mirror of
https://github.com/winterknife/EVENSTAR
synced 2026-06-21 14:13:51 +00:00
winterknife
86 lines
3.3 KiB
JSON
86 lines
3.3 KiB
JSON
{
|
|
"header": {
|
|
"activity_id": "{00000000-0000-0000-0000-000000000000}",
|
|
"event_flags": 576,
|
|
"event_id": 22,
|
|
"event_name": "",
|
|
"event_opcode": 0,
|
|
"event_version": 3,
|
|
"process_id": 4,
|
|
"provider_name": "Microsoft-Windows-Threat-Intelligence",
|
|
"task_name": "KERNEL_THREATINT_TASK_PROTECTVM",
|
|
"thread_id": 6388,
|
|
"timestamp": "2026-05-05 16:00:49Z",
|
|
"trace_name": "TI-Trace"
|
|
},
|
|
"properties": {
|
|
"BaseAddress": "0x2865F380000",
|
|
"CallingProcessCreateTime": "2026-05-03 19:35:28Z",
|
|
"CallingProcessId": 4,
|
|
"CallingProcessProtection": 114,
|
|
"CallingProcessSectionSignatureLevel": 28,
|
|
"CallingProcessSignatureLevel": 30,
|
|
"CallingProcessStartKey": 10133099161583617,
|
|
"CallingThreadCreateTime": "2026-05-05 15:40:13Z",
|
|
"CallingThreadId": 6388,
|
|
"FullRegionSize": 4096,
|
|
"LastProtectionMask": 4,
|
|
"OriginalProcessCreateTime": "2026-05-03 19:35:28Z",
|
|
"OriginalProcessId": 4,
|
|
"OriginalProcessProtection": 114,
|
|
"OriginalProcessSectionSignatureLevel": 28,
|
|
"OriginalProcessSignatureLevel": 30,
|
|
"OriginalProcessStartKey": 10133099161583617,
|
|
"ProtectionMask": 32,
|
|
"RegionSize": 4096,
|
|
"TargetAddress": "0x2865F380000",
|
|
"TargetProcessCreateTime": "2026-05-03 19:35:57Z",
|
|
"TargetProcessId": 1052,
|
|
"TargetProcessProtection": 0,
|
|
"TargetProcessSectionSignatureLevel": 0,
|
|
"TargetProcessSignatureLevel": 0,
|
|
"TargetProcessStartKey": 10133099161583637,
|
|
"VaVadAllocationBase": "0x2865F380000",
|
|
"VaVadAllocationProtect": 4,
|
|
"VaVadCommitSize": "0x1000",
|
|
"VaVadMmfName": "",
|
|
"VaVadQueryResult": 0,
|
|
"VaVadRegionSize": "0x1000",
|
|
"VaVadRegionType": 131072
|
|
},
|
|
"property_types": {
|
|
"BaseAddress": "POINTER",
|
|
"CallingProcessCreateTime": "FILETIME",
|
|
"CallingProcessId": "UINT32",
|
|
"CallingProcessProtection": "UINT8",
|
|
"CallingProcessSectionSignatureLevel": "UINT8",
|
|
"CallingProcessSignatureLevel": "UINT8",
|
|
"CallingProcessStartKey": "UINT64",
|
|
"CallingThreadCreateTime": "FILETIME",
|
|
"CallingThreadId": "UINT32",
|
|
"FullRegionSize": "UINT64",
|
|
"LastProtectionMask": "UINT32",
|
|
"OriginalProcessCreateTime": "FILETIME",
|
|
"OriginalProcessId": "UINT32",
|
|
"OriginalProcessProtection": "UINT8",
|
|
"OriginalProcessSectionSignatureLevel": "UINT8",
|
|
"OriginalProcessSignatureLevel": "UINT8",
|
|
"OriginalProcessStartKey": "UINT64",
|
|
"ProtectionMask": "UINT32",
|
|
"RegionSize": "UINT64",
|
|
"TargetAddress": "POINTER",
|
|
"TargetProcessCreateTime": "FILETIME",
|
|
"TargetProcessId": "UINT32",
|
|
"TargetProcessProtection": "UINT8",
|
|
"TargetProcessSectionSignatureLevel": "UINT8",
|
|
"TargetProcessSignatureLevel": "UINT8",
|
|
"TargetProcessStartKey": "UINT64",
|
|
"VaVadAllocationBase": "POINTER",
|
|
"VaVadAllocationProtect": "UINT32",
|
|
"VaVadCommitSize": "POINTER",
|
|
"VaVadMmfName": "STRINGW",
|
|
"VaVadQueryResult": "UINT32",
|
|
"VaVadRegionSize": "POINTER",
|
|
"VaVadRegionType": "UINT32"
|
|
}
|
|
} |