mirror of
https://github.com/winterknife/EVENSTAR
synced 2026-06-21 14:13:51 +00:00
winterknife
68 lines
2.7 KiB
JSON
68 lines
2.7 KiB
JSON
{
|
|
"header": {
|
|
"activity_id": "{00000000-0000-0000-0000-000000000000}",
|
|
"event_flags": 576,
|
|
"event_id": 21,
|
|
"event_name": "",
|
|
"event_opcode": 0,
|
|
"event_version": 1,
|
|
"process_id": 4,
|
|
"provider_name": "Microsoft-Windows-Threat-Intelligence",
|
|
"task_name": "KERNEL_THREATINT_TASK_ALLOCVM",
|
|
"thread_id": 4684,
|
|
"timestamp": "2026-04-28 09:11:50Z",
|
|
"trace_name": "TI-Trace"
|
|
},
|
|
"properties": {
|
|
"AllocationType": 12288,
|
|
"BaseAddress": "0x23626550000",
|
|
"CallingProcessCreateTime": "2025-05-13 15:53:10Z",
|
|
"CallingProcessId": 744,
|
|
"CallingProcessProtection": 0,
|
|
"CallingProcessSectionSignatureLevel": 0,
|
|
"CallingProcessSignatureLevel": 0,
|
|
"CallingProcessStartKey": 12947848928690190,
|
|
"CallingThreadCreateTime": "2025-05-13 15:53:39Z",
|
|
"CallingThreadId": 4684,
|
|
"OriginalProcessCreateTime": "2025-05-13 15:52:42Z",
|
|
"OriginalProcessId": 4,
|
|
"OriginalProcessProtection": 114,
|
|
"OriginalProcessSectionSignatureLevel": 28,
|
|
"OriginalProcessSignatureLevel": 30,
|
|
"OriginalProcessStartKey": 12947848928690177,
|
|
"ProtectionMask": 64,
|
|
"RegionSize": "0x3",
|
|
"TargetProcessCreateTime": "2025-05-13 15:53:10Z",
|
|
"TargetProcessId": 744,
|
|
"TargetProcessProtection": 0,
|
|
"TargetProcessSectionSignatureLevel": 0,
|
|
"TargetProcessSignatureLevel": 0,
|
|
"TargetProcessStartKey": 12947848928690190
|
|
},
|
|
"property_types": {
|
|
"AllocationType": "UINT32",
|
|
"BaseAddress": "POINTER",
|
|
"CallingProcessCreateTime": "FILETIME",
|
|
"CallingProcessId": "UINT32",
|
|
"CallingProcessProtection": "UINT8",
|
|
"CallingProcessSectionSignatureLevel": "UINT8",
|
|
"CallingProcessSignatureLevel": "UINT8",
|
|
"CallingProcessStartKey": "UINT64",
|
|
"CallingThreadCreateTime": "FILETIME",
|
|
"CallingThreadId": "UINT32",
|
|
"OriginalProcessCreateTime": "FILETIME",
|
|
"OriginalProcessId": "UINT32",
|
|
"OriginalProcessProtection": "UINT8",
|
|
"OriginalProcessSectionSignatureLevel": "UINT8",
|
|
"OriginalProcessSignatureLevel": "UINT8",
|
|
"OriginalProcessStartKey": "UINT64",
|
|
"ProtectionMask": "UINT32",
|
|
"RegionSize": "POINTER",
|
|
"TargetProcessCreateTime": "FILETIME",
|
|
"TargetProcessId": "UINT32",
|
|
"TargetProcessProtection": "UINT8",
|
|
"TargetProcessSectionSignatureLevel": "UINT8",
|
|
"TargetProcessSignatureLevel": "UINT8",
|
|
"TargetProcessStartKey": "UINT64"
|
|
}
|
|
} |