOfU>QT%^{zwb8V;7?XRktJQ_{|09ao^qQ;fmapGNAH_v#Z38ki>tqr(HrDY-mrR5S> zDy^J&cNdh_MA9aueXY}!Ht29krIlH)DeaWwCArJbPIqxd|IYw+D(xdzHbq^lWt~b} zqM=S&{lAq~_xJx(Y4K72R$4H@GNU7KkxKK6l1gjXg(P(;?WPpyzmCsNj+f%QO}uH1 z$t@+ZOkAYah9U#4jU}+u+Jjf(z;4`@3X{}HZ6CdQDbhFdNZ&SxO6slXJxy=hUP`?k zT(5QBrMKk(JN35El}%BtTGpwzi5hB4dI{!#IGg8<|ERa1q~5W;%);?0Z)EmrL3%r^ zEi*#s?w#HJk4V|oC%8zxU8FMJ@(iaNSh%kgX9}V(DBwvtBgt-0tgU`3rhmqRSb4GP zGu|>dQX^n?5-^4$16@TBn4a$4D;|BuV>}(}B=%-?ylAtB$9W#s%75U|W&0j1o+pbV zdw7k39iG2*JU;51=AC(+_7{Js%>c-IeAI&=PXH;cnly+TL7oG$SuLkQI6+=YraBG6 zv54fnb=IM`H1^BbkKNr z`BFz>@!!{8Tc2sZ6mq_)Bz7Ga=}SkEfqqUASPS-||6U&L{iP%>V?9u%E3MsM(v=cc zIfMP*vNKhk{@`+@M^B4g>82}-V6SCe!5$^pe8#)~+m%LN`G+fI9`-G|_<>GtSWca) zaEj(k|D;|tVdC%;>sa@GV)s6*46|^yJ7+eQinEZBFOX(Nry}b}ABANky`JU%10DbR zxnIWx$2_;?rT#Ix*u9VAqQ>sl>GERtVciCwbH6O#{4y?+7wB`E|5R+)&ud#hL0O9RA+;)t_gXWfiBt)(MxqF@NLYw9 zU0&*Ur;FXY2QKQsPfCjQoMIRbf#t=!E;abMKoe`YFT}cV1rUg^g4h+yh2PpfScEQ z!<{PHfs9%g;%7#0K(>U6#-RumO~C~!vf^UNY1)TMcJIEpsIzvKRMF{GQbmj9#XFoD zJpV#dQ4PG8tiD>Hsi-y8@WgC!`UtNi;tuleKAReXwmm+dHb~EQiH!$&jWUmhf*dyZ zEQiP300S*Yf1V7B{T0O#?T6WY!r$3rUT7HOZ2`$H?3AEf97ihUR zE|#2{;Z(AFN8qBq*jiG{dU;A?yt|y#;Z5|_nfo;@4=n>N&&kxZyoea`Z!<~D9UHAd z2?sd&w3jWDL%o;{hrzoq)U7^i0El{?Ru6APx%!qS>Kwr%!X&mFNRNqJ4rpga-$b^A z{1y};e-bW`e;_W9zd4oc-jTSdKYmnF{)c$01Ow?8dGR(-gMRxo`ImY?{sC`m@@G*E z+a|s}!aFtISogK~>Vh}KZ@yX+-{W{GUC|Hn^_bIYi0E__$Hbk*grhtp;Jgh?Y3n-G zS3bjWTCL+rADwY8C$=8t`4|&8{A}X6{0=!l=SVeItpAelwAR4cug#6MaQ8uGP7*rg zj*L1hgVgYMZBj#w+%3CPK|9X#eub=dq8FA7uJFo@w}`Cw9lWEbPQwQvD3%>SEA<2l zc#Gd0h0_8{64EI&L8LfsyeVL&m${7rVQPM zn*BYNh4dcGjhmw52_DCM@)w`LNqU(9MdX%+YLd8gl8?s|fE~WV3E2rTB%d zq+6uZ{d1qbi0W-UJXGUpGEgTEdBCN${&O-Ne#P{_6cXDrwpVO#oC2j{7P)y$m`?Lm z^#M4p&!Ssq$7y1>t>`mkFqdb%E5KH!^11 zF|!RDSQ^^nMEF_Wz)a%g-cLoFq0pW~+H zgRjbd5aa@;RdePXUtOB1_|@ZIvT*OfJ9e)YxQypfBx?1<+vj*IzojT@)P{jf<~P2g z;W-{y_Am&+ZHOkGAV0@v2ZlmhxN&*Nk~6N*oRfYr(H@U`J@Ssi0Fif|2Up)Pk4Po1 zRp0&@P3=i*Grw`eJRYNw`Bd)}>j6u49P{6pRKla@QA zZg%F@s%u2v_q?TNNV-$jzT&&@d2q%2;s*7#9Q8azcwOKj-iMBWjJi*zyG6?jh_)Y# zlnZ!1>EUW&yTI+CJ?BblJ5($Pi_6Zrd3qZ$ z@F(1T^AI2W#IN!v%f*79c}+vX$8r*&1ElotUOHCP;z8oapSjh&`@683h`7o_#N1!_ zSTAd;Y?ydeZ7QDr!rQo~uPSaZ@Cq8dKf%?YkNExy?jqI~zE|a2qV=zGyVob}VPOxHm4s5bi|%sUGAMsk z<~#LKKiVtN&1!^(Zr0EZgP=&d)w+=Ci^K0v(*(cHTkx|xMf7#P!}BWE_qaV2t-dQB zU&lMfr^Lh?c#QwFxN?JcVmR&n4G+nl7K466BwQsn{Kk9Z#`E*v_%VLlCXW2hzrZvz z_Ya=qGi0RHj$I0B6#gn7?72Ym%mQ`4$W$@fOyWb8C)KF7OH*WqYWhm^hXOT#atV%O z6k}4Tf{4~+G2hYUu@_-yaWf&lcKW9BQY~m`>(~&n;77mPf)zF7m$A5 z6-#gOU3dU7?iL?{gZj<4;Hu3;^V|FaYbbo~;8EQ~k#dK3=C5pG=N(=^UH_9$Vqb|H zfAU0p8LQD`%y$oth;Y$ai|XXR;^;22BgO9^z3(7u<{ zG*0;bg%=B;z`uA~wm@w93y+!)5~u&-H5%LI;Qm?W0uS^f=vKKzn&r+U*ca2A1gdoz zeE^kaDkrRXtV z#tw-&Pk8mn9dH|p^?lT={ba+$NOhK$@l_{l8C4yvWzMMgH+0HlwW)xCyh1`dMXGi!6QoukL2b?j{#3E&DQ|>9Q1p}!!U`ne zZ+xGiv#|b+HJ7(2K&j@Ft}?W)QyYK+%|Cdu5+?xkQHNOromGkmc*chXHP|a%C-I)T zF<<6rqI*ZnCazQQu-h}G5ZzOG84`w}$zpputZ(>Ai8h=<mtW{9s=Y$9?xNExG@CERz2e<0f9`fQ8>Z!`6Md1zs^cDR zMSIXONYXuvEgnmqQ|ckqXw1Lg1;u8bh@sbgN1;Ra)EdIm!5gxnqNRh^E^T`Ugw-rD z%7L}~T#@U*m^dwVIC#A0mOfIEf2a+`D+jOQrQlO*+A^cea+5yBE4!n!{?I4F;ot#Y zHHsU&vwWF8(aX!#psm&*c+)Nyg+Szr*EzP{l2B=NzNpRgBUp8@i0MsU0XwwG{SP%& z9Ax@bXt@E`S1mhty9<7Chv?1qre-r<@g<^Iv54ZPX5T0ZH4$#NZ>guHst zzyU|qR$>>|H$lw&9VEOS&|4>CP7ceA9x04^eRq5gaFkwOr@lMxvE$ILr#Yu5eMiat zdLC}(0+3?JC-^A%9({NUGl=_*kHr^yeSn7#P_X~_KwQ=9>w7N-g2TA)3dai!r$vC9 zzPiUy@KPIWeW|SfqhcfDRx+Z|vpSFv^(t;A6=6$r@MD=NR6j+=Y|{>#XoOY}Id1wk zEKYpormr);ZcoDV-f#mX=WLRsrfQ%(0*wL4R{z*eH(l19v}PI6$C1;e)d$0~TC362 zDxMH+CvD$5jGos>V<*ud1r5}CsL6<4BC*_6ECSv2m2s>%!(AV0U6?={Jbb)QP3g(d zyQa=oLz0;;X5Qnp0NMzmK3v^7jz;$xt?|%-gl24_@&D{P_~(5f{enpSmMtHBpif~0 zydzgWg=#Rqyd-tvj|{0IgB0!tT}%@-OX=G;IQu=*sXx)lIX3jFDGQ+Y00!<^!)etjE>lBNPVP_2%L$LWG-y2B&PNbVa zGCWSy8l+Hz%kPWfKKdHt|Q>d^-f~zoW#PN#N?|_H=UAgG3dvJJ?*3syNZ@-6&GHH6E9WX zcEI5z3GuOr@zu}uvB}_@YtoU}Se5xg0be;`K?G|hm>(1{&?$2hKWJ^WT!-eGQmDaV zv7H+18mx8d8X6e#&CX6ygJ0hh$>rcFVn`kFp#%WCanXfTx%^^E$OhOtgq5W%jzD+U>X+`E@Gg+KF%kgj0Pju!}-Hbe|^oWf8bP+n5Ph| z-%9D!&Swnp&d>vYeRvsTTl$7x^sQJ?ud+V8T{Gft`;uOg!-_Jq1<7(753bcn(0|v- zUbYq%%<4EmZ&jxc8H56JK`ebKZSmM>qLBjKFZ+NvLxeyVsU`pSi>9%PBjiyqYw`k#I8PJ5j&FbTXl*!5uoqx zv!Rs6Er_@w>Q;f3Q=Kp!!LBbC{j0#r(N5r1(j0Eap`nkb6LyA#n=J~e==<|sLq*j< zeW2mta+PNU%;&<#o3>A6wxcXO0stzu2KQjJzH8*>9@5K&34yZ71D<1 zT_x!>$6O^jTJl{bIi5a5sTAhi1Ey(WVtIWdkrASIuS7#}n5&%}ti7lt#+KJNrxtD% zVyKCqt4RzEL%paQq>p1?hzYp3PhUa^;eJj8{~&78gn-n49hGXyCf$6UO-f%S&0fnB ziNX4IhShnlo>Bx|B-RG&u392fCkplgl>qGyAMoxRGKR+CVhLBA{3K8#c&y)ACkJt z#zC3dN${Hb@Rl8?&^|BMlt-{N@`L*rj#LPz8rw2cS1RnDg0Dx$keg!>B_TMvt*LL| zGb9Kw;0IB(F^VlU^|c0X$2TYlb1$}5YD7s)3GoWl1kR@Fx2Y}gr%~bircy%V&&@Gf zY~J&aVud$2OD;`AA|+@tfjWzZwe+|a0Hkl_rtgY`H@d2JSR#O*9s>7elHLE%?)8!j9jLI)`mLjQB%SC9YKEzPB znZ`{T;y+?4{~C)E1rGLWQ%9gm)c%P=~^?z`=H2T0`|l%|3q(=L{86 zCp&SdP{T=JB^64AYu1`Zg#?jSM;{YDEnABqz62ZNEZie;2RaL9sL%}se8A=J0CA&^ zzK+kuw4h5VeVoW`K0Dn?fEU2e%!OY@tJ$+Yvf4y9ozLx3JTJqKmwJRcr&~B-kVIS=Y z3OB>syG3%CzK(yJMj$93mcU~ZL8Ll4v*n33Vfr388Mq&Y5rNPA)z{a;_ZJ4$*Bh-K z?d2wLnGB+|mFn;z)6vJX^QaT}>}`ZJC_4ay{xqAoW0$kcB)wys)mb){Lo4;*>uSl? zUR=Ex-;`9}L-p&~HfEkIdE{!O8j0ui^;LS6s-)9F(O*=QywBh!DuzPe&w*`uO`lLbId9}kFm+}(+LQNmkNbL}MQ4{SEWPPy!Md&W7OG?me4M}iPtyUY#(pEM1 zh_z3gv?$578zazSpJyVtm9WifY#nOtePkaNMJ+ti`xZ-lGRGzH>4sA6g?KqeJunmF~)qJf^3V|!y7OOLgCcoZ5DsULS zh^O|3L{5u`70cRyWR3oZtXJS+B&$e@(EEB75(TN6gCaFTUyZ#d7Dwm`NM9}RHyTM+h z&zQ53yHPf3T22gYq_5GxB9(03hI~kUbDFb17t|}xtljuqeGLCIu9}PLvErJ~sb-H> z#2Q-NT3lnl2WqRuwMP07ufu4ib+@|kX^igbME%Bkll4dFSQ;>uH2$;pi3{WG;?|#& zBm84fT*jGN@vvM?Lkz=m03P2-mPndQk_~r~Yj&CfrON?A!BiVV8C21BD)rKOhFVJA zpO6_*khSrkE5#xrx7tFfx58W{$;nwjkt}lFTy6 zl6;{{6MZS`=5&%pijqfasPr+Eg2tQw*;wn*jMt5KQsbN3qy~)(sjI!{R zeU0*^C|KZAe8uob(?yG>`l`b&&>(=fl|Jr1Kf_Ij7j29W>$#M-Z#rR>)ZNA9CG5G% ziR*LRy(8fscaNh>Oryu3a~e5j|m+!SHoeEJ1RGM%bz-m7*)=yXyNjM;}Y z^c3r6*PDw3Fz2i`jlz{QVmNb$UpX-75ul7+HG&aD&;)|gAtc3$!=+u} zV;~cz?sWx9sqBwjrBq_R+EwzUB@Wi*&GZ4*&j*xbnWeET3zpC7>UBlwm>S~e-AOYY zcUS(=@Tb=e8DuNMTllYgN$)B{aH3LyDjRAOj9Kf%M7$lRTGHsy@}oIca8DnIe{o>O z%t8K6D+)6Z$I8!oI>$hv93k{>bk&#uHE^oS_eqYYcLD(@S)X z)cadat7y1n9x!EquP&`C+J30D4WPD}sKpvW8cM6fGjtMr1_an@N^Ru(d`LrqNhRG{(KA(YBaIFHo*EmdR4FFZ`fEVFGGnAy>{k?v@ZGZno5S zs@EHzrNdb1gN_G+EF_BF4!+@_u0F@74&+Fe+Fv75qV!b^v4fpJ=@j_bW|Y2#bzgG; zGoq``AT?S*s~}X;I{Yzct)Af2{xa<>daTx4v>Ngl)w8u~>SEiETwR<7e03<*ke5Jv zYO@XG3br#i*ohj0D7FW~(OGpX5g{pNo+E8C#nWlfe82ah`46!Alj6&r+zE<UOcXmA;ZScDfv{kH8x(BOy=G&szSk+OltWD+~uW z8x$FQIDu|E2XM_*8ZBX?hfQBx0^PwJBvR2N{bRV?CJ>Z9OuLbP0!a z4*CxC&(P%e8Im;J_9FffPX44l?_%xUf`n>CRN0@gODRMvJSYJ`op-YG)>+~E4y!HOB&DT@Z#iaS7;>;N9(Kfzd8_KDf-m3 zPE*VK8va(opFfWJ{m+QHN@z;RKy!6?Q`#Bho67S{z8Jq?f0WSCS-DoJD4Ms{hgi=e z!WCP&qJ~28Lql=4eT6Tyz%gV9Zo5+3&!x$zW1Ojp^a6@eFOGFu$~c?i<`$RXj33eM zt$kGchQI?%&R{PkUP&KQS*c_<}D>p&gqfEz?~T9FYq1a5jxKxdfWl|@6Pzv1C+dMz~wK%lPB zP%nN6)UPpM0Ghl80$~&NuC$J^r)+T&=h$c4=z}XSgyYF2J!TtP8n|pRNqEKRgRMFQ zCg}lk+Hc$6>9;iPt2Z#BWu2V$FStr_)<5Ygkk-TMF7dl$c`ivNH7oZWNwEC{$D2q?;u zsOudS4e=5f8m1;16_ynmruH_&qQWv4i%LNX%N*^kz0vSiYFOB6Sz%#eZ!1hHD=jRn zU9+O1^6vNfnwj0R+UNHd{NDR`%$euwGOu~f<;=`EJLjDD#3{LTGYb3UUH*pdw+0QJ z7ijmV=&YCn>0=|`T?h;JciUZnoG!-P`Xc^`d#_;eS?6`A&Zp<00v{XsA5tkgdU>NB zgUvvfOc*4pEDfhPdEl?Iov2{Zs(4iyUd6tbk2W6Rq@A4neh#faGFVlnH8$g;^|V^J zqKGm)iBjzpiXY=#^=^UU?j;?_&5cll^aCNSA!#|J-W%E9nbz*NyFfTEy8GYugB?yHFT5UvhIaVGgqT~ zoyGZRcCV3n!QJayzl?XUgMNy4ulM{E?_N9o6z^V}{1oqAcnHVrUcOwsI+fas_vY-xav(S6TELnCjDtQOXYOIJEg8%cqSrB{M zV?VSn{qMl)@JjsMv-krqAAg^kk5~h>b!~I|S4|)f_TE(9b291BcGw_6PHvQ}E-$EGm zp7-19(OTXw`SB2ro{3}dC!cyfyXzY3aQtnJDB1JjHP*9ua-Y3F&N^M)=W$(Y9bk#s zmqpId)|7uuqd{f@-Y&O;&7EM)?C|SdB#Nmq=nSL%ehY1^Cdb;Kw? zlV2&`he?VZS3LDEY``Szb$0h1JilW0_$2FWywmTON!Cdn+_!ONM!>m~7FIXG+9hhh zG%jci2==g7a;%9_cxNUGW4HSYvrOpQ+v82R5X5;t%dyVYv=_13q|ZQJ&sN=F{nP&K zBw>v`ccZmZz0%X;ChI91K3JJ}n{_!h)$O>=`ZQkPk$Jl{4R5%4=yq$8I^VPAcIzWH zwVS8Yoz@+8OVVKW(L8G(>@z(*&zfrgbqqI{?-_EB^#wI%oRdhZ{$Kf5eX06~c)W$y z+He(jP8V6@RNQP?WKC8_d%j*|J!e(JJ%=B)ZdPe$YN@p&z5%nU)Vfyvkqv#^+9R}% z-Y!hoxUGkFnkA&@K8mp7__SlhimZ)uLpzf4vo-5W<9rYwT>iso`SG&z_Q6>lmAQ zljr?6teymX&vVfiaP@N!`vU((M!nh|pV=v&XwN_@B)%B4&U4_f^_;5adiH;1jkBo3 zJ>MO%Zm_7&u_fPHOVk2SNV7H3qPBT@eP^{>)SoAdWaktKO432Im#vK;vRM(T3f3gWNTuyRcaa=(ouUzeT&s})TXPqc%ovp&qCF^ zJ>DekaXso{oqB1-{Ni!<)TXpU=lOJywi#bpeR#0;nuhIM1JblR@i*|wG|j2r?D3>& zJJq1*CNElC~YsT`;MTUCGa^c}DD zR@GNMH%-v4Q|+;1Fq&7y9A?`lYW?lUaK{+bde8S0wWFGv!}drp*jnLAgTq`uES$<>Bn!>WFR)?Izc)8__lzKXeG?Ty+9Jj3zTjoJ$Q z!*I_{5azMxZqi0r&c?7qH)+E=MRcTE3HRVi-22S+xHnTCUS6qUE&AQvQG5CA*$J^mz8q@Q&CiPj* zSNYmoD)v>cnxS25Ig!9xW@v9SDC@P2g-W!li*^~uGU{*O~{qO0J| zkb2+oi_oh(c+T9R`BXLD(=t;VZ&i=7lsPCd&gwbZG)=wB^WNQBsjA{%=X*4-#a?`Y zW{4pZS=znYTubwLw((wVmU@pT;y&%Ts!nBXMVd!l=h=F{rdtyqrn3k$Z3*T(?=OS+ z4XT^?nbqL^cF;N6;bwn*C}$_KUy8M!mLLCSu?w^w>Lxa7f!4F#ESzgpma7JxW05yl zI@&u5?E&nm1zK-Q+h3kH7HAVRbu2R$X=#{oG8SpHq5s=O+QS{M{axgqgYM_mkvk^8 zn0~C#t@W|^er9Xk+Orr}2bQ4!tY_Dkph3s5$`W(|7du~~J)rJoMT@mj>Kp8}#oE8r zZ&>1^+USlQT7!&U=r4@+U=Kd3jR-w>LU{X|i{+PSE_VD;?GALSagQN~GWM^>kV8MV znW(SXhmUDBYA4UbrP@>t@5KFViI#%z{MweHdDGd~OSQh(f^09-#$spdq%tiX&$E@4 zp_9#IHDy|y8pigQY1OEudF5Jvbc?m++MDV^4?cH&QODPLr#_=Cwc^>#@1N67Lwa%_z^qgBhNepVzjkTE+M1<1{sSwyz)iO4UK7je@r7fJw6Y#@8ntD<%Y1TecEt~?-kF{eVU;r#Nle~Qq4Pm5}Fsbulzt8 zfUWZ>A87H>hqhC93SW2yMv$9Y&eG7OuvarP_kDJj ze;bfZ`CLo4v_`R~K1X**WnX@dzWp^T`$EgI{IH2Net{wRUUv2i?NK}ju;{SX4Id|4 ze^~pq{n;vB!UP9O*#6VAG#;?mztpa<>{-nQey#Op+E?)9VV3@tcBOiV-TM{B^lG;E zD{UT5gp{wfeEiqD{A;ZjKGOZ>*XU&x%ymQ?jOQJu9nrE?hiAhP?P(P$hJ2&-u@|pF zW)oeyo1%8Styt zK~s+BKzqjv;RSt&c*Z-g;I1SAyo`b(*OvTRrQGaUJU}}5f zPi=&K6ozi^@ttR%9r>QqbK*~}hea**M4r-8EO_j0^cig&9tc==MtfJ?$R?e|)Ht1$ zp4A?;TyQh{IaEmvyZ@Z_A52a$=e5)hR=gMUr!m;*i@)rYqA|!6FZ({PO|<-UKYRJS zHs12XB6jLLs&F~$dqJziy!Z13OimB6;TJK^v}1Q&gk$fqS1)Q))SBmXy{|g_xk35{ z^@isT>k~0`_E7cb@rn1ns(!U4?rCPT=&xXqdflSm7PsnQs(yS?<*FKV_RL-Rbm>tM z6Uq8o^$L73{SAs9XW1H}FWBdrz7o0Lt?SiT!A05hFpK()C(*8VR8cWQL-aoIW=06I zUd-&FdbOpc$g@3EAEBx*v7g%M6L8Uy7N(!qEEm6ES4Qd#PhWl#3HCrwLX?h=vae!~ zchF~H3Gj0V{lD}b^Ju*UZ-h*b(R0;M_H>NiC-V72bahc~$aeo}4*PG6o~(9ftucCM zoTFhK^)Jy@KXlXw=cZSHy1{aqZsyEI*##=)sF@ezjpi zvp8Gtt7C%QK2aa9<8$+8rs&l@!*5HVQK`&{YVqC6UVcdbWSk}1WUWj#aT&0={}_qr zYR9Jyrt`b3knpKN9CQB3L1$U#THWOy_Ak^p9v-ESTb5Nq4a;{2-r}@?_=4j*`s&$> z88?Vmkew(Wlk!-zhMmlg$7ZJBy$|9OF%OY#znKPdcecpQNjXmw*h~Bz!sTW8gp-rp zG|!iDK^g@90)Xcv1ucoomk?euony{l^D{S+LVQISKSj80ATQ!7!d`*v2p=I_UdHV- z3hX3)eOi!U7jVFV^0E?AXp2G(mzNb2UPZbUWjxbmEb|dP)?F|ysAlkPj$F{<8HG18 zkOZ~Uh{$`so-T`IB|E|KJsi(lE{E{#xVMTtvI*ZO^5Z(QfCJSIjS<3B8NgOmPY@S`}>-5t~?%X#~_efuH2AV)2c$PZX_O8FKMxxN%`oJLTF+tXQN#9Z5zPF}cS~1(0qeSmG z<;H+Dzp zt*x`^P;rpaWkE(;`FP}&@SS~t9|4NAP3aCsSb;$*n#L}8Gjwp+}S z+5LuKXKs+4{2)8kWJlUu6=X93Hr*&C&#WrQXzh=t6LCRC!vy9fYwl#$Ny@i6GLHr`{gNMgl$i!O+-f%*W34~4-@7lKmonKB&!`pG= zg=FMgaUyVh2$&4A$Wpy?2ZgfopEO?5{e@jsswcYNrsRGBPk6EtS;%7K3xidZAXnfz z!r6rJRGZ`a8|Y;bDcR*G@GxNpo(`Su4Wo+@{2x|caSE#00KKG3P(vc`w2rJKm{1_{Bu$6p=%BnZv+94qxOkQTkdT&nLWD;0(fR1TG<5 zDR5U#lm;mk3!G0%bJ_GK^i=gqw(<$Rzs2ri??0jUR#Af>`)%t9FL>L^{BeP^^iB(! zl6p}^_@BW1CT;2u=P$CV8}&}^3~$qy{zTBYX%@7jgmyPzuKoLQUiem;sXk8ymP?io zf&B%gH_wKvlvmSRJg<*t%G9+YHScQnK|D1t$w}0H20Q+w-q{^C4D2AkVQM~-`-+6A zeSTB9!jzLLV)H<9DttO+IpH$BzCn5=&{WhkqmU2ucbRrC+R$2(>dxY zckm2(Khq3eK|J$QHjbsT-Df`(Ovm|FMPaBa7Y-fB3YOV@M-B$lanx;=V%3@}^3Q=k zzHEUr2#+u^_q*>UbcQeC5<1@(2HLDtGKWe{@y_4nuT=O&<>B4uVmkeYMzot4alTI? zx#N^`_Ts&(5c&3;sUcIwF<386=ij!9W%elLmupG9UPIH`3It@anitrv_=`-uROb>Tg2PIl1 z5@nF$vLJp*5WgshKO6j@3UE@oT+%Hsgp>x8QCzhW?kN&yPzL3PxYr!F z7a8+5wF;vtr1ST1zJkdi{ALcvjf5wOv|hr8oZOCs?0=9fh%_SJ6gZFYD+2Qjp2ar| za5g+bEPwwiBug)=C}u@j72(@Of^5Rq3*1WhnjkzpNN0e+Jnf+!+*7U}8>G`NNavzE zk-N<^_(Ncx_(x#btKbXwt4WA+DF22ayeA0P1mWr+yb3s|lV*^OQt&d|{#zlqCNBa* zUa2^tz!xfx*8&YG&)e(Ld9g^t7d7b|%wnoZ!t1wuZ9AbW?ZfIIS3s}=f{#NRBilkgfguo6>6 zsW3sC1AK8ic_ZhC0MGrCn{!eR$rm`K9dNGDr{~Fi*#hT~{s^JN&w~_+vB$!fEOhD! z#|cdDIm-=*h%_Z zg^q*ts|0Q)ofSfd9_;fi>Eh-_9h6|9P*NyCp}!EqxcXco8`dq;dtLWg$4 z_!65gnbLQ@_~tV0{NP0`HeB0 zaP4&*D?@1u5WRP{{w!Bi1nu(GUP5R4>P2Fb`{J%+53JC;xytt=ad~*^4Y>B|8B31w zXTK68tcbbr6eQuX_*RJCKmDV-Xu}sC^(YVjJs13KaUw-U%qyh!c1M04SV8sTosLri z7ljpkA94%p^_~dZ_T$`V15qs zijb?sb%M|BJST7^*;yJVMyeVj9uWfC$>y7{^PxVQGM*{;yjJ#q$Q>#qM<)tCKW}#k zK0hZnoZ)TG^|$Qhh2iIah2ZlJbZiUPNohwTl`aiYW~X^8i%IL}Abczce-?!I2jRB} z2d?b1aba8vGbfs#HYW^{TCZ3}zL+`19pWfl%R$_d(AhNs6=?zT_Z!v3qX`rCR5p zKct0)?kA-MxH6lB8vO+%uT4*NeHYnuh~kxG z@(g(SXvHEt&@2IueRiL}JX}sS;A;^}L5>@kzFO~xciRnKjsNE6vD;VcU2d;=H{cDw z4$QFdF6u;LUVW9+)r7ZP?iBJ2Zu|<7A>>3u?({jFT%TuHf5mzB?;CO5*2vDU#w~^V z^Jn-P4*FCw=sSFkc3uF|NAsMSh)5P~W1u+ZRqYZ|qgw^XHw9L8;;Pp7V{e`@U5fg~ z1N#??h-G?r`3du0!-jtt*kmU1yU-M2wsixr-zMa|X1*X2l(X)|c|GTdI(!u$+JEaqcG67*b}y zI_fsVS06+#7QHt!oO?_vzI|SQ@0He?&~`HSd{U^EEdZOmJy-Z?d4r>%7q4>ij{3$7 zWXR7-$w>3nMg`M(zG~3H86*n_os?Nx5Dt?WkuLrG4z#g3YxFL7#pIJ~^gj6VJF8uz z_n-9Dc*>vupNCsSSW=)Py#Ss}D^Il|Sz6dCr2Mi#`|aih;l6C(T0Iv3H;-GZcZ<%C zL<#&CSG*Y_Qd!Abj7I(cAvrSGY#`xv_|!@AhFhJN>OFj%pyPb4=lQ6VL7ucYIL;@0 zSl|-E2L!GnTqkfH;abA(in3-RHVc75E2%XCI|)|`oI$u$;C#Zx0+$e;D{vLze1Yo- z=L+0RI9p)8&>kVMlSVXmiXbxhib>#n!f^tZ5DpW#im)PZ9pSe2yu{6fy}*GJ9M^D% zL1*s5!}p53=Z>4rMK1=e1AHCav3}X3PyO;$1h0-cubaA`yvSd-FefVz=KT%tYZa zXkcH}2D*$4kMuWw2|EwP0X0F2;y>&ch*J^%@9U6gib(Vk+S;d8udIDZj*P5El4LjNasM1PIChsEf>AK_MMtEFS z*>Xwi8urACdgjPSt`2gd8D2{#-XgvnZj#D*MvYV^{cY|*4dMMvt45|9Q19MVMj+D) z2`ggm!IIRwh)t^2`-SF_)_902*};eP1UI&@Sg?g999vjuqjrurJ`@)G^_@fZ4RFLM z9+(W8QsrcV*@(*B62e{M)tbFWxJmpG0_PBJ{F65u$16^8ofMTW<>Q8(yT}U5^f;EW z0e?5e>uZW&C{*{|kY6#{U(VXZ()9+~{ip*HH$WSdWePhpLTD-l)gU zNX_K!OFMvltCsNG?Bw=3wwux4i;Zq$v32`dQcy8~p&`o+D_kTvCZ#<)cFS_lM5>~{_SqMon$jWRwrT7o#vTwcRJ?ayM zR4Geed0Sn;3B91mQA6I*sPvdWo7k_S4U613U4+Z=n@ z@lE;wcgj_Pb4UD5CC{Bg;s-c(U(GMv!8|fk3Nv!jauVG%ig!+q?H2K;my~Caya4}q zN}7-4MY!^lw3{>Pj|7%9$UehY8$`?X-#~@u&((K+E!Tg+({HOz(=X~TF#Y0F537Tw z-%4`jL#OHLQ$x;ObYm9#`zKZLU9l@@pvG*z{vYP@yrceMZeftQ448wpy=1M)BWftv z!JL0sO!J;}(|av0=~}&mO#YI}O+HN~AB9POJKA6hxP(e{hWeSjXa0-8b;SQp;AX;~ z3rzEj??Zu|gx}W0^?n8suL?mv;f=t-zOMwGxeM33fy%|coPW4pm}pjRs&M^hY+Ls= zye>N~8Xc}?kV{!22RHv9=?PSLD$fFaK9EI*w~^jN;;)@Tax5Y!i%$ph+Ig9>xD#3U zYvhF0tdVa7uA?kJ6}Xx3`vNOTWb_R|@G99399;4j*npSyj(x8DhbQ-UH48gTc+#6Z z`G^(1j7ypa;Lc3<^Q?o^k8^F?s&|gB@6OLh7bR{O$g6_mJ?z+4Y}b984cMl4A9R@ibKHSGWpZnK zC@md4_|w7ry}x3~h#PO>S~Rx$--pU0`1Cdla(`Y6MR8 z%Xhqd86-b-r$0B|mz~6G0}pwp5KilJNnhu@(qlY5_aUwi+qhlth4%%W3F_LE@+WYD zTl8ztm;NVI=zZ{6Fd1k1LCTW@}$w%GqSS@Xdx* zzv?uBd2TrZlR;k=Te?H<-@Srf3g+(&b(E91hWLp1SbLM|Kz3w@o`|RV&h60CdN_hp zddXEmRXZ_XVmwv;3 zeN~U|py8^8x`UtHvhf1Huhv2N20hj9IxpWhY|?9byu0Zr@4^|B-I9%$bf($VnX)J= z44s721kNVhS6~-mr@(f?(E@wPo?YMu!spHiJA_*WUIIMW*CL47BseT^HsJ$OiHz0> zTtfV47wc53_v)?=4r&ZK7i42(5?^kB-@sCAHYunhYzla=hG*C=3}0=-gqVy@!E3D| zJj4J^9Y)geB-c!OzYe4^;&U^}7Qlm`Ww8HR&%& zUTxB+$$(}W45184P5D#{XzGWufKw@bfhqrz*T8A_r3zW5!f8^dHVrJM5+$4R7J4mjX^ly|w+us2P=a54!Ce70~nRL9> zf=$fzCS&ng7^pSr5He70(o=bfTLNvENi|Yr(tF9F0+U`&_HqMs44q{-yJt|vY&%3| z+|(Q750b^yMyY0ozfl_{oAh4l6VZP9v6C*OnTbrimB(nF4j%@L!Nlcj{fh=qF25g6 zdJBbo959zRO1T?}&ZFABIYQweFjuHC4Rj}Yijbd13AwzIgviy)&i zLB5;l0+S9QI@hG#yYXPQuL)NSGC?n@;#5;%K`7{ClkP=yv`K#%0$MZa{kVhVYx^_c zz*M4JOnO`d=%xVe4(I1#eSi_ZpGs6~(yJ+hYLn(8*$R_BP5RMh0me~*G?V6MMO&>| zK+@0kr*~I`FQ5#XOa)$oRKEh+lxn2bl!x#dxJFJO@=UrG)%NjbIu zFsh8xonX(uCCheosbcIRt$)?n#w@`*fCViR;P+-zro=Y^H|8RiM_gSXGQgSHOq`84)lMbO0 zMw@gzIi#6%FG}C`yQ~2*4t$1o_g3AB#ZP&7Cgz6h$M+X?Mf=m^qIjQmL;L66<+gLQX%p=7H3E=4(E@{G0GMvuXVl{sEbrF^}Va6Yj__>%#9L912XU8W&&G$bslH z)QZHS0}n{+SAAUcR9xn|Ol!<`-row(yk+0sAkE1qAHs$d&QdXPt#pHly$`|t*Fy*_+Udu0m0`740 z>Cj}HrUdmS9YP6eP5LyIpxUIDll}^mUPtyyO*)baRAkb;Mhi^Zy%#5oFV|#5QU+Nj zy@lvhlO9GTOg8B`ltHvfFDHANNzbPmYWq1*Vm^7b1Za2oK`LQWfDyhICy%e*q4Q`wMJBzJs;K;^`TlsDmG=RY{*A_s z6(&85(wCYvpNvvJ2%M%=18!fk$rwi^iZ*H9B$`Q2rwrTP4;bJJj+P*rnxx63kMWVv zq~l3mYtoooF#lJZjDb{TD@;0`+O*W9f1?^IGU>@wr3EIvg&fQ^>B(d-%cSR!1F0sx zC3GAZ_2x)6pAxhj44ehyx{-k&18o*hbgG{g>-vf-u-bF%Vi*3ak8{iY`rwV}@H^@irW03e(91r-m zlv*#VKF~URIhktG{35HUAs`<{(@4uFfwJzWQ9jGG$CsC>Ce4=`$($CW_HT4XMVktX z`P6UHDxI-yEdd9Ib)pPSdNI*WCcO?HC-T*s^f02cssj#+GoIvf)ZR;D)Cx1fRH92w z`ZpRvicES3oe%{keVTWdAetP?GU>h4y;4m&lDbbaXv&{18+T9!(Wb(DKIoZrCM76+ zF;IfjH18CdbP_pGVA4E&{r7E%S%n)EuV!D_e35L3TN_acL(CY?zoDl+N)Brh;&zS_$*>D^R-ER&v0 z8K#=_F-q@FHW~afF50B`^O@G9*YUI9SfIpw3~MpzsZ=9PCe7vbCcT52u-2r9!6CP= z+GKD8D@=MfuK|<(lE$ucnhdsm z8_)A$2kcahv!x`tK{8FAtOb9*P7RKDBJBDOX9JY|^|dMVs_G z($`Fyr*AtNa3C{=-vBTfk#xE@nRF7-^(K9gx>Bu4uj5_IbZ{~`w8E4pk-XHT#gt^y zd)<_vz+{LTFzFkK#XD`*S`wHEo9A6H|a9oU8zz%$-$3^91S37^r<;7?MUE;oC ze|@I+c7JmpwxHtov5a4p@fsOFBjbl;JXglkWPF{BN69!v#$9FXknvylihOuxIJ6dW z+O1gT3qhQWT{2FW@mLw(DC4;@enQ4i$+$|!Z^-z7jK2{XDXo%Lq$3@9jGe(fBx8__ zuaj}Uj31Ek5*b&?c)N`2Wc-zkH$Eo{^r6i7Z5h|dc)g6Dp&0oqrIImE#xrC*LB=Cw z{EaL@illF3BBKl$_mFXvj4!Md^6zB)v5eo4@fyUGzfvL@b7ee5#-n6>g^a^w{I)FN zVHvl|c$tjJCjCy_FC6IqfQaYGxJJgO9-zmX@ymTsD6Ew6VHtNS7W{M>=gRmY8NV%K z`vRetE#s$T{Gp7)9uo3vW&D(k4?pAWxn}t3AW4FE92fJ!oXY^ZYSQ+0X<4PH?k?~hDwm-r3 z-AZ2plnFAPC*x`ve<Sb&x6A4DixJ1TVWo#=K@?;sO$@n1|x5_wWnb5me#^1>Ji3-7QpcrqXQY=pi##k9I zk@1HzPJdd+@09VQGA@&+*L5=PE8|cZe_SNeZDr~WMxxsyNjl-^cTSoSl%fo(6zUUX zTp;5`ayY?89IpD8{gaZ#!4CcGfudSZn?~{^I-zI6lqhXRBB<*^k z$4A;5C8JWt#ZvJNNf*kD3MBt#8MjLLDH&TNKS#!MWjsj6V`V%-#&C@1uRI|QR7*jj zq?=^yFTqMPA!pSV1-GT5I3+z>#)D)$TE@9DE|YO_QS7A#w#rWSt|#P}o`0LV$aB|K zwmYqAAv-wQ_TXsetCkGx08|_@Zrotw^yU1Nje=kEiqLP^CTL{`E4$h@&waVRzkG!c z2)$w%>kt^ouvF5OL3}ItYb3onh)-J!Yb9M5#CL*!K+tZbQ3|LqcqfR`BN>WBt2WkRF>HU~=|YwOx6 zqee7a-X@VONPh2F+jXHq^oL_@Jwgf_g?B-s+9EQ`VP9t3t_;qj(>UAE>6a&W?Y`VM;X_WX;QP(mUz2*W%+8ku-8xL;ZrEiR z3)zlwwoSbYw+l1PQY~Pn=JM=3k6vq=7uMsJMYlSyFPbxVuJgg^bBgB7o8`Roo_n45 z6wRJ_ue0dh>37V$uYdpkp{)N+w!1u4H`$81-un31u5-|YyuaX+K1#ydHYK4N?{C4+ zFT-mm6kL%g#gG+WCJQG;bk1dvExSw>@vLec;3;{)cDR3+_3!G+Mucq$I}qMNs7Lr1 z;WKvs2HW6}xx|9CWo*X=n_KO{25z*y67HCxDE*6O78fNKD=D6zH`-paB;~CHuee}( z(R4+Ln`$W2;Gv+QgkKTcyT#U_mp04be)pe4s>#^u3U%<}LZB{qsl-cR=eO8yp^q-S zWZO9`M0wGoWLnaln^WOI_ro^d>^20 zUc~LXvQHz0byimes@TwG8nzINw%BIBHuT-F%@JEHVJVLFQBQQtiOz~!Zc+MndS98Y zS;lIpKlbf$TlWa%f=wBXbJ`UGa6OCq!L~A{8n6u2D{^>bvLMaqeZD&rmVq72=N~QqKvmJt05jl;z}W2 z!TBS#6aVD11wY#UHRK3obsPtWVki+oSy|>yEBpV-ip6_vwWF3^<mq!g#kp8BE8!%wp0Evz zNV6EqchowW0Q1c_UeGN4FI{s}@P~18cxA`u9{7iE|eVuje6_v1%k)$ilt3pYVWEoA- zV#`Amsn+`q>VqYguE{+NWU0kQHLo+2W7cA%doD4uqzCJM(l#k{E@ZtPz+n+vbkf!% zbd8_h$hM!fb-JMrwClI8Y|4HBEz_d(MpoF%rDM53-t|Vv`P-%>q41Z`Ql|v+=Yw=O z&AR+-OLV8|Fg+57YZ0_i>V}29S~F~~DnDp=kW^73v9-WZBNaRPbOGs;D|Z9fKZYm$ zm1La5!krMMuF9f(hOq3YaOV=5yAz@muCpkQBS2>c_c@56sQA#BeUO%K&9S5iqwN$2 zymBGbAx~b$V453kr<8!VDo7_lvo62bdXB`3M|m9~*#;AoB-h~dVetAA59K6zFdaz4 z7XM<44Z-ZIj72DB>wdwIN^mwpiA;StZK@yr#g;fKWe4u9A~Z?$U^+4iXJtX65|!Fj ziBc1kc7+PBY?pz`9*DyPmj0`4Y-lmji*b04mHlcPomfxwM>u?kV2{Xo2IHig4%_MQ z75nK|Td!1y-B8}8Q8peR10f=!@3Rm)=#YTJqA7%K!{Ni628*)S7?H!WTWu-bilEHT zr$+!*BZNlOlWHX$*5L3^9s75yZDg+|$euw3x{d;z;)<=La}I}_>-JfcjHlvOfKF!W zZ?-;;z6o5h9(2{Pi5VIxAhrW z`31TRf(xlcpJ>PF$io&Tm3YXPIXd9sGJPwh}_9yyhRygR1INZ!`BzgtWYjJp) zZ3Nxf3y6PlFn|DD7hzz+cVfUjrl+?u<1gDpwT|8Jmu*%|-35#C3BrMQdJNTEa zTd!86!b7i$>omaK?G5FMFe=4jV+2Lh4ZaRYvW&`QUH-P+s8+F}zioN(4N#1tR0jdV z93Ubb&(kczj{j|YFd`2e-hZb9%wu<*vW@My8PK%@hYu0#dxEzVGKJfqLpJerfb^5Xt6;~RgWI3psV z3N6@|4kK`Qw2;MLv>kFd*J6(9m!48!RgSsRoom^-i?;MD(qLz*^;YY2>oq`@*r>EE zhLV|-hlFpnSt3jRSidvRIH9^e-f4MA$@=F z+{@-!jQ*jOL_d$idbZJG42s+eNT*NEWUJDEu$B2NM$gD2lASUIU!lIr#*O*GjxO#29m zGUn2;GBt-`ZXOi621#5SaM;FP)r|g*CZdnxZ~{RKtz)g4k>ZH%0&W)^dLs}wMK_XT zvWYtxhiSx(XccbF(T!P=)!54n)kDvL5(^Ve`EZ$4IgAi} zg(&3ZbS-4WJD0@n3N`vi&XsyO6;@>y!d$i`)aVnrMzWj0`U7DNJ05CuGqs<#Di0vc zW%2Ed!J!%5;OjUXa@dXSaPAcoy%>k5*i-FLwp~Q;#o=T2G0~@pCViDfgc<4h+}^k_ zBe8o}GWm?rxXp%TyjA%fLGZ9*_0y~(%ow1Su(v2hNl=Q`7pzLbf2@k&;SVxD&D3zC zXH*+k#d*5ks$7fEmdw(_QLlZw%S>Agr4js?7p+QPwjkW-94SOf5PL(oF`(Znopkxaur&m@=kD82^ssYdkbw#%8NB6(N~zi!iz+HuS*dj*2!t2;fB! zgG9;DxtnknEM&h%7-OQ^z^Cq7__9?A-wMZju(9op-jQiN1%K*xtFj&;jV*3(+!R?Y z*`+)1^;?8$=4)>ZaD=%~ne#;75=fV_Ja zgeogOvMQZFwkorUhm0?$osbhRm%SBf#0Kgur_rk1hLFsTN5YZAGPQCLZG~`{b&oQ- z_2%qoO^I%?D|%Ci(s;Alh!xPyADV4~3 z_mfrm9Kp%v$Djq4fbF8B%h?Mt#@NVespj|tO^Q&>{){oM?BnbYwO%+}ix3u(vl+!G zq{A8<`YxWR) z3z>-2l*j@d>S4-So2GQa$E91P>C5R7$cfj&CdQ$b3sO+ByKyLC55*bRhVJsyd)dcv zM*o;5(0us9d|2nulg@ z4Jq${+t?fNMh|@H^jN&nVMv`!)H6;~1|j(A=2%T3UM-hn6iscX1bD1hC!c$&FAlI%&!*gameXCnGUZh%rh9*lRms(68jFFaUK$W(aukS0|$bUV?HQHX{#9 zX>%g#9^o)c>TD#U*)uyEcZ9AQj54glVKdv_*+`G90i<43)f*-5qbW7)bZ28cCV(*s zMq*L|YL2AdL7LKaF#M8qBWU7Z1Da^Vr>8jNyq@L$Ex9JFYDNbqMx|lr31J7aqkj^0pc5 zgDytqkS6eXi83_hO$4GNHC53@i*;$jP}D$o98wUlT!Df9HEd*8qfh8G63xURlHJ?Y zctLGok%>lm#EL7i(!f;WS_|+FdnwVlZHkg6Xa5j@>k&FdjMG@;EF5Mi_~@_VS^%&WAu5cnmKIw_&E19!*RoYfhSTyl`fHML zW1Kx57YnG^v>1R=gclK#vHo;jVPv!`+Kv<(=-^@ZU14i3}xZyB`jMKUUOhK5B5EW7K3X<<&BfA-$lOL?nm6!N6jKv-rb~EJC*gDIPQ0o#I zSu%z#>}C{19EJ>yqqvR%c-b%AjG_G!Mi|O{=rd`(0J29K%Iyd@@++ftTDrU>q$tx! zuVa&wjTqI=W+fXB+d^JNou)HyvM~~0lkU;o7}`DuX>l1tH`Y|`=U3Ukx*PjrU8B(0 z192FIpoQ{V*6GfzYuqnG%rYTpg z!dS|d_QblsPO@wMttsJaaB48sWps{+&M=gRsJ^-YB(vTwW5&chK(f$S1q&(D@s1u)L(ihiXbFM(5B$wnCEa0ekl8eKutu$zQdoEYdJKu#+w$IqO4PKxRc%43v0<$Y+Wy7@VIJl_+VVr zUP;-mDKilS4@|+cW znGAkXm`w?5YNyySRcfixO7Az|B0?(3P)C>33S`8?H+%bFaw(N+HE(LlI|!w0e;;FT zwg2Q%%9uYYZaYK7;($F*Dy#EZly`OP)eCX>mv>_Y6^o0rFyroZIZ}u}X`?Zp- z(>N52MUBh*C3B%6Eb7wYc5wdM&af^T5O4ALElTMN*MRegb`6`~-?-+QtuW-;i9^UW zbZ3u`Hbdt^V@BaV4L47SvCcAT1vt+TXPrg-VWf@P16CL70UU?^V;s!b0}e03$J?5$v?1 zIOy3ZC_6F07|<~qFf=TpGa`#xQol>5Xf_*=VssD92D8@`9ByW}r5IO)7WwH#tSrTt z61f#LWm9uNQ}!WjWk08298kvL4j^^h5P)RXaiDQ;L&fV0B{(= z5mEVuob8%#+sED;WK0gVkB7ZT9J;cugN;!Uxq$02M7VARC}npIHp<$c1e`(c{Rwb> zJhP@6-6Nb6aPx+&_W~HohNc>WBJu&(Q`zPKEMX6%8lyrt1G;wLu#3H&YNW@v0?xoG z;W`bFK9M@QvIjkSAd4Jg48doUuNh)wI!hqnwX_sqD}wm1sA}jQ(mk<XV((sQ3~GN8kQeArfOC_WHO=T3?aGnNfdC^Bvai8uu%{*R|R1?6TD>Bi8A5r9+3${2wA*_3qS&X^j&N2x5k0sf0%i#S!sK1w$R zT-gdL?K}>#*Q1FM!a_^-V%?iwd4*1YiEg(j`T4WA(?6ybo6VjG4cv#!VuObp1CytL zdJ%Th<^U{5SdZY~2I|tCZ)1@^sF^JpZgjD)h5+e4X4{4vgF7{WavjCtX9Qb><6RVQ z6diKdnc+sKPa1 zP)ZnW*saPf21_iq#e|%ih83MDtRHRUggC$}xh0UG?^qh2i>mkR%n^0Wq}uey!rId?4VE+LnwV)8DnwWhH~ zo;CY+gZ)}z>*%B^M+p95WXC%yE^(9>BIR~&oLAyzq<`m86zKL#Dx`23Dx~=u!-4DA z->xw_gzuVx|045o5rn{-_FwHPYjL*W=bB-#|G>ZSQ+FW$=|MW3S$(!q9Nzd(e#t7> zpFPe<4llgK@ZNDo=kPe>VdlkI&VpbTI#NQY%za6|!9ID&7Snw*a=E+)aMmh0@W`}= zq@5YB1;-3t3#Hc@u0T;53pg+3X?WLoExJSD9mEL8TSd*KjyGK4PULrq-B?yxY11`$ z+RV?4K&otRgzXt`M5_*lDYFA>8E+H^Oxk-d{sL&#`7R^BPTPHugXg&0)Qc{{{r^8P{@i2o z)__-cN>`L1y^Y{`q1RyQxs`e_YoJ&-$4vaf(}t4wJ2Eabc}Kv*y((o_kik~)s{Yay zXAsX(iAfH;%|X1d<%UuTUP=(p30~Y^Ze2Mw&&;G`1)Az_UC9aJRe_fVUZv@^@-BGA zaJo6jU<-H+$ix+tR(lRJ9nw02c*)?Mf?flqO_23E7R(wjcLilKmxWIa?1^S|e1{`b6$n5q8vyv+Zem-+wG^D+bTjE7@9zuaxSWLLx4@_UUDw%f1E zxEYtQggu`lb?!r>MgyDbbF-V8_!RK-J9JmDWwQKQQi07ki#(i<_(y10D z3_IN`5x;U9c7p=fApUB)MOldbU4&@@}s-iJ*4lmCmb3Ve!>Bh&&@d=8=B zMvpY_KtDquCxUk+({APVucCV(0mXQ@OgRUPCw`Q<2vk{xh@ZrzbC`jqN4y7t?9?GH ze%+!>1HS|@+a+|W5PRMbxDN3bd(b5)aq}LF^7q>UEALp8*u4Tf5kLQ)MX82P6=Kgm z!EZ!79=r2e!KYn%_aRWmm57fWKwq>QN-N^_9|^t#vHKH?vK9Oi#IqV<+a)YWwvhRF*LrZ*>aZ%rOGp*#h^t6FF1C|q zT*c6g{q8GRMv2}nXq(4Ai47$7jL4X+KhWuRa}+TK}9~3z{Nih|CPL3 z@GR-$3~jdh+4&541yx){)teshnKE1)Myl`-Tvp6e;!(JR_%qqX;2GEH>Y7KU(ad8! z0+$f26NLk(`^-W-7fvP`4^Q_^GB3CbuYN7|K zffN2sMYmpit(+ONud>XV5>_M6;O1eUSwYHhuepk=!TJrU!Ns0bR~zxJHCEMG+sP@$ z#cq%APm9jVy;i?r`h~EXt+PnR0DjF3pCyCvQusHLhnqP*^8_hzPVBWNXO}S)demnw zrIpc$tDW%>N$%rt_~Uwp86Q|VJ#(+N%qR2MvB)^5@&i7vB8F;y!N)hBDjc2#pK`qv zw!5AXpGd6}hK;VrVBRlN;~}`l^%~gcKi$WK3tcaVXI-ZjJ0R7I<%!jgwHENE;^I`Y z#<}N1wy~C>*i-E1Pg8p1c*ufdi9V`AxSOP9u@3C@tk3kvvta9UK2wOt;Rc(!A6^5e zJkM^Ahv7-mjwj%h7ks8uUhP(L92fVJb9e$4l@q7uN7iJ! z$3RXU%X}v4Py@up9xHsN7|(#Sen&GEkHC2qJOl2PXa~{bVeCCBvYEKpM)Gm-5SfmP z?IePGby}R7t!)CUXn?XHUP)?j@fs4t#p_8sexYqh{@)OVH3&3z49%t67Gv@ z*dSc|Jt@Y;Eo5%CZ6#$Z3yZix+)1=j462)3(HXqZ!)07u-KWSpTwFq$aPgYgc?WRu zR&o{>N0UC+F&zQkL6|jX3gKd#KMGC-&0=_S6?-K&B#9T|!{I0r#=X{WkckeAy-S{C zT--s*@ff^xEgvVI3+E7>D=xHtnH@>{_e?dXq3bPkyQKGec3&2%feQ zjT_h?T---WaPd1b-&y&wm2+D;Ltb4NS8aF~sl&y8l4e}={gF8mcm~{E%Nf(@*<$6` zDiW(eJci`rVhI_Cdo5yIZQ|GJxD6NAl2Y8O6yvHE_j!l&3@+A_2D|~b>|p1@<1q7m z)*H;Lf8Xc4(_&p^t7zP{P^_YH^@p4!7#IIY%5kxgMDZ9LPqSDj46kL(=cKmro1}(y z#0{iL>%%idpN&^PW}F(bZC?GD-JJz-ElInPiAHb->5pG1ATv{_g|Em~c5%kVd4xid z@yf`$FJntS;rPSFC|Qb&3)*;xv_32+EhqZ%vnCQJP23<}`&X8o)BCJ`wQg~cC; z|0ce#_WR7epYjgkVVHi9=f^YPHWJ2T@IMZz=0CcXGw3r6?PjstVKzgn!ha=&Cxc1O z!`Cn_wvswL4kJg{BCUVatw`g^sx-^(cnciY&Snka;DX7%G%lVaLvU!DM>{wzv*5L- zakZ#BNC_?;BTwQ9m^jYaK@Q*kg0}+qs?$TQWQBU{X^tUWoI;B5FbpMlOk50}(S14P zc!g?iP_cUYS@sZIe1f#$rEuOqIDg{}aO!uwvRy$FhNsVQ-up2d1gHMMli^(p)hbq> zA`2N8gZx_lWjq6Jv-zWng&1t3Dy=U_uQJWJs?Lqrg4>ek$RZZRg`^4>e@(PfIXpxKyYY)4fAPIg$5t(y-;|p= z))Aj0Ex6aQ#=G{f)yv*M(sHdNw^)ALWU+vlMv{xi-~-+LCWMFK(RAvQcmmc^wNCyN zaK3WQxEk5-QUE`Ii*b^`#fy5UTx=lzVSIdWk2}7nx9vBrEM#(nSJ=i?+&)e6aq+Ut z{H6#O^GFFUKJ1Q1;H+v5g;y+RT&45# zJ#{fg;*5(YNGC4-;#NM+pYV4z_!7y&#U&&k7gvypcocqd8*c(`MscJp4zVq|0iJKA zi&>-DcNiDnAm{KHjE&{+rEV_T1#C243hVFWqZrOd3pd}*ks*i0(|B7)aMZ!SJj~mO z$Kj}16!5oq=M^I#J<5|g2M_SovGi7c{(6k_3aP>iVI;yXf{Sv4s@j;wds0Prz7Y3h*r0cR3%me7Qepen!Vjj%6I)m?}{R_AULr`o+aPWF7AHrg8eywwbY&7sG=1I7#4MeR>?7JjNQf@gi}tnGC_j z!=wO@!}Z(Q9r3OmYjv&PZ{!=7aWTBpZz^z=i(e+q+im{I3|YU62fc$k!#=w?PH?X! zjH@kNNfzPaCKAOPU|%Y}HCi8zAPt`fldQxS7O*~iomAjnB^XyV*q5=FgO~*$OeZnt zo+DPj8F7YUAG06t}P)_|0E=PTcJ0c>9#o1RjI6hxnP~PPPjUKf*Zz z55aFgsnjYQ&muxXVVA5#U9sFBE`k!WTM7ll{;Po z?;FgEVLS{U9Ktrr;YE~B>u|4#igzuks;v4IImqimb^?VjT%1DI zF-){2JD6hm~c} zkiU=V48>e8i^^;kEF$`P6R)4bi)8!;SV8DqALHS}P6zj+oDSpVZ@}Fiu*W2S4XP>|{t6AlXU`1<(Zinv^o0F(Y95l0}!dAOn*Tt;*{W>+Si&XuO>$>99x325rQuh5AX-hWVN90xQTOTo=yKb#ruI zQJ2q=i~C&{yKy}mjqCb3_b#FSrv+US=cIc>Xeoyt(YUV9qRX?$b+wfRM6S!N{K<7O z?t0h>nExhPr)WjMJWk}gP{{})AMy(C5Rn(#(SW&nCA$T`jX1L^U|wC#F^}uw5}B{1 zRuT(bZ-B>K*Toa=B6=WQC*dX6HA`7@l9S_5bCu;{v+J6bc|Wmr!%SomkvIK;eTB$1 zU-Fkku1S)bBPrJe$>6$_{}>jz9)|qa-pO?|y|I#L{lCMk^(ogRM$KW=I8zpFGkyd6 z?MS{3;L{|IYnI|hqLnli@%9>C(Y|1knzb0^+ErpD(K=}x17;YJYj)vCB3}phxqcc> zcq{c>n%<|`eNDUhVL(%__7mMfQ>|{;lyc3addhXpo5~|vNAsbUyRO+!IYi@{s`QQP zp}K&XMKm6P%U##3qQWioQ2DZ-4d1i*Bg}#(>ue#q!%p~>>zXbzjA-13)vjx5%t_ZZ zz#1Gw$%7I_+R8e zW6*p6yKPT>WSX3zxf!~zu6+2i>*5*G#z|7tECfI2A#w1Iz$M8$6z=BpCC9fr>%X+F zvm<+$qCg72=9h+WZga{b@RaKbICpPqJoghemgtuVrEr_;G1#juHJ$}$xE_HUU5_5( zgiCba80>X8&^Nh|b(lL4-4KENMdB;#>h5Jn0_G^;!hg4}a4ODN zKf1AML(PV|4YYboIn+VT+Pbw3Yn#@lRcBS-P+e2qR2{2stBzM6uipGnr?u*${|74( B-39;v delta 81103 zcmafc34Bb~`}f>4NrWsD%McL+6A1}PLn3V-EDw2;d(*t$%3S8c{=m+7UX=~b-F=l zyH;L>irez%Nbi8cb8jpCBS*Lok#@-W?$IE0z?}%) zL7F5tt2u?mE7x7QpZt(4tsMWZ^d)(|OBUXA=e@@eFE$iW_jobEA1N|1MX zL^J=7TpuQ1SFk941W8tGbD@+Mg$ zkfzG%NV~|(yn*nce9)T^?f`UAZe}2a6r^kAMM&q%+mWWqSCN8)4-h_(yZZM za6k$UwFL*H;7~g(zRPA;oh9dRaAirPtM2&m;}*MDCx9y7Rf|>S70;D(tCdU6*8WF= z%1+l!WrmG%SiLDyiM*!X7-?L|qk0P@>3+$a`teLURq~ndWr_K$FL~R~!ldgZzxaPB zNh4&riCGGjPd5o;o^Q#lDcLxpDcLw3=@xkzQkVuQOw)84^Ij{b1;mo#0z|ivqFc>G zw~(S+NTIl9(8HVZ!DeI#-{xe9l;%Wf5z?vh_U2?o_ZDQuxE5r^)yNmhr;$&PgH5pF z8}e8aA@4E~@*NXd(Go~jTogD&x-VZq{7ToY%J$?$r{Uxy*uudj*jN z(vj|ymmys%A3!=^zJoMXZWc@kDZxNkCBGU>2-^X=C|^Yi2W~|OaY*67NWlRq9Jmz_ zR?4ik;LuudKne~>!2u~aAO(kzR#JDlPe_=wTz&=VkMf5|+sWUDM4?UXP-+v0w2M45 zR1ke9l!%@N=%OsOA)*m&rb(mab#3BcrK@dVr4@3Wwq&Kawq&K5NVmxAkwSY&r^-?o z>2_Ec>2_Hd5juc$pL_@KEZGts4PRLlj^VXj{x+P3SM3NIUXvqec&$f1P=1I!#%4P) zHrt7@iF|_W8wtY{$pa$EFqDNzcMn|B^AU6to|PLL1)ItNRy$~QU>kh;lTV@64L<-K0o@@=fF{ZW*|%#CX}g@- zwTX04ex++~X=urjt_BI0bKS!9QpXav9)l$iNR9s#zEL}&JFB@!9-I(Ds!0&4K?>C% zg=%^V)gXmxkU}**r%5MeL$5fvV@fY_$3;j}NBtj8LL*?|uA=1zCuEc2aALQXby@mhuhW{*(zwIsjr;qTTKEi*HhyNfC|49=5 zlO+5HdH7E<{O1*UKr(S&luVqrBi$!oMY>k5-Iqj-Lz*hjMA}7O-xs3JlfUju2vR>n zh(NkePDi>{UWRnOd;n>xdQrw{&>(RDP8s)oB-DvFqm9x%itFgyL^WXl;Y&6LlT%rrd%>)m~=q) z9NJG>B&QB-;{9WAHLtlZ=MU{6HIt7IZ6XbjZw&1%m6voF2CpeE={X!;vr&FIbqY*( zH8re#=yYvjiBw#)iRIV~Oe`j~NE3@F*Q-`8i60dt!7HbZo+b4yxjb58L@aHAbV(kQ z9tU?@pHA*}8Y#SFtnd<~@RG3@i7(2_$I?hV0MK#y4$>`hvvGuwf^@39XdEVwDe~=c zG#`F_w^GEWHSX@p7H1gb+8C5N0CXC$C4kRz8h%zAQ~6 zgb1YIFbxRfGKF#p_qsV^L}OJ)-T^Q`8QMo;;L%}K*d*T#pJ1|7^qfYSvb$X-UhW|*926wP%A>^lzIN~R<*)sA}a26 z5Ij7GX~W>qm+COc`7JnZ7naHpz&KQGUrekIsqKH0w}V5NTH#K@%4)@N`Rcs6(%6!b zuYBSz{V99rww2DxW~3jz+xC|#3l+5@F?av0L1@?fN&$gdz>E3dcj zhGj-BnJCHf!6oCQ7`f%rRO!c(oTaNI>5S~RYzT(v%w;sN)+0@lPa_SLrR8DFv%B1G zIgRP`+&E62C6gPkm&uJ!Bi$!UE69x_kj|IWk*3Pakam#| zteA#461I}!$jp^AnAflLuQ&Uuuzt~CXnI2h>o-u__aB1xKlusPzsbwMp@v!! zFbEYTYQ=H+z$*VBgIeK36*+3fmaZCyff@(9*Lx){+%8EuCCgV2biqu1eQkeQZFgK} z4PxGlmsi+A7|FBL<#Y1D`EBwT^i$EJ;6I zD?r*UPrWlp8ZRHXGl&_|r80TK-M(1Ze2TQWtiRV6jxqpguDl*;lzbcMb-CLg zeI+h0L28kIK>C*)dcUvqf&2>6k@A=K`!df|+3!KJ^jXQ|2OIU0QTBP%Tl!KSiPT#1 z{-f7Cq}!!!+@x(T5#us2H)RXMG?tOSG23Eq{3>OpBa=m$3CN^TCKZ{E+}lG6ikMC1 z5R^w#ra3anlxc`eG-Z5{xrb@*Mh#@HBO@0-ZdqFBA@z5cVoQIhE3I!Jz0Iv5(pBc! zf{zWAT1wY=L8vrH>cuaGN-5HP9^OV8Bdz2`ZBXjLe{3UJq(`M8ZKdumQfcY*c2ZNl z#7mb%NjD{FbLsq!QlefO!;f^9%u=&bml!GDT{>Qx*hA_jNoz|B;-x%qsXjLhl(tF} zOZN|yK4y}GPah&Rmo9P)M2s))pi&>+e5h0?ea^QIMd?lc^-w8E>dTuBLn)-R`!FfN zMf#cNr=oa}f0!zzN)x#ID3rRFhK!Q*lGK%ljh0MO!_q;cB`*dFW7DLm(vZ@MG(=`; zApd%jv`u=aG-t9THIs@<^9rPTwWOTVHL~=#tILe*E;|0htNMu2FW-=wyFyhr-D zsnfYpG|I`}7mw9D{r&36C*<#6raSAVKdswwT+|)mmv2jrq;~x8+frkxJ#TnNYSh@L z3gMshDqV6#L=qv^EO~Y;kCE9wrTWt6*S-{hBqrMXW&i!uy z{=`y{X&RRJnM3_&ofwau(6X*Bx}v0lcTLtgprs0!YswaRlCjW~kG!Q|g{cVFIK$3* zrkqDLXLq-ZI|xa#FFGYbp~z)8$q2C$ZSf`{3v@!HZZy>(7I#t;QM}=4DTe})!+-e4 z3ag0(AV-N+PWI91a?1?4-_(R+VkARey;`K$`6i26-=rUjlxr#jYFu_#G?;?Jt3=yq zFl}V9z2u%`yO+JNp)M=R&@>lqh;H8i_}l#@t~w>V817;_nOl}Mc2D85cv6 zp;y#PRJKLU$0af5zTx$@=!qrgiD7ngOTnk63nUS`e+5?qesKmLH$&}Q(^2Ga^tIS7 z@r9mJfHiX#1_HWC;3~9&wE`{4-cw4nowL}EDsLI|=-&#_EYWscNj6dcjw*xw9gZZM zVzD(IS16*m1WjZLct4}nwFeH0U(w2MUrj2DNPW?)Qc{EDvSd4DjVY+j=0@E zLB#3{+bN5^P*_-5XJfh|T7cOgO^$gIE(VLCm$4U>wMLeleWoHS{DEpzyd+z$aGazV z*S3U`HwS}{gz{2Wdy`OxyorDS(Os|8F+(0aQy)1-K5?kZutpnR?j+QaZ0i+H+T1fmM5WoH`B7yrnp#x-`!p8e zXRubYe&Q2({V(;cb5w*@8h9=c&~1%>qiIhZ7;I$pY{(N?Cc+7FbX|>Wl0B-|QlX%s zxCo!>NM&18EG|z6vGA^s-GEr-T}4Euypc+$x_f1#qMCdCK0|dc0+V|QJh+$2zRJBC zc&YA1&B(pVn~_`HhU)B#Rf`p)M#*kNUU!OGyoVMR(V~ym;x@Gy{j^06T3A*6$GHmq zkKF+MnPA<9|hNq3GT{spFkG4E^M1CE&OSC5Q!7CLH zPtr+FQ394>Fc`tew88K)hwl}Qi}6XP?!p0Zbr?UeQZo`n zV2`u7B-zcEZs~PN1^YY&s9KeM*&GDzf)$=?H5x?AVGIKai{16YJzO9L0V5xfDSaRa z;)^dXF6iYRi~+$qT%etLn-ql5u5wOsaY|*;f0<-MRe$$5$0>_#t*MOgY+os*u?~ki zgbBrAoJ17t@um#YU$o}PWaNAC25YWKheomapPC2)MYsq>L{@pb>g!gW&Q>Tyv>h-t z@4_-8NEr%HAp;HUW>h|kvc=|;6q74Dm1O9yWkL?#=<(oyOIBNIbw#vtx8xnmY(nKS z6^pVDiQqV0Qpmw1{ec@kB8-S$Syz~{DUP{Tnui%Ee#D#R7PKs*DA(r^WF_G)2yxa#?LGF&3Y!AaJnQ zVg)Gk<_%wrh4I<*P;Ic-4q9xrEVk3xbAg9NC>DKUHcmq1n*4NOS-FAsg*ox2{ysM@ zTO8%;a`77r1|O|oEs@8S1NY$__O&Kj?k3ts#wOZc;-iyTBkPz$%9SMaPWg^fsA3N( z5f&l!Dz4)IOtPyUw5I|fs){A+`1PcMu~7|mh7hn%-LPUW>XOWKgYlb)ALak+mxwy6 zvtcF*|MmMCb(itGgCFJp>*vzdSy!xn)^?B-3PNK)P@nTGRJJw(?!!Bh=iU{7}hlPQAlKb5hw{pRz|S_Q3(l4-ys_ zJTryGC3n0<%e04Dn7CJ=3ep<4=BjDcimd-5$M zRq&xrkl?jIgEYM9Q0zgrj{lB1&Dp zY#?idGYLYM-r!>fv3CA{X9?`AmX@3&v6h&uUkrH&`dEimDBv@QHLxBX1!YnIUKgv= z?Lu79RbD`nZJvT1JQn0T1lz&oq?C(wRi)UCKfa<#@okeTl|89LSz4-h`I7>!*AFWY z!FLUTnJF}$QM|mU0er{kfdQiLiw2o4`ER(ER&BJ!i@DML(FGKtXn3}AHo8yODDPN3KB35TXGtcDjzh0r8aFN8Ydjh?-5P2Cqjbp z;LA?c`1tXY!-@a%IZ0RW zzecborZ2LbecJ0Q?2tqNo7pTb!l%FHF(X+!)^vtyhhgr|+u;G{BU!lTg4s?|9=`m{ zNH)&&ex?fPudHn#h$m1Jo4JFy2;wDtL@JA9j%h@^ew`Z6(>}*bQ&~&v7(@`&#-r#o zP_^+0HA{LNN?Fq5IZP_>`bj85k2Y7gG(tQD1GpduL>gz3n!N(VCu0PnqP(RddZP;C ztjako9K|LvLw#N`3L(CCmFg~F0(@qq@INq8E?}g5{L1qqrAQfZ zjp=NMDo?}PAi&yLBmj+!<)DIr@YPEI*v$LHMd)aAO?CGj^Td$5im=8tg?xPOXx2db zhc6q=>er2OeO_^A_@2=$++z*SLR9h!zdxEyV0EH+>KN8AXc8(CZD*-2Rv96tji`Im z1nXBsbH!pW4Bv2 z4gKRhBArd8K$y-#t&4?WlJk|Cz!cU^(>itZw!;yx2Ey6Tn|GVC_zKe{dl9))waNfjtY%+g@CRj=qKM=x`{`)wYJ(@qG6fR*!{E=3~avM1u8^ zHj!wWcbm-f$1;;&xJq{Y3_*6exCpYn_>r-!BU?I&S3vi5bk7r*$b-gVWZfD;3JizV zZXyQ-MkD*HnvI15f1#{B*`iDoOA^;VQO-}8Y;#>ToDeh6dIfSooP+E#kFJI1}Hyo6CkPy`0;Vfn>8Q6mrY{bd6V&2sjlN)$Fnf&FVq!M+(g53`Vaiw zssEU)Cyvi)p%HI8;tay!%FjQjK{!psN}FpQcoyV|jkV1+Ta|DZNoaGOrDU_!9E8@8$&kTj_7@kSuDOmU7<<@k(AeYK#<0e$ zB3)IT``^#2?tT8tWY*a4LM=gTraF+vJ{`!nc#{`k)NU$)s5y_GCs02fqUU~}g`@Ox z7x2v5WQj4~nSz6e+{tvDYmXYw-yjm>=kk3StR=tw0`ru@`QsN@tJ*iI9gfDMP9TF` zoZ}s*u&ylV1wMNUi*U)sX(2C)ko@`4De#jNesK!(Z*&clwHCE%!WAs`m2}F2m9w&# z*L{)U={7#`Mb^@iO})r57vVxYTr;R_|BMTx6hM<=j?M0#oOjHStNOaX z0b3+-fLo#XeZ$Yb$U`5G>Q+F@RMDz+n^^Ps61-|zEYQ_-J`<3yw1a1o7; z^F?T6J%TdvFoQ>CfW_|L=_&orXECs`FKlKBDYxW2bY%L9!4J10L6yA;PaL)*mFJ<# zINN{g|;O4v|c!3JFx z8860x;|-iLNa3%gM{ zsP03C2~y`RIab_#!Oa)Gu!mIBCroW*+Nm}Q=O0aDZCNu5kHbSgG1`WF;LjB1v_80z zp!SuwHS4~9jf$?f$8w@r+dYKZJfWCu^V_|I zejecn85{F_QjgCg{yCl)uhVF(+Nr?5X|ZK9yNu<(PG^Iq&v@(%*4TRMr)uK7^AP;S z%KwTunfF>W586rXLQtW%?RV9z-MAGElA4=3#l`+`cRc^xJh;tS`k0l7*P@(mN%^V>vA`<-0 zn`S`A-A0Jf-)7Fee+}Ld>frUR8oZUw=+wm?HI*;RV6CKCd~XJe#Etk{8O%TQG^=u= z2MUKLOz7L|5s70(^fA^4aD)J%kaHiJ@l1aSwzMYfm4o8L=-i(7;f> zY8D&9e0q>;`CGeV@lxee_l0lMEbH7q7!lAq|i7Z!%eoXW>)OY3`rJd_yl#H*?Gi z^&Ugt^(d9?3qUy;zroR#oJXXUzYs@1<7rtqSjpfEvRFV@TEYUc7cK%ZNGw@__!Pke zP*Tj%+2Irv8zU%UktPJJ`xXB_i$z&OEtrPmaaY#n+6q}(_)JDVP|Iha_su8|f19JM z6N>`ZZ~*cXR@+=FdICA280}9W2Yqcq_DeOp4VdMWwI}aVCaQ?%QO-}e;GDCAE#-Xa z%ghUBif_HlGNcObJ)4E5)DqoD)+ulN1JlqsLa?UuVc%;L_KdO5EuU#L_Od9L(k&2+025|sI#+KE4Fk1m$I=yuK6Xujca6GTDsx9^+Uw+s`J)`v?#MD zmntg(r6qPj0FNV0X~pU+`k*zy!rD9>Z6P?t2JK1Oh^5^9lHP(i5GfIctOH9mYU^Pf5i zM=v-77D9P+sxDOWug?p0qrVW!kn1OgyD`K`zqz0vb&nSCHuE)c5kBAPcd_V6r2V9O zO+IrpCgnmd&BH$Oi^}K8kK?W9vB+9MLo`*s%qPubZE9_EsusJYd8{Yf)KBet^K#L3 z>sgWl_Bi~oTGzQ)1ET9611iqHtJ&ibodXs0bQjNdyozThl59919lX(E>+7y8z-bIA zga&1^j@1=1PI+EpsUKECOJ6}Sujs1^m3Tx5)jmcO>c*edg!+7t*0XN_eO{<$jdq$hd71P1tb??l zpPUaHJiPuqMeMTY!v-VhDI{{|&Aj~r9GV0stKD07Sk-w-imLNC%r{l;R?mqPLbDLv zbEu~C+0-qk&R@p@sk+V|i8C8j=Wn;K-sdYnKQH0JB!?qR98lj9L1UsMj^`^KXDrV<5b!a>?KPs+Bci z6Z@z-xN=bFpy>$mQ~2Ghn7gWUFxW|ADxYa(b$joko;kaXhc2J#c8s_!p?3RnyXxI; zhDFu0r@640l|@MQRoTqQYN#SarjxxP!e&e@RU*vquk}Kv3FkR8T;`**nSYzH;s8kH z?Dh<2%TLd9zRovh<6!2~M78^E52!8>PSytRQ&?VA@!rr+q8;6H&qZ|Jgi8(emS9Q@@ zP7z)ZA_%8k0xu-%*p2N)ZIUTK>HV~NhNz|$QQ((iMbvi^);+CS5t3NeF1)N}?Z#`z zP-8%iRaBi<##dEcFGkhsih7-}G0C2=5e{!qnu~*{r#GO^D?T_x z0rQ9oaRchS(iL}aiwO76;OB6!<5)<&c}0&@f!ulJEY4AYeE+0|%$&%3pGW?n3fYOf zTE*S%#641>F}6OBJN%^_`JnjSNruyx= z^U5`xyjbj3qpK6SjuZK-py$-J=U>QlYy)i_JE3Xo+)1s+OP|MG_%Gb4Dz07N#zOUL zoX7*8NACVFhhLQO=3aE#DdxG>RpbXdGu@SHEA^8{~Gg?e&XM~#=^0I@pzrZ z#P-}P7GQKPY{U4+(p$UtPd67uNgU|SK*{+e3>}ZDgx}c1__C2M_4(S@nW5hLwph2~ z7DfghOPPab7f&i4d-(p>nSae@6cl0_H&5Z$UWdE~d82&Ra$uj8*nWs-K64J?9%JJY zM9r)>2yek|s%cz{mZEvzXU@Wk#*OkZmoxG3cOPHHr!{mUur6o)j+R#vP-`<*@)h~4 zOWWVXqs9n~RzU}6`j!IM*F_UNLVs3qMte_fZWtJa)Z`H?XlB=~e!w4Qr$~ zW2#lX&ubL2Y}|m)FJwKXk9kEQGx_e`01e~WknqHuBR-Ype;f|nt+NL%=N@*}&RVM# zwso1)^NwLFR+6gM;T*|s9E%O{jX}s9Kt`G0M0kd6kSW|@>^9u#8hKQgMs+#n@OX8f z5$J;qwr34-q1`byKy90&h27W-t*ICW1YvJ7uad&|*;%V*Lqh;mQjjW1l=MP^_n7IQ zCFg*9<$3P5geAFuH{r3vR=9WzAF+fbkN9jqC}Ig6pnM+yblMCA>^UpKFu57-)uP(? z=V2Oa1dtCi-SN?Dn64du7W^pxfBv|%lqGpD#lfU{{)_eD6Fzb&YvywC6Q<)nOPSfb z0^QnUA#SK$!oNbTG?m|6%6iu{cZHXPG;Z6K#}={H(sKS{5%YJsX?E4|_34tY-qyIB zzhA^U;-URZMa(S4asOqkyZ+HO#_zl-1>q6(f@Q36&DX|0#u?L!MWKA_GSl0 zcUSO;<*Xj}TFz=T-gdy*y`%$Tgc+AqwM(UTjiTmMHK~Ut$BXv9#dNRZw+6q>|MlaG zma~TLKZ=tN*GT@(a@I*{s?UM@kk|4=Tl^il9Hf)C4cX&$QVuqGms!V9|gil!^`3*1rSg%VgsF6@G+ZP95-R)HB6@Vvv zgAKKrr6Bp%k%T`bBI7XrFqp)5-MLY1gY3XP0$K2LG^WFea%}O!Xp4u z0&6Y5vx3F3mLKtpD_I+9BpaQvu^7@W35@vLMmAxdQdKedL1z)${J!@AW> zX`uEhu{8co_7RhMl-_-dnHg*K4v#2iDfQ`57$5Zw6> z^(m;Y0)f0m9g_#e!$iiX0#t1Kw*WscB-%VGiq&?1t(OpDD?j-T8|f>5f)c&lAw4)K zW!BmgfW9ey>li=qqvXq5ZD2k)vG2Trg}DV&%^tpP1NPU~`Th;8H@U>Sm~h+kz;|(C z*n#(Zm*x6bqIaYV#O028b< nz!G)oErF_P4^OV&$T~ESR7v&FNEuro zgE=OYzzB$Gc>H7JMrQWtvXy94sGq_&Y-F7cj<2wGr})$hPU5wh|F)5}w@$4kdbVQ= z8W-S=F1%Sn9UlxZA^~Cdc4pI*ZfaIrt3;@%ejll*wsLyb@d~iN#LJXM*? z2$o}BkBd;|BJQ~v$}A^AoE;b;ME$>%Df+j!CQseSB7-p{{)EXH)b7!ojksz&qt4kE z2`m&a7Bb3lZ`S3lHZlW0wV8SP=)SD3$`3a4n;iDOCpSM%3W%Ze*Q&Zk1Qp z$Qv7lMy#oBLL<|h8qxZm0I;T%&dzL_5~gM~?`o!^eu5Vm$T9!RyY~E6-Mi>1P&iSh z$%kGuyTYv)WPx!`l|3Df+X!5?c|hV#wj54mo7tW)}%8+-xlWa4Xzws-R6e^V6$tw)IeTr48Sp zx|u%{T5I$Evs!ZnSku}gNz0}wx74hrwW}y0vVTW!Ui=R?o2UE_t&yAgwp@u7?ej{T zNw6IAB3y*h(#@*U*5S3NDy4N6V*aPn-jr0O9qJ-zoxw#Ytpph;Z6AS!(z^4nwnJ&- z1#ME=Bb}5d6 z{{K~4R?NSZmO`)`b2=_UX>l<^X<=3h1h0oVp|_js)y_Nh_65M2 z-u5`NY06eLtLbgMiaO=3|E;&q*Zxnv1q>b@Rn)&dnxA3j%X+ z5xN?N40M%FV0w&K;ek6@Y^^XAd!zC;pRtq0*Sb?IsQrRxlt0^vmGcIEcPDExdiLLs z9S;uqWP0WNM7xV$l!*WoJvih}kUs&bp$t+XE(G}-kc~=r6~YMeSTGG&ArfAWB#E1$ zh`!>!dMRsOqx7oK6wQsHfgK>G2wG34#_a?{oX16|WPJyI;sfRzroQ2&S!Et^_-|MG z{*iE{4$V|rbv0VXdr?9=|KOrUdT!gr%wB&`C=qjGXJEpSIvMs<_oKOM)JXrA=t#2W z3r;r*1lSqromoVBHLD3Msi+^k`M=$0&E;p@DCdArWsUcBVyA+ISY4VceFqP5zK@Oj zk&F3HyD$aFd8Vq_gzld*iH_sv{uwTD7$yVk`8hdKV@(&j$e z0P6u^%`DO3Wxd^4ufgA3YYLSZ4^v<5UMHx*?E`3lf>ImDCifPL&AL|%)kxhr-^1F~ zdIbgSpOugu{LCH}Wc?9kA=bClstaCs%`p?HYGQE|Ar=V>u{MiKn^);#_sYRVS@KDB zu|kAA#%8KmBdCFwCe{ugh~=Y+HJNJak3osvSUiP3Q5d40TDtXV-h8H`=4w zmZ#0=5$#1>^lpW~Aj|;5%)(0>*nn5iK}~GEX$6nU3-lrRAOM#tnp{Y!} z3xAr2?!&%jC-1e71xurN#y;#!dhyrxVE`ZD8~5QBwGytW=rS_Ohyqg48Dy)e=q(hX zqW5uuinijCR1lRs6ohn(O0jR@XoT*Hea>ebgE$s z^7)g4tO3vbj1BNU7Y5q)gi_iWwf=;k{fxD!8Hl4*+ST}k#*5h$Ryic%_$yb$8 zf9_`++dUE38mTy}rBzbrK?B~0nC7*P6is))gXjpN?IM1vjJ5S%f(GC&HY1hTUmU=} zKn!npfVH+phiXa=Lq_>7mz3NB*=kD8LJ>+{hzpebIxa~CfoW8-d!^%|gl?&>9h{l-#@B36yYhQ%ZZ-P6gD91@ITV-$LEW ze+z(^zcWMd)|0bu@ABaX@fD*umoYh1Cvs>;8EYVc8x#|K%T$g{1Vitn5MocNR0 zs^YsJann_PCtiU$sSMz+9Ku=fLcZ=0Ywo8n1XJ3v&h`-xYMfMt*P>6_xOV5?A7Z5# z5;);(U+asTWb?k!%07PjFxzGw80@OExk#N{yCSo2FjO3cjIt%0)X)l9M^>!ZB)d{U zJ;(EEi>!K-mzoN$@XE6{h^&{n2D-P&s&?Apu7%aII8K!8wNm z#^9i2)e)Rsr1IKF*d1vE*O#*qjl)2yh>X~hGIXcuqi?Xbp;uk%-Qe@eS-jM>bbmQc z%WK*z$tx?AJnnvsO~+Gyvyb5n>`(swG4`hPJ@5V{0zEK z?3#3f&pW{qq>p&n37nLC#;=@UO@>@LL2F;^x*^=i%J3yR-Lt#%&#B%v&|OJ5N%raE zF3z>o)=e_$%qw;vCXl#6;|SupZtKP_QC6NzH-4V9;=f1Vbxh? zY%u#0=sq~aGJUXuQY(}9<0-4qvusFESCv2wMFRJnuL7vP>Xf*#vvNG&e3p%5?w7dR zH(2k@$`M@mE1&WH->{UXFM>G*&tH_Q7uDQ;<-C?#r<~wr->}ZL24rcX7I2qytXchE zsv3+^bJXzxJmws0?se-R$S9Q}{fSRGhgkaqFFJ=ukXpRO_nu?+;M_%m+Eyh7$n?4h z9w@+@QJ6=e594TOEuPFik0avu`Ns1ss$=-~s&o~~``@X#rOH|@w^dn=+>QEiyS!Bz zXR-x{TgoF|_X4v@Yq)%Yg^~kaVD<1w_%|0=>t+kS6}w2BisyWbyAe+Q9cF2`H+jIf z>}`BgX#ck?xYpG~0j^NC@H^i!zfcJ{q_+xX_61;X3xIKHl+Oj#>~6I(y(z@l&JYNX zD}Kkq{oX@6!nmb0LQXv?H;^;W=Zn6>INrk7e}@z1Vt(Q~*1MLgI73aojM`@3v!&8; zzWsaV+n~i6^4LQGxQ~~01Cs%?!TeB5trn^KUM)D=cUgFa3c98g73i zrT{twd++RH$EubrfO}kGR@YbGgw=TZ71o?@zr?0`Y|Ri2ldmWfc<^P`&Go%CRSlM0 zMuV?sI2+`1*DJVDIEu$!5$}PHy29)pKTda6ujco!;1-ja2V7-6*yh#z+(p)gFTctb z)jqb2V%Y`p@+aLS+s#csvX;_a-seZwq0LC#i?P^kMd+QfbuKwopERW>0c`{OD$G+ zQ-0+o3P#%?{;k3Wx9GcFRb;j@=$PscWlC?#B|5&K5R;~K;VG4vRO0yBO4d*s%6C?> zrH0ohRO8V3C{I*aH0EV$|A@=KVt}77r*LI2BmI2E5B|!w;~B%u8*D6&=g;4Ot4`#T zeq-nGG)vc;cp7&BFS^P4vbKf%%1u^AUH_fUlK$fLZn0$PLq7Hvy8b6$b&E~LhsGSY z*eEHMkGjo9N@w}*+n7VP^NY7Z`x5VVhmFJA!W-_ed37BhkU20L+kFr=$fZy4@VhL0 z`3Hd?pm2YOS+YBizHTHNQVfG^bwnR_iHyS%s=y{hIH+%QE4P;rG}K z^s4wCgj>!J-D4wK?6;CQ>I3n#NeIK2Yv7;s$rZbO7b)s39{UI09)Jq}VBMuse(n!E zPrj5t`Gd8H+`AAr&T?LNM^6H7)WL^<=zh6i^cWv> zpUq`qWxV1(OgEla-Un6eDITzXQaYdifGxre*e4Ifos))tvK7)T{_&rzY4l|{4#l8h z%8or`#pGyZi<;pt#ns&6-p;+YqL`% zAuFs&6oKU-gnTBjD5s0b^AKKwq2A-P=xRzCWjDcM>04XiZ{*h>vUV5-4gX?eumqX=7rsG&cl-asqH7et zjZ$DxiU{V#%4kra83<2L;&23aV2xWwYgLDM??-HW!027Vcam=_XG=wnrn+NlHn~{A z18t93Hx@RA8~%o~&*$lXvlm;1BPf!Z%aolvg_?_%kB|X~u-{R$Ac+w7H(M=jhK8GJj*mVlMh zape|jROYUqK(RUHvGhjoWOV4ZGLUz6urNvHQyeU)#@;tTPT9d%JFu4D&i6SmCZ6!i z4wg{s!Z4x8Uz9N`+v*#69KyHSNF~20omLLg$9nAQtySOpWM!D%&tqU!{jrsY^~oMF z&iYxRzS+6$PW&X~s+Ku>hYB(^l%0I2q@O7DfHW|Qp|5k`V6ReG}AZs z-2Sl>USk`7o#{;-B4(t&N)(S9;3U#mGOBW;o6H17sEryrN@jObx4`YuQGjm zgv|PSFl&7sEnhr3KF7>?f?hvB%Hyl``c`eCaAzHdb%Vqg>#&-xy9{@5>7jE&DZwYh z@uuQ9027F7y^s0tdcB`}SD;`g@(uTK(YNv1U*v)hyi{Ihctzm}@9m;*>MsAx@F|=R zAJf;f+9iBQ7BqHl3M9n5o*PL;7+NxxdXtmv=L>L$>(=a=OemU?>e1h-;`-79rY>+P-lZ zJ6|P@9Yup8kWogWCfj^KV7V$-1G?%P;yCdGSADQ`Pa^H^l1#&tqCpaRH$iK)JXO-g z=03>uqg^2C!<8!{l%7%>%cBX+I9`?V=bym8>^!SA?V&PMvq~Oa` zLMIkvNEO+na2M!e6CdoR@7Y#5C+QSVdX*bTH{x&=D>;O1;vJ}laSMGDjl#Nd8b9Wy zZ`5%U^iIJn$)0M;!2QwiMB9texIaqXQE5Y^^PW1cxN}9}3+5ld8`aPc>v-%U)8WHS zjV*ZQD2>jGG9r&Tj9&pNb~g^=E@X4&n=&NBiZTMtA{aMx40nC7AxMLj5v=}Zp6{;j%ob1PGkx^+_yu?UOz#rX9D$<*^fb^awOd6h)#w23&0Fq6EWfN=&@8tm`tQCcP^E`kwQ3Pl7iW+R@e*mdX zrUs*T(v;b%$#d1iGrACJ+!M5V_1B~(Jglrd^+Dd4Yj_#rb^{J3Nr)eKhL3)c_g)cu z3r#u_8;dd@DBv#*7C^A6Jfb!futbx2d~Im$xLAf3n$oDjetwA>TuoOyRl5#4^^15k z1tX9e)LF+1>%hm}9j&(bypDc`_j$4BDKy1Wi?KYWF8H2s!pMT*d|F+7V`%`1Y2?Lq z!FE?q%~({Q!~N<3XQu|!5iEr#)q^NMrK*gq_4F@zA5Kt_%81cM{(z9))?md1%i_UC zeV})Rr`j%-22*!F5-`JB4HiH!!&<)72;>(uppJkS`2j-ipuzBlnDAqQ=`|P~11m4{ zp!$HF@=%#%6K)Sa0x-i{8mySw`Mk-O)CZF(8j$=4rYa-kj?RVz`+(o8uMhU_r1j(! zJ_t&uu?_T%S_gciK0VZ5@s6Zugn(LT>QB_09Fu6RQfLy*1K#A*8|eM<#-pu)J_76W z&u|IUo0%@zhVRherL+pAe+)_?zu>E%9*O$%z3rael5K~T&b+R#z6BQl9ewqQ-dlR8 zol2ulS@{xQeY|(?np#ImR-9V->H`}$&|ql0=CWovSlm!uR{> zjVkmhg`4h_9KYp_!!+(-O&BmGE*Re!R--rvw-70ui*AJx@gRXWFCU&gG1WUW8N z6w!M+OQLtt&QclGwRV=WiGaUaqS>ytvqIQV?<@(Yxxd^=o<_?r&XO2U-=gG(Id`9F z4qsna-;QrzC{qY__RSKpCZxYUa!V4Smwhyjs&M1VeC`kk-C#dY&C zLP)EvA@~Lm@9_kr{_ChTL^N6Cqcy2>gT+onLgfkt`jH% z_lu$g(H~Zc?$S7x0&YuZy8tTrI@`JP)6MlA>gfo0W~oO13iad*ezdth-jMAC787t5 zZ`48`@6*N!Oe0{^rF=#U$oJh6Cq7X-&JUoe@9R#Wn6BrF666b3~L7HbD+ zpqM7~ZqZ`vQE0kCrR{vaN#9c{;)hK7G($~iT|UmqlvjAWKz(@Uc`wr@58t^X*a`71 ze*|$Vq*0A+g{eOketH?7$c%-H&>~7eaBv%_Z|l8005ISOP_#+l7XtMy(=XvO6NI@7 z`zj^9I;Mcc_^SfvQ}rj*7Wi|h;0pe*rqL@Jqs8X6^AJ{e%ksq1bbt!lK%j+uOiO)` zp(lZW8cTCmO&ed?Qh!vcY1)X_YprkP{e62)9W;py;C))_57zI5kGo=RTaUge zx{0KVd1%P{fwu^OCF+EeB}|PxN%5pHD2bF+7)f*};N0bJhUooRPzWy#(Raf80e3?5 z{iVIUd#Jvp=~_#1UxwN>d<_)T+o=}VM}2a_1y9iN!ccuH-x=*dP&_1o$0Y(tbz){K z<0nG(1Et=)SsRQ9e8;biz9qh}u(XZdXpQbEHi0Wd5T&iu?9GynKCWFvov<4-B7{LB z_Q9Z@3yC{+IV()UJ1$zavavf_DK{5XRSUMCRaNiD2PBn~sD3)zX5@;Jd!b5dEDym} zc}Rx_^s(d0YxM*(ew^q3)htP-~zK8p?a9MBSB7w|}{fb`=;mjpeBkc1=HoAs8x&29}BG|mX7W*c8`-{vn z5By-*tUgqo4aF&&7K4KLsKG*&{8sB8(0^yXsv_GNWwuk9#<_o>CLc9IJA_`@UVZL3 zvPyu45CGNHCFt-LNpMu@8w6#ktD4)yx@)|!D9QEHtB)P@0ZxKj3EQH~Y(=fT?(W8- zsFQov@G6NP7C0q-5+)Sl!0Ru{-B+pvE_YhMc`n_A-@@}Z)iOi_*9(~0*`dBQs;}HN21*( z_}is4PO2&J<~FCSbyZnc;EQ+4>+`Ay z1_%XHbqr-w#jM%X0qZGhDR}=#W<){MW`V8{i-_Fl4y87#5^1>Vfz=1<%d6Fax}SGkG~M5Z#>?OD)JneHIBIM%y!Y? z^%`S~sz#OMLeJRq{K{(f{E`L`aJ`SX&Li9-u93OhXq@iFeyPfYQ62O8_+)u`pG-5sCnlT#d=&HthuRn2M z&?7(@vsHrWL~sxY3WpFBdrlB`g^z(usG>Myl2G<{&Qb<3Kkh8~&=Lph@(y}G>y1&> zS?*9-dV*zZu&m6&)R2&SGt+d$_0Tg7J@It`$VLq#s3Bgnf7(lW8(FK2r^+yOf|;Xs zVm;n}Q|4#Vq2+fAt>B(D4uAK-f|-N-omLbUP+coN+o_EKhj1c#`+3JY+FxrUDjMHo zDH8X8#TSeczj8QsD_HF~j4eN+v)uU$K|S+5L(_O2N)mOzkoyK^g>3WvR8c655~WJD zWJLiy#;S7ujn{vab1#wg@CQdkm9~C3!2P53tvk1bEXvikz{x2Oz(*^x6p~D=0``u_ z8;Bj2Ax7Jc29;bsksAkc4&%=}J6i8+9khmq3;sw%Hi+vo`=jlh*1~amQ`#Xmjdw(XIG4gXrTPVuXfVMSkoFqicZm)6SK_$^T|?)wyw}Yib~_) zR?v8BW)+QDRWv3)L`{xbV>|CKTDFM21yG-~0`(U}4UU$*mc9!EeHVf?LID(>BM@_Qr2z><#ikw5M^D=+2)>t7* zRlZOQ-4x?Bo7&7LSI#-&k{HANV)T7NUdM;$Fjj^^`l%obiKcxFzG)ec9ZCqkt{^al z_D}Gl7=0td%ybPXoC06djL~zR2+Xm$j?9-R zp3Z^h7rz6|e}mPZ5MOZplj2~`k>JFb2Zp@PYD5@^W<*7}&=Ij%Jc>_q?(d>+V4XQv zjL`ew4N3DMPvsA4J|21K=_bssT$%oC-?l+-s*ygy-6G`xRojifuCK-?S>rR|5bj81 zT-CHGWb6(ZDFEG5P@_&u^r)&I4d*&+b#gO)TqRRGn zbmMnHD66R!m^y7_I!AeqqlsZ@3?fywIZv>;3L$r@WW$JTt?7+vn!K6mxqEeI8qW-P zPhDXuzhl-n8tF3z-y!!bT!%kg zRjtD>SD~-1j&6Xz6vb`Bq03-Y6phHvPyf1s97?{Z?CQVqkNH8Pva-UWQq#hs+AT9ID)0W@&pBszR{Q=3zt6s2XP)<1o~P;RWn-zC-iS>xE;OtPG9L>SsJw?Oo?nZyNE*beJ9~`fB=05Yu=as@| z>+P|9b7*D2cNm|dJMM#(&*Kd0TXTJFP(OzBYEXUhTFSmAsQ%(xc>jJj4lJLLg}!VBoeBMx$<%ADad8cq_*g^PH7UM_ zNsFadJoj$a|61!c_G@q9b%e9Sc`SsRv z)$sPX!FtN3_G4XUSf5c>u`M&KPpc6u^JZ(hdJB8#W^1CF>0NcR^${E1Q_z04b&K6{ zav=NUPHP`r9-h9_nri>=XzsAUJNPc^YBe^2zLCLO{dfNLU}|;U>npI&d+<@~Mip-fDK4?LQzx?(CDxa)%q{J4Yme}9dYLf2>f}l9 z?8mMB4fO->^UJJLRrL;UbD6a<3a{Wju-e*IwR?YDZT((XhkN%`Ss&EY*SsS)S?e_Q zPOtHXHA=U9dDNTmmi1aSJ|fkkWVPPjj4v(X=!gsMY`m-CV(eeuq8jUHo7&U+{@Ye> zN31Gb^ff~L*2})eACqm~ZjCQ5E}dX^BNsAXjNRnjf6#hPRg=6Q9=66?)K=c_k671P z@S)Jf-&u>)`QETbYZr@J=k4{q)oxM$;~m&U>R5L0C+i}$v-gIdt%+f=si*iIug5;K zEO}(kpwIEA}UQE+{M_Ry}O&OH#uSsU>Pg+ zrU|Wm8#YmkV`=biZ~u$d1=g6+PX$yR)=Sku?|&>>rm8ORp0{d0=xT-cSeRzCYPakQ z3gGIwXpOH>FVPkcunRHTOX?xEDpp&86_tbAX%DIIvFdi(Onj8IO`P^+xLW4*C2EiB zZHztYr4949*V9v*)QY~UI#AoF{^5OikoJ~_zv23)YqKGJK3#LF4|%=m+BP-*=m387 z*+T^9;CrywpiYrHSxJUA3QM8(WoRG7f0V+Fb`ycoYPT>NDJbd ze}vhDKVC38j^3g&iG4gwTZfg=cMsQU;;-QUbD@#?-FFU$Q8DwB#X7yiM`#~w>U3|| zDD4v!Yu>)j(q6?-e{{5#N}pKuj?uPTFtgk_R!dZG^_Gv-UR2dR-sG#b-m3b!_lEJ> zHLCq*+%U#;;$yE*(E8c82yUzQhY8wI4KE(uGf7))v9@PdU#E4#%G7z+Y4fod=d0_` zJR_JVSGyK3toSTf8;qNF`eY5?miG3Utlh1uPWICE+A#HFcKCX&0jo$nu;n*s z!z>-zu`h1WhPLn5j#?$si_3D~v)AE9&CJHvBw`hJ<9pY`eRlC}Xhf-4Jp~hc(XV257Yig?DDeU(q2TTPxP<%iGloX)dPIb z+UNUjAU>e|b36O?G%mi9omimtv>2yY+=E&Ve2QtrgIdp4PhwxAx?DN%9Lt<+X=iUI ztnq%Y2esaon18%)Kd6n@us*?9q@}Bg%)LlkjlTPCk@j%A+x`%x=V18xbd-(}96Ny( zc(gv2uoLVhkM5)Y4@wgSYfd?LOsmhD%NhtNa*sY zHnQEI<`AbB`U$6F*aMGh!@^JgBBDL%VtGZHi~abhb_>>Yj(rRzyvlBW3?)op8;Lv1 zK6*^6Rx`X0muOQpHHUqP3&5-l04TJ5FU82n*&ZK;-__F<)^7-WyL z>QXIUjbR^_YE@YOc;`~BA0~pAmTLb|OT753_C*~ZT%P)@w#2HoXFn|0PGisVBNOPdDPvKl^KX9X{7>85z3X1llC5eh_W61($@0_h?9_UUwl`V74O)^~%C6g>U5N&Gj=1h@ z#|G_s{6EloBWk|UJ9r}=7gv4k=&M>sysYiatJ=MN=M3lf3HJHc^VbKS!eF@=`vQa| zwS~6qCHKz#)semA;kj5pc`QmmIz1pY<`to$0Hcjooa6yJo z7mjXxe{?+tJ-!9>-tn`1$W3OI?`cCVVb$KF?`ekGF&)p`UTQh}S7F)t&F4SR`s2^; zln=Com_Og3;S{;BD`t=zn$FTh=43a0pbfy&D^Gu*-JzcIp8r6Luvpq|_qO^-``m)p z*nhiUJFiBwBcEuwc)DP~r`qV~6ZqGY_Mv`9xr;8ZvL`>)K31RgUiX=nYQ=Zl7JrVT z$UtWOLUUUZ*0a%HphE_-hriIeTRN_1YroJwRB?9Jp#6kbrC;}@_HC;_adU<|-uvZQ z{#7Y9=_@V6QXkEp`U=AVPbz$cv3-`6eywF$Y#Ukq*O-zYVrReB9>rUc7ai2PVFl9K zgWB({JFMX~>==a_w*LGq%?E7zA+4+B$VxWg8?86f4kMNqS;k@Q3Oqb_&tc5zo7tYj z+MU=DQohmh)GYSQH(D?CZT6pUFv?zMt|QtYHGxe(qGhWo-gQT`r&YC%4gOZ^V_$(U zh~f~o+&lMM?H*O_?fvFE?J-r|?Y;RJs-}L;#{8fiu;{D22~FC!n))F-<PVo@3eYH(8or+o|?t&3^5_bnyKJ^WP^d{#T5XWbfEtHJnWJ^Zx!D#<6peU7~J53PUv&@xr|qjfUQaxgV-|C7$NX=={#9{2-uDpvK6_)EJAhqfpF z(uUb*VCwe$xb5t7!{2p!fB8%6VNt8R(WkT&3x?&$Gul{ud*B9Gqg$YpHF!;We1QjxHMh{tlcI7mh}u6WR3h+5}6h``K&f zwW}>Q4?A@pO}K?6U(jlC-23eU4o)wyp%*dFw8ipp1oko8dQqFC)-TufWOdZ?f%-c2 zzU2q?2{?52Q1ut^`ma5zKFWf3%-JmZo7kncTl5+6J07Oy#}`zttj1u^+>u9D7`UI$ zlC63f=AXBTtYg_4$Up2WO@AJx-=XVO>W$tuHa)_kUhsCY>+R@jA}vhsgJ@=jq3AWt z9S^GHsMqDx6AE&3NpL#dM=|_4wPOry>e0S>x+Ugs;&t&Sq+tdhe zakieU<8=9r3HsGKK5Ktwl3vv_vR_A*r#{xGVogWqjaUg}PRyC}HBOCrje;m0?fVhFe) ziN`-qgoWK*@sALghd7Y%($aJo`E7}GJ|L>p9`Z{n>LiOMC%2$r{c~q>%;gJz<6cro z-Z+3az$wBF0Qf z(D^L!5k1b6H9e$l@G6f~@Z!;ix82Bs_NfQ)9j&7aDA~+TNc?>gcpv8wZjD>AC?lJ2 zH&Gt9i31KcJe+@hBRNNd%5_|2Wu9^{zM@d?+{>r&ruVHh*p`aH_I~uG9-sJ^NA9ry zzZ^ai;&7(v(Br=k9s}Oz0SDS|KN^aB`IAsYXeDBJk(iQ#mEc9bgZrbGwot2(B7g5- zwvaWXM9)7_!6H#$H5FJh?a~6Pz+c)WWagU?T3`xgd@+tUnwzjk6j(&~Ig~-&P9yn- zOPzZnulkpFvhy|X4XFyvpa@qp?C<^in;$=fj`Z%QC9 zK0NNP2+6#du&m{(NHd6>5JwF+nyupd*|Z-Y;>R80Czt$4pV=Wk&$T~y(SusLsp*PB zoK}Q5J=Mpo*>Qn+&1#W3kT)wN@05_dyF&6-hvY3W^LqUDkjx!JG8ctpE)2<>ZD#iG zpJuj1<4M(>5*lB!ZyP9<= z(Ytu=Y!#y58TXf?2w9CN;jof2Xad&~K1F-nlH8=I>n7iT^NW=1rN7_-M0fVm33GkN zf1qZtvr|73h$^&qQ#SYY~v?_+^+W|#mAdL>AS9^dh~ z-ZU;^7q6yF`+OBJqFZcuQD5J)%soeMH&hO++j_xJ1cO-cb{aF5D|syVOCt8@2fXYV zRQ8Y_{Ia7%lqf-$B}4~H@FugAD!m2clg_*|ECZ#vb#NleyG!uw)^haNiEaaj%W z1n|a7^H)-y3Zc&jM@HjW<`a6V8prN`Lhpy`!2SA`^+Y7Ri2&4=5L z0X#Ra&3^QNo4xm>-odjg9paF<;c6ne$`!8G1ze>HS59h-DdegwGLx#8e3@NDh+PWo zg8SOrw7+8Dx_sMq2KKG}IBLLAEEU+a>msiaYM4TW#GFUlEG^9=Z07^F)J1syK`x&{ zxVbyWPQpzlM%|tMEMZ4F@ag`#OY~FxHRou!-GauGC&x85-ax$YjRMQecE9g)u9JMc ze?c2eS4%}e3$sFXcK@yep?o|Ioh3MPO%>(mARfO94qmc0ulD-edc=Kj| z$*rm>$9|H_<9DsFagw~|G`GnkyiwRx5?%!?V`gWU>XDw3kW33iCN~+*50U4E$a6#F z*^q}cfRpm2lI_w`9;nMKjOJHix9;Jz;aX} z79LlPQ0I{EjUjkd2rdu7B_VhLaL6EalaGAJ+@8Sw6R^ZwWZZon zWWc<}I|!GR&L!J(2RNQWxc)rCk-J)jurDY1Vu87zg)F)phl+gRf>sRpPu1{F&I^iq9n$W1HUG0Y6+j}#C_8HJp9L7IQHaG z0gZy8=k5Fr!l;PwK7msx!!BXtqzln%f$5<=f0eMQCA>mlC)qC(Hc@0>Byc0y6bc)9 zCeS~(lZQtUMH!|GBZV^L2ux2C`m;m^H{o=dne3B=4L@CS3YbSRibw$$mbt2g4_ijPit04)t-aFsdY@Y=Mi&W|**{MZx|QAulJJ zB!S&z6EAGs)YK6I)0$wvBK?qk%OAYLPS|+-z7CvGD8mtfY2m8BUKkZnhB|?3sem2A zrjqbx!b?lz$)-}^D8dy2SMo70@LX!qg#yzX3H${ddrB7&lP?rb!czox5gsovJ-+XE z3(TjTRKjJYIW$&W0@HK2{*F>k1xHDHve5*dLVixQ=Xs0B=D0^N^sKMHkuXl62sa3M zH5u&_xRT_%gpHeUwZM6Vs|3y_yh7O1;$r{w&3s~_|HtPhY6_x�`q;CH-tP(EEaO^=RSeU$s40PWetZBkm%O!Xsmvh0FGyu-yo>yr??Cj@T`!J9(xON4`0_u06*zZg658hn7A zuIkGV@KIGf3FDwJ28MWl4OTaH7<(i}sv)+0?AiOuLtdUXx%Jm5oB3}fmiK2${|4u{}RL-1Z;etb@WJAR4c{E#;T z=Pz~-M`xi?oYVu`e+^tJ2P84S@pdIG^1A(62w&{kQ$)Fnqv-Ez;XywxJz$8=C1p)F zIFQ$-8wr<{HqxHGN??9`D;G9SvM&*s4~PXJ^7+EvMK;Z`)KaBInZz`K;b$O$`yAp_ zk2~}E0`;LY8ga2)A@o#x|3>!X3cWA>6mGi`|Kwf6u3V{iy19HWkC+_r>p-W44^he6 z{RK4C#MunjD?;yvy}zQXC=hz$p?CUgyKsA6U}4wu?8WPG-B!(xuEZ^cs`F<=@Ztg) z_EG*KJ8vb~J%=Zl-SdP$P#yECb}`I7;WqJSB3D! zV)Q0P@`$B{}=M?zg^a;pBZaI4WxzZ_|6;Odm;APGH=^;3RMZcuSVLfNBm-KEi?r2mY zaCOBy{lp-a_Y$Tf$G#su?-tT6xE<(nk#+*-P;8IO~UB*>81G9P=jGA#f2z zxLM#z!j%Ho60RWZ!PG*`VxdszRBEBXPQnEOy9wtDoJV+yz(s_|3tUOqEpRR2RDl}_ zy9DNE+8qVvr}dsF!MOP;lfZd|PqpT?DI$Da;7Y=c0@o655V(=>KH%UUj*GY*;4^pN z!F@&Ec*h;*+*g9TJKBs+-k!atH$T=nsSU2blCI)JlZ$&6HJ|e!c93?Xz}bYSi-Hdl z&JlPn;Vd@xWxZQ}Cy4^Ry?_)BVYC7mL)`9v;}bq=i1*K8FTSjI>Grw9%oO?8HMou} zT1VHBktcz9raX2OhW*P!48?JxbFmoCn{9I zNA!hAUTI#@KY;l>;-*NOgoe)?JI-+{E+2;PJO=iG9P>cwuL!Y;53xx$Z9M*h5Tll1 zrX#y)PJt=0QDi^tG8nH_R*raw)AD>{s;6;Wv#638E2E%OGANxtwm)rM#ees?(3}@Bpd_Z(>capwP$B?!E;^u+Tds zEQ`Gs=cK+FtbY{>O(&~9Y*v*%z;ikb#(}2IAy+>`BKGFsX-rM3JaFK^LshJ!O!8Kw zYnO{ z-wly_1?C06CNMAfWr4ZV=LD`LpHDK|dc8L-zFn`!&5Ft7eM*aj{R{de*2G1=o0w;X zB9HJBz@f3<4?c4TE^>p7iv>CV3O%QbISyh(=$~L^yMN<$IdIYG2-{5|C5aL|{HvwE zpuuB!5g7BqBHX@edUHvjbqXl36P?W>whrR0vy_S$gCYVg@{yI}N-Aczz_o<83fxF| zy}(K$IekGeyh)w{4z2kj*7`NQU7xsrMKU=gk^~V+I7RY0%XtmgIZ5PmX=y$DV@TWm zCEIvVIaK(*NIJDD<;UQ2mP_rX3p=i>6m|;5*l?L$D(phzEQGCG>OuSHc>HgW%Qd@!11n1$Mo#aoO&b5Q=FJpatl{O`93%sBA4fZ}O+ zm$!8_VV}Uf-B&4QACwEcm~4{f@Ca5AUO;lY9Hi4(;v0J0H5K3U`ngGeaCV?H^AfuO zGL)S{`uIMVjCC$cJ;w9%7*6$OPrRY`@*KT*CS+(+&W|Ap?a}{$zx0ow0^beKp`^eL zv4e6gZ_j;a6Q0_i<66SMZQ*t0^1I=Qc03+HJ{4T%5z$T|jr^hedFy47!BTO3na+(% zi^$`$WM0d;g!3Ndy`N6FLHzMpPNOs(FX9jSLyM3sb#L%!!2?JFpFLhS*TD;y1i-_s zgACCYkn>Y}cr{#vHw!s;Qb}0eu&Q9E-_-j}K8lwG2HS@AWqBm)#2;FuRaCg~wTQdp zJ$;{W&FeEy;8Rr0O#<&A9L*M1>pc_vxalKYiy4fE&;TK;-=N1wmQ5(YvVd}AxEPzn zj#cY%J*T5-5Ff>jGkF_@CTsN35Oc8H$+~RO69!b&@~FsxKbwk@ro#m0rKJeW8zPC# z+oJdDeh0loEHD^qsU&gT@H)wHeogM8*{&^m7y4?#7CpU3b81MAJTpg%$Uzc+#X|PZ z7QHjRu{?FF-lcQQIo{AtQrQX1VRY^+bsU?$S?|%d9yk~Xj}~w3*{UbBZQ6Zl*VnDT zz;C9ttv-s88VFtH=>L|U;3*-6-23K=&j9f81le5bz$7XPQzzkgfwKum2<#%P2y7?Z za)#UcD14v5`v@Nqcq8F@ffoZ0^4AGwE-7{hoK1MMG$N;!0vD0Ir6)V{mfow!v4J5? zOZ$TCjKo2_Gx*-|_(Lpup&r9-s?o#okkZ^5ENs=_i)x5U`MAH+JYZhFPhejD5rH?7 zO})U23D*g{kMIs)-df~Ot~9C=`aIIF01nPDOGi7gl%IJv>ydpIkP+_=b5ctc6Qq+e zrq49TELQw%!+opz6!zIyJ0U#qb8EW=lf6C z{%v|sbu4Syrn?8%r%;0h?tYOu*7G2Xomww=78>QxX*A~@>;>EPZg^U_Y`Z?Z(+K|V z!3nPHC0Hjo8fyus*nKG^TN00Vq5r&HPxD*}7B4cQQi82i7WtqJheZuThGaN@^Ak_Q zM)Ie1@J%MaiTM1t0|Ptq&_x{dY1ByjUK;c@Ccn}Oz6!iY8jK}Dg=z4i3ckeTrxIUi z@?i$}e3S1*1?HOkgT!ZHvpHTgYw@Y0`j=8Pv0;W5fkwKG_QAylIZli#U;FERN; zNimf zHQ|I^7MMs~mSyU*zlRTyYkFd%#SV;~wQ@@02)N(2q@EWR7lgV!(zQN@E z)aP|3Kaun`CjTJ$^HiCF)6}FDAv_tBnEcFh&=;EgX{tfK$*-gWb4`8->9az3YOz$4 z9{_(If08N4qyS<}ekwJYX7ap=TmA{Qz%!(8GWi2kK!eGT1(ap-cay)=ARkM68OG{Ja$EKVx$)3wkw0i= zQXj>b1s}jfs}OWeYrZ+=V=&Q3&3}L`Un$1Yk@iE`L32uw z_v3+Wf2zrQR+69w*9|g57&UQ>X)rY$yk_!Y#JBtvEMR9C_$HIzg!@ST29qB`e4WYn za)7T1@}5Y(A65kgk(;PS6(;{66;NXGd?qV2`9oyiQWLB|FRD#kIpvE-dHHZlqpiikqDonkf>|0ubEx`4Krk=M@gQ@2g%r*7%DBv2Yr~Xf%CQ3C8 zHc=B*m<~?Upo=l}ODKRsQ=dS`f|j>}Ef7Zja!vhC;99lh=Q1^8br z@FnF|L;#uSqU^^#=mP|B9wYv;06If21MouYnuamRTut3liz}u*ZA{I zek}31CLc!gN|wpbi?rbQpK1!C+rl8pnW*U;RbYx2B;Spgo$|3r$o?&H9}50N{mhBYSdCkIs~{~-^^rHQw^$MAm{#PctEE98Quby=`~Zoh4lHR{s0x&v?&;%mDnK*!Vq!A&W658WKUjg8RKW(5UqUTX=QpqaSCXK{H1NlQuQK^W z(pQ-LL~>XX!cz?kO`f-CzR91Yy(HJhJ6_{%Bekvfzf+yai02JE$=EW4r}S{s5nNOg@3~=bJn~ z7&W~g+-<1^JpKk#(2HtRXY!&;Og@vEtjgrKP>WQA@H`-s-@^kk`P0+_`6iEJ3y%M} zrXZS{EX(9i6Q64G2l!rK@&m|WjL9$IgVN*&@Gf~TSmUu2V3Wx&37-T(;fFzkiIk!4 zKyWwd)eU^o&%r)D-4%RHfEVZWcR=QA_Ts;(rIE$JSfpY}XWu1i_NdXMsuZfJLDgMf z=wUX}yNoe;ex{*uUQF5t_+h3g7{E+^a0CVzk?;arn{hW3Xn zlRreGB{hVnfRapp4If=5f0B3&Je5yZjn7a4Ek6WXU?LebnS3G*xBORvH8@0vom`Vw zDS#}K=lQG5{7cAxlBwTA6)5?^oV59*s+k63c?*~hiurh78w_9x>9b5duVJ03-$E5g zGW7%a3}ot~sfDy3%t-z)ul3eIINQF$tUcL~>YX>J!Mm#^h)68OG%ACceVt zi>U=mJf=V#`At5I9Oj#RBGo9@e}=lS!sHVWkjGzQ3b=zplV8bOz~pz* zl$LAqyoOmO&rfCQ{u`V(_{m$1$wyO#s!V=j3{Bb7p&h6fB`8(o8;#9JcHZ)~FZtX;TQ#yTs&G3b4-P z@1}_@cW*HNShBDBD7Y6zduV3U8iRe#YuNH#kPo9#+hp<&lEVg*KS_L@$*-XRYD~Tt z`L7D_;wUo#yPmIcAHTuTdjJ@5m-sFE>noC<9cqCHMTU1e&=H39{X!oX^%7yFnjb~B z00$2+VII8K)h8CnMvevMUfmy}7~$n{(x(uQd(8nofAU1=Um|^!&_5W^D}v|qZ4y4V z5;|Sxej98is)l%@+$59RVKfM^c5ywOni(P-~bA^(A2A>&o_B-L^Am`?Pw@xnF7%Q zCeMdvlF3I?0Wl_@NqohsU<+*_zU4@;1@;i%Wb*v1zQN=()2WH-OaX7A8u0GxFan&v z4$od{#fyXO*-P|(hcP^s;%fu$sEe^v+2$|x_%?2=X6J9i{4Rz-r&EX6S6}MApNq0K zQ}Ud+7mt(T_pPLRCEYCPT1iVKT`1{%NoPoUjihc#`$_7Q)Fvq}j5c@kay?2L0Th>{ z>5`6<^m<8WOS(|f=OtY&X|<#uNqR)m69uAz$~}TcN!o)`tPD<*f{~KWkhDP3CnQ}V zX|<%gC9RkA7fH7-7X=-b1%E1Ot)yEeT}u?@D-}|(NYZ;Goi6EkNl(Zcxh0R6;PTeY zku*)xu97+={o{FI_pPKKNxB)7%2&#zV4VFKMZypGq44ps<@F>1s(2OWN@v zp`Rw{YDs+$d4!_t!_tAIb&{qm6!N)}9+cGah>(wyv{cgllD1hS^phlgLDKIfO_Ajm zcqG^@=_yGwiiCrOlJ1uDjHCmLg}y-2t&;vN>4-;#zDUyjlEyzKhDee81!uOS)OoPl?h@cUTI1k~T}4D+92} z0AnQWDrvH$-^zk^OFCcX*CY)D+EMC9O24O|=QHhWDX5fmu{8Wh@&=W@R96_Egn;OC9WzgY0u}*mru~3^mbv+i=@#E8eYsz-@bAWb+n_8><18MoH_}**Jf> zJY~I*7riO$_q{Io`f661X}i;NxqYC1<@XD_6_V;u;7h$qmE@~KHloE%8!pb_dJIvUP4BRV}hj*&woo=m0l^a_#kF;gxJ4+L{+lPJu|4vn#05n4w3t88gAFVF7U zd3kIyh8iIcxV66}?POCpUz7Y0jfY{Eb#${WSJ^i7b_ZHang!idUtXN|(QMnD5hIeF zbMLzA_Is~Hr|@60^VY%#ZZ4b`5Zt)vCg*j9Gw&(9HQ!ly&&*qHy*I;o$Gm%Q5qj2c zvh6nNR7LSVGTHV(=bH?7=Xu1^Xu@ZKl#aV?O2_qhy$gN;9o|Zz;JQUw0NsMibdh9; zp}P#aWtZt3-n$EJKlkgjcdxFzkMs%B0i>fyO-Lt@{$lsNVjC2;46qKKHnT0S*gRO@ zJD|$;W@O4NMd?>~>w?0h1xk+hw<_CPmc+TwL$)A)X5malaZNRp>4;A7Fv72d?b%>! z+bd>{!DH?>k4%%W6c*-?#fQOM$grMUQQYkO2HTBlrFZH^+qNNL^=mCkrX{0!J&XI^ z_LYY|vFV=1w^6HACWxice5{5@BeHQmtdMxOpbe)^5bk4s;>6|)C z>8wsu;+kU{+tx?dw#H&!cb=}e&)bye(8}o(0A57ejMOo_`fWuiwu~flOi!2Wf+xOz zQdj!5^(@wv&zmz;rPwxN0Prj_+hffjlBsc0Y#COLPYo2@>9|=}ESk;!3fx+vi|XLu zKz#CGn=;w1owFs|n{2&o+KGtqj{Q-)+KjeF4UB1Qx4wN|yu0Hei;`@4U-{5#>#d|& zl!SqiN>bq#cbZHg-qn}tZ79TeBV${!K1_0H)_bftGKn%F(Cdc8%dTvq=gK6yCSLd5-!Whc}F zNnI|~6Oh@s%5f;YO+T=Y8ks!#-v&@s4hjTDA>GPHEv-0O1Eio(hQ|HlFJcU4o6XU zs7j(Gqkg4DDb_NGD<+P;?6)P%-1W4sBsacbQBd7-RJZXqzWq{bg!vlln33ecov15~ zE5b>WXc}Av|`8L+7FfM+)wh^L>Dgs4SOVM=+WMOlZm?5GIp5}pSYrnuKwl*vf23Fnb>0o(bj zt;6s}$WI~dhkIVBP@d;+rQ{&Uxkv$ZkWuCzlcq5Q3FO6wL)3C|B#^i(^Sr$e_)_-=o> zz|71J9Jh5zP_|eU`rL7&j3vmku-|MQ!cz^j@NjIVuztVU#)Ov;Uxv*Zw&*w8$S(E7 zAHwDYlHF18EGE;JY4a&<&am%(v-L{tXg8F-=oVLZfbmEU$N1-K8lig@P3iIjXkla+ zRRNoh*i0*b&!V`WN+&*x{dL0DCn^ONt|8c5iDYr)v6SC!@ljJqIun~YTw27Y{BCnP zmVvpATrUTBmp$>jty`=8FM9!ehZaEm6QsD#159%mO8amp=H6p^MlC!0r)`2-&c?Rb=ERm?uqZDh?cXbB z4dU5*Ew*mG&LJ0`o>g3WYeRVusVi@(Vq+LpW~RYU6cQ~X3R(1Dw(Ic_>fFCZq4knB8Kx9Hb_3O)^6 zKd=$Uoque-!Vg04I)=^P?DKzYliH-WF_bSHIExw$&_5ohf8MlHHm~NSQC!?F_Ug(L zMBR>ImFU3nw3&|0qiz;?-u6XQ^C}#z`evl$Ta{z3jOJCW`MfQoYZm-Wwccc%X}u1} z64xeulc8iLE}ycLCAPlQYq(>_ghM{E*Qz`nZ&)Ou`F} zuCpq~S+r`jjY{u;s%K(z6_Ul#%u-du>6i~DgIe!CfJfOZ)fgGQ43ONWTyItGMOwzT zsYaJB$06n&{1-q(N9r;6Ggif&mRyBq8OHupjUgFXkZ+~)pa}p)NKp|q+101gwss(G zi(6$7$+Qn6;+{|2@>D0AZ7~LhZ$=i^Hf-KuYb{2Y~~|rjshyIh)vau4zY_#^-NGzPO3__L^HZX z?IP8C*z8BLMC7m?n&FCVA?bN+!n%;JT4YGgVSi~xx2R-DT!XP0iezy#GM8=)3tvFe zVr&+(J9P|%Wq?#YWr0bG$-@x#?_ATkOVt)G8<_# zdURL_nd@#iOhit~sa91K!1F#vv zIvYk>_*~-e#%2+lVHg?Vn~A5s+{V@#M(@}r@Ou%o>oN6lteO^U(VM+N3w{nY?|HZ7rjv0<&;^KIYb8&g1K51ab`x(;lJ?Q; zLYR?(Cn1M~8(q40gg8;bp50=@DZN$s14+nm_8Q>XBjHAW%*(G+j`ENk&8w|S{>vDe zT&5^No}COgdbZKJiv~$qYgNV}Y28`xR%q8@T#iDU45c3O*jKE|FgCB1(IHx>lo0Xq zR!0B68>Oe%byg(}N$|L8hXIm6wlZFf=BIk-4fjT?G8HL>y%b?|>vFIM zE`3z==`ny)NMe#GN?W!8d%-I9U4${Zjn-2HUhtY#iQJ69d$P1hqjz++luv!bs;ouI zW_L##H$>M+amf~|!jNj%p-7{DR7V$@ygN3@NS5#%7Vj`z(dl4llr(O)DxJMnC7n%l zp!f5oxB#M8kn&lX!{{GfDaF-0tjha4tx6^P#9?#`*LuNqBsMYZj03%!Mf?P8a#==e zW5nQmKt4QiK3egKRq61lRarnX6nr`Fgq~#i?Df`0T(I48>aEHQq!jjLYXstxxs?M} zB^k-bVxx?1y}39>Q(~Izirx^W)PG@B?r5ME6NQ;Pn-ztzU)Wp7i@vfduOSt(HE^RA zviG8lTM~!$K{ZBWb0d;Hg7)j2v~$!k5gW1TxRH&GHoVbI&{9pJey}P-k(yX^8{>-T zq+}t^X|gJhAtkY?Z7`(fOL4)ER^=h2`RwsFMmI+-#B1Ti^&!9!w!Mup&Jo{N9;y=o zT+GoH2b&Z?Dy;TbtMV063Y*y$J+Oi-DC-*bR9jktkGq7ZhujJid9o`kT_3QI{9HrcrH3T)uuG+nsOQ` zu)76$b}ZKDHl&4I&_z=|E}9VbOEyhuk55@EDZ=&Td=c~{YhlCNp_L0^=6VF1a&}ug zV_f*Y0Dpk(ZfEq1ZQ^b)li+w*8>K1VBQ-HK4&zv;&~HI;uQ;513>zQ{Zfv6|ZQE*? zcV@y`9mXDnHoOK}J^cug6I6yO`cKcYLpZLT0QE?AN6sdk zq!%2;S>%jInYV+HIk*XOUL&`r{0E8nXiZhLk>aE@ISnl^7#lYdPFLWdUp?#F(dZLC zpH%l@lgMUuG*+X{)K11yN7WTL)4-v`^*X?3?1fIoj7d@H^5~xca0^m&rlb!xGPN8ARz zbhgG~K-DQay69FmKhel{_@G1Q;5HG!DfVrmk=8ePn4#Q@F_S(7V9IbqxeMufer>cy z!%cjCO-Llu$S7x-U5!}P#ct?oJZ$T=6>U0=9qeih$ET~?bu-dh=OHgHWauWFsztuV zZtP}!7?(Z*ot=rzHAq@Gzpb6o{2CjYWb}=m0vQdWf@d|Q0%;0+FbPMCjg)5#Han0k z$ivnp8C}8;lDO9qn{teOnq+isrCllc$Sc{|BqOnX3JHc_GZx9_XnqUL)VT(m6qeQ< zXTZ4-Q*q5qQ?6Wrxs*NF9q0Y^Qe6F_rbMp7uE9=rH##_y+_(m%_Ua3e%G&oZW=)t2 zNFM4d;bD!Y5Kj-l+6G!u=qOMPK5rW~mRFU8aNLW+>>NJOR>1EWLOl2Md$?yv`mGj~ zsk+gY9qD1jL?48R{FYZ~%EWb=a*(M#jks7L##m~whp77YL}TP-qOS9>xu0F%6X%i} z*)u(jL1Swm;pdWtt(BBFH04$#A;WYZ%F7EF=bNYqQs4q6$g@b7(Jdx>q?`&S0!%@& zU>s+;jMV7BO}?mY8m`4OWj|ZuGWx{qhYcTOUjiKA8LHVnm*MJSABB4aDw;DIz=b4E z`ts6NQ4eiqt$P`Rho?fG7-3T)8d@oK94fWc7^U~y2oWiZbZDc?c?CL>rLy8)IJi_u zv+Dn7%72k6*v?+Ypy>TlT)zwR-#ZlV`Cgb)qgb!r7;#Zq!gtYsHDxnW6r0@J7=r>PCa1hlK? zL-LM3pS{+{$n2|(fv+%Z3X!_X8z#$O!HeIcOOKyI^7p4KA=&7k(A698D7CBSK=Oz- zhs{hjuDWU$d3+C>gsTks_fciqGFZ$icn`-#KFzMNjHrR+S(2>5-xHX5Rc*u(h&ox1 zW1H4)2m3wQXs3>0w!TJMR1RFZrebq565V$k-`9wbT0qibY@X!Oa#q+Er|ZkWP|rI* z(3GJ_%h>CEjV_Kxh|_<=CN>+_6YOwbqkp?3!0-r19}tUL)U*TtPpL(VS(koB_wXqY z_L_ywZS0zUM%VC?0RI$wsGl(@dKY*qrh31oyoa=l9qosCAZje;UK+Rw0IAH@-?+z7 z4%n6MV5|gqgFVq7C#gpOT|Z*;2NGtwRqRlIoIXX3gE#@39?X_vWW-JZa*AI4BYP{wm>3>^HT)%F(~mg@7$Y3{fNL>D zxb6U`VABQ|rLE5a&Z6-2@rDvPp8Yw%=m1{rQgGZddw45tCwv!4bTtGlnd26GJMTnDfV$?hnB2YL2jGmZX; zRIMYvW1CWqK}jvpK18PH0oqapV!XH!=V>CcKyKse(<`@q+iM&h(c$|$)H)hAy z0zOK19|C-XWOKytVeh0H{jX52!~PP9O-}+y5#dF9aN3(u-c_f6N8hk0d3kf+;D74c zZ1(=Jz>Ua!)@_I}AZb3hSKv4OL4Y+#Talu;gW3$|Zk*!}tY!;_7@h2!pg_J8?4=>b zp!QART)$y+9?9lN*^BDUpiKe$Wr)!}JU&+*6%&~w!|2^T349{TY3!ye|4Gsn!K0FO z9ZVU!DFe5XHpA4l4VztTZH94;+Q?337;%Zs(!;QRx-uFmz()a-tdaE^Y7Fg_Gnop) zxNd5VTNe(cAVpU;AqhFoNdi188*0oM%r9l=pgC7nI$njT52=~E!1{&Dcm+Jknpm%4 zh9`R2^`c6(V{!d8PRI1MbC}UVUB#})w_PGXLUNo% zjWF7^It9#6OVp|C_Yv5kv)Rm%I4>z`W7F`}^x;<;SAkaD~;+FqDFuf<_T;!)}eb(O_Nfx5b9pq1a(6YurXom~%R=DQ^sB=$M5J zmD3FNoyXSB4*BKI=1w=BNsMJBnaJA+Uqa7=O+iFq>C-ML!&!_d<3}3FR{IQteYU_B zs|Rz8vNqnxo$)C1P$-YG79K)MJvY)wvF3yr`a}fzqflMnrM8<#A*!PPqehCz!wagO z!3&+91-~n9GT56>pr)5LTV0kh#X99?1XN^e=cG1A3jJYPS594;hx>Nl%zaZUT6Wyb zc8@dS>^EQ1AO)ppkowU^l$ytmjW*gw?we&OIeEAMLgHO}d#k(}>}vR>&obD{=(tFG zK6dk&AvPUY%@|`rWaBOWk{3M>|5L6qk|K*PalGX!qeG+%Wte4gQ3_m}B8;pK!Qxls z8SM9^wsuJ<Yz&8@TSySpD|uX> zG}drMrl7n_{Km1y1vX7zfl!K)P zD7e6s9fu4zsg!*o4wZ64sr*}4QbJ@-$n22q2$6Ms1``Ej?hsiDWbuD{bj5B)qm)+| zO5;Del6R+Ba5ZGmjU$a9>Cv3)%VcMu-1BX7j(tZ2tF{jq<<8Z2tF{&Ho;=5l5x}J!bR2$87$8ddw#A zdgI|(HIiLfU<}i4zQ#Sx`{M1!Yj(92mw4YRH2Q>XUu4)jsw=!M;} z)LXgTqP&O4!QBeV1%2Q#i&CS)Kj^V?i_+18%LCAlS6Y-QR$$NuECJr7;e6Cw4(#FU zf`?!&-#agl?V4^p@WKp#DQ5n$O)wp*9 zc^+sn5-r#(2Ys^AqEvhj47#ook<g3Q>$g~>y08$R(B>F2-J}^-gtBVVPLsucwYUIGG zW1=r2Rl$bnHl$i$qWh8Rf$Krf62I5xQG!d3p`fM6-yt;v6UFmrirqlhgAUs&8pREI z1FqQPA*U<%Wk^)Va?tGUSWpXj4(Oa6!lnT9$+rbA2i>qs;A+qhc4K&uqx#(z<>y*~ zn?Y}T*P>KIUI6;!dqQ3b+5t=Q&OuH~^F|?2!Fixt_G2vCarp@P9TLeKL9hMHqU?Y? z2lR@1_zA<111&_No-gtMXa}%B{6m|P0{SUZ7L4jaU&cSG^MNZtr!~MSa2_Z=v!X2f z20aOSGnNM*BspkcDRJnMVOlyo2t^~03uzQ5!+yFY$@zxU*lT#~zMG{5ImY52#a zl5ueXsl&xe(uk`M8YjtD4AT#%JOhqB$}Yz``7lDXjyU>cC$sPZ-iec3@8bRsIn=vw zUV%S4#W@L&zyqf{nPxl=+gq7B)0J-$ZJo@}k2#9*5L`v{pem#K|K&b0{Nq=g!&s+d zmsg$MgQPOuO7a7|F5Tt{ko){p>9`>RUnP3b8h9_Y(@hsL4qr+4nGh%G7+jY@+vXyU zVi;n2%UoPMNUHHTe5@P)*(#Hbfa9n5Oa|^1QoqH&cr*4@h=0_v@D;q~R-ZY7d;L^g zJ=J~%JkTZlo(}&)vhWJnPWm|m-?n<%6B+Vaskqvy*WB(iYjAN0slr2W#WbE0FNM2F zR&QPt{M2AUuIlb4KnzM$X(0rfiMirw0S0&?4lH48P@Sp1$X4hMTx`r;Z%zF#y9FqcPZ9Sh? zAww0v;AI!lf5WrkL#`LYX4ez2;QrJ)VOZ;W3=VrBH6DUxu2;aUU%HP8m$)8 z?UO3Q^292|S`YH3;^GWa=}g(jHr6r}dx-tuSG+=whio{G=%dPqdkFOo6N48m;&{Nb z;h{%-CXC17R-0|ZE8z6S92xpGmu%ad_x4K7Ks@nD1)youz#6EQDa! z-}3?E8E_`i`LYH+N58d~bJ5?~UR7f|R$x_)P5%R*1mj|FG7%RCky*GnmfVYbwOCyB z*tKLSF76_0@EBB2R)0vnzAWSPX8V`{Pw)Y;AdVvRM3S70pK{*(yVW;G6 zxQ}${%XdKYo#A z>~(swxwzO!CgS2TaxX46lVaTK(BgD!Z4+3}ld~XRLTYgFauUbIt4KTkP1Ba2OBs8e zWaRL~u#V*7UgH*5^Y-yFHV7A=C3A7{Rq}9-Z6#$V3#+(6e3NLU7*y$Y&6(ggMqRAr>xlnKn&WT`>4%Fql3{p0e9Gn@d96Y76dbw<=LT^&3FG2u z62ZNyZ;<&7jO`#x85ehxQalE`ZT6W8d@!6xl7A0js_M(H)>M8!E$1|Jm1Vv!$=t#d zvXBkc{hihpOfuO4W?Zb@$_C-$K~jW^Uy>!xy8YIm>q{B(I>NZR!f%l}T>LLNf{VVF zm>7X)z&(|mF`cgOT7zu0ht(P$OG3C|A&p_I{hsW&p4LZJ+bnyVj+)+Ql7P#A+9pzr#s_aq%Tmii@?R0*}E7 zsuOd<@T$dpPO2C`Pik04+)5g?KKzvEv++8|jMF`~&7TgiyR#r}CcUnSE zTgf)^)I;pzjEf6MA?`JhbzjDoy~pu~i>0It7awfo9n$(RN*Yf0OrQ_pH=55dLz$tk=TF8G4;H(mp0e97rV|4s_q&T`)SHX8(I ze9e>L9b43DQ@4`kjEg~jjNgQ3z+E=~sA3@o8|g>u52V+VW?cR0Cen_JUy+PKe0PMs zd{okKu@4!Ki~We!=~$&!rTP}X--H<#=aORFmOMgMu^=uXRk-*&qLrfXSb*yBN5TK= zV5^JGuZE_Mb;L(VGwv0u@s6cym9e*yUW2V9U$y+U8O#D=YDox>!P_sO1dfMcQ@Y=j z;R#qtzdHFX;9Sp|an-PQ(E4u0#W*oTco*S$nJE`*NEYMbUUz(NrtLR}Sjg2KV6vr+ zi)~~gE_Uxun+_L;ks@5Y+Z~UF&=@3C~L35y@EF0vCyqzx4D>i%jO0N|A!ZI z1{W_TX+vqD!4co$?ZU+yh{nDCHm-X2x=Z|KI4)L`X}EZZL~!v4iQ?i(qID9`o^fgF za}C2E(f-yB=rzGvNsaL7m-$TvE>@9RT--+*aPhc1?)AhOS6_U7Umg<|i%8bB6!zc> z((hXO3XN9xi^nrq(%)|!62`@Q2e9?de;fI_Uc!*qD96<-&&%b2!Nr_`eEfI_?kDZe z_userPB_buS1ljLZ@NRjshz8SzK!HDE*>OvanU!7-5M8%lBLdzJe*z0P-2ANTsx9i z&0h+yP0qNQ=I6@kVvHmh7f+M4@9?j6@E6zdapK}1$Y5MtMkeCoYBCEig&$qdn}D0q z94SwQ*cROY&sEXI>@n;+jEm2aF8Z&AFgA|EmyWq;=drWl#jyG&zgaSzj}~s9%zAP- zZ6+DPQ3v0>o3{~!yXx{vb;slxMNB*N(c7jJx$ zoqQDI@F!1E?;p)LOg5l#v4IrgVk>zVPr%O0IhgPan6-kV7te-0R38F<9%nWN&g3e@w~vn{yzIEmshIAVh)T+BOS z^}Vf%A+HyWs~`OeX~o4E8+qz6%iOC0ZvAtDk3!oD)2>O_j)Gm$TXy zb~FAnK*xr(n$xuk>xe#D(v7&-i?r&#@LYRZTtUtRP)EaV39K2m~5;J9s^GoA9I>{*oz#kaHf{FS{H7n9ZJaa>gcKUb3$XTHW> z%ec6J6yf4JvIO_~(YSijw^Z}z7Z>-EYTPSJ_M-$M(e{7@_z)AT#GNyV|}=hynuT>U|fA*U&cNT zVitTboy46f$E}{T6AZ-;aArQpd2<3A3^z3L0`Lm>`TIN%ZVq$2eZXk~kHN}g{L#FL z?SjKka8ANQ@INPcV{c~tCcg=u()6gm9p^ZxV5s|Pzqypu;@R-=kJ!=hD7>+i9djb5 z667X@7Wl9b`*V_srA#|2&r&wkEl;EaiLG{$bRO#BQ}5B|e0m`3sJVNlZ6} z{Yc1J#Hw~aLleH_O;_*;Z1|ep3y;Hnowzy*9)smR`kRy43iwB=0sK)BfDs(_h@iz~@2 zjl)gucm=#|0NcZO7~YY~`Y+9}c2D%7XX|$;C_I zJrq($;a)KnS7G(hA-q$#xRxx$#SJ9t+;Nf*t(2j(p#gIfslxMz1!9N5qJ~HEzTD31fQw0QJPOy3;=XtVY`LCI#1ru58+aT%AHEPud1y?)HjBry z?L27lcqSeEfH#DV@LIBbLG9R}RkL<2Nn?F+WFAk9iz`VkUJ75KPOHcCYPGoPwc~CM zm{MGvPO5)+0bkLO=SjV@sEMhDQD;Sy)wk<%wzYmzz+5?*)ton*m|@-SeAZ+=%3Qk# zo2|Y>R%I}K{x;??ObeI-in7^B@-X~)E5NUs&WmKcKU_m%&c0?IKH{`+Z`!e)TdYAj zm8=lIBVcmwWF>qsEF$%IF^rRD=Z+Q*#5BsDx^UM{l7T1SCnU&jN&BO2EgtDbjVm!G=$_o;DR zY3c#jby2AUuIutqg9-Pw%|fIswP18vs83wib(>BTJ%O(B^j#v?^_u3ou4^!je3CuS z&s+ppO_t-jY>uv)qxD5yJV!2m;kr0r8Pz}Cpv&jznmKY^5a;~mDG$R%uImadxO4l_@Qj;XLzGg^XN#v7Yk?X~9qwAXAxPxe&o?B>O5;?ONZKGL? zTF|7$d8BzH-{asjB!O$1;(nraG#Bx15;+)5QqvZ-^NKr&*6IIZz)T@>O)s25DBW;cjMDzQ!lIC80;kxEpOH#+=VI z7maJqi>AEDkHf(0Dc1xS&2Q28Eck2J?Hc4mcOiRc!2Ez{CCwnw1QPjA;ghcS+QkDA zjTgf8H-e{6M1bAI=4 ztKZdiTVq=rw^HgY4w_sL+uXQ0zWLPV{^g