[ { "date": "2026-06-29-00-56-13", "do_etw": true, "do_etwti": true, "do_hook": false, "do_hook_callstack": true, "do_kernel": true, "func": "init", "targets": [ "redtest" ], "trace_id": 41, "type": "meta", "version": "1.0" }, { "etw_provider_name": null, "event": "process_modules", "id": 1, "modules": [ { "base": 140701268443136, "name": "MsMpEng.exe", "size": 282624 }, { "base": 140733318627328, "name": "ntdll.dll", "size": 2195456 }, { "base": 140733289136128, "name": "KERNEL32.DLL", "size": 802816 }, { "base": 140733274783744, "name": "KERNELBASE.dll", "size": 4009984 }, { "base": 140733280026624, "name": "CRYPT32.dll", "size": 1474560 }, { "base": 140733272948736, "name": "WINTRUST.dll", "size": 507904 }, { "base": 140733299425280, "name": "ADVAPI32.dll", "size": 724992 }, { "base": 140733269409792, "name": "ucrtbase.dll", "size": 1118208 }, { "base": 140733317644288, "name": "msvcrt.dll", "size": 684032 }, { "base": 140733297328128, "name": "RPCRT4.dll", "size": 1146880 }, { "base": 140733307879424, "name": "sechost.dll", "size": 688128 }, { "base": 140733279633408, "name": "bcrypt.dll", "size": 163840 }, { "base": 140733260431360, "name": "MSASN1.dll", "size": 73728 }, { "base": 140733095804928, "name": "version.dll", "size": 40960 }, { "base": 140733085319168, "name": "mpsvc.dll", "size": 6500352 }, { "base": 140733083418624, "name": "MpClient.dll", "size": 1892352 }, { "base": 140733081321472, "name": "urlmon.dll", "size": 2052096 }, { "base": 140733258596352, "name": "USERENV.dll", "size": 163840 }, { "base": 140733081190400, "name": "MPR.dll", "size": 122880 }, { "base": 140733078306816, "name": "iertutil.dll", "size": 2879488 }, { "base": 140733078110208, "name": "srvcli.dll", "size": 163840 }, { "base": 140733245554688, "name": "netutils.dll", "size": 49152 }, { "base": 140733234806784, "name": "windows.storage.dll", "size": 9543680 }, { "base": 140733302243328, "name": "combase.dll", "size": 3739648 }, { "base": 140733272293376, "name": "msvcp_win.dll", "size": 630784 }, { "base": 140733273473024, "name": "wintypes.dll", "size": 1306624 }, { "base": 140733265674240, "name": "DPAPI.DLL", "size": 40960 }, { "base": 140733254991872, "name": "sspicli.dll", "size": 274432 }, { "base": 140733258203136, "name": "gpapi.dll", "size": 155648 }, { "base": 140733244899328, "name": "SLC.dll", "size": 192512 }, { "base": 140733300211712, "name": "ole32.dll", "size": 1708032 }, { "base": 140733302046720, "name": "GDI32.dll", "size": 167936 }, { "base": 140733294510080, "name": "USER32.dll", "size": 1777664 }, { "base": 140733279830016, "name": "win32u.dll", "size": 155648 }, { "base": 140733271113728, "name": "gdi32full.dll", "size": 1159168 }, { "base": 140733252501504, "name": "kernel.appcore.dll", "size": 98304 }, { "base": 140733253615616, "name": "ntmarta.dll", "size": 212992 }, { "base": 140733270589440, "name": "bcryptPrimitives.dll", "size": 503808 }, { "base": 140733286252544, "name": "clbcatq.dll", "size": 720896 }, { "base": 140733296410624, "name": "oleaut32.dll", "size": 884736 }, { "base": 140733298900992, "name": "ws2_32.dll", "size": 462848 }, { "base": 140732953395200, "name": "MpCommu.dll", "size": 606208 }, { "base": 140733268164608, "name": "powrprof.dll", "size": 315392 }, { "base": 140733268033536, "name": "UMPDC.dll", "size": 77824 }, { "base": 140732952084480, "name": "mprtp.dll", "size": 1265664 }, { "base": 140733053665280, "name": "FLTLIB.DLL", "size": 45056 }, { "base": 140733130604544, "name": "fwpuclnt.dll", "size": 540672 }, { "base": 140733245947904, "name": "firewallapi.dll", "size": 688128 }, { "base": 140733245620224, "name": "fwbase.dll", "size": 286720 }, { "base": 140733250207744, "name": "WTSAPI32.dll", "size": 81920 }, { "base": 140733265739776, "name": "WINSTA.dll", "size": 442368 }, { "base": 140732919971840, "name": "mpengine.dll", "size": 18812928 }, { "base": 140733046259712, "name": "wofutil.dll", "size": 57344 }, { "base": 140733281533952, "name": "SETUPAPI.dll", "size": 4669440 }, { "base": 140733265018880, "name": "DEVOBJ.dll", "size": 180224 }, { "base": 140733265215488, "name": "cfgmgr32.dll", "size": 319488 }, { "base": 140733138534400, "name": "WINHTTP.dll", "size": 1228800 }, { "base": 140732959752192, "name": "wscapi.dll", "size": 286720 }, { "base": 140733095870464, "name": "Tdh.dll", "size": 577536 }, { "base": 140733250338816, "name": "secur32.dll", "size": 49152 }, { "base": 140733308600320, "name": "shell32.dll", "size": 9027584 }, { "base": 140733292412928, "name": "shcore.dll", "size": 1064960 }, { "base": 140733288677376, "name": "SHLWAPI.dll", "size": 430080 }, { "base": 140733268557824, "name": "profapi.dll", "size": 151552 }, { "base": 140732253798400, "name": "amsiproxy.dll", "size": 32768 }, { "base": 140733260038144, "name": "CRYPTSP.dll", "size": 110592 }, { "base": 140733251846144, "name": "rsaenh.dll", "size": 225280 }, { "base": 140733260169216, "name": "CRYPTBASE.dll", "size": 49152 }, { "base": 140733288546304, "name": "imagehlp.dll", "size": 126976 }, { "base": 140733173202944, "name": "netprofm.dll", "size": 491520 }, { "base": 140733128376320, "name": "npmproxy.dll", "size": 98304 }, { "base": 140732562538496, "name": "wscisvif.dll", "size": 53248 }, { "base": 140732562472960, "name": "wscproxystub.dll", "size": 36864 } ], "pid": 1260, "process_name": "MsMpEng.exe", "trace_id": 41, "type": "meta" }, { "as_signature_version": "1.453.335.0", "av_signature_version": "1.453.335.0", "etw_provider_name": null, "event": "defender_platform_info", "id": 2, "install_location": "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.26050.15-0\\", "mpengine_version": "1.1.26050.11", "pid": 1260, "trace_id": 41, "type": "meta" }, { "etw_provider_name": null, "func": "process_create", "id": 3, "krn_pid": 10100, "name": "\\Device\\HarddiskVolume3\\Users\\hacker\\Desktop\\b\\redtest3.exe", "parent_name": "\\Device\\HarddiskVolume3\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", "pid": 3620, "ppid": 10100, "time": 134271933909531040, "trace_id": 41, "type": "kernel" }, { "create": 1, "etw_provider_name": null, "func": "thread_create", "id": 4, "krn_pid": 10100, "pid": 3620, "threadid": 7148, "time": 134271933909531040, "trace_id": 41, "type": "kernel" }, { "etw_provider_name": null, "func": "image_load", "id": 5, "image": "\\Device\\HarddiskVolume3\\Users\\hacker\\Desktop\\b\\redtest3.exe", "krn_pid": 3620, "pid": 3620, "time": 134271933909531040, "trace_id": 41, "type": "kernel" }, { "etw_provider_name": null, "func": "image_load", "id": 6, "image": "\\Device\\HarddiskVolume3\\Windows\\System32\\ntdll.dll", "krn_pid": 3620, "pid": 3620, "time": 134271933909531040, "trace_id": 41, "type": "kernel" }, { "etw_provider_name": null, "func": "image_load", "id": 7, "image": "\\Device\\HarddiskVolume3\\Windows\\System32\\kernel32.dll", "krn_pid": 3620, "pid": 3620, "time": 134271933909531040, "trace_id": 41, "type": "kernel" }, { "etw_provider_name": null, "func": "image_load", "id": 8, "image": "\\Device\\HarddiskVolume3\\Windows\\System32\\KernelBase.dll", "krn_pid": 3620, "pid": 3620, "time": 134271933909531040, "trace_id": 41, "type": "kernel" }, { "etw_provider_name": null, "func": "image_load", "id": 9, "image": "\\Device\\HarddiskVolume3\\Windows\\System32\\apphelp.dll", "krn_pid": 3620, "pid": 3620, "time": 134271933909531040, "trace_id": 41, "type": "kernel" }, { "etw_provider_name": null, "func": "image_load", "id": 10, "image": "\\Device\\HarddiskVolume3\\Windows\\System32\\sechost.dll", "krn_pid": 3620, "pid": 3620, "time": 134271933909687440, "trace_id": 41, "type": "kernel" }, { "etw_provider_name": null, "func": "image_load", "id": 11, "image": "\\Device\\HarddiskVolume3\\Windows\\System32\\bcrypt.dll", "krn_pid": 3620, "pid": 3620, "time": 134271933909687440, "trace_id": 41, "type": "kernel" }, { "create": 1, "etw_provider_name": null, "func": "thread_create", "id": 12, "krn_pid": 3620, "pid": 3620, "threadid": 1268, "time": 134271933909687440, "trace_id": 41, "type": "kernel" }, { "create": 1, "etw_provider_name": null, "func": "thread_create", "id": 13, "krn_pid": 3620, "pid": 3620, "threadid": 5232, "time": 134271933909687440, "trace_id": 41, "type": "kernel" }, { "etw_provider_name": null, "func": "image_load", "id": 14, "image": "\\Device\\HarddiskVolume3\\Windows\\System32\\ApiSetHost.AppExecutionAlias.dll", "krn_pid": 3620, "pid": 3620, "time": 134271933909687440, "trace_id": 41, "type": "kernel" }, { "etw_provider_name": null, "func": "image_load", "id": 15, "image": "\\Device\\HarddiskVolume3\\Windows\\System32\\ucrtbase.dll", "krn_pid": 3620, "pid": 3620, "time": 134271933909687440, "trace_id": 41, "type": "kernel" }, { "etw_provider_name": null, "func": "image_load", "id": 16, "image": "\\Device\\HarddiskVolume3\\Windows\\System32\\combase.dll", "krn_pid": 3620, "pid": 3620, "time": 134271933909687440, "trace_id": 41, "type": "kernel" }, { "etw_provider_name": null, "func": "image_load", "id": 17, "image": "\\Device\\HarddiskVolume3\\Windows\\System32\\rpcrt4.dll", "krn_pid": 3620, "pid": 3620, "time": 134271933909687440, "trace_id": 41, "type": "kernel" }, { "etw_provider_name": null, "func": "image_load", "id": 18, "image": "\\Device\\HarddiskVolume3\\Windows\\System32\\msvcp_win.dll", "krn_pid": 3620, "pid": 3620, "time": 134271933909687440, "trace_id": 41, "type": "kernel" }, { "etw_provider_name": null, "func": "image_load", "id": 19, "image": "\\Device\\HarddiskVolume3\\Windows\\System32\\profapi.dll", "krn_pid": 3620, "pid": 3620, "time": 134271933909687440, "trace_id": 41, "type": "kernel" }, { "etw_provider_name": null, "func": "image_load", "id": 20, "image": "\\Device\\HarddiskVolume3\\Windows\\System32\\windows.storage.dll", "krn_pid": 3620, "pid": 3620, "time": 134271933909687440, "trace_id": 41, "type": "kernel" }, { "etw_provider_name": null, "func": "image_load", "id": 21, "image": "\\Device\\HarddiskVolume3\\Windows\\System32\\WinTypes.dll", "krn_pid": 3620, "pid": 3620, "time": 134271933909687440, "trace_id": 41, "type": "kernel" }, { "etw_provider_name": null, "func": "image_load", "id": 22, "image": "\\Device\\HarddiskVolume3\\Windows\\System32\\SHCore.dll", "krn_pid": 3620, "pid": 3620, "time": 134271933909687440, "trace_id": 41, "type": "kernel" }, { "etw_provider_name": null, "func": "image_load", "id": 23, "image": "\\Device\\HarddiskVolume3\\Windows\\System32\\shlwapi.dll", "krn_pid": 3620, "pid": 3620, "time": 134271933909687440, "trace_id": 41, "type": "kernel" }, { "etw_provider_name": null, "func": "image_load", "id": 24, "image": "\\Device\\HarddiskVolume3\\Windows\\System32\\msvcrt.dll", "krn_pid": 3620, "pid": 3620, "time": 134271933909687440, "trace_id": 41, "type": "kernel" }, { "create": 1, "etw_provider_name": null, "func": "thread_create", "id": 25, "krn_pid": 4, "pid": 3620, "threadid": 5200, "time": 134271933909842540, "trace_id": 41, "type": "kernel" }, { "create": 1, "etw_provider_name": null, "func": "thread_create", "id": 26, "krn_pid": 3620, "pid": 3620, "threadid": 6828, "time": 134271933909842540, "trace_id": 41, "type": "kernel" }, { "etw_provider_name": null, "func": "image_load", "id": 27, "image": "\\Device\\HarddiskVolume3\\Windows\\System32\\kernel.appcore.dll", "krn_pid": 3620, "pid": 3620, "time": 134271933909842540, "trace_id": 41, "type": "kernel" }, { "etw_provider_name": null, "func": "image_load", "id": 28, "image": "\\Device\\HarddiskVolume3\\Windows\\System32\\daxexec.dll", "krn_pid": 3620, "pid": 3620, "time": 134271933909842540, "trace_id": 41, "type": "kernel" }, { "etw_provider_name": null, "func": "image_load", "id": 29, "image": "\\Device\\HarddiskVolume3\\Windows\\System32\\oleaut32.dll", "krn_pid": 3620, "pid": 3620, "time": 134271933909998930, "trace_id": 41, "type": "kernel" }, { "etw_provider_name": null, "func": "image_load", "id": 30, "image": "\\Device\\HarddiskVolume3\\Windows\\System32\\userenv.dll", "krn_pid": 3620, "pid": 3620, "time": 134271933909998930, "trace_id": 41, "type": "kernel" }, { "etw_provider_name": null, "func": "image_load", "id": 31, "image": "\\Device\\HarddiskVolume3\\Windows\\System32\\container.dll", "krn_pid": 3620, "pid": 3620, "time": 134271933909998930, "trace_id": 41, "type": "kernel" }, { "etw_provider_name": null, "func": "image_load", "id": 32, "image": "\\Device\\HarddiskVolume3\\Windows\\System32\\bcryptprimitives.dll", "krn_pid": 3620, "pid": 3620, "time": 134271933909998930, "trace_id": 41, "type": "kernel" }, { "etw_provider_name": null, "func": "image_load", "id": 33, "image": "\\Device\\HarddiskVolume3\\Windows\\System32\\clbcatq.dll", "krn_pid": 3620, "pid": 3620, "time": 134271933909998930, "trace_id": 41, "type": "kernel" }, { "create": 1, "etw_provider_name": null, "func": "thread_create", "id": 34, "krn_pid": 3620, "pid": 3620, "threadid": 2056, "time": 134271933909998930, "trace_id": 41, "type": "kernel" }, { "etw_provider_name": null, "func": "image_load", "id": 35, "image": "\\Device\\HarddiskVolume3\\Windows\\System32\\Windows.StateRepositoryPS.dll", "krn_pid": 3620, "pid": 3620, "time": 134271933909998930, "trace_id": 41, "type": "kernel" }, { "etw_provider_name": null, "func": "image_load", "id": 36, "image": "\\Device\\HarddiskVolume3\\Windows\\System32\\AppxAllUserStore.dll", "krn_pid": 3620, "pid": 3620, "time": 134271933909998930, "trace_id": 41, "type": "kernel" }, { "etw_provider_name": null, "func": "image_load", "id": 37, "image": "\\Device\\HarddiskVolume3\\Windows\\System32\\Windows.StateRepositoryClient.dll", "krn_pid": 3620, "pid": 3620, "time": 134271933909998930, "trace_id": 41, "type": "kernel" }, { "etw_provider_name": null, "func": "image_load", "id": 38, "image": "\\Device\\HarddiskVolume3\\Windows\\System32\\Windows.StateRepositoryCore.dll", "krn_pid": 3620, "pid": 3620, "time": 134271933909998930, "trace_id": 41, "type": "kernel" }, { "etw_provider_name": null, "func": "image_load", "id": 39, "image": "\\Device\\HarddiskVolume3\\Windows\\System32\\capauthz.dll", "krn_pid": 3620, "pid": 3620, "time": 134271933909998930, "trace_id": 41, "type": "kernel" }, { "etw_provider_name": null, "func": "image_load", "id": 40, "image": "\\Device\\HarddiskVolume3\\Windows\\System32\\advapi32.dll", "krn_pid": 3620, "pid": 3620, "time": 134271933909998930, "trace_id": 41, "type": "kernel" }, { "etw_provider_name": null, "func": "image_load", "id": 41, "image": "\\Device\\HarddiskVolume3\\Windows\\System32\\ntmarta.dll", "krn_pid": 3620, "pid": 3620, "time": 134271933909998930, "trace_id": 41, "type": "kernel" }, { "desiredaccess": 1536, "etw_event_id": 5, "etw_pid": 1260, "etw_process": "MsMpEng.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Audit-API-Calls", "etw_tid": 3852, "etw_time": 134271933909611410, "event": "PspLogAuditOpenProcessEvent", "id": 42, "returncode": 0, "stack_trace": [ { "addr": 140733319287492, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733274989678, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140732929299087, "addr_info": "mpengine.dll", "idx": 2 }, { "addr": 140732924623512, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732920338951, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732921325770, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732922333424, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732924307898, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732924300100, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732923490940, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 11 }, { "addr": 140732952238483, "addr_info": "mprtp.dll", "idx": 12 }, { "addr": 140732952236075, "addr_info": "mprtp.dll", "idx": 13 }, { "addr": 140732952934324, "addr_info": "mprtp.dll", "idx": 14 }, { "addr": 140732952935614, "addr_info": "mprtp.dll", "idx": 15 }, { "addr": 140732952919783, "addr_info": "mprtp.dll", "idx": 16 }, { "addr": 140732952430163, "addr_info": "mprtp.dll", "idx": 17 }, { "addr": 140732952427103, "addr_info": "mprtp.dll", "idx": 18 }, { "addr": 140732952605871, "addr_info": "mprtp.dll", "idx": 19 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 20 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 21 } ], "targetprocessid": 3620, "trace_id": 41, "type": "etw" }, { "desiredaccess": 4096, "etw_event_id": 5, "etw_pid": 1260, "etw_process": "MsMpEng.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Audit-API-Calls", "etw_tid": 3340, "etw_time": 134271933909613760, "event": "PspLogAuditOpenProcessEvent", "id": 43, "returncode": 0, "stack_trace": [ { "addr": 140733319287492, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733274989678, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140732921250766, "addr_info": "mpengine.dll", "idx": 2 }, { "addr": 140732921250247, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732921249809, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732923068265, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732923062121, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920334390, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920332582, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732921163108, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921168371, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921166467, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732921166329, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732921164240, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732920224842, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732920224083, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732923490229, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 18 }, { "addr": 140732952134716, "addr_info": "mprtp.dll", "idx": 19 }, { "addr": 140732952290401, "addr_info": "mprtp.dll", "idx": 20 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 21 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 22 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 23 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 24 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 25 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 26 } ], "targetprocessid": 3620, "trace_id": 41, "type": "etw" }, { "defaultbase": 140703039684608, "etw_event_id": 5, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Process", "etw_tid": 7148, "etw_time": 134271933909634110, "event": "ImageLoadInfo ", "id": 44, "imagebase": 140703039684608, "imagechecksum": 0, "imagename": "\\Device\\HarddiskVolume3\\Users\\hacker\\Desktop\\b\\redtest3.exe", "imagesize": 192512, "processid": 3620, "stack_trace": [ { "addr": 140733318999888, "addr_info": "ntdll.dll:.text", "idx": 0 } ], "timedatestamp": 1782719611, "trace_id": 41, "type": "etw" }, { "defaultbase": 140733318627328, "etw_event_id": 5, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Process", "etw_tid": 7148, "etw_time": 134271933909635070, "event": "ImageLoadInfo ", "id": 45, "imagebase": 140733318627328, "imagechecksum": 2245601, "imagename": "\\Device\\HarddiskVolume3\\Windows\\System32\\ntdll.dll", "imagesize": 2195456, "processid": 3620, "stack_trace": [ { "addr": 140733318999888, "addr_info": "ntdll.dll:.text", "idx": 0 } ], "timedatestamp": 2891307683, "trace_id": 41, "type": "etw" }, { "defaultbase": 140733289136128, "etw_event_id": 5, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Process", "etw_tid": 7148, "etw_time": 134271933909642240, "event": "ImageLoadInfo ", "id": 46, "imagebase": 140733289136128, "imagechecksum": 845092, "imagename": "\\Device\\HarddiskVolume3\\Windows\\System32\\kernel32.dll", "imagesize": 802816, "processid": 3620, "stack_trace": [ { "addr": 140733319287556, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733318810108, "addr_info": "ntdll.dll:.text", "idx": 1 }, { "addr": 140733318809082, "addr_info": "ntdll.dll:.text", "idx": 2 }, { "addr": 140733318809476, "addr_info": "ntdll.dll:.text", "idx": 3 }, { "addr": 140733318812505, "addr_info": "ntdll.dll:.text", "idx": 4 }, { "addr": 140733318816473, "addr_info": "ntdll.dll:.text", "idx": 5 }, { "addr": 140733318794726, "addr_info": "ntdll.dll:.text", "idx": 6 }, { "addr": 140733318729948, "addr_info": "ntdll.dll:.text", "idx": 7 }, { "addr": 140733318801290, "addr_info": "ntdll.dll:.text", "idx": 8 }, { "addr": 140733319541763, "addr_info": "ntdll.dll:.text", "idx": 9 }, { "addr": 140733319460172, "addr_info": "ntdll.dll:.text", "idx": 10 }, { "addr": 140733319103843, "addr_info": "ntdll.dll:.text", "idx": 11 }, { "addr": 140733319103630, "addr_info": "ntdll.dll:.text", "idx": 12 } ], "timedatestamp": 3838495266, "trace_id": 41, "type": "etw" }, { "defaultbase": 140733274783744, "etw_event_id": 5, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Process", "etw_tid": 7148, "etw_time": 134271933909643940, "event": "ImageLoadInfo ", "id": 47, "imagebase": 140733274783744, "imagechecksum": 4080470, "imagename": "\\Device\\HarddiskVolume3\\Windows\\System32\\KernelBase.dll", "imagesize": 4009984, "processid": 3620, "stack_trace": [ { "addr": 140733319287556, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733318810108, "addr_info": "ntdll.dll:.text", "idx": 1 }, { "addr": 140733318809082, "addr_info": "ntdll.dll:.text", "idx": 2 }, { "addr": 140733318809476, "addr_info": "ntdll.dll:.text", "idx": 3 }, { "addr": 140733318812505, "addr_info": "ntdll.dll:.text", "idx": 4 }, { "addr": 140733318782452, "addr_info": "ntdll.dll:.text", "idx": 5 }, { "addr": 140733318778422, "addr_info": "ntdll.dll:.text", "idx": 6 }, { "addr": 140733318777835, "addr_info": "ntdll.dll:.text", "idx": 7 }, { "addr": 140733318809896, "addr_info": "ntdll.dll:.text", "idx": 8 }, { "addr": 140733318812505, "addr_info": "ntdll.dll:.text", "idx": 9 }, { "addr": 140733318816473, "addr_info": "ntdll.dll:.text", "idx": 10 }, { "addr": 140733318794726, "addr_info": "ntdll.dll:.text", "idx": 11 }, { "addr": 140733318729948, "addr_info": "ntdll.dll:.text", "idx": 12 }, { "addr": 140733318801290, "addr_info": "ntdll.dll:.text", "idx": 13 }, { "addr": 140733319541763, "addr_info": "ntdll.dll:.text", "idx": 14 }, { "addr": 140733319460172, "addr_info": "ntdll.dll:.text", "idx": 15 }, { "addr": 140733319103843, "addr_info": "ntdll.dll:.text", "idx": 16 }, { "addr": 140733319103630, "addr_info": "ntdll.dll:.text", "idx": 17 } ], "timedatestamp": 1573674004, "trace_id": 41, "type": "etw" }, { "desiredaccess": 4096, "etw_event_id": 5, "etw_pid": 1260, "etw_process": "MsMpEng.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Audit-API-Calls", "etw_tid": 3300, "etw_time": 134271933909649710, "event": "PspLogAuditOpenProcessEvent", "id": 48, "returncode": 0, "stack_trace": [ { "addr": 140733319287492, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733274989678, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140732921250766, "addr_info": "mpengine.dll", "idx": 2 }, { "addr": 140732921250247, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732921249809, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732921912608, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732921913425, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732921170783, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732921169556, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732929341080, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732929340803, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 11 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 12 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 13 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 14 } ], "targetprocessid": 3620, "trace_id": 41, "type": "etw" }, { "desiredaccess": 4096, "etw_event_id": 5, "etw_pid": 1260, "etw_process": "MsMpEng.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Audit-API-Calls", "etw_tid": 3300, "etw_time": 134271933909649920, "event": "PspLogAuditOpenProcessEvent", "id": 49, "returncode": 0, "stack_trace": [ { "addr": 140733319287492, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733274989678, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140732921250766, "addr_info": "mpengine.dll", "idx": 2 }, { "addr": 140732921250247, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732921249809, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732921913709, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732921170783, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732921169556, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732929341080, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732929340803, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 10 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 11 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 12 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 13 } ], "targetprocessid": 3620, "trace_id": 41, "type": "etw" }, { "defaultbase": 140733220388864, "etw_event_id": 5, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Process", "etw_tid": 7148, "etw_time": 134271933909660290, "event": "ImageLoadInfo ", "id": 50, "imagebase": 140733220388864, "imagechecksum": 688428, "imagename": "\\Device\\HarddiskVolume3\\Windows\\System32\\apphelp.dll", "imagesize": 618496, "processid": 3620, "stack_trace": [ { "addr": 140733319287556, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733318810108, "addr_info": "ntdll.dll:.text", "idx": 1 }, { "addr": 140733318809082, "addr_info": "ntdll.dll:.text", "idx": 2 }, { "addr": 140733318809476, "addr_info": "ntdll.dll:.text", "idx": 3 }, { "addr": 140733318695743, "addr_info": "ntdll.dll:.text", "idx": 4 }, { "addr": 140733318698272, "addr_info": "ntdll.dll:.text", "idx": 5 }, { "addr": 140733318697711, "addr_info": "ntdll.dll:.text", "idx": 6 }, { "addr": 140733318794756, "addr_info": "ntdll.dll:.text", "idx": 7 }, { "addr": 140733318729948, "addr_info": "ntdll.dll:.text", "idx": 8 }, { "addr": 140733319125033, "addr_info": "ntdll.dll:.text", "idx": 9 }, { "addr": 140733319542389, "addr_info": "ntdll.dll:.text", "idx": 10 }, { "addr": 140733319460172, "addr_info": "ntdll.dll:.text", "idx": 11 }, { "addr": 140733319103843, "addr_info": "ntdll.dll:.text", "idx": 12 }, { "addr": 140733319103630, "addr_info": "ntdll.dll:.text", "idx": 13 } ], "timedatestamp": 2150276531, "trace_id": 41, "type": "etw" }, { "desiredaccess": 5136, "etw_event_id": 5, "etw_pid": 1260, "etw_process": "MsMpEng.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Audit-API-Calls", "etw_tid": 3300, "etw_time": 134271933909665230, "event": "PspLogAuditOpenProcessEvent", "id": 51, "returncode": 0, "stack_trace": [ { "addr": 140733319287492, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733274989678, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140732921250766, "addr_info": "mpengine.dll", "idx": 2 }, { "addr": 140732921250247, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732922672087, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732922671120, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732921179850, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732921174752, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732921174289, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732921172268, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921171926, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921913546, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732921170783, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732921169556, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732929341080, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732929340803, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 16 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 17 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 18 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 19 } ], "targetprocessid": 3620, "trace_id": 41, "type": "etw" }, { "desiredaccess": 4096, "etw_event_id": 5, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Audit-API-Calls", "etw_tid": 7148, "etw_time": 134271933909667890, "event": "PspLogAuditOpenProcessEvent", "id": 52, "returncode": 0, "stack_trace": [ { "addr": 140733319287492, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733274989678, "addr_info": "KERNELBASE.dll:.text", "idx": 1 }, { "addr": 140733220426532, "addr_info": "apphelp.dll:.text", "idx": 2 }, { "addr": 140733220419142, "addr_info": "apphelp.dll:.text", "idx": 3 }, { "addr": 140733220419724, "addr_info": "apphelp.dll:.text", "idx": 4 }, { "addr": 140733319125203, "addr_info": "ntdll.dll:.text", "idx": 5 }, { "addr": 140733319542389, "addr_info": "ntdll.dll:.text", "idx": 6 }, { "addr": 140733319460172, "addr_info": "ntdll.dll:.text", "idx": 7 }, { "addr": 140733319103843, "addr_info": "ntdll.dll:.text", "idx": 8 }, { "addr": 140733319103630, "addr_info": "ntdll.dll:.text", "idx": 9 } ], "targetprocessid": 3620, "trace_id": 41, "type": "etw" }, { "defaultbase": 140733307879424, "etw_event_id": 5, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Process", "etw_tid": 7148, "etw_time": 134271933909710050, "event": "ImageLoadInfo ", "id": 53, "imagebase": 140733307879424, "imagechecksum": 735424, "imagename": "\\Device\\HarddiskVolume3\\Windows\\System32\\sechost.dll", "imagesize": 688128, "processid": 3620, "stack_trace": [ { "addr": 140733319287556, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733318810108, "addr_info": "ntdll.dll:.text", "idx": 1 }, { "addr": 140733318809082, "addr_info": "ntdll.dll:.text", "idx": 2 }, { "addr": 140733318809476, "addr_info": "ntdll.dll:.text", "idx": 3 }, { "addr": 140733318812505, "addr_info": "ntdll.dll:.text", "idx": 4 }, { "addr": 140733318816473, "addr_info": "ntdll.dll:.text", "idx": 5 }, { "addr": 140733318794726, "addr_info": "ntdll.dll:.text", "idx": 6 }, { "addr": 140733318729472, "addr_info": "ntdll.dll:.text", "idx": 7 }, { "addr": 140733318717630, "addr_info": "ntdll.dll:.text", "idx": 8 }, { "addr": 140733318771045, "addr_info": "ntdll.dll:.text", "idx": 9 }, { "addr": 140733318807335, "addr_info": "ntdll.dll:.text", "idx": 10 }, { "addr": 140733275306418, "addr_info": "KERNELBASE.dll:.text", "idx": 11 }, { "addr": 140733275528893, "addr_info": "KERNELBASE.dll:.text", "idx": 12 }, { "addr": 140733275073178, "addr_info": "KERNELBASE.dll:.text", "idx": 13 }, { "addr": 140733275329713, "addr_info": "KERNELBASE.dll:.text", "idx": 14 }, { "addr": 140733275328598, "addr_info": "KERNELBASE.dll:.text", "idx": 15 }, { "addr": 140733289145076, "addr_info": "KERNEL32.DLL:.text", "idx": 16 }, { "addr": 140703039692782, "addr_info": "redtest3.exe:.text", "idx": 17 }, { "addr": 140703039702818, "addr_info": "redtest3.exe:.text", "idx": 18 }, { "addr": 140703039703776, "addr_info": "redtest3.exe:.text", "idx": 19 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL:.text", "idx": 20 }, { "addr": 140733318999928, "addr_info": "ntdll.dll:.text", "idx": 21 } ], "timedatestamp": 1038424952, "trace_id": 41, "type": "etw" }, { "defaultbase": 140733279633408, "etw_event_id": 5, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Process", "etw_tid": 7148, "etw_time": 134271933909711400, "event": "ImageLoadInfo ", "id": 54, "imagebase": 140733279633408, "imagechecksum": 187148, "imagename": "\\Device\\HarddiskVolume3\\Windows\\System32\\bcrypt.dll", "imagesize": 163840, "processid": 3620, "stack_trace": [ { "addr": 140733319287556, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733318810108, "addr_info": "ntdll.dll:.text", "idx": 1 }, { "addr": 140733318809082, "addr_info": "ntdll.dll:.text", "idx": 2 }, { "addr": 140733318809476, "addr_info": "ntdll.dll:.text", "idx": 3 }, { "addr": 140733318812505, "addr_info": "ntdll.dll:.text", "idx": 4 }, { "addr": 140733318782452, "addr_info": "ntdll.dll:.text", "idx": 5 }, { "addr": 140733318778422, "addr_info": "ntdll.dll:.text", "idx": 6 }, { "addr": 140733318777835, "addr_info": "ntdll.dll:.text", "idx": 7 }, { "addr": 140733318809896, "addr_info": "ntdll.dll:.text", "idx": 8 }, { "addr": 140733318812505, "addr_info": "ntdll.dll:.text", "idx": 9 }, { "addr": 140733318816473, "addr_info": "ntdll.dll:.text", "idx": 10 }, { "addr": 140733318794726, "addr_info": "ntdll.dll:.text", "idx": 11 }, { "addr": 140733318729472, "addr_info": "ntdll.dll:.text", "idx": 12 }, { "addr": 140733318717630, "addr_info": "ntdll.dll:.text", "idx": 13 }, { "addr": 140733318771045, "addr_info": "ntdll.dll:.text", "idx": 14 }, { "addr": 140733318807335, "addr_info": "ntdll.dll:.text", "idx": 15 }, { "addr": 140733275306418, "addr_info": "KERNELBASE.dll:.text", "idx": 16 }, { "addr": 140733275528893, "addr_info": "KERNELBASE.dll:.text", "idx": 17 }, { "addr": 140733275073178, "addr_info": "KERNELBASE.dll:.text", "idx": 18 }, { "addr": 140733275329713, "addr_info": "KERNELBASE.dll:.text", "idx": 19 }, { "addr": 140733275328598, "addr_info": "KERNELBASE.dll:.text", "idx": 20 }, { "addr": 140733289145076, "addr_info": "KERNEL32.DLL:.text", "idx": 21 }, { "addr": 140703039692782, "addr_info": "redtest3.exe:.text", "idx": 22 }, { "addr": 140703039702818, "addr_info": "redtest3.exe:.text", "idx": 23 }, { "addr": 140703039703776, "addr_info": "redtest3.exe:.text", "idx": 24 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL:.text", "idx": 25 }, { "addr": 140733318999928, "addr_info": "ntdll.dll:.text", "idx": 26 } ], "timedatestamp": 811005966, "trace_id": 41, "type": "etw" }, { "etw_event_id": 3, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Process", "etw_tid": 7148, "etw_time": 134271933909712320, "event": "ThreadStartStart ", "id": 55, "processid": 3620, "stack_trace": [ { "addr": 140733319298420, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733318845462, "addr_info": "ntdll.dll:.text", "idx": 1 }, { "addr": 140733318845044, "addr_info": "ntdll.dll:.text", "idx": 2 }, { "addr": 140733319099807, "addr_info": "ntdll.dll:.text", "idx": 3 }, { "addr": 140733318777977, "addr_info": "ntdll.dll:.text", "idx": 4 }, { "addr": 140733318809896, "addr_info": "ntdll.dll:.text", "idx": 5 }, { "addr": 140733318812505, "addr_info": "ntdll.dll:.text", "idx": 6 }, { "addr": 140733318782452, "addr_info": "ntdll.dll:.text", "idx": 7 }, { "addr": 140733318778422, "addr_info": "ntdll.dll:.text", "idx": 8 }, { "addr": 140733318777835, "addr_info": "ntdll.dll:.text", "idx": 9 }, { "addr": 140733318809896, "addr_info": "ntdll.dll:.text", "idx": 10 }, { "addr": 140733318812505, "addr_info": "ntdll.dll:.text", "idx": 11 }, { "addr": 140733318816473, "addr_info": "ntdll.dll:.text", "idx": 12 }, { "addr": 140733318794726, "addr_info": "ntdll.dll:.text", "idx": 13 }, { "addr": 140733318729472, "addr_info": "ntdll.dll:.text", "idx": 14 }, { "addr": 140733318717630, "addr_info": "ntdll.dll:.text", "idx": 15 }, { "addr": 140733318771045, "addr_info": "ntdll.dll:.text", "idx": 16 }, { "addr": 140733318807335, "addr_info": "ntdll.dll:.text", "idx": 17 }, { "addr": 140733275306418, "addr_info": "KERNELBASE.dll:.text", "idx": 18 }, { "addr": 140733275528893, "addr_info": "KERNELBASE.dll:.text", "idx": 19 }, { "addr": 140733275073178, "addr_info": "KERNELBASE.dll:.text", "idx": 20 }, { "addr": 140733275329713, "addr_info": "KERNELBASE.dll:.text", "idx": 21 }, { "addr": 140733275328598, "addr_info": "KERNELBASE.dll:.text", "idx": 22 }, { "addr": 140733289145076, "addr_info": "KERNEL32.DLL:.text", "idx": 23 }, { "addr": 140703039692782, "addr_info": "redtest3.exe:.text", "idx": 24 }, { "addr": 140703039702818, "addr_info": "redtest3.exe:.text", "idx": 25 }, { "addr": 140703039703776, "addr_info": "redtest3.exe:.text", "idx": 26 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL:.text", "idx": 27 }, { "addr": 140733318999928, "addr_info": "ntdll.dll:.text", "idx": 28 } ], "stackbase": 18446626998470664000, "stacklimit": 18446626998470640000, "startaddr": 140733318845888, "subprocesstag": 0, "tebbase": 546687057920, "threadid": 1268, "trace_id": 41, "type": "etw", "userstackbase": 546688729088, "userstacklimit": 546688724992, "win32startaddr": 140733318845888 }, { "etw_event_id": 3, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Process", "etw_tid": 1268, "etw_time": 134271933909716100, "event": "ThreadStartStart ", "id": 56, "processid": 3620, "stack_trace": [ { "addr": 140733319298420, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733318845462, "addr_info": "ntdll.dll:.text", "idx": 1 }, { "addr": 140733318949970, "addr_info": "ntdll.dll:.text", "idx": 2 }, { "addr": 140733319030808, "addr_info": "ntdll.dll:.text", "idx": 3 }, { "addr": 140733318848182, "addr_info": "ntdll.dll:.text", "idx": 4 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL:.text", "idx": 5 }, { "addr": 140733318999928, "addr_info": "ntdll.dll:.text", "idx": 6 } ], "stackbase": 18446626998470980000, "stacklimit": 18446626998470955000, "startaddr": 140733318845888, "subprocesstag": 0, "tebbase": 546687066112, "threadid": 5232, "trace_id": 41, "type": "etw", "userstackbase": 546689777664, "userstacklimit": 546689773568, "win32startaddr": 140733318845888 }, { "commandline": "\"C:\\Users\\hacker\\Desktop\\b\\redtest3.exe\" 2", "etw_provider_name": null, "func": "peb", "id": 57, "image_base": 140703039684608, "image_path": "C:\\Users\\hacker\\Desktop\\b\\redtest3.exe", "is_debugged": 0, "is_protected_process": 0, "is_protected_process_light": 0, "parent_pid": 10100, "pid": 3620, "time": 134271933910935870, "trace_id": 41, "type": "process_query", "working_dir": "C:\\Users\\hacker\\Desktop\\b\\" }, { "dlls": [ { "addr": 140703039684608, "name": "C:\\Users\\hacker\\Desktop\\b\\redtest3.exe", "size": 192512 }, { "addr": 140733318627328, "name": "ntdll.dll", "size": 2195456 }, { "addr": 140733289136128, "name": "KERNEL32.DLL", "size": 802816 }, { "addr": 140733274783744, "name": "KERNELBASE.dll", "size": 4009984 }, { "addr": 140733220388864, "name": "apphelp.dll", "size": 618496 }, { "addr": 140733307879424, "name": "sechost.dll", "size": 688128 }, { "addr": 140733279633408, "name": "bcrypt.dll", "size": 163840 }, { "addr": 140732575711232, "name": "apisethost.appexecutionalias.dll", "size": 200704 }, { "addr": 140733269409792, "name": "ucrtbase.dll", "size": 1118208 }, { "addr": 140733302243328, "name": "combase.dll", "size": 3739648 }, { "addr": 140733297328128, "name": "RPCRT4.dll", "size": 1146880 }, { "addr": 140733272293376, "name": "msvcp_win.dll", "size": 630784 }, { "addr": 140733268557824, "name": "profapi.dll", "size": 151552 }, { "addr": 140733234806784, "name": "windows.storage.dll", "size": 9543680 }, { "addr": 140733273473024, "name": "wintypes.dll", "size": 1306624 }, { "addr": 140733292412928, "name": "SHCORE.dll", "size": 1064960 }, { "addr": 140733288677376, "name": "shlwapi.dll", "size": 430080 }, { "addr": 140733317644288, "name": "msvcrt.dll", "size": 684032 }, { "addr": 140733252501504, "name": "kernel.appcore.dll", "size": 98304 }, { "addr": 140732843950080, "name": "daxexec.dll", "size": 1122304 }, { "addr": 140733296410624, "name": "OLEAUT32.dll", "size": 884736 }, { "addr": 140733258596352, "name": "USERENV.dll", "size": 163840 }, { "addr": 140732843622400, "name": "container.dll", "size": 278528 }, { "addr": 140733270589440, "name": "bcryptPrimitives.dll", "size": 503808 }, { "addr": 140733286252544, "name": "clbcatq.dll", "size": 720896 }, { "addr": 140732978167808, "name": "Windows.StateRepositoryPS.dll", "size": 962560 }, { "addr": 140732889497600, "name": "AppXAllUserStore.dll", "size": 462848 }, { "addr": 140733122084864, "name": "windows.staterepositoryclient.dll", "size": 249856 }, { "addr": 140733122347008, "name": "windows.staterepositorycore.dll", "size": 106496 }, { "addr": 140732825206784, "name": "capauthz.dll", "size": 393216 }, { "addr": 140733299425280, "name": "advapi32.dll", "size": 724992 }, { "addr": 140733253615616, "name": "ntmarta.dll", "size": 212992 } ], "etw_provider_name": null, "func": "loaded_dll", "id": 58, "pid": 3620, "process_name": "C:\\Users\\hacker\\Desktop\\b\\redtest3.exe", "time": 134271933910935870, "trace_id": 41, "type": "process_query" }, { "etw_event_id": 10, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-File", "etw_tid": 7148, "etw_time": 134271933909720030, "event": "NameCreateInfo ", "filekey": 18446692399656012000, "filename": "\\Device\\HarddiskVolume3\\Windows\\System32\\notepad.exe", "id": 59, "stack_trace": [ { "addr": 140733319292884, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733275076164, "addr_info": "KERNELBASE.dll:.text", "idx": 1 }, { "addr": 140733275329713, "addr_info": "KERNELBASE.dll:.text", "idx": 2 }, { "addr": 140733275328598, "addr_info": "KERNELBASE.dll:.text", "idx": 3 }, { "addr": 140733289145076, "addr_info": "KERNEL32.DLL:.text", "idx": 4 }, { "addr": 140703039692782, "addr_info": "redtest3.exe:.text", "idx": 5 }, { "addr": 140703039702818, "addr_info": "redtest3.exe:.text", "idx": 6 }, { "addr": 140703039703776, "addr_info": "redtest3.exe:.text", "idx": 7 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL:.text", "idx": 8 }, { "addr": 140733318999928, "addr_info": "ntdll.dll:.text", "idx": 9 } ], "trace_id": 41, "type": "etw" }, { "etw_event_id": 10, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-File", "etw_tid": 7148, "etw_time": 134271933909755100, "event": "NameCreateInfo ", "filekey": 18446692399684553000, "filename": "\\Device\\HarddiskVolume3\\Windows\\System32\\ApiSetHost.AppExecutionAlias.dll", "id": 60, "stack_trace": [ { "addr": 140733319288228, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733318803833, "addr_info": "ntdll.dll:.text", "idx": 1 }, { "addr": 140733318801719, "addr_info": "ntdll.dll:.text", "idx": 2 }, { "addr": 140733318698162, "addr_info": "ntdll.dll:.text", "idx": 3 }, { "addr": 140733318697711, "addr_info": "ntdll.dll:.text", "idx": 4 }, { "addr": 140733318794756, "addr_info": "ntdll.dll:.text", "idx": 5 }, { "addr": 140733318729472, "addr_info": "ntdll.dll:.text", "idx": 6 }, { "addr": 140733318717630, "addr_info": "ntdll.dll:.text", "idx": 7 }, { "addr": 140733318771045, "addr_info": "ntdll.dll:.text", "idx": 8 }, { "addr": 140733318807335, "addr_info": "ntdll.dll:.text", "idx": 9 }, { "addr": 140733275306418, "addr_info": "KERNELBASE.dll:.text", "idx": 10 }, { "addr": 140733275528283, "addr_info": "KERNELBASE.dll:.text", "idx": 11 }, { "addr": 140733274804744, "addr_info": "KERNELBASE.dll:.text", "idx": 12 }, { "addr": 140733275076832, "addr_info": "KERNELBASE.dll:.text", "idx": 13 }, { "addr": 140733275329713, "addr_info": "KERNELBASE.dll:.text", "idx": 14 }, { "addr": 140733275328598, "addr_info": "KERNELBASE.dll:.text", "idx": 15 }, { "addr": 140733289145076, "addr_info": "KERNEL32.DLL:.text", "idx": 16 }, { "addr": 140703039692782, "addr_info": "redtest3.exe:.text", "idx": 17 }, { "addr": 140703039702818, "addr_info": "redtest3.exe:.text", "idx": 18 }, { "addr": 140703039703776, "addr_info": "redtest3.exe:.text", "idx": 19 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL:.text", "idx": 20 }, { "addr": 140733318999928, "addr_info": "ntdll.dll:.text", "idx": 21 } ], "trace_id": 41, "type": "etw" }, { "defaultbase": 140732575711232, "etw_event_id": 5, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Process", "etw_tid": 7148, "etw_time": 134271933909778600, "event": "ImageLoadInfo ", "id": 61, "imagebase": 140732575711232, "imagechecksum": 247244, "imagename": "\\Device\\HarddiskVolume3\\Windows\\System32\\ApiSetHost.AppExecutionAlias.dll", "imagesize": 200704, "processid": 3620, "stack_trace": [ { "addr": 140733319287556, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733318810108, "addr_info": "ntdll.dll:.text", "idx": 1 }, { "addr": 140733318809082, "addr_info": "ntdll.dll:.text", "idx": 2 }, { "addr": 140733318809476, "addr_info": "ntdll.dll:.text", "idx": 3 }, { "addr": 140733318695743, "addr_info": "ntdll.dll:.text", "idx": 4 }, { "addr": 140733318698272, "addr_info": "ntdll.dll:.text", "idx": 5 }, { "addr": 140733318697711, "addr_info": "ntdll.dll:.text", "idx": 6 }, { "addr": 140733318794756, "addr_info": "ntdll.dll:.text", "idx": 7 }, { "addr": 140733318729472, "addr_info": "ntdll.dll:.text", "idx": 8 }, { "addr": 140733318717630, "addr_info": "ntdll.dll:.text", "idx": 9 }, { "addr": 140733318771045, "addr_info": "ntdll.dll:.text", "idx": 10 }, { "addr": 140733318807335, "addr_info": "ntdll.dll:.text", "idx": 11 }, { "addr": 140733275306418, "addr_info": "KERNELBASE.dll:.text", "idx": 12 }, { "addr": 140733275528283, "addr_info": "KERNELBASE.dll:.text", "idx": 13 }, { "addr": 140733274804744, "addr_info": "KERNELBASE.dll:.text", "idx": 14 }, { "addr": 140733275076832, "addr_info": "KERNELBASE.dll:.text", "idx": 15 }, { "addr": 140733275329713, "addr_info": "KERNELBASE.dll:.text", "idx": 16 }, { "addr": 140733275328598, "addr_info": "KERNELBASE.dll:.text", "idx": 17 }, { "addr": 140733289145076, "addr_info": "KERNEL32.DLL:.text", "idx": 18 }, { "addr": 140703039692782, "addr_info": "redtest3.exe:.text", "idx": 19 }, { "addr": 140703039702818, "addr_info": "redtest3.exe:.text", "idx": 20 }, { "addr": 140703039703776, "addr_info": "redtest3.exe:.text", "idx": 21 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL:.text", "idx": 22 }, { "addr": 140733318999928, "addr_info": "ntdll.dll:.text", "idx": 23 } ], "timedatestamp": 3617615351, "trace_id": 41, "type": "etw" }, { "defaultbase": 140733269409792, "etw_event_id": 5, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Process", "etw_tid": 7148, "etw_time": 134271933909789680, "event": "ImageLoadInfo ", "id": 62, "imagebase": 140733269409792, "imagechecksum": 1146380, "imagename": "\\Device\\HarddiskVolume3\\Windows\\System32\\ucrtbase.dll", "imagesize": 1118208, "processid": 3620, "stack_trace": [ { "addr": 140733319287556, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733318810108, "addr_info": "ntdll.dll:.text", "idx": 1 }, { "addr": 140733318809082, "addr_info": "ntdll.dll:.text", "idx": 2 }, { "addr": 140733318809476, "addr_info": "ntdll.dll:.text", "idx": 3 }, { "addr": 140733318812505, "addr_info": "ntdll.dll:.text", "idx": 4 }, { "addr": 140733318782452, "addr_info": "ntdll.dll:.text", "idx": 5 }, { "addr": 140733318778422, "addr_info": "ntdll.dll:.text", "idx": 6 }, { "addr": 140733318777835, "addr_info": "ntdll.dll:.text", "idx": 7 }, { "addr": 140733318809896, "addr_info": "ntdll.dll:.text", "idx": 8 }, { "addr": 140733318695743, "addr_info": "ntdll.dll:.text", "idx": 9 }, { "addr": 140733318698272, "addr_info": "ntdll.dll:.text", "idx": 10 }, { "addr": 140733318697711, "addr_info": "ntdll.dll:.text", "idx": 11 }, { "addr": 140733318794756, "addr_info": "ntdll.dll:.text", "idx": 12 }, { "addr": 140733318729472, "addr_info": "ntdll.dll:.text", "idx": 13 }, { "addr": 140733318717630, "addr_info": "ntdll.dll:.text", "idx": 14 }, { "addr": 140733318771045, "addr_info": "ntdll.dll:.text", "idx": 15 }, { "addr": 140733318807335, "addr_info": "ntdll.dll:.text", "idx": 16 }, { "addr": 140733275306418, "addr_info": "KERNELBASE.dll:.text", "idx": 17 }, { "addr": 140733275528283, "addr_info": "KERNELBASE.dll:.text", "idx": 18 }, { "addr": 140733274804744, "addr_info": "KERNELBASE.dll:.text", "idx": 19 }, { "addr": 140733275076832, "addr_info": "KERNELBASE.dll:.text", "idx": 20 }, { "addr": 140733275329713, "addr_info": "KERNELBASE.dll:.text", "idx": 21 }, { "addr": 140733275328598, "addr_info": "KERNELBASE.dll:.text", "idx": 22 }, { "addr": 140733289145076, "addr_info": "KERNEL32.DLL:.text", "idx": 23 }, { "addr": 140703039692782, "addr_info": "redtest3.exe:.text", "idx": 24 }, { "addr": 140703039702818, "addr_info": "redtest3.exe:.text", "idx": 25 }, { "addr": 140703039703776, "addr_info": "redtest3.exe:.text", "idx": 26 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL:.text", "idx": 27 }, { "addr": 140733318999928, "addr_info": "ntdll.dll:.text", "idx": 28 } ], "timedatestamp": 281308785, "trace_id": 41, "type": "etw" }, { "defaultbase": 140733302243328, "etw_event_id": 5, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Process", "etw_tid": 7148, "etw_time": 134271933909792020, "event": "ImageLoadInfo ", "id": 63, "imagebase": 140733302243328, "imagechecksum": 3765899, "imagename": "\\Device\\HarddiskVolume3\\Windows\\System32\\combase.dll", "imagesize": 3739648, "processid": 3620, "stack_trace": [ { "addr": 140733319287556, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733318810108, "addr_info": "ntdll.dll:.text", "idx": 1 }, { "addr": 140733318809082, "addr_info": "ntdll.dll:.text", "idx": 2 }, { "addr": 140733318809476, "addr_info": "ntdll.dll:.text", "idx": 3 }, { "addr": 140733318812505, "addr_info": "ntdll.dll:.text", "idx": 4 }, { "addr": 140733318782452, "addr_info": "ntdll.dll:.text", "idx": 5 }, { "addr": 140733318778422, "addr_info": "ntdll.dll:.text", "idx": 6 }, { "addr": 140733318777835, "addr_info": "ntdll.dll:.text", "idx": 7 }, { "addr": 140733318809896, "addr_info": "ntdll.dll:.text", "idx": 8 }, { "addr": 140733318695743, "addr_info": "ntdll.dll:.text", "idx": 9 }, { "addr": 140733318698272, "addr_info": "ntdll.dll:.text", "idx": 10 }, { "addr": 140733318697711, "addr_info": "ntdll.dll:.text", "idx": 11 }, { "addr": 140733318794756, "addr_info": "ntdll.dll:.text", "idx": 12 }, { "addr": 140733318729472, "addr_info": "ntdll.dll:.text", "idx": 13 }, { "addr": 140733318717630, "addr_info": "ntdll.dll:.text", "idx": 14 }, { "addr": 140733318771045, "addr_info": "ntdll.dll:.text", "idx": 15 }, { "addr": 140733318807335, "addr_info": "ntdll.dll:.text", "idx": 16 }, { "addr": 140733275306418, "addr_info": "KERNELBASE.dll:.text", "idx": 17 }, { "addr": 140733275528283, "addr_info": "KERNELBASE.dll:.text", "idx": 18 }, { "addr": 140733274804744, "addr_info": "KERNELBASE.dll:.text", "idx": 19 }, { "addr": 140733275076832, "addr_info": "KERNELBASE.dll:.text", "idx": 20 }, { "addr": 140733275329713, "addr_info": "KERNELBASE.dll:.text", "idx": 21 }, { "addr": 140733275328598, "addr_info": "KERNELBASE.dll:.text", "idx": 22 }, { "addr": 140733289145076, "addr_info": "KERNEL32.DLL:.text", "idx": 23 }, { "addr": 140703039692782, "addr_info": "redtest3.exe:.text", "idx": 24 }, { "addr": 140703039702818, "addr_info": "redtest3.exe:.text", "idx": 25 }, { "addr": 140703039703776, "addr_info": "redtest3.exe:.text", "idx": 26 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL:.text", "idx": 27 }, { "addr": 140733318999928, "addr_info": "ntdll.dll:.text", "idx": 28 } ], "timedatestamp": 2728493560, "trace_id": 41, "type": "etw" }, { "defaultbase": 140733297328128, "etw_event_id": 5, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Process", "etw_tid": 7148, "etw_time": 134271933909794510, "event": "ImageLoadInfo ", "id": 64, "imagebase": 140733297328128, "imagechecksum": 1181344, "imagename": "\\Device\\HarddiskVolume3\\Windows\\System32\\rpcrt4.dll", "imagesize": 1146880, "processid": 3620, "stack_trace": [ { "addr": 140733319287556, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733318810108, "addr_info": "ntdll.dll:.text", "idx": 1 }, { "addr": 140733318809082, "addr_info": "ntdll.dll:.text", "idx": 2 }, { "addr": 140733318809476, "addr_info": "ntdll.dll:.text", "idx": 3 }, { "addr": 140733318812505, "addr_info": "ntdll.dll:.text", "idx": 4 }, { "addr": 140733318782452, "addr_info": "ntdll.dll:.text", "idx": 5 }, { "addr": 140733318778422, "addr_info": "ntdll.dll:.text", "idx": 6 }, { "addr": 140733318777835, "addr_info": "ntdll.dll:.text", "idx": 7 }, { "addr": 140733318809896, "addr_info": "ntdll.dll:.text", "idx": 8 }, { "addr": 140733318812505, "addr_info": "ntdll.dll:.text", "idx": 9 }, { "addr": 140733318782452, "addr_info": "ntdll.dll:.text", "idx": 10 }, { "addr": 140733318778422, "addr_info": "ntdll.dll:.text", "idx": 11 }, { "addr": 140733318777835, "addr_info": "ntdll.dll:.text", "idx": 12 }, { "addr": 140733318809896, "addr_info": "ntdll.dll:.text", "idx": 13 }, { "addr": 140733318695743, "addr_info": "ntdll.dll:.text", "idx": 14 }, { "addr": 140733318698272, "addr_info": "ntdll.dll:.text", "idx": 15 }, { "addr": 140733318697711, "addr_info": "ntdll.dll:.text", "idx": 16 }, { "addr": 140733318794756, "addr_info": "ntdll.dll:.text", "idx": 17 }, { "addr": 140733318729472, "addr_info": "ntdll.dll:.text", "idx": 18 }, { "addr": 140733318717630, "addr_info": "ntdll.dll:.text", "idx": 19 }, { "addr": 140733318771045, "addr_info": "ntdll.dll:.text", "idx": 20 }, { "addr": 140733318807335, "addr_info": "ntdll.dll:.text", "idx": 21 }, { "addr": 140733275306418, "addr_info": "KERNELBASE.dll:.text", "idx": 22 }, { "addr": 140733275528283, "addr_info": "KERNELBASE.dll:.text", "idx": 23 }, { "addr": 140733274804744, "addr_info": "KERNELBASE.dll:.text", "idx": 24 }, { "addr": 140733275076832, "addr_info": "KERNELBASE.dll:.text", "idx": 25 }, { "addr": 140733275329713, "addr_info": "KERNELBASE.dll:.text", "idx": 26 }, { "addr": 140733275328598, "addr_info": "KERNELBASE.dll:.text", "idx": 27 }, { "addr": 140733289145076, "addr_info": "KERNEL32.DLL:.text", "idx": 28 }, { "addr": 140703039692782, "addr_info": "redtest3.exe:.text", "idx": 29 }, { "addr": 140703039702818, "addr_info": "redtest3.exe:.text", "idx": 30 }, { "addr": 140703039703776, "addr_info": "redtest3.exe:.text", "idx": 31 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL:.text", "idx": 32 }, { "addr": 140733318999928, "addr_info": "ntdll.dll:.text", "idx": 33 } ], "timedatestamp": 319493896, "trace_id": 41, "type": "etw" }, { "defaultbase": 140733272293376, "etw_event_id": 5, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Process", "etw_tid": 7148, "etw_time": 134271933909796980, "event": "ImageLoadInfo ", "id": 65, "imagebase": 140733272293376, "imagechecksum": 642630, "imagename": "\\Device\\HarddiskVolume3\\Windows\\System32\\msvcp_win.dll", "imagesize": 630784, "processid": 3620, "stack_trace": [ { "addr": 140733319287556, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733318810108, "addr_info": "ntdll.dll:.text", "idx": 1 }, { "addr": 140733318809082, "addr_info": "ntdll.dll:.text", "idx": 2 }, { "addr": 140733318809476, "addr_info": "ntdll.dll:.text", "idx": 3 }, { "addr": 140733318812505, "addr_info": "ntdll.dll:.text", "idx": 4 }, { "addr": 140733318782452, "addr_info": "ntdll.dll:.text", "idx": 5 }, { "addr": 140733318778422, "addr_info": "ntdll.dll:.text", "idx": 6 }, { "addr": 140733318777835, "addr_info": "ntdll.dll:.text", "idx": 7 }, { "addr": 140733318809896, "addr_info": "ntdll.dll:.text", "idx": 8 }, { "addr": 140733318695743, "addr_info": "ntdll.dll:.text", "idx": 9 }, { "addr": 140733318698272, "addr_info": "ntdll.dll:.text", "idx": 10 }, { "addr": 140733318697711, "addr_info": "ntdll.dll:.text", "idx": 11 }, { "addr": 140733318794756, "addr_info": "ntdll.dll:.text", "idx": 12 }, { "addr": 140733318729472, "addr_info": "ntdll.dll:.text", "idx": 13 }, { "addr": 140733318717630, "addr_info": "ntdll.dll:.text", "idx": 14 }, { "addr": 140733318771045, "addr_info": "ntdll.dll:.text", "idx": 15 }, { "addr": 140733318807335, "addr_info": "ntdll.dll:.text", "idx": 16 }, { "addr": 140733275306418, "addr_info": "KERNELBASE.dll:.text", "idx": 17 }, { "addr": 140733275528283, "addr_info": "KERNELBASE.dll:.text", "idx": 18 }, { "addr": 140733274804744, "addr_info": "KERNELBASE.dll:.text", "idx": 19 }, { "addr": 140733275076832, "addr_info": "KERNELBASE.dll:.text", "idx": 20 }, { "addr": 140733275329713, "addr_info": "KERNELBASE.dll:.text", "idx": 21 }, { "addr": 140733275328598, "addr_info": "KERNELBASE.dll:.text", "idx": 22 }, { "addr": 140733289145076, "addr_info": "KERNEL32.DLL:.text", "idx": 23 }, { "addr": 140703039692782, "addr_info": "redtest3.exe:.text", "idx": 24 }, { "addr": 140703039702818, "addr_info": "redtest3.exe:.text", "idx": 25 }, { "addr": 140703039703776, "addr_info": "redtest3.exe:.text", "idx": 26 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL:.text", "idx": 27 }, { "addr": 140733318999928, "addr_info": "ntdll.dll:.text", "idx": 28 } ], "timedatestamp": 2382890697, "trace_id": 41, "type": "etw" }, { "defaultbase": 140733268557824, "etw_event_id": 5, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Process", "etw_tid": 7148, "etw_time": 134271933909800750, "event": "ImageLoadInfo ", "id": 66, "imagebase": 140733268557824, "imagechecksum": 190606, "imagename": "\\Device\\HarddiskVolume3\\Windows\\System32\\profapi.dll", "imagesize": 151552, "processid": 3620, "stack_trace": [ { "addr": 140733319287556, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733318810108, "addr_info": "ntdll.dll:.text", "idx": 1 }, { "addr": 140733318809082, "addr_info": "ntdll.dll:.text", "idx": 2 }, { "addr": 140733318809476, "addr_info": "ntdll.dll:.text", "idx": 3 }, { "addr": 140733318695743, "addr_info": "ntdll.dll:.text", "idx": 4 }, { "addr": 140733318696952, "addr_info": "ntdll.dll:.text", "idx": 5 }, { "addr": 140733318697920, "addr_info": "ntdll.dll:.text", "idx": 6 }, { "addr": 140733318800848, "addr_info": "ntdll.dll:.text", "idx": 7 }, { "addr": 140733318794768, "addr_info": "ntdll.dll:.text", "idx": 8 }, { "addr": 140733318729472, "addr_info": "ntdll.dll:.text", "idx": 9 }, { "addr": 140733318717630, "addr_info": "ntdll.dll:.text", "idx": 10 }, { "addr": 140733318771045, "addr_info": "ntdll.dll:.text", "idx": 11 }, { "addr": 140733318807335, "addr_info": "ntdll.dll:.text", "idx": 12 }, { "addr": 140733275306418, "addr_info": "KERNELBASE.dll:.text", "idx": 13 }, { "addr": 140733275528283, "addr_info": "KERNELBASE.dll:.text", "idx": 14 }, { "addr": 140733274804744, "addr_info": "KERNELBASE.dll:.text", "idx": 15 }, { "addr": 140733275076832, "addr_info": "KERNELBASE.dll:.text", "idx": 16 }, { "addr": 140733275329713, "addr_info": "KERNELBASE.dll:.text", "idx": 17 }, { "addr": 140733275328598, "addr_info": "KERNELBASE.dll:.text", "idx": 18 }, { "addr": 140733289145076, "addr_info": "KERNEL32.DLL:.text", "idx": 19 }, { "addr": 140703039692782, "addr_info": "redtest3.exe:.text", "idx": 20 }, { "addr": 140703039702818, "addr_info": "redtest3.exe:.text", "idx": 21 }, { "addr": 140703039703776, "addr_info": "redtest3.exe:.text", "idx": 22 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL:.text", "idx": 23 }, { "addr": 140733318999928, "addr_info": "ntdll.dll:.text", "idx": 24 } ], "timedatestamp": 719887316, "trace_id": 41, "type": "etw" }, { "defaultbase": 140733234806784, "etw_event_id": 5, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Process", "etw_tid": 7148, "etw_time": 134271933909822820, "event": "ImageLoadInfo ", "id": 67, "imagebase": 140733234806784, "imagechecksum": 9633520, "imagename": "\\Device\\HarddiskVolume3\\Windows\\System32\\windows.storage.dll", "imagesize": 9543680, "processid": 3620, "stack_trace": [ { "addr": 140733319287556, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733318810108, "addr_info": "ntdll.dll:.text", "idx": 1 }, { "addr": 140733318809082, "addr_info": "ntdll.dll:.text", "idx": 2 }, { "addr": 140733318809476, "addr_info": "ntdll.dll:.text", "idx": 3 }, { "addr": 140733318695743, "addr_info": "ntdll.dll:.text", "idx": 4 }, { "addr": 140733318698272, "addr_info": "ntdll.dll:.text", "idx": 5 }, { "addr": 140733318697711, "addr_info": "ntdll.dll:.text", "idx": 6 }, { "addr": 140733318794756, "addr_info": "ntdll.dll:.text", "idx": 7 }, { "addr": 140733318729472, "addr_info": "ntdll.dll:.text", "idx": 8 }, { "addr": 140733318717630, "addr_info": "ntdll.dll:.text", "idx": 9 }, { "addr": 140733318771045, "addr_info": "ntdll.dll:.text", "idx": 10 }, { "addr": 140733318807335, "addr_info": "ntdll.dll:.text", "idx": 11 }, { "addr": 140732575829714, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 12 }, { "addr": 140732575835543, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 13 }, { "addr": 140732575740493, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 14 }, { "addr": 140733274804744, "addr_info": "KERNELBASE.dll:.text", "idx": 15 }, { "addr": 140733275076832, "addr_info": "KERNELBASE.dll:.text", "idx": 16 }, { "addr": 140733275329713, "addr_info": "KERNELBASE.dll:.text", "idx": 17 }, { "addr": 140733275328598, "addr_info": "KERNELBASE.dll:.text", "idx": 18 }, { "addr": 140733289145076, "addr_info": "KERNEL32.DLL:.text", "idx": 19 }, { "addr": 140703039692782, "addr_info": "redtest3.exe:.text", "idx": 20 }, { "addr": 140703039702818, "addr_info": "redtest3.exe:.text", "idx": 21 }, { "addr": 140703039703776, "addr_info": "redtest3.exe:.text", "idx": 22 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL:.text", "idx": 23 }, { "addr": 140733318999928, "addr_info": "ntdll.dll:.text", "idx": 24 } ], "timedatestamp": 1920864934, "trace_id": 41, "type": "etw" }, { "defaultbase": 140733273473024, "etw_event_id": 5, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Process", "etw_tid": 7148, "etw_time": 134271933909824300, "event": "ImageLoadInfo ", "id": 68, "imagebase": 140733273473024, "imagechecksum": 1352135, "imagename": "\\Device\\HarddiskVolume3\\Windows\\System32\\WinTypes.dll", "imagesize": 1306624, "processid": 3620, "stack_trace": [ { "addr": 140733319287556, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733318810108, "addr_info": "ntdll.dll:.text", "idx": 1 }, { "addr": 140733318809082, "addr_info": "ntdll.dll:.text", "idx": 2 }, { "addr": 140733318809476, "addr_info": "ntdll.dll:.text", "idx": 3 }, { "addr": 140733318812505, "addr_info": "ntdll.dll:.text", "idx": 4 }, { "addr": 140733318782452, "addr_info": "ntdll.dll:.text", "idx": 5 }, { "addr": 140733318778422, "addr_info": "ntdll.dll:.text", "idx": 6 }, { "addr": 140733318777835, "addr_info": "ntdll.dll:.text", "idx": 7 }, { "addr": 140733318809896, "addr_info": "ntdll.dll:.text", "idx": 8 }, { "addr": 140733318695743, "addr_info": "ntdll.dll:.text", "idx": 9 }, { "addr": 140733318698272, "addr_info": "ntdll.dll:.text", "idx": 10 }, { "addr": 140733318697711, "addr_info": "ntdll.dll:.text", "idx": 11 }, { "addr": 140733318794756, "addr_info": "ntdll.dll:.text", "idx": 12 }, { "addr": 140733318729472, "addr_info": "ntdll.dll:.text", "idx": 13 }, { "addr": 140733318717630, "addr_info": "ntdll.dll:.text", "idx": 14 }, { "addr": 140733318771045, "addr_info": "ntdll.dll:.text", "idx": 15 }, { "addr": 140733318807335, "addr_info": "ntdll.dll:.text", "idx": 16 }, { "addr": 140732575829714, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 17 }, { "addr": 140732575835543, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 18 }, { "addr": 140732575740493, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 19 }, { "addr": 140733274804744, "addr_info": "KERNELBASE.dll:.text", "idx": 20 }, { "addr": 140733275076832, "addr_info": "KERNELBASE.dll:.text", "idx": 21 }, { "addr": 140733275329713, "addr_info": "KERNELBASE.dll:.text", "idx": 22 }, { "addr": 140733275328598, "addr_info": "KERNELBASE.dll:.text", "idx": 23 }, { "addr": 140733289145076, "addr_info": "KERNEL32.DLL:.text", "idx": 24 }, { "addr": 140703039692782, "addr_info": "redtest3.exe:.text", "idx": 25 }, { "addr": 140703039702818, "addr_info": "redtest3.exe:.text", "idx": 26 }, { "addr": 140703039703776, "addr_info": "redtest3.exe:.text", "idx": 27 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL:.text", "idx": 28 }, { "addr": 140733318999928, "addr_info": "ntdll.dll:.text", "idx": 29 } ], "timedatestamp": 1945972378, "trace_id": 41, "type": "etw" }, { "defaultbase": 140733292412928, "etw_event_id": 5, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Process", "etw_tid": 7148, "etw_time": 134271933909832580, "event": "ImageLoadInfo ", "id": 69, "imagebase": 140733292412928, "imagechecksum": 1097776, "imagename": "\\Device\\HarddiskVolume3\\Windows\\System32\\SHCore.dll", "imagesize": 1064960, "processid": 3620, "stack_trace": [ { "addr": 140733319287556, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733318810108, "addr_info": "ntdll.dll:.text", "idx": 1 }, { "addr": 140733318809082, "addr_info": "ntdll.dll:.text", "idx": 2 }, { "addr": 140733318809476, "addr_info": "ntdll.dll:.text", "idx": 3 }, { "addr": 140733318812505, "addr_info": "ntdll.dll:.text", "idx": 4 }, { "addr": 140733318816473, "addr_info": "ntdll.dll:.text", "idx": 5 }, { "addr": 140733318794726, "addr_info": "ntdll.dll:.text", "idx": 6 }, { "addr": 140733318729472, "addr_info": "ntdll.dll:.text", "idx": 7 }, { "addr": 140733318717630, "addr_info": "ntdll.dll:.text", "idx": 8 }, { "addr": 140733318771045, "addr_info": "ntdll.dll:.text", "idx": 9 }, { "addr": 140733318807335, "addr_info": "ntdll.dll:.text", "idx": 10 }, { "addr": 140733236538210, "addr_info": "windows.storage.dll:.text", "idx": 11 }, { "addr": 140733236734919, "addr_info": "windows.storage.dll:.text", "idx": 12 }, { "addr": 140733235986078, "addr_info": "windows.storage.dll:.text", "idx": 13 }, { "addr": 140733235982905, "addr_info": "windows.storage.dll:.text", "idx": 14 }, { "addr": 140733235997449, "addr_info": "windows.storage.dll:.text", "idx": 15 }, { "addr": 140732575740493, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 16 }, { "addr": 140733274804744, "addr_info": "KERNELBASE.dll:.text", "idx": 17 }, { "addr": 140733275076832, "addr_info": "KERNELBASE.dll:.text", "idx": 18 }, { "addr": 140733275329713, "addr_info": "KERNELBASE.dll:.text", "idx": 19 }, { "addr": 140733275328598, "addr_info": "KERNELBASE.dll:.text", "idx": 20 }, { "addr": 140733289145076, "addr_info": "KERNEL32.DLL:.text", "idx": 21 }, { "addr": 140703039692782, "addr_info": "redtest3.exe:.text", "idx": 22 }, { "addr": 140703039702818, "addr_info": "redtest3.exe:.text", "idx": 23 }, { "addr": 140703039703776, "addr_info": "redtest3.exe:.text", "idx": 24 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL:.text", "idx": 25 }, { "addr": 140733318999928, "addr_info": "ntdll.dll:.text", "idx": 26 } ], "timedatestamp": 3016141450, "trace_id": 41, "type": "etw" }, { "defaultbase": 140733288677376, "etw_event_id": 5, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Process", "etw_tid": 7148, "etw_time": 134271933909838200, "event": "ImageLoadInfo ", "id": 70, "imagebase": 140733288677376, "imagechecksum": 448942, "imagename": "\\Device\\HarddiskVolume3\\Windows\\System32\\shlwapi.dll", "imagesize": 430080, "processid": 3620, "stack_trace": [ { "addr": 140733319287556, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733318810108, "addr_info": "ntdll.dll:.text", "idx": 1 }, { "addr": 140733318809082, "addr_info": "ntdll.dll:.text", "idx": 2 }, { "addr": 140733318809476, "addr_info": "ntdll.dll:.text", "idx": 3 }, { "addr": 140733318812505, "addr_info": "ntdll.dll:.text", "idx": 4 }, { "addr": 140733318816473, "addr_info": "ntdll.dll:.text", "idx": 5 }, { "addr": 140733318794726, "addr_info": "ntdll.dll:.text", "idx": 6 }, { "addr": 140733318729472, "addr_info": "ntdll.dll:.text", "idx": 7 }, { "addr": 140733318717630, "addr_info": "ntdll.dll:.text", "idx": 8 }, { "addr": 140733318771045, "addr_info": "ntdll.dll:.text", "idx": 9 }, { "addr": 140733318807335, "addr_info": "ntdll.dll:.text", "idx": 10 }, { "addr": 140733236538210, "addr_info": "windows.storage.dll:.text", "idx": 11 }, { "addr": 140733236755699, "addr_info": "windows.storage.dll:.text", "idx": 12 }, { "addr": 140733235953054, "addr_info": "windows.storage.dll:.text", "idx": 13 }, { "addr": 140733236209330, "addr_info": "windows.storage.dll:.text", "idx": 14 }, { "addr": 140733235941383, "addr_info": "windows.storage.dll:.text", "idx": 15 }, { "addr": 140733235985516, "addr_info": "windows.storage.dll:.text", "idx": 16 }, { "addr": 140733235982905, "addr_info": "windows.storage.dll:.text", "idx": 17 }, { "addr": 140733235997449, "addr_info": "windows.storage.dll:.text", "idx": 18 }, { "addr": 140732575740493, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 19 }, { "addr": 140733274804744, "addr_info": "KERNELBASE.dll:.text", "idx": 20 }, { "addr": 140733275076832, "addr_info": "KERNELBASE.dll:.text", "idx": 21 }, { "addr": 140733275329713, "addr_info": "KERNELBASE.dll:.text", "idx": 22 }, { "addr": 140733275328598, "addr_info": "KERNELBASE.dll:.text", "idx": 23 }, { "addr": 140733289145076, "addr_info": "KERNEL32.DLL:.text", "idx": 24 }, { "addr": 140703039692782, "addr_info": "redtest3.exe:.text", "idx": 25 }, { "addr": 140703039702818, "addr_info": "redtest3.exe:.text", "idx": 26 }, { "addr": 140703039703776, "addr_info": "redtest3.exe:.text", "idx": 27 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL:.text", "idx": 28 }, { "addr": 140733318999928, "addr_info": "ntdll.dll:.text", "idx": 29 } ], "timedatestamp": 3104884628, "trace_id": 41, "type": "etw" }, { "baseaddress": 546687045648, "bytescopied": 8, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271932395558750, "callingthreadid": 3300, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 3300, "etw_time": 134271933909665440, "event": "KERNEL_THREATINT_TASK_READVM", "id": 71, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319288292, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733275150581, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140733275151673, "addr_info": "KERNELBASE.dll", "idx": 2 }, { "addr": 140733275151129, "addr_info": "KERNELBASE.dll", "idx": 3 }, { "addr": 140732928926912, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732922673719, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732922672322, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732922671120, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732921179850, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732921174752, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921174289, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921172268, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732921171926, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732921913546, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732921170783, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732921169556, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732929341080, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732929340803, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 18 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 19 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 20 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 21 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 546685583360, "vavadallocationprotect": 4, "vavadcommitsize": 12288, "vavadmmfname": "", "vavadqueryresult": 0, "vavadregionsize": 2097152, "vavadregiontype": 131072 }, { "baseaddress": 546687045656, "bytescopied": 8, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271932395558750, "callingthreadid": 3300, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 3300, "etw_time": 134271933909665540, "event": "KERNEL_THREATINT_TASK_READVM", "id": 72, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319288292, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733275151392, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140733275151129, "addr_info": "KERNELBASE.dll", "idx": 2 }, { "addr": 140732928926912, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732922673719, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732922672322, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732922671120, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732921179850, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732921174752, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732921174289, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921172268, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921171926, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732921913546, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732921170783, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732921169556, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732929341080, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732929340803, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 17 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 18 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 19 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 20 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 546685583360, "vavadallocationprotect": 4, "vavadcommitsize": 12288, "vavadmmfname": "", "vavadqueryresult": 0, "vavadregionsize": 2097152, "vavadregiontype": 131072 }, { "baseaddress": 140733320229984, "bytescopied": 8, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271932395558750, "callingthreadid": 3300, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 3300, "etw_time": 134271933909665680, "event": "KERNEL_THREATINT_TASK_READVM", "id": 73, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319288292, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733275151460, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140733275151129, "addr_info": "KERNELBASE.dll", "idx": 2 }, { "addr": 140732928926912, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732922673719, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732922672322, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732922671120, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732921179850, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732921174752, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732921174289, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921172268, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921171926, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732921913546, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732921170783, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732921169556, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732929341080, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732929340803, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 17 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 18 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 19 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 20 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 140733318627328, "vavadallocationprotect": 128, "vavadcommitsize": 65536, "vavadmmfname": "\\Device\\HarddiskVolume3\\Windows\\System32\\ntdll.dll", "vavadqueryresult": 0, "vavadregionsize": 2195456, "vavadregiontype": 16777216 }, { "baseaddress": 2475692598368, "bytescopied": 136, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271932395558750, "callingthreadid": 3300, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 3300, "etw_time": 134271933909665780, "event": "KERNEL_THREATINT_TASK_READVM", "id": 74, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319288292, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733275151537, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140733275151129, "addr_info": "KERNELBASE.dll", "idx": 2 }, { "addr": 140732928926912, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732922673719, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732922672322, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732922671120, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732921179850, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732921174752, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732921174289, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921172268, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921171926, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732921913546, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732921170783, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732921169556, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732929341080, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732929340803, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 17 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 18 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 19 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 20 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 2475692589056, "vavadallocationprotect": 4, "vavadcommitsize": 57344, "vavadmmfname": "", "vavadqueryresult": 0, "vavadregionsize": 1048576, "vavadregiontype": 131072 }, { "allocationtype": 12288, "baseaddress": 2344576548864, "callingprocesscreatetime": 134271933909597060, "callingprocessid": 3620, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238807, "callingthreadcreatetime": 134271933909597070, "callingthreadid": 7148, "etw_event_id": 1, "etw_pid": 3620, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 7148, "etw_time": 134271933910509380, "event": "KERNEL_THREATINT_TASK_ALLOCVM", "id": 75, "originalprocesscreatetime": 134271933909597060, "originalprocessid": 3620, "originalprocessprotection": "unsupported", "originalprocesssectionsignaturelevel": "unsupported", "originalprocesssignaturelevel": "unsupported", "originalprocessstartkey": 3659174697238807, "process_name": "redtest3.exe", "protectionmask": "RWX", "regionsize": 102400, "stack_trace": [ { "addr": 140733319287044, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733275286956, "addr_info": "KERNELBASE.dll:.text", "idx": 1 }, { "addr": 140733275286838, "addr_info": "KERNELBASE.dll:.text", "idx": 2 }, { "addr": 140703039693028, "addr_info": "redtest3.exe:.text", "idx": 3 }, { "addr": 140703039702818, "addr_info": "redtest3.exe:.text", "idx": 4 }, { "addr": 140703039703776, "addr_info": "redtest3.exe:.text", "idx": 5 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL:.text", "idx": 6 }, { "addr": 140733318999928, "addr_info": "ntdll.dll:.text", "idx": 7 } ], "targetprocesscreatetime": 134271933910302100, "targetprocessid": 4868, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238808, "trace_id": 41, "type": "etw" }, { "defaultbase": 140733317644288, "etw_event_id": 5, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Process", "etw_tid": 7148, "etw_time": 134271933909839060, "event": "ImageLoadInfo ", "id": 76, "imagebase": 140733317644288, "imagechecksum": 739285, "imagename": "\\Device\\HarddiskVolume3\\Windows\\System32\\msvcrt.dll", "imagesize": 684032, "processid": 3620, "stack_trace": [ { "addr": 140733319287556, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733318810108, "addr_info": "ntdll.dll:.text", "idx": 1 }, { "addr": 140733318809082, "addr_info": "ntdll.dll:.text", "idx": 2 }, { "addr": 140733318809476, "addr_info": "ntdll.dll:.text", "idx": 3 }, { "addr": 140733318812505, "addr_info": "ntdll.dll:.text", "idx": 4 }, { "addr": 140733318782452, "addr_info": "ntdll.dll:.text", "idx": 5 }, { "addr": 140733318778422, "addr_info": "ntdll.dll:.text", "idx": 6 }, { "addr": 140733318777835, "addr_info": "ntdll.dll:.text", "idx": 7 }, { "addr": 140733318809896, "addr_info": "ntdll.dll:.text", "idx": 8 }, { "addr": 140733318812505, "addr_info": "ntdll.dll:.text", "idx": 9 }, { "addr": 140733318816473, "addr_info": "ntdll.dll:.text", "idx": 10 }, { "addr": 140733318794726, "addr_info": "ntdll.dll:.text", "idx": 11 }, { "addr": 140733318729472, "addr_info": "ntdll.dll:.text", "idx": 12 }, { "addr": 140733318717630, "addr_info": "ntdll.dll:.text", "idx": 13 }, { "addr": 140733318771045, "addr_info": "ntdll.dll:.text", "idx": 14 }, { "addr": 140733318807335, "addr_info": "ntdll.dll:.text", "idx": 15 }, { "addr": 140733236538210, "addr_info": "windows.storage.dll:.text", "idx": 16 }, { "addr": 140733236755699, "addr_info": "windows.storage.dll:.text", "idx": 17 }, { "addr": 140733235953054, "addr_info": "windows.storage.dll:.text", "idx": 18 }, { "addr": 140733236209330, "addr_info": "windows.storage.dll:.text", "idx": 19 }, { "addr": 140733235941383, "addr_info": "windows.storage.dll:.text", "idx": 20 }, { "addr": 140733235985516, "addr_info": "windows.storage.dll:.text", "idx": 21 }, { "addr": 140733235982905, "addr_info": "windows.storage.dll:.text", "idx": 22 }, { "addr": 140733235997449, "addr_info": "windows.storage.dll:.text", "idx": 23 }, { "addr": 140732575740493, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 24 }, { "addr": 140733274804744, "addr_info": "KERNELBASE.dll:.text", "idx": 25 }, { "addr": 140733275076832, "addr_info": "KERNELBASE.dll:.text", "idx": 26 }, { "addr": 140733275329713, "addr_info": "KERNELBASE.dll:.text", "idx": 27 }, { "addr": 140733275328598, "addr_info": "KERNELBASE.dll:.text", "idx": 28 }, { "addr": 140733289145076, "addr_info": "KERNEL32.DLL:.text", "idx": 29 }, { "addr": 140703039692782, "addr_info": "redtest3.exe:.text", "idx": 30 }, { "addr": 140703039702818, "addr_info": "redtest3.exe:.text", "idx": 31 }, { "addr": 140703039703776, "addr_info": "redtest3.exe:.text", "idx": 32 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL:.text", "idx": 33 }, { "addr": 140733318999928, "addr_info": "ntdll.dll:.text", "idx": 34 } ], "timedatestamp": 1702569737, "trace_id": 41, "type": "etw" }, { "etw_event_id": 10, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-File", "etw_tid": 7148, "etw_time": 134271933909877420, "event": "NameCreateInfo ", "filekey": 18446692399639155000, "filename": "\\Device\\HarddiskVolume3\\Users\\hacker\\AppData\\Local\\Microsoft\\WindowsApps\\notepad.exe", "id": 77, "stack_trace": [ { "addr": 140733319288996, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733274957424, "addr_info": "KERNELBASE.dll:.text", "idx": 1 }, { "addr": 140733274955740, "addr_info": "KERNELBASE.dll:.text", "idx": 2 }, { "addr": 140732575735836, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 3 }, { "addr": 140732575776289, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 4 }, { "addr": 140732575735620, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 5 }, { "addr": 140732575734382, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 6 }, { "addr": 140733274804853, "addr_info": "KERNELBASE.dll:.text", "idx": 7 }, { "addr": 140733275076832, "addr_info": "KERNELBASE.dll:.text", "idx": 8 }, { "addr": 140733275329713, "addr_info": "KERNELBASE.dll:.text", "idx": 9 }, { "addr": 140733275328598, "addr_info": "KERNELBASE.dll:.text", "idx": 10 }, { "addr": 140733289145076, "addr_info": "KERNEL32.DLL:.text", "idx": 11 }, { "addr": 140703039692782, "addr_info": "redtest3.exe:.text", "idx": 12 }, { "addr": 140703039702818, "addr_info": "redtest3.exe:.text", "idx": 13 }, { "addr": 140703039703776, "addr_info": "redtest3.exe:.text", "idx": 14 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL:.text", "idx": 15 }, { "addr": 140733318999928, "addr_info": "ntdll.dll:.text", "idx": 16 } ], "trace_id": 41, "type": "etw" }, { "etw_event_id": 3, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Process", "etw_tid": 5200, "etw_time": 134271933909885820, "event": "ThreadStartStart ", "id": 78, "processid": 3620, "stack_trace": [ { "addr": 140733319298420, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733318845462, "addr_info": "ntdll.dll:.text", "idx": 1 }, { "addr": 140733318845044, "addr_info": "ntdll.dll:.text", "idx": 2 }, { "addr": 140733318836176, "addr_info": "ntdll.dll:.text", "idx": 3 }, { "addr": 140733275223643, "addr_info": "KERNELBASE.dll:.text", "idx": 4 }, { "addr": 140733297346429, "addr_info": "RPCRT4.dll:.text", "idx": 5 }, { "addr": 140733297427227, "addr_info": "RPCRT4.dll:.text", "idx": 6 }, { "addr": 140733297426721, "addr_info": "RPCRT4.dll:.text", "idx": 7 }, { "addr": 140733297486018, "addr_info": "RPCRT4.dll:.text", "idx": 8 }, { "addr": 140733297508041, "addr_info": "RPCRT4.dll:.text", "idx": 9 }, { "addr": 140733318951847, "addr_info": "ntdll.dll:.text", "idx": 10 }, { "addr": 140733318847724, "addr_info": "ntdll.dll:.text", "idx": 11 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL:.text", "idx": 12 }, { "addr": 140733318999928, "addr_info": "ntdll.dll:.text", "idx": 13 } ], "stackbase": 18446626998471066000, "stacklimit": 18446626998471040000, "startaddr": 140733318845888, "subprocesstag": 0, "tebbase": 546687082496, "threadid": 6828, "trace_id": 41, "type": "etw", "userstackbase": 546691874816, "userstacklimit": 546691870720, "win32startaddr": 140733318845888 }, { "defaultbase": 140733252501504, "etw_event_id": 5, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Process", "etw_tid": 7148, "etw_time": 134271933909994200, "event": "ImageLoadInfo ", "id": 79, "imagebase": 140733252501504, "imagechecksum": 147463, "imagename": "\\Device\\HarddiskVolume3\\Windows\\System32\\kernel.appcore.dll", "imagesize": 98304, "processid": 3620, "stack_trace": [ { "addr": 140733319287556, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733318810108, "addr_info": "ntdll.dll:.text", "idx": 1 }, { "addr": 140733318809082, "addr_info": "ntdll.dll:.text", "idx": 2 }, { "addr": 140733318809476, "addr_info": "ntdll.dll:.text", "idx": 3 }, { "addr": 140733318695743, "addr_info": "ntdll.dll:.text", "idx": 4 }, { "addr": 140733318698272, "addr_info": "ntdll.dll:.text", "idx": 5 }, { "addr": 140733318697711, "addr_info": "ntdll.dll:.text", "idx": 6 }, { "addr": 140733318794756, "addr_info": "ntdll.dll:.text", "idx": 7 }, { "addr": 140733318729472, "addr_info": "ntdll.dll:.text", "idx": 8 }, { "addr": 140733318717630, "addr_info": "ntdll.dll:.text", "idx": 9 }, { "addr": 140733318771045, "addr_info": "ntdll.dll:.text", "idx": 10 }, { "addr": 140733318807335, "addr_info": "ntdll.dll:.text", "idx": 11 }, { "addr": 140732575829714, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 12 }, { "addr": 140732575834031, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 13 }, { "addr": 140732575806453, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 14 }, { "addr": 140732575736469, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 15 }, { "addr": 140732575776289, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 16 }, { "addr": 140732575735620, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 17 }, { "addr": 140732575734382, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 18 }, { "addr": 140733274804853, "addr_info": "KERNELBASE.dll:.text", "idx": 19 }, { "addr": 140733275076832, "addr_info": "KERNELBASE.dll:.text", "idx": 20 }, { "addr": 140733275329713, "addr_info": "KERNELBASE.dll:.text", "idx": 21 }, { "addr": 140733275328598, "addr_info": "KERNELBASE.dll:.text", "idx": 22 }, { "addr": 140733289145076, "addr_info": "KERNEL32.DLL:.text", "idx": 23 }, { "addr": 140703039692782, "addr_info": "redtest3.exe:.text", "idx": 24 }, { "addr": 140703039702818, "addr_info": "redtest3.exe:.text", "idx": 25 }, { "addr": 140703039703776, "addr_info": "redtest3.exe:.text", "idx": 26 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL:.text", "idx": 27 }, { "addr": 140733318999928, "addr_info": "ntdll.dll:.text", "idx": 28 } ], "timedatestamp": 2576179553, "trace_id": 41, "type": "etw" }, { "defaultbase": 140732843950080, "etw_event_id": 5, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Process", "etw_tid": 7148, "etw_time": 134271933909998220, "event": "ImageLoadInfo ", "id": 80, "imagebase": 140732843950080, "imagechecksum": 1151134, "imagename": "\\Device\\HarddiskVolume3\\Windows\\System32\\daxexec.dll", "imagesize": 1122304, "processid": 3620, "stack_trace": [ { "addr": 140733319287556, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733318810108, "addr_info": "ntdll.dll:.text", "idx": 1 }, { "addr": 140733318809082, "addr_info": "ntdll.dll:.text", "idx": 2 }, { "addr": 140733318809476, "addr_info": "ntdll.dll:.text", "idx": 3 }, { "addr": 140733318695743, "addr_info": "ntdll.dll:.text", "idx": 4 }, { "addr": 140733318698272, "addr_info": "ntdll.dll:.text", "idx": 5 }, { "addr": 140733318697711, "addr_info": "ntdll.dll:.text", "idx": 6 }, { "addr": 140733318794756, "addr_info": "ntdll.dll:.text", "idx": 7 }, { "addr": 140733318729472, "addr_info": "ntdll.dll:.text", "idx": 8 }, { "addr": 140733318717630, "addr_info": "ntdll.dll:.text", "idx": 9 }, { "addr": 140733318771045, "addr_info": "ntdll.dll:.text", "idx": 10 }, { "addr": 140733318807335, "addr_info": "ntdll.dll:.text", "idx": 11 }, { "addr": 140732575829714, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 12 }, { "addr": 140732575834363, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 13 }, { "addr": 140732575806597, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 14 }, { "addr": 140732575736469, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 15 }, { "addr": 140732575776289, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 16 }, { "addr": 140732575735620, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 17 }, { "addr": 140732575734382, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 18 }, { "addr": 140733274804853, "addr_info": "KERNELBASE.dll:.text", "idx": 19 }, { "addr": 140733275076832, "addr_info": "KERNELBASE.dll:.text", "idx": 20 }, { "addr": 140733275329713, "addr_info": "KERNELBASE.dll:.text", "idx": 21 }, { "addr": 140733275328598, "addr_info": "KERNELBASE.dll:.text", "idx": 22 }, { "addr": 140733289145076, "addr_info": "KERNEL32.DLL:.text", "idx": 23 }, { "addr": 140703039692782, "addr_info": "redtest3.exe:.text", "idx": 24 }, { "addr": 140703039702818, "addr_info": "redtest3.exe:.text", "idx": 25 }, { "addr": 140703039703776, "addr_info": "redtest3.exe:.text", "idx": 26 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL:.text", "idx": 27 }, { "addr": 140733318999928, "addr_info": "ntdll.dll:.text", "idx": 28 } ], "timedatestamp": 1001680520, "trace_id": 41, "type": "etw" }, { "defaultbase": 140733296410624, "etw_event_id": 5, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Process", "etw_tid": 7148, "etw_time": 134271933910001040, "event": "ImageLoadInfo ", "id": 81, "imagebase": 140733296410624, "imagechecksum": 921392, "imagename": "\\Device\\HarddiskVolume3\\Windows\\System32\\oleaut32.dll", "imagesize": 884736, "processid": 3620, "stack_trace": [ { "addr": 140733319287556, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733318810108, "addr_info": "ntdll.dll:.text", "idx": 1 }, { "addr": 140733318809082, "addr_info": "ntdll.dll:.text", "idx": 2 }, { "addr": 140733318809476, "addr_info": "ntdll.dll:.text", "idx": 3 }, { "addr": 140733318812505, "addr_info": "ntdll.dll:.text", "idx": 4 }, { "addr": 140733318782452, "addr_info": "ntdll.dll:.text", "idx": 5 }, { "addr": 140733318778422, "addr_info": "ntdll.dll:.text", "idx": 6 }, { "addr": 140733318777835, "addr_info": "ntdll.dll:.text", "idx": 7 }, { "addr": 140733318809896, "addr_info": "ntdll.dll:.text", "idx": 8 }, { "addr": 140733318695743, "addr_info": "ntdll.dll:.text", "idx": 9 }, { "addr": 140733318698272, "addr_info": "ntdll.dll:.text", "idx": 10 }, { "addr": 140733318697711, "addr_info": "ntdll.dll:.text", "idx": 11 }, { "addr": 140733318794756, "addr_info": "ntdll.dll:.text", "idx": 12 }, { "addr": 140733318729472, "addr_info": "ntdll.dll:.text", "idx": 13 }, { "addr": 140733318717630, "addr_info": "ntdll.dll:.text", "idx": 14 }, { "addr": 140733318771045, "addr_info": "ntdll.dll:.text", "idx": 15 }, { "addr": 140733318807335, "addr_info": "ntdll.dll:.text", "idx": 16 }, { "addr": 140732575829714, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 17 }, { "addr": 140732575834363, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 18 }, { "addr": 140732575806597, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 19 }, { "addr": 140732575736469, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 20 }, { "addr": 140732575776289, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 21 }, { "addr": 140732575735620, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 22 }, { "addr": 140732575734382, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 23 }, { "addr": 140733274804853, "addr_info": "KERNELBASE.dll:.text", "idx": 24 }, { "addr": 140733275076832, "addr_info": "KERNELBASE.dll:.text", "idx": 25 }, { "addr": 140733275329713, "addr_info": "KERNELBASE.dll:.text", "idx": 26 }, { "addr": 140733275328598, "addr_info": "KERNELBASE.dll:.text", "idx": 27 }, { "addr": 140733289145076, "addr_info": "KERNEL32.DLL:.text", "idx": 28 }, { "addr": 140703039692782, "addr_info": "redtest3.exe:.text", "idx": 29 }, { "addr": 140703039702818, "addr_info": "redtest3.exe:.text", "idx": 30 }, { "addr": 140703039703776, "addr_info": "redtest3.exe:.text", "idx": 31 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL:.text", "idx": 32 }, { "addr": 140733318999928, "addr_info": "ntdll.dll:.text", "idx": 33 } ], "timedatestamp": 37457084, "trace_id": 41, "type": "etw" }, { "defaultbase": 140733258596352, "etw_event_id": 5, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Process", "etw_tid": 7148, "etw_time": 134271933910003060, "event": "ImageLoadInfo ", "id": 82, "imagebase": 140733258596352, "imagechecksum": 203804, "imagename": "\\Device\\HarddiskVolume3\\Windows\\System32\\userenv.dll", "imagesize": 163840, "processid": 3620, "stack_trace": [ { "addr": 140733319287556, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733318810108, "addr_info": "ntdll.dll:.text", "idx": 1 }, { "addr": 140733318809082, "addr_info": "ntdll.dll:.text", "idx": 2 }, { "addr": 140733318809476, "addr_info": "ntdll.dll:.text", "idx": 3 }, { "addr": 140733318695743, "addr_info": "ntdll.dll:.text", "idx": 4 }, { "addr": 140733318696952, "addr_info": "ntdll.dll:.text", "idx": 5 }, { "addr": 140733318697920, "addr_info": "ntdll.dll:.text", "idx": 6 }, { "addr": 140733318800848, "addr_info": "ntdll.dll:.text", "idx": 7 }, { "addr": 140733318794768, "addr_info": "ntdll.dll:.text", "idx": 8 }, { "addr": 140733318729472, "addr_info": "ntdll.dll:.text", "idx": 9 }, { "addr": 140733318717630, "addr_info": "ntdll.dll:.text", "idx": 10 }, { "addr": 140733318771045, "addr_info": "ntdll.dll:.text", "idx": 11 }, { "addr": 140733318807335, "addr_info": "ntdll.dll:.text", "idx": 12 }, { "addr": 140732575829714, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 13 }, { "addr": 140732575834363, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 14 }, { "addr": 140732575806597, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 15 }, { "addr": 140732575736469, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 16 }, { "addr": 140732575776289, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 17 }, { "addr": 140732575735620, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 18 }, { "addr": 140732575734382, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 19 }, { "addr": 140733274804853, "addr_info": "KERNELBASE.dll:.text", "idx": 20 }, { "addr": 140733275076832, "addr_info": "KERNELBASE.dll:.text", "idx": 21 }, { "addr": 140733275329713, "addr_info": "KERNELBASE.dll:.text", "idx": 22 }, { "addr": 140733275328598, "addr_info": "KERNELBASE.dll:.text", "idx": 23 }, { "addr": 140733289145076, "addr_info": "KERNEL32.DLL:.text", "idx": 24 }, { "addr": 140703039692782, "addr_info": "redtest3.exe:.text", "idx": 25 }, { "addr": 140703039702818, "addr_info": "redtest3.exe:.text", "idx": 26 }, { "addr": 140703039703776, "addr_info": "redtest3.exe:.text", "idx": 27 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL:.text", "idx": 28 }, { "addr": 140733318999928, "addr_info": "ntdll.dll:.text", "idx": 29 } ], "timedatestamp": 694651271, "trace_id": 41, "type": "etw" }, { "defaultbase": 140732843622400, "etw_event_id": 5, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Process", "etw_tid": 7148, "etw_time": 134271933910005360, "event": "ImageLoadInfo ", "id": 83, "imagebase": 140732843622400, "imagechecksum": 306014, "imagename": "\\Device\\HarddiskVolume3\\Windows\\System32\\container.dll", "imagesize": 278528, "processid": 3620, "stack_trace": [ { "addr": 140733319287556, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733318810108, "addr_info": "ntdll.dll:.text", "idx": 1 }, { "addr": 140733318809082, "addr_info": "ntdll.dll:.text", "idx": 2 }, { "addr": 140733318809476, "addr_info": "ntdll.dll:.text", "idx": 3 }, { "addr": 140733318695743, "addr_info": "ntdll.dll:.text", "idx": 4 }, { "addr": 140733318696952, "addr_info": "ntdll.dll:.text", "idx": 5 }, { "addr": 140733318697920, "addr_info": "ntdll.dll:.text", "idx": 6 }, { "addr": 140733318800848, "addr_info": "ntdll.dll:.text", "idx": 7 }, { "addr": 140733318794768, "addr_info": "ntdll.dll:.text", "idx": 8 }, { "addr": 140733318729472, "addr_info": "ntdll.dll:.text", "idx": 9 }, { "addr": 140733318717630, "addr_info": "ntdll.dll:.text", "idx": 10 }, { "addr": 140733318771045, "addr_info": "ntdll.dll:.text", "idx": 11 }, { "addr": 140733318807335, "addr_info": "ntdll.dll:.text", "idx": 12 }, { "addr": 140732575829714, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 13 }, { "addr": 140732575834363, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 14 }, { "addr": 140732575806597, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 15 }, { "addr": 140732575736469, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 16 }, { "addr": 140732575776289, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 17 }, { "addr": 140732575735620, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 18 }, { "addr": 140732575734382, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 19 }, { "addr": 140733274804853, "addr_info": "KERNELBASE.dll:.text", "idx": 20 }, { "addr": 140733275076832, "addr_info": "KERNELBASE.dll:.text", "idx": 21 }, { "addr": 140733275329713, "addr_info": "KERNELBASE.dll:.text", "idx": 22 }, { "addr": 140733275328598, "addr_info": "KERNELBASE.dll:.text", "idx": 23 }, { "addr": 140733289145076, "addr_info": "KERNEL32.DLL:.text", "idx": 24 }, { "addr": 140703039692782, "addr_info": "redtest3.exe:.text", "idx": 25 }, { "addr": 140703039702818, "addr_info": "redtest3.exe:.text", "idx": 26 }, { "addr": 140703039703776, "addr_info": "redtest3.exe:.text", "idx": 27 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL:.text", "idx": 28 }, { "addr": 140733318999928, "addr_info": "ntdll.dll:.text", "idx": 29 } ], "timedatestamp": 2852169205, "trace_id": 41, "type": "etw" }, { "defaultbase": 140733270589440, "etw_event_id": 5, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Process", "etw_tid": 7148, "etw_time": 134271933910035230, "event": "ImageLoadInfo ", "id": 84, "imagebase": 140733270589440, "imagechecksum": 531633, "imagename": "\\Device\\HarddiskVolume3\\Windows\\System32\\bcryptprimitives.dll", "imagesize": 503808, "processid": 3620, "stack_trace": [ { "addr": 140733319287556, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733318810108, "addr_info": "ntdll.dll:.text", "idx": 1 }, { "addr": 140733318809082, "addr_info": "ntdll.dll:.text", "idx": 2 }, { "addr": 140733318809476, "addr_info": "ntdll.dll:.text", "idx": 3 }, { "addr": 140733318812505, "addr_info": "ntdll.dll:.text", "idx": 4 }, { "addr": 140733318816473, "addr_info": "ntdll.dll:.text", "idx": 5 }, { "addr": 140733318794726, "addr_info": "ntdll.dll:.text", "idx": 6 }, { "addr": 140733318729472, "addr_info": "ntdll.dll:.text", "idx": 7 }, { "addr": 140733318717630, "addr_info": "ntdll.dll:.text", "idx": 8 }, { "addr": 140733318771045, "addr_info": "ntdll.dll:.text", "idx": 9 }, { "addr": 140733318807335, "addr_info": "ntdll.dll:.text", "idx": 10 }, { "addr": 140733297693906, "addr_info": "RPCRT4.dll:.text", "idx": 11 }, { "addr": 140733297743697, "addr_info": "RPCRT4.dll:.text", "idx": 12 }, { "addr": 140733297439509, "addr_info": "RPCRT4.dll:.text", "idx": 13 }, { "addr": 140733302614554, "addr_info": "combase.dll:.text", "idx": 14 }, { "addr": 140733302615627, "addr_info": "combase.dll:.text", "idx": 15 }, { "addr": 140733302615540, "addr_info": "combase.dll:.text", "idx": 16 }, { "addr": 140733302726614, "addr_info": "combase.dll:.text", "idx": 17 }, { "addr": 140733302413340, "addr_info": "combase.dll:.text", "idx": 18 }, { "addr": 140733302413161, "addr_info": "combase.dll:.text", "idx": 19 }, { "addr": 140732844273878, "addr_info": "daxexec.dll:.text", "idx": 20 }, { "addr": 140732844226229, "addr_info": "daxexec.dll:.text", "idx": 21 }, { "addr": 140732844035213, "addr_info": "daxexec.dll:.text", "idx": 22 }, { "addr": 140732575806597, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 23 }, { "addr": 140732575736469, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 24 }, { "addr": 140732575776289, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 25 }, { "addr": 140732575735620, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 26 }, { "addr": 140732575734382, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 27 }, { "addr": 140733274804853, "addr_info": "KERNELBASE.dll:.text", "idx": 28 }, { "addr": 140733275076832, "addr_info": "KERNELBASE.dll:.text", "idx": 29 }, { "addr": 140733275329713, "addr_info": "KERNELBASE.dll:.text", "idx": 30 }, { "addr": 140733275328598, "addr_info": "KERNELBASE.dll:.text", "idx": 31 }, { "addr": 140733289145076, "addr_info": "KERNEL32.DLL:.text", "idx": 32 }, { "addr": 140703039692782, "addr_info": "redtest3.exe:.text", "idx": 33 }, { "addr": 140703039702818, "addr_info": "redtest3.exe:.text", "idx": 34 }, { "addr": 140703039703776, "addr_info": "redtest3.exe:.text", "idx": 35 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL:.text", "idx": 36 }, { "addr": 140733318999928, "addr_info": "ntdll.dll:.text", "idx": 37 } ], "timedatestamp": 597862400, "trace_id": 41, "type": "etw" }, { "defaultbase": 140733286252544, "etw_event_id": 5, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Process", "etw_tid": 7148, "etw_time": 134271933910042880, "event": "ImageLoadInfo ", "id": 85, "imagebase": 140733286252544, "imagechecksum": 754354, "imagename": "\\Device\\HarddiskVolume3\\Windows\\System32\\clbcatq.dll", "imagesize": 720896, "processid": 3620, "stack_trace": [ { "addr": 140733319287556, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733318810108, "addr_info": "ntdll.dll:.text", "idx": 1 }, { "addr": 140733318809082, "addr_info": "ntdll.dll:.text", "idx": 2 }, { "addr": 140733318809476, "addr_info": "ntdll.dll:.text", "idx": 3 }, { "addr": 140733318812505, "addr_info": "ntdll.dll:.text", "idx": 4 }, { "addr": 140733318816473, "addr_info": "ntdll.dll:.text", "idx": 5 }, { "addr": 140733318794726, "addr_info": "ntdll.dll:.text", "idx": 6 }, { "addr": 140733318729472, "addr_info": "ntdll.dll:.text", "idx": 7 }, { "addr": 140733318717630, "addr_info": "ntdll.dll:.text", "idx": 8 }, { "addr": 140733318771045, "addr_info": "ntdll.dll:.text", "idx": 9 }, { "addr": 140733318807335, "addr_info": "ntdll.dll:.text", "idx": 10 }, { "addr": 140733303208242, "addr_info": "combase.dll:.text", "idx": 11 }, { "addr": 140733303333295, "addr_info": "combase.dll:.text", "idx": 12 }, { "addr": 140733303173438, "addr_info": "combase.dll:.text", "idx": 13 }, { "addr": 140733302943690, "addr_info": "combase.dll:.text", "idx": 14 }, { "addr": 140733303239457, "addr_info": "combase.dll:.text", "idx": 15 }, { "addr": 140733302758259, "addr_info": "combase.dll:.text", "idx": 16 }, { "addr": 140733302755902, "addr_info": "combase.dll:.text", "idx": 17 }, { "addr": 140732844325198, "addr_info": "daxexec.dll:.text", "idx": 18 }, { "addr": 140732844282579, "addr_info": "daxexec.dll:.text", "idx": 19 }, { "addr": 140732844297602, "addr_info": "daxexec.dll:.text", "idx": 20 }, { "addr": 140732844226348, "addr_info": "daxexec.dll:.text", "idx": 21 }, { "addr": 140732844035213, "addr_info": "daxexec.dll:.text", "idx": 22 }, { "addr": 140732575806597, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 23 }, { "addr": 140732575736469, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 24 }, { "addr": 140732575776289, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 25 }, { "addr": 140732575735620, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 26 }, { "addr": 140732575734382, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 27 }, { "addr": 140733274804853, "addr_info": "KERNELBASE.dll:.text", "idx": 28 }, { "addr": 140733275076832, "addr_info": "KERNELBASE.dll:.text", "idx": 29 }, { "addr": 140733275329713, "addr_info": "KERNELBASE.dll:.text", "idx": 30 }, { "addr": 140733275328598, "addr_info": "KERNELBASE.dll:.text", "idx": 31 }, { "addr": 140733289145076, "addr_info": "KERNEL32.DLL:.text", "idx": 32 }, { "addr": 140703039692782, "addr_info": "redtest3.exe:.text", "idx": 33 }, { "addr": 140703039702818, "addr_info": "redtest3.exe:.text", "idx": 34 }, { "addr": 140703039703776, "addr_info": "redtest3.exe:.text", "idx": 35 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL:.text", "idx": 36 }, { "addr": 140733318999928, "addr_info": "ntdll.dll:.text", "idx": 37 } ], "timedatestamp": 2348632990, "trace_id": 41, "type": "etw" }, { "etw_event_id": 3, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Process", "etw_tid": 7148, "etw_time": 134271933910064220, "event": "ThreadStartStart ", "id": 86, "processid": 3620, "stack_trace": [ { "addr": 140733319292628, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733275063711, "addr_info": "KERNELBASE.dll:.text", "idx": 1 }, { "addr": 140733289219341, "addr_info": "KERNEL32.DLL:.text", "idx": 2 }, { "addr": 140733302658077, "addr_info": "combase.dll:.text", "idx": 3 }, { "addr": 140733303108978, "addr_info": "combase.dll:.text", "idx": 4 }, { "addr": 140733303108890, "addr_info": "combase.dll:.text", "idx": 5 }, { "addr": 140733302845286, "addr_info": "combase.dll:.text", "idx": 6 }, { "addr": 140733302678557, "addr_info": "combase.dll:.text", "idx": 7 }, { "addr": 140733302678248, "addr_info": "combase.dll:.text", "idx": 8 }, { "addr": 140733302845259, "addr_info": "combase.dll:.text", "idx": 9 }, { "addr": 140733302830118, "addr_info": "combase.dll:.text", "idx": 10 }, { "addr": 140733302818611, "addr_info": "combase.dll:.text", "idx": 11 }, { "addr": 140733302817199, "addr_info": "combase.dll:.text", "idx": 12 }, { "addr": 140733302793520, "addr_info": "combase.dll:.text", "idx": 13 }, { "addr": 140733302788154, "addr_info": "combase.dll:.text", "idx": 14 }, { "addr": 140733302757824, "addr_info": "combase.dll:.text", "idx": 15 }, { "addr": 140733302755902, "addr_info": "combase.dll:.text", "idx": 16 }, { "addr": 140732844325198, "addr_info": "daxexec.dll:.text", "idx": 17 }, { "addr": 140732844282579, "addr_info": "daxexec.dll:.text", "idx": 18 }, { "addr": 140732844297602, "addr_info": "daxexec.dll:.text", "idx": 19 }, { "addr": 140732844226348, "addr_info": "daxexec.dll:.text", "idx": 20 }, { "addr": 140732844035213, "addr_info": "daxexec.dll:.text", "idx": 21 }, { "addr": 140732575806597, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 22 }, { "addr": 140732575736469, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 23 }, { "addr": 140732575776289, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 24 }, { "addr": 140732575735620, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 25 }, { "addr": 140732575734382, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 26 }, { "addr": 140733274804853, "addr_info": "KERNELBASE.dll:.text", "idx": 27 }, { "addr": 140733275076832, "addr_info": "KERNELBASE.dll:.text", "idx": 28 }, { "addr": 140733275329713, "addr_info": "KERNELBASE.dll:.text", "idx": 29 }, { "addr": 140733275328598, "addr_info": "KERNELBASE.dll:.text", "idx": 30 }, { "addr": 140733289145076, "addr_info": "KERNEL32.DLL:.text", "idx": 31 }, { "addr": 140703039692782, "addr_info": "redtest3.exe:.text", "idx": 32 }, { "addr": 140703039702818, "addr_info": "redtest3.exe:.text", "idx": 33 }, { "addr": 140703039703776, "addr_info": "redtest3.exe:.text", "idx": 34 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL:.text", "idx": 35 }, { "addr": 140733318999928, "addr_info": "ntdll.dll:.text", "idx": 36 } ], "stackbase": 18446626998470894000, "stacklimit": 18446626998470870000, "startaddr": 140733303132160, "subprocesstag": 0, "tebbase": 546687090688, "threadid": 2056, "trace_id": 41, "type": "etw", "userstackbase": 546692923392, "userstacklimit": 546692915200, "win32startaddr": 140733303132160 }, { "defaultbase": 140732978167808, "etw_event_id": 5, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Process", "etw_tid": 7148, "etw_time": 134271933910082990, "event": "ImageLoadInfo ", "id": 87, "imagebase": 140732978167808, "imagechecksum": 992001, "imagename": "\\Device\\HarddiskVolume3\\Windows\\System32\\Windows.StateRepositoryPS.dll", "imagesize": 962560, "processid": 3620, "stack_trace": [ { "addr": 140733319287556, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733318810108, "addr_info": "ntdll.dll:.text", "idx": 1 }, { "addr": 140733318809082, "addr_info": "ntdll.dll:.text", "idx": 2 }, { "addr": 140733318809476, "addr_info": "ntdll.dll:.text", "idx": 3 }, { "addr": 140733318695743, "addr_info": "ntdll.dll:.text", "idx": 4 }, { "addr": 140733318698272, "addr_info": "ntdll.dll:.text", "idx": 5 }, { "addr": 140733318697711, "addr_info": "ntdll.dll:.text", "idx": 6 }, { "addr": 140733318794756, "addr_info": "ntdll.dll:.text", "idx": 7 }, { "addr": 140733318729948, "addr_info": "ntdll.dll:.text", "idx": 8 }, { "addr": 140733318801290, "addr_info": "ntdll.dll:.text", "idx": 9 }, { "addr": 140733274961746, "addr_info": "KERNELBASE.dll:.text", "idx": 10 }, { "addr": 140733302476621, "addr_info": "combase.dll:.text", "idx": 11 }, { "addr": 140733302476380, "addr_info": "combase.dll:.text", "idx": 12 }, { "addr": 140733302475821, "addr_info": "combase.dll:.text", "idx": 13 }, { "addr": 140733302473942, "addr_info": "combase.dll:.text", "idx": 14 }, { "addr": 140733302761160, "addr_info": "combase.dll:.text", "idx": 15 }, { "addr": 140733302612061, "addr_info": "combase.dll:.text", "idx": 16 }, { "addr": 140733302743481, "addr_info": "combase.dll:.text", "idx": 17 }, { "addr": 140733302882867, "addr_info": "combase.dll:.text", "idx": 18 }, { "addr": 140733302925990, "addr_info": "combase.dll:.text", "idx": 19 }, { "addr": 140733302893361, "addr_info": "combase.dll:.text", "idx": 20 }, { "addr": 140733302892991, "addr_info": "combase.dll:.text", "idx": 21 }, { "addr": 140733302891382, "addr_info": "combase.dll:.text", "idx": 22 }, { "addr": 140733302911178, "addr_info": "combase.dll:.text", "idx": 23 }, { "addr": 140733302813839, "addr_info": "combase.dll:.text", "idx": 24 }, { "addr": 140733302813382, "addr_info": "combase.dll:.text", "idx": 25 }, { "addr": 140733302788206, "addr_info": "combase.dll:.text", "idx": 26 }, { "addr": 140733302757824, "addr_info": "combase.dll:.text", "idx": 27 }, { "addr": 140733302755902, "addr_info": "combase.dll:.text", "idx": 28 }, { "addr": 140732844325198, "addr_info": "daxexec.dll:.text", "idx": 29 }, { "addr": 140732844282579, "addr_info": "daxexec.dll:.text", "idx": 30 }, { "addr": 140732844297602, "addr_info": "daxexec.dll:.text", "idx": 31 }, { "addr": 140732844226348, "addr_info": "daxexec.dll:.text", "idx": 32 }, { "addr": 140732844035213, "addr_info": "daxexec.dll:.text", "idx": 33 }, { "addr": 140732575806597, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 34 }, { "addr": 140732575736469, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 35 }, { "addr": 140732575776289, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 36 }, { "addr": 140732575735620, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 37 }, { "addr": 140732575734382, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 38 }, { "addr": 140733274804853, "addr_info": "KERNELBASE.dll:.text", "idx": 39 }, { "addr": 140733275076832, "addr_info": "KERNELBASE.dll:.text", "idx": 40 }, { "addr": 140733275329713, "addr_info": "KERNELBASE.dll:.text", "idx": 41 }, { "addr": 140733275328598, "addr_info": "KERNELBASE.dll:.text", "idx": 42 }, { "addr": 140733289145076, "addr_info": "KERNEL32.DLL:.text", "idx": 43 }, { "addr": 140703039692782, "addr_info": "redtest3.exe:.text", "idx": 44 }, { "addr": 140703039702818, "addr_info": "redtest3.exe:.text", "idx": 45 }, { "addr": 140703039703776, "addr_info": "redtest3.exe:.text", "idx": 46 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL:.text", "idx": 47 }, { "addr": 140733318999928, "addr_info": "ntdll.dll:.text", "idx": 48 } ], "timedatestamp": 2023439076, "trace_id": 41, "type": "etw" }, { "defaultbase": 140732889497600, "etw_event_id": 5, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Process", "etw_tid": 7148, "etw_time": 134271933910108100, "event": "ImageLoadInfo ", "id": 88, "imagebase": 140732889497600, "imagechecksum": 478323, "imagename": "\\Device\\HarddiskVolume3\\Windows\\System32\\AppxAllUserStore.dll", "imagesize": 462848, "processid": 3620, "stack_trace": [ { "addr": 140733319287556, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733318810108, "addr_info": "ntdll.dll:.text", "idx": 1 }, { "addr": 140733318809082, "addr_info": "ntdll.dll:.text", "idx": 2 }, { "addr": 140733318809476, "addr_info": "ntdll.dll:.text", "idx": 3 }, { "addr": 140733318695743, "addr_info": "ntdll.dll:.text", "idx": 4 }, { "addr": 140733318696952, "addr_info": "ntdll.dll:.text", "idx": 5 }, { "addr": 140733318697920, "addr_info": "ntdll.dll:.text", "idx": 6 }, { "addr": 140733318794756, "addr_info": "ntdll.dll:.text", "idx": 7 }, { "addr": 140733318729472, "addr_info": "ntdll.dll:.text", "idx": 8 }, { "addr": 140733318717630, "addr_info": "ntdll.dll:.text", "idx": 9 }, { "addr": 140733318771045, "addr_info": "ntdll.dll:.text", "idx": 10 }, { "addr": 140733318807335, "addr_info": "ntdll.dll:.text", "idx": 11 }, { "addr": 140732844637666, "addr_info": "daxexec.dll:.text", "idx": 12 }, { "addr": 140732844694940, "addr_info": "daxexec.dll:.text", "idx": 13 }, { "addr": 140732844299576, "addr_info": "daxexec.dll:.text", "idx": 14 }, { "addr": 140732844226806, "addr_info": "daxexec.dll:.text", "idx": 15 }, { "addr": 140732844035213, "addr_info": "daxexec.dll:.text", "idx": 16 }, { "addr": 140732575806597, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 17 }, { "addr": 140732575736469, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 18 }, { "addr": 140732575776289, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 19 }, { "addr": 140732575735620, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 20 }, { "addr": 140732575734382, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 21 }, { "addr": 140733274804853, "addr_info": "KERNELBASE.dll:.text", "idx": 22 }, { "addr": 140733275076832, "addr_info": "KERNELBASE.dll:.text", "idx": 23 }, { "addr": 140733275329713, "addr_info": "KERNELBASE.dll:.text", "idx": 24 }, { "addr": 140733275328598, "addr_info": "KERNELBASE.dll:.text", "idx": 25 }, { "addr": 140733289145076, "addr_info": "KERNEL32.DLL:.text", "idx": 26 }, { "addr": 140703039692782, "addr_info": "redtest3.exe:.text", "idx": 27 }, { "addr": 140703039702818, "addr_info": "redtest3.exe:.text", "idx": 28 }, { "addr": 140703039703776, "addr_info": "redtest3.exe:.text", "idx": 29 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL:.text", "idx": 30 }, { "addr": 140733318999928, "addr_info": "ntdll.dll:.text", "idx": 31 } ], "timedatestamp": 3586255872, "trace_id": 41, "type": "etw" }, { "defaultbase": 140733122084864, "etw_event_id": 5, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Process", "etw_tid": 7148, "etw_time": 134271933910114610, "event": "ImageLoadInfo ", "id": 89, "imagebase": 140733122084864, "imagechecksum": 308486, "imagename": "\\Device\\HarddiskVolume3\\Windows\\System32\\Windows.StateRepositoryClient.dll", "imagesize": 249856, "processid": 3620, "stack_trace": [ { "addr": 140733319287556, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733318810108, "addr_info": "ntdll.dll:.text", "idx": 1 }, { "addr": 140733318809082, "addr_info": "ntdll.dll:.text", "idx": 2 }, { "addr": 140733318809476, "addr_info": "ntdll.dll:.text", "idx": 3 }, { "addr": 140733318695743, "addr_info": "ntdll.dll:.text", "idx": 4 }, { "addr": 140733318698272, "addr_info": "ntdll.dll:.text", "idx": 5 }, { "addr": 140733318697711, "addr_info": "ntdll.dll:.text", "idx": 6 }, { "addr": 140733318794756, "addr_info": "ntdll.dll:.text", "idx": 7 }, { "addr": 140733318729472, "addr_info": "ntdll.dll:.text", "idx": 8 }, { "addr": 140733318717630, "addr_info": "ntdll.dll:.text", "idx": 9 }, { "addr": 140733318771045, "addr_info": "ntdll.dll:.text", "idx": 10 }, { "addr": 140733318807335, "addr_info": "ntdll.dll:.text", "idx": 11 }, { "addr": 140733275306418, "addr_info": "KERNELBASE.dll:.text", "idx": 12 }, { "addr": 140733275527127, "addr_info": "KERNELBASE.dll:.text", "idx": 13 }, { "addr": 140733274900485, "addr_info": "KERNELBASE.dll:.text", "idx": 14 }, { "addr": 140733274900371, "addr_info": "KERNELBASE.dll:.text", "idx": 15 }, { "addr": 140733274898736, "addr_info": "KERNELBASE.dll:.text", "idx": 16 }, { "addr": 140732844138534, "addr_info": "daxexec.dll:.text", "idx": 17 }, { "addr": 140732844033115, "addr_info": "daxexec.dll:.text", "idx": 18 }, { "addr": 140732844035242, "addr_info": "daxexec.dll:.text", "idx": 19 }, { "addr": 140732575806597, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 20 }, { "addr": 140732575736469, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 21 }, { "addr": 140732575776289, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 22 }, { "addr": 140732575735620, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 23 }, { "addr": 140732575734382, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 24 }, { "addr": 140733274804853, "addr_info": "KERNELBASE.dll:.text", "idx": 25 }, { "addr": 140733275076832, "addr_info": "KERNELBASE.dll:.text", "idx": 26 }, { "addr": 140733275329713, "addr_info": "KERNELBASE.dll:.text", "idx": 27 }, { "addr": 140733275328598, "addr_info": "KERNELBASE.dll:.text", "idx": 28 }, { "addr": 140733289145076, "addr_info": "KERNEL32.DLL:.text", "idx": 29 }, { "addr": 140703039692782, "addr_info": "redtest3.exe:.text", "idx": 30 }, { "addr": 140703039702818, "addr_info": "redtest3.exe:.text", "idx": 31 }, { "addr": 140703039703776, "addr_info": "redtest3.exe:.text", "idx": 32 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL:.text", "idx": 33 }, { "addr": 140733318999928, "addr_info": "ntdll.dll:.text", "idx": 34 } ], "timedatestamp": 302884805, "trace_id": 41, "type": "etw" }, { "defaultbase": 140733122347008, "etw_event_id": 5, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Process", "etw_tid": 7148, "etw_time": 134271933910117070, "event": "ImageLoadInfo ", "id": 90, "imagebase": 140733122347008, "imagechecksum": 168683, "imagename": "\\Device\\HarddiskVolume3\\Windows\\System32\\Windows.StateRepositoryCore.dll", "imagesize": 106496, "processid": 3620, "stack_trace": [ { "addr": 140733319287556, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733318810108, "addr_info": "ntdll.dll:.text", "idx": 1 }, { "addr": 140733318809082, "addr_info": "ntdll.dll:.text", "idx": 2 }, { "addr": 140733318809476, "addr_info": "ntdll.dll:.text", "idx": 3 }, { "addr": 140733318695743, "addr_info": "ntdll.dll:.text", "idx": 4 }, { "addr": 140733318698272, "addr_info": "ntdll.dll:.text", "idx": 5 }, { "addr": 140733318697711, "addr_info": "ntdll.dll:.text", "idx": 6 }, { "addr": 140733318794756, "addr_info": "ntdll.dll:.text", "idx": 7 }, { "addr": 140733318729472, "addr_info": "ntdll.dll:.text", "idx": 8 }, { "addr": 140733318717630, "addr_info": "ntdll.dll:.text", "idx": 9 }, { "addr": 140733318771045, "addr_info": "ntdll.dll:.text", "idx": 10 }, { "addr": 140733318807335, "addr_info": "ntdll.dll:.text", "idx": 11 }, { "addr": 140733122213378, "addr_info": "windows.staterepositoryclient.dll:.text", "idx": 12 }, { "addr": 140733122096846, "addr_info": "windows.staterepositoryclient.dll:.text", "idx": 13 }, { "addr": 140733122159088, "addr_info": "windows.staterepositoryclient.dll:.text", "idx": 14 }, { "addr": 140733274900485, "addr_info": "KERNELBASE.dll:.text", "idx": 15 }, { "addr": 140733274900371, "addr_info": "KERNELBASE.dll:.text", "idx": 16 }, { "addr": 140733274898736, "addr_info": "KERNELBASE.dll:.text", "idx": 17 }, { "addr": 140732844138534, "addr_info": "daxexec.dll:.text", "idx": 18 }, { "addr": 140732844033115, "addr_info": "daxexec.dll:.text", "idx": 19 }, { "addr": 140732844035242, "addr_info": "daxexec.dll:.text", "idx": 20 }, { "addr": 140732575806597, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 21 }, { "addr": 140732575736469, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 22 }, { "addr": 140732575776289, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 23 }, { "addr": 140732575735620, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 24 }, { "addr": 140732575734382, "addr_info": "apisethost.appexecutionalias.dll:.text", "idx": 25 }, { "addr": 140733274804853, "addr_info": "KERNELBASE.dll:.text", "idx": 26 }, { "addr": 140733275076832, "addr_info": "KERNELBASE.dll:.text", "idx": 27 }, { "addr": 140733275329713, "addr_info": "KERNELBASE.dll:.text", "idx": 28 }, { "addr": 140733275328598, "addr_info": "KERNELBASE.dll:.text", "idx": 29 }, { "addr": 140733289145076, "addr_info": "KERNEL32.DLL:.text", "idx": 30 }, { "addr": 140703039692782, "addr_info": "redtest3.exe:.text", "idx": 31 }, { "addr": 140703039702818, "addr_info": "redtest3.exe:.text", "idx": 32 }, { "addr": 140703039703776, "addr_info": "redtest3.exe:.text", "idx": 33 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL:.text", "idx": 34 }, { "addr": 140733318999928, "addr_info": "ntdll.dll:.text", "idx": 35 } ], "timedatestamp": 3006206641, "trace_id": 41, "type": "etw" }, { "defaultbase": 140732825206784, "etw_event_id": 5, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Process", "etw_tid": 7148, "etw_time": 134271933910123940, "event": "ImageLoadInfo ", "id": 91, "imagebase": 140732825206784, "imagechecksum": 406668, "imagename": "\\Device\\HarddiskVolume3\\Windows\\System32\\capauthz.dll", "imagesize": 393216, "processid": 3620, "stack_trace": [ { "addr": 140733319287556, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733318810108, "addr_info": "ntdll.dll:.text", "idx": 1 }, { "addr": 140733318809082, "addr_info": "ntdll.dll:.text", "idx": 2 }, { "addr": 140733318809476, "addr_info": "ntdll.dll:.text", "idx": 3 }, { "addr": 140733318695743, "addr_info": "ntdll.dll:.text", "idx": 4 }, { "addr": 140733318698272, "addr_info": "ntdll.dll:.text", "idx": 5 }, { "addr": 140733318697711, "addr_info": "ntdll.dll:.text", "idx": 6 }, { "addr": 140733318794756, "addr_info": "ntdll.dll:.text", "idx": 7 }, { "addr": 140733318729472, "addr_info": "ntdll.dll:.text", "idx": 8 }, { "addr": 140733318717630, "addr_info": "ntdll.dll:.text", "idx": 9 }, { "addr": 140733318771045, "addr_info": "ntdll.dll:.text", "idx": 10 }, { "addr": 140733318807335, "addr_info": "ntdll.dll:.text", "idx": 11 }, { "addr": 140733275306418, "addr_info": "KERNELBASE.dll:.text", "idx": 12 }, { "addr": 140733275519561, "addr_info": "KERNELBASE.dll:.text", "idx": 13 }, { "addr": 140733274817392, "addr_info": "KERNELBASE.dll:.text", "idx": 14 }, { "addr": 140733274816437, "addr_info": "KERNELBASE.dll:.text", "idx": 15 }, { "addr": 140733289239620, "addr_info": "KERNEL32.DLL:.text", "idx": 16 }, { "addr": 140733275072768, "addr_info": "KERNELBASE.dll:.text", "idx": 17 }, { "addr": 140733275329713, "addr_info": "KERNELBASE.dll:.text", "idx": 18 }, { "addr": 140733275328598, "addr_info": "KERNELBASE.dll:.text", "idx": 19 }, { "addr": 140733289145076, "addr_info": "KERNEL32.DLL:.text", "idx": 20 }, { "addr": 140703039692782, "addr_info": "redtest3.exe:.text", "idx": 21 }, { "addr": 140703039702818, "addr_info": "redtest3.exe:.text", "idx": 22 }, { "addr": 140703039703776, "addr_info": "redtest3.exe:.text", "idx": 23 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL:.text", "idx": 24 }, { "addr": 140733318999928, "addr_info": "ntdll.dll:.text", "idx": 25 } ], "timedatestamp": 1845001524, "trace_id": 41, "type": "etw" }, { "defaultbase": 140733299425280, "etw_event_id": 5, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Process", "etw_tid": 7148, "etw_time": 134271933910127330, "event": "ImageLoadInfo ", "id": 92, "imagebase": 140733299425280, "imagechecksum": 752260, "imagename": "\\Device\\HarddiskVolume3\\Windows\\System32\\advapi32.dll", "imagesize": 724992, "processid": 3620, "stack_trace": [ { "addr": 140733319287556, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733318810108, "addr_info": "ntdll.dll:.text", "idx": 1 }, { "addr": 140733318809082, "addr_info": "ntdll.dll:.text", "idx": 2 }, { "addr": 140733318809476, "addr_info": "ntdll.dll:.text", "idx": 3 }, { "addr": 140733318812505, "addr_info": "ntdll.dll:.text", "idx": 4 }, { "addr": 140733318816473, "addr_info": "ntdll.dll:.text", "idx": 5 }, { "addr": 140733318794726, "addr_info": "ntdll.dll:.text", "idx": 6 }, { "addr": 140733318729472, "addr_info": "ntdll.dll:.text", "idx": 7 }, { "addr": 140733318717630, "addr_info": "ntdll.dll:.text", "idx": 8 }, { "addr": 140733318771045, "addr_info": "ntdll.dll:.text", "idx": 9 }, { "addr": 140733318807335, "addr_info": "ntdll.dll:.text", "idx": 10 }, { "addr": 140732825469026, "addr_info": "capauthz.dll:.text", "idx": 11 }, { "addr": 140732825220376, "addr_info": "capauthz.dll:.text", "idx": 12 }, { "addr": 140732825241200, "addr_info": "capauthz.dll:.text", "idx": 13 }, { "addr": 140732825245919, "addr_info": "capauthz.dll:.text", "idx": 14 }, { "addr": 140732825239642, "addr_info": "capauthz.dll:.text", "idx": 15 }, { "addr": 140733274817392, "addr_info": "KERNELBASE.dll:.text", "idx": 16 }, { "addr": 140733274816437, "addr_info": "KERNELBASE.dll:.text", "idx": 17 }, { "addr": 140733289239620, "addr_info": "KERNEL32.DLL:.text", "idx": 18 }, { "addr": 140733275072768, "addr_info": "KERNELBASE.dll:.text", "idx": 19 }, { "addr": 140733275329713, "addr_info": "KERNELBASE.dll:.text", "idx": 20 }, { "addr": 140733275328598, "addr_info": "KERNELBASE.dll:.text", "idx": 21 }, { "addr": 140733289145076, "addr_info": "KERNEL32.DLL:.text", "idx": 22 }, { "addr": 140703039692782, "addr_info": "redtest3.exe:.text", "idx": 23 }, { "addr": 140703039702818, "addr_info": "redtest3.exe:.text", "idx": 24 }, { "addr": 140703039703776, "addr_info": "redtest3.exe:.text", "idx": 25 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL:.text", "idx": 26 }, { "addr": 140733318999928, "addr_info": "ntdll.dll:.text", "idx": 27 } ], "timedatestamp": 623104132, "trace_id": 41, "type": "etw" }, { "defaultbase": 140733253615616, "etw_event_id": 5, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Process", "etw_tid": 7148, "etw_time": 134271933910134980, "event": "ImageLoadInfo ", "id": 93, "imagebase": 140733253615616, "imagechecksum": 240996, "imagename": "\\Device\\HarddiskVolume3\\Windows\\System32\\ntmarta.dll", "imagesize": 212992, "processid": 3620, "stack_trace": [ { "addr": 140733319287556, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733318810108, "addr_info": "ntdll.dll:.text", "idx": 1 }, { "addr": 140733318809082, "addr_info": "ntdll.dll:.text", "idx": 2 }, { "addr": 140733318809476, "addr_info": "ntdll.dll:.text", "idx": 3 }, { "addr": 140733318695743, "addr_info": "ntdll.dll:.text", "idx": 4 }, { "addr": 140733318698272, "addr_info": "ntdll.dll:.text", "idx": 5 }, { "addr": 140733318697711, "addr_info": "ntdll.dll:.text", "idx": 6 }, { "addr": 140733318794756, "addr_info": "ntdll.dll:.text", "idx": 7 }, { "addr": 140733318729472, "addr_info": "ntdll.dll:.text", "idx": 8 }, { "addr": 140733318717630, "addr_info": "ntdll.dll:.text", "idx": 9 }, { "addr": 140733318771045, "addr_info": "ntdll.dll:.text", "idx": 10 }, { "addr": 140733318807335, "addr_info": "ntdll.dll:.text", "idx": 11 }, { "addr": 140732825469026, "addr_info": "capauthz.dll:.text", "idx": 12 }, { "addr": 140732825222001, "addr_info": "capauthz.dll:.text", "idx": 13 }, { "addr": 140732825246004, "addr_info": "capauthz.dll:.text", "idx": 14 }, { "addr": 140732825239642, "addr_info": "capauthz.dll:.text", "idx": 15 }, { "addr": 140733274817392, "addr_info": "KERNELBASE.dll:.text", "idx": 16 }, { "addr": 140733274816437, "addr_info": "KERNELBASE.dll:.text", "idx": 17 }, { "addr": 140733289239620, "addr_info": "KERNEL32.DLL:.text", "idx": 18 }, { "addr": 140733275072768, "addr_info": "KERNELBASE.dll:.text", "idx": 19 }, { "addr": 140733275329713, "addr_info": "KERNELBASE.dll:.text", "idx": 20 }, { "addr": 140733275328598, "addr_info": "KERNELBASE.dll:.text", "idx": 21 }, { "addr": 140733289145076, "addr_info": "KERNEL32.DLL:.text", "idx": 22 }, { "addr": 140703039692782, "addr_info": "redtest3.exe:.text", "idx": 23 }, { "addr": 140703039702818, "addr_info": "redtest3.exe:.text", "idx": 24 }, { "addr": 140703039703776, "addr_info": "redtest3.exe:.text", "idx": 25 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL:.text", "idx": 26 }, { "addr": 140733318999928, "addr_info": "ntdll.dll:.text", "idx": 27 } ], "timedatestamp": 4066697849, "trace_id": 41, "type": "etw" }, { "desiredaccess": 1052672, "etw_event_id": 5, "etw_pid": 1260, "etw_process": "MsMpEng.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Audit-API-Calls", "etw_tid": 3852, "etw_time": 134271933910145180, "event": "PspLogAuditOpenProcessEvent", "id": 94, "returncode": 0, "stack_trace": [ { "addr": 140733319287492, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733274989678, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140732921250766, "addr_info": "mpengine.dll", "idx": 2 }, { "addr": 140732921250247, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732920230616, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732921241061, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732921239599, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920278094, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920863473, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920275319, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732920264529, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732920260309, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732926221602, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732920317187, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732920317521, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732920317954, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920588037, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732920592514, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732920594801, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732920584873, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732920577858, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140732926083335, "addr_info": "mpengine.dll", "idx": 22 }, { "addr": 140732923484714, "addr_info": "mpengine.dll", "idx": 23 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 24 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 25 }, { "addr": 140732952121841, "addr_info": "mprtp.dll", "idx": 26 }, { "addr": 140732952116418, "addr_info": "mprtp.dll", "idx": 27 }, { "addr": 140732952934033, "addr_info": "mprtp.dll", "idx": 28 }, { "addr": 140732952936211, "addr_info": "mprtp.dll", "idx": 29 }, { "addr": 140732952919783, "addr_info": "mprtp.dll", "idx": 30 }, { "addr": 140732952430163, "addr_info": "mprtp.dll", "idx": 31 }, { "addr": 140732952427103, "addr_info": "mprtp.dll", "idx": 32 }, { "addr": 140732952605871, "addr_info": "mprtp.dll", "idx": 33 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 34 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 35 } ], "targetprocessid": 3620, "trace_id": 41, "type": "etw" }, { "etw_event_id": 10, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-File", "etw_tid": 7148, "etw_time": 134271933910277310, "event": "NameCreateInfo ", "filekey": 18446692399718367000, "filename": "\\Device\\HarddiskVolume3\\Program Files\\WindowsApps\\Microsoft.WindowsNotepad_11.2604.5.0_x64__8wekyb3d8bbwe\\Notepad\\Notepad.exe", "id": 95, "stack_trace": [ { "addr": 140733319292884, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733275076164, "addr_info": "KERNELBASE.dll:.text", "idx": 1 }, { "addr": 140733275329713, "addr_info": "KERNELBASE.dll:.text", "idx": 2 }, { "addr": 140733275328598, "addr_info": "KERNELBASE.dll:.text", "idx": 3 }, { "addr": 140733289145076, "addr_info": "KERNEL32.DLL:.text", "idx": 4 }, { "addr": 140703039692782, "addr_info": "redtest3.exe:.text", "idx": 5 }, { "addr": 140703039702818, "addr_info": "redtest3.exe:.text", "idx": 6 }, { "addr": 140703039703776, "addr_info": "redtest3.exe:.text", "idx": 7 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL:.text", "idx": 8 }, { "addr": 140733318999928, "addr_info": "ntdll.dll:.text", "idx": 9 } ], "trace_id": 41, "type": "etw" }, { "createtime": 134271933910302100, "etw_event_id": 1, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Process", "etw_tid": 7148, "etw_time": 134271933910302450, "event": "ProcessStartStart ", "flags": 3, "id": 96, "imagechecksum": 3327353, "imagename": "\\Device\\HarddiskVolume3\\Program Files\\WindowsApps\\Microsoft.WindowsNotepad_11.2604.5.0_x64__8wekyb3d8bbwe\\Notepad\\Notepad.exe", "mandatorylabel": "unsupported", "packagefullname": "Microsoft.WindowsNotepad_11.2604.5.0_x64__8wekyb3d8bbwe", "packagerelativeappid": "App", "parentprocessid": 3620, "parentprocesssequencenumber": 279, "processid": 4868, "processsequencenumber": 280, "processtokenelevationtype": 3, "processtokeniselevated": 0, "sessionid": 2, "stack_trace": [ { "addr": 140733319292884, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733275076164, "addr_info": "KERNELBASE.dll:.text", "idx": 1 }, { "addr": 140733275329713, "addr_info": "KERNELBASE.dll:.text", "idx": 2 }, { "addr": 140733275328598, "addr_info": "KERNELBASE.dll:.text", "idx": 3 }, { "addr": 140733289145076, "addr_info": "KERNEL32.DLL:.text", "idx": 4 }, { "addr": 140703039692782, "addr_info": "redtest3.exe:.text", "idx": 5 }, { "addr": 140703039702818, "addr_info": "redtest3.exe:.text", "idx": 6 }, { "addr": 140703039703776, "addr_info": "redtest3.exe:.text", "idx": 7 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL:.text", "idx": 8 }, { "addr": 140733318999928, "addr_info": "ntdll.dll:.text", "idx": 9 } ], "timedatestamp": 1778084109, "trace_id": 41, "type": "etw" }, { "etw_event_id": 3, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Process", "etw_tid": 7148, "etw_time": 134271933910318100, "event": "ThreadStartStart ", "id": 97, "processid": 4868, "stack_trace": [ { "addr": 140733319292884, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733275076164, "addr_info": "KERNELBASE.dll:.text", "idx": 1 }, { "addr": 140733275329713, "addr_info": "KERNELBASE.dll:.text", "idx": 2 }, { "addr": 140733275328598, "addr_info": "KERNELBASE.dll:.text", "idx": 3 }, { "addr": 140733289145076, "addr_info": "KERNEL32.DLL:.text", "idx": 4 }, { "addr": 140703039692782, "addr_info": "redtest3.exe:.text", "idx": 5 }, { "addr": 140703039702818, "addr_info": "redtest3.exe:.text", "idx": 6 }, { "addr": 140703039703776, "addr_info": "redtest3.exe:.text", "idx": 7 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL:.text", "idx": 8 }, { "addr": 140733318999928, "addr_info": "ntdll.dll:.text", "idx": 9 } ], "stackbase": 18446626998494253000, "stacklimit": 18446626998494228000, "startaddr": 140697685991984, "subprocesstag": 0, "tebbase": 652747051008, "threadid": 3744, "trace_id": 41, "type": "etw", "userstackbase": 652746489856, "userstacklimit": 652746485760, "win32startaddr": 140697685991984 }, { "desiredaccess": 5136, "etw_event_id": 5, "etw_pid": 1260, "etw_process": "MsMpEng.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Audit-API-Calls", "etw_tid": 3340, "etw_time": 134271933910328500, "event": "PspLogAuditOpenProcessEvent", "id": 98, "returncode": 0, "stack_trace": [ { "addr": 140733319287492, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733274989678, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140732921250766, "addr_info": "mpengine.dll", "idx": 2 }, { "addr": 140732921250247, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732922672087, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732922671120, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732921179278, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732921174752, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732921174289, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732921172268, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921171926, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921170133, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732921169556, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732929341080, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732929340803, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 15 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 16 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 17 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 18 } ], "targetprocessid": 3620, "trace_id": 41, "type": "etw" }, { "baseaddress": 546687045656, "bytescopied": 8, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914557700, "event": "KERNEL_THREATINT_TASK_READVM", "id": 99, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319288292, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733275150581, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140733275150204, "addr_info": "KERNELBASE.dll", "idx": 2 }, { "addr": 140733275150065, "addr_info": "KERNELBASE.dll", "idx": 3 }, { "addr": 140732928926288, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732924676049, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732921694947, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920592807, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920594801, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920584873, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 22 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 23 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 24 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 25 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 26 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 27 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 28 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 29 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 30 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 31 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 32 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 33 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 546685583360, "vavadallocationprotect": 4, "vavadcommitsize": 53248, "vavadmmfname": "", "vavadqueryresult": 0, "vavadregionsize": 2097152, "vavadregiontype": 131072 }, { "baseaddress": 140733320229984, "bytescopied": 8, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914557950, "event": "KERNEL_THREATINT_TASK_READVM", "id": 100, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319288292, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733275150581, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140733275150245, "addr_info": "KERNELBASE.dll", "idx": 2 }, { "addr": 140733275150065, "addr_info": "KERNELBASE.dll", "idx": 3 }, { "addr": 140732928926288, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732924676049, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732921694947, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920592807, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920594801, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920584873, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 22 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 23 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 24 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 25 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 26 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 27 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 28 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 29 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 30 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 31 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 32 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 33 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 140733318627328, "vavadallocationprotect": 128, "vavadcommitsize": 65536, "vavadmmfname": "\\Device\\HarddiskVolume3\\Windows\\System32\\ntdll.dll", "vavadqueryresult": 0, "vavadregionsize": 2195456, "vavadregiontype": 16777216 }, { "baseaddress": 2475692598368, "bytescopied": 312, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914558100, "event": "KERNEL_THREATINT_TASK_READVM", "id": 101, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319288292, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733275150315, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140733275150065, "addr_info": "KERNELBASE.dll", "idx": 2 }, { "addr": 140732928926288, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732924676049, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732921694947, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920592807, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920594801, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920584873, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 22 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 23 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 24 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 25 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 26 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 27 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 28 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 29 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 30 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 31 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 32 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 2475692589056, "vavadallocationprotect": 4, "vavadcommitsize": 479232, "vavadmmfname": "", "vavadqueryresult": 0, "vavadregionsize": 1048576, "vavadregiontype": 131072 }, { "baseaddress": 2475692597952, "bytescopied": 312, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914558200, "event": "KERNEL_THREATINT_TASK_READVM", "id": 102, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319288292, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733275150315, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140733275150065, "addr_info": "KERNELBASE.dll", "idx": 2 }, { "addr": 140732928926288, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732924676049, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732921694947, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920592807, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920594801, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920584873, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 22 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 23 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 24 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 25 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 26 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 27 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 28 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 29 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 30 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 31 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 32 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 2475692589056, "vavadallocationprotect": 4, "vavadcommitsize": 479232, "vavadmmfname": "", "vavadqueryresult": 0, "vavadregionsize": 1048576, "vavadregiontype": 131072 }, { "baseaddress": 2475692618128, "bytescopied": 312, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914558320, "event": "KERNEL_THREATINT_TASK_READVM", "id": 103, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319288292, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733275150315, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140733275150065, "addr_info": "KERNELBASE.dll", "idx": 2 }, { "addr": 140732928926288, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732924676049, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732921694947, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920592807, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920594801, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920584873, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 22 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 23 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 24 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 25 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 26 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 27 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 28 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 29 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 30 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 31 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 32 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 2475692589056, "vavadallocationprotect": 4, "vavadcommitsize": 479232, "vavadmmfname": "", "vavadqueryresult": 0, "vavadregionsize": 1048576, "vavadregiontype": 131072 }, { "baseaddress": 2475692619648, "bytescopied": 312, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914558430, "event": "KERNEL_THREATINT_TASK_READVM", "id": 104, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319288292, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733275150315, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140733275150065, "addr_info": "KERNELBASE.dll", "idx": 2 }, { "addr": 140732928926288, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732924676049, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732921694947, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920592807, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920594801, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920584873, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 22 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 23 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 24 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 25 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 26 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 27 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 28 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 29 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 30 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 31 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 32 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 2475692589056, "vavadallocationprotect": 4, "vavadcommitsize": 479232, "vavadmmfname": "", "vavadqueryresult": 0, "vavadregionsize": 1048576, "vavadregiontype": 131072 }, { "baseaddress": 2475692618816, "bytescopied": 312, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914558540, "event": "KERNEL_THREATINT_TASK_READVM", "id": 105, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319288292, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733275150315, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140733275150065, "addr_info": "KERNELBASE.dll", "idx": 2 }, { "addr": 140732928926288, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732924676049, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732921694947, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920592807, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920594801, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920584873, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 22 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 23 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 24 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 25 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 26 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 27 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 28 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 29 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 30 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 31 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 32 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 2475692589056, "vavadallocationprotect": 4, "vavadcommitsize": 479232, "vavadmmfname": "", "vavadqueryresult": 0, "vavadregionsize": 1048576, "vavadregiontype": 131072 }, { "baseaddress": 2475692663392, "bytescopied": 312, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914558660, "event": "KERNEL_THREATINT_TASK_READVM", "id": 106, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319288292, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733275150315, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140733275150065, "addr_info": "KERNELBASE.dll", "idx": 2 }, { "addr": 140732928926288, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732924676049, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732921694947, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920592807, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920594801, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920584873, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 22 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 23 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 24 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 25 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 26 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 27 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 28 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 29 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 30 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 31 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 32 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 2475692589056, "vavadallocationprotect": 4, "vavadcommitsize": 479232, "vavadmmfname": "", "vavadqueryresult": 0, "vavadregionsize": 1048576, "vavadregiontype": 131072 }, { "baseaddress": 2475692776816, "bytescopied": 312, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914558770, "event": "KERNEL_THREATINT_TASK_READVM", "id": 107, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319288292, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733275150315, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140733275150065, "addr_info": "KERNELBASE.dll", "idx": 2 }, { "addr": 140732928926288, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732924676049, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732921694947, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920592807, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920594801, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920584873, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 22 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 23 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 24 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 25 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 26 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 27 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 28 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 29 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 30 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 31 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 32 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 2475692589056, "vavadallocationprotect": 4, "vavadcommitsize": 479232, "vavadmmfname": "", "vavadqueryresult": 0, "vavadregionsize": 1048576, "vavadregiontype": 131072 }, { "baseaddress": 2475692785472, "bytescopied": 312, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914558880, "event": "KERNEL_THREATINT_TASK_READVM", "id": 108, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319288292, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733275150315, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140733275150065, "addr_info": "KERNELBASE.dll", "idx": 2 }, { "addr": 140732928926288, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732924676049, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732921694947, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920592807, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920594801, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920584873, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 22 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 23 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 24 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 25 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 26 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 27 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 28 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 29 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 30 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 31 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 32 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 2475692589056, "vavadallocationprotect": 4, "vavadcommitsize": 479232, "vavadmmfname": "", "vavadqueryresult": 0, "vavadregionsize": 1048576, "vavadregiontype": 131072 }, { "baseaddress": 2475692786384, "bytescopied": 312, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914558990, "event": "KERNEL_THREATINT_TASK_READVM", "id": 109, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319288292, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733275150315, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140733275150065, "addr_info": "KERNELBASE.dll", "idx": 2 }, { "addr": 140732928926288, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732924676049, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732921694947, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920592807, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920594801, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920584873, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 22 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 23 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 24 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 25 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 26 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 27 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 28 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 29 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 30 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 31 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 32 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 2475692589056, "vavadallocationprotect": 4, "vavadcommitsize": 479232, "vavadmmfname": "", "vavadqueryresult": 0, "vavadregionsize": 1048576, "vavadregiontype": 131072 }, { "baseaddress": 2475692787024, "bytescopied": 312, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914559100, "event": "KERNEL_THREATINT_TASK_READVM", "id": 110, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319288292, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733275150315, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140733275150065, "addr_info": "KERNELBASE.dll", "idx": 2 }, { "addr": 140732928926288, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732924676049, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732921694947, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920592807, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920594801, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920584873, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 22 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 23 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 24 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 25 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 26 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 27 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 28 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 29 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 30 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 31 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 32 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 2475692589056, "vavadallocationprotect": 4, "vavadcommitsize": 479232, "vavadmmfname": "", "vavadqueryresult": 0, "vavadregionsize": 1048576, "vavadregiontype": 131072 }, { "baseaddress": 2475692788096, "bytescopied": 312, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914559220, "event": "KERNEL_THREATINT_TASK_READVM", "id": 111, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319288292, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733275150315, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140733275150065, "addr_info": "KERNELBASE.dll", "idx": 2 }, { "addr": 140732928926288, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732924676049, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732921694947, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920592807, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920594801, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920584873, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 22 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 23 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 24 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 25 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 26 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 27 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 28 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 29 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 30 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 31 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 32 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 2475692589056, "vavadallocationprotect": 4, "vavadcommitsize": 479232, "vavadmmfname": "", "vavadqueryresult": 0, "vavadregionsize": 1048576, "vavadregiontype": 131072 }, { "baseaddress": 2475692778608, "bytescopied": 312, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914559330, "event": "KERNEL_THREATINT_TASK_READVM", "id": 112, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319288292, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733275150315, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140733275150065, "addr_info": "KERNELBASE.dll", "idx": 2 }, { "addr": 140732928926288, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732924676049, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732921694947, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920592807, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920594801, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920584873, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 22 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 23 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 24 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 25 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 26 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 27 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 28 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 29 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 30 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 31 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 32 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 2475692589056, "vavadallocationprotect": 4, "vavadcommitsize": 479232, "vavadmmfname": "", "vavadqueryresult": 0, "vavadregionsize": 1048576, "vavadregiontype": 131072 }, { "baseaddress": 2475692788992, "bytescopied": 312, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914559440, "event": "KERNEL_THREATINT_TASK_READVM", "id": 113, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319288292, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733275150315, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140733275150065, "addr_info": "KERNELBASE.dll", "idx": 2 }, { "addr": 140732928926288, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732924676049, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732921694947, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920592807, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920594801, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920584873, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 22 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 23 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 24 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 25 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 26 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 27 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 28 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 29 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 30 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 31 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 32 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 2475692589056, "vavadallocationprotect": 4, "vavadcommitsize": 479232, "vavadmmfname": "", "vavadqueryresult": 0, "vavadregionsize": 1048576, "vavadregiontype": 131072 }, { "baseaddress": 2475692816720, "bytescopied": 312, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914559550, "event": "KERNEL_THREATINT_TASK_READVM", "id": 114, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319288292, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733275150315, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140733275150065, "addr_info": "KERNELBASE.dll", "idx": 2 }, { "addr": 140732928926288, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732924676049, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732921694947, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920592807, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920594801, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920584873, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 22 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 23 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 24 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 25 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 26 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 27 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 28 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 29 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 30 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 31 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 32 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 2475692589056, "vavadallocationprotect": 4, "vavadcommitsize": 479232, "vavadmmfname": "", "vavadqueryresult": 0, "vavadregionsize": 1048576, "vavadregiontype": 131072 }, { "baseaddress": 2475692785792, "bytescopied": 312, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914559650, "event": "KERNEL_THREATINT_TASK_READVM", "id": 115, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319288292, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733275150315, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140733275150065, "addr_info": "KERNELBASE.dll", "idx": 2 }, { "addr": 140732928926288, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732924676049, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732921694947, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920592807, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920594801, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920584873, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 22 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 23 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 24 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 25 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 26 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 27 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 28 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 29 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 30 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 31 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 32 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 2475692589056, "vavadallocationprotect": 4, "vavadcommitsize": 479232, "vavadmmfname": "", "vavadqueryresult": 0, "vavadregionsize": 1048576, "vavadregiontype": 131072 }, { "baseaddress": 2475692818496, "bytescopied": 312, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914559760, "event": "KERNEL_THREATINT_TASK_READVM", "id": 116, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319288292, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733275150315, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140733275150065, "addr_info": "KERNELBASE.dll", "idx": 2 }, { "addr": 140732928926288, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732924676049, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732921694947, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920592807, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920594801, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920584873, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 22 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 23 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 24 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 25 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 26 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 27 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 28 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 29 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 30 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 31 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 32 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 2475692589056, "vavadallocationprotect": 4, "vavadcommitsize": 479232, "vavadmmfname": "", "vavadqueryresult": 0, "vavadregionsize": 1048576, "vavadregiontype": 131072 }, { "baseaddress": 2475692828096, "bytescopied": 312, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914559870, "event": "KERNEL_THREATINT_TASK_READVM", "id": 117, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319288292, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733275150315, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140733275150065, "addr_info": "KERNELBASE.dll", "idx": 2 }, { "addr": 140732928926288, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732924676049, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732921694947, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920592807, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920594801, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920584873, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 22 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 23 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 24 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 25 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 26 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 27 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 28 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 29 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 30 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 31 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 32 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 2475692589056, "vavadallocationprotect": 4, "vavadcommitsize": 479232, "vavadmmfname": "", "vavadqueryresult": 0, "vavadregionsize": 1048576, "vavadregiontype": 131072 }, { "baseaddress": 2475692829696, "bytescopied": 312, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914559980, "event": "KERNEL_THREATINT_TASK_READVM", "id": 118, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319288292, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733275150315, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140733275150065, "addr_info": "KERNELBASE.dll", "idx": 2 }, { "addr": 140732928926288, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732924676049, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732921694947, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920592807, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920594801, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920584873, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 22 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 23 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 24 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 25 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 26 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 27 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 28 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 29 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 30 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 31 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 32 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 2475692589056, "vavadallocationprotect": 4, "vavadcommitsize": 479232, "vavadmmfname": "", "vavadqueryresult": 0, "vavadregionsize": 1048576, "vavadregiontype": 131072 }, { "baseaddress": 2475692829376, "bytescopied": 312, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914560100, "event": "KERNEL_THREATINT_TASK_READVM", "id": 119, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319288292, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733275150315, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140733275150065, "addr_info": "KERNELBASE.dll", "idx": 2 }, { "addr": 140732928926288, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732924676049, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732921694947, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920592807, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920594801, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920584873, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 22 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 23 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 24 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 25 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 26 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 27 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 28 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 29 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 30 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 31 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 32 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 2475692589056, "vavadallocationprotect": 4, "vavadcommitsize": 479232, "vavadmmfname": "", "vavadqueryresult": 0, "vavadregionsize": 1048576, "vavadregiontype": 131072 }, { "baseaddress": 2475692826496, "bytescopied": 312, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914560210, "event": "KERNEL_THREATINT_TASK_READVM", "id": 120, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319288292, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733275150315, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140733275150065, "addr_info": "KERNELBASE.dll", "idx": 2 }, { "addr": 140732928926288, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732924676049, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732921694947, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920592807, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920594801, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920584873, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 22 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 23 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 24 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 25 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 26 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 27 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 28 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 29 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 30 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 31 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 32 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 2475692589056, "vavadallocationprotect": 4, "vavadcommitsize": 479232, "vavadmmfname": "", "vavadqueryresult": 0, "vavadregionsize": 1048576, "vavadregiontype": 131072 }, { "baseaddress": 2475692828736, "bytescopied": 312, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914560320, "event": "KERNEL_THREATINT_TASK_READVM", "id": 121, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319288292, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733275150315, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140733275150065, "addr_info": "KERNELBASE.dll", "idx": 2 }, { "addr": 140732928926288, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732924676049, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732921694947, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920592807, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920594801, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920584873, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 22 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 23 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 24 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 25 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 26 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 27 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 28 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 29 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 30 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 31 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 32 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 2475692589056, "vavadallocationprotect": 4, "vavadcommitsize": 479232, "vavadmmfname": "", "vavadqueryresult": 0, "vavadregionsize": 1048576, "vavadregiontype": 131072 }, { "baseaddress": 2475692828416, "bytescopied": 312, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914560420, "event": "KERNEL_THREATINT_TASK_READVM", "id": 122, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319288292, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733275150315, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140733275150065, "addr_info": "KERNELBASE.dll", "idx": 2 }, { "addr": 140732928926288, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732924676049, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732921694947, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920592807, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920594801, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920584873, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 22 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 23 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 24 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 25 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 26 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 27 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 28 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 29 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 30 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 31 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 32 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 2475692589056, "vavadallocationprotect": 4, "vavadcommitsize": 479232, "vavadmmfname": "", "vavadqueryresult": 0, "vavadregionsize": 1048576, "vavadregiontype": 131072 }, { "baseaddress": 2475692827776, "bytescopied": 312, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914560530, "event": "KERNEL_THREATINT_TASK_READVM", "id": 123, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319288292, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733275150315, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140733275150065, "addr_info": "KERNELBASE.dll", "idx": 2 }, { "addr": 140732928926288, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732924676049, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732921694947, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920592807, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920594801, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920584873, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 22 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 23 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 24 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 25 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 26 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 27 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 28 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 29 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 30 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 31 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 32 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 2475692589056, "vavadallocationprotect": 4, "vavadcommitsize": 479232, "vavadmmfname": "", "vavadqueryresult": 0, "vavadregionsize": 1048576, "vavadregiontype": 131072 }, { "baseaddress": 2475692826816, "bytescopied": 312, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914560640, "event": "KERNEL_THREATINT_TASK_READVM", "id": 124, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319288292, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733275150315, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140733275150065, "addr_info": "KERNELBASE.dll", "idx": 2 }, { "addr": 140732928926288, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732924676049, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732921694947, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920592807, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920594801, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920584873, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 22 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 23 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 24 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 25 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 26 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 27 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 28 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 29 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 30 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 31 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 32 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 2475692589056, "vavadallocationprotect": 4, "vavadcommitsize": 479232, "vavadmmfname": "", "vavadqueryresult": 0, "vavadregionsize": 1048576, "vavadregiontype": 131072 }, { "baseaddress": 2475692826176, "bytescopied": 312, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914560750, "event": "KERNEL_THREATINT_TASK_READVM", "id": 125, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319288292, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733275150315, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140733275150065, "addr_info": "KERNELBASE.dll", "idx": 2 }, { "addr": 140732928926288, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732924676049, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732921694947, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920592807, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920594801, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920584873, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 22 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 23 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 24 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 25 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 26 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 27 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 28 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 29 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 30 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 31 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 32 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 2475692589056, "vavadallocationprotect": 4, "vavadcommitsize": 479232, "vavadmmfname": "", "vavadqueryresult": 0, "vavadregionsize": 1048576, "vavadregiontype": 131072 }, { "baseaddress": 2475692827456, "bytescopied": 312, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914560860, "event": "KERNEL_THREATINT_TASK_READVM", "id": 126, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319288292, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733275150315, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140733275150065, "addr_info": "KERNELBASE.dll", "idx": 2 }, { "addr": 140732928926288, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732924676049, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732921694947, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920592807, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920594801, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920584873, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 22 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 23 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 24 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 25 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 26 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 27 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 28 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 29 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 30 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 31 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 32 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 2475692589056, "vavadallocationprotect": 4, "vavadcommitsize": 479232, "vavadmmfname": "", "vavadqueryresult": 0, "vavadregionsize": 1048576, "vavadregiontype": 131072 }, { "baseaddress": 2475692999520, "bytescopied": 312, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914560980, "event": "KERNEL_THREATINT_TASK_READVM", "id": 127, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319288292, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733275150315, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140733275150065, "addr_info": "KERNELBASE.dll", "idx": 2 }, { "addr": 140732928926288, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732924676049, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732921694947, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920592807, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920594801, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920584873, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 22 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 23 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 24 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 25 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 26 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 27 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 28 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 29 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 30 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 31 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 32 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 2475692589056, "vavadallocationprotect": 4, "vavadcommitsize": 479232, "vavadmmfname": "", "vavadqueryresult": 0, "vavadregionsize": 1048576, "vavadregiontype": 131072 }, { "baseaddress": 2475693001120, "bytescopied": 312, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914561090, "event": "KERNEL_THREATINT_TASK_READVM", "id": 128, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319288292, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733275150315, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140733275150065, "addr_info": "KERNELBASE.dll", "idx": 2 }, { "addr": 140732928926288, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732924676049, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732921694947, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920592807, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920594801, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920584873, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 22 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 23 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 24 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 25 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 26 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 27 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 28 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 29 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 30 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 31 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 32 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 2475692589056, "vavadallocationprotect": 4, "vavadcommitsize": 479232, "vavadmmfname": "", "vavadqueryresult": 0, "vavadregionsize": 1048576, "vavadregiontype": 131072 }, { "baseaddress": 2475693001440, "bytescopied": 312, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914561180, "event": "KERNEL_THREATINT_TASK_READVM", "id": 129, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319288292, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733275150315, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140733275150065, "addr_info": "KERNELBASE.dll", "idx": 2 }, { "addr": 140732928926288, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732924676049, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732921694947, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920592807, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920594801, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920584873, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 22 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 23 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 24 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 25 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 26 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 27 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 28 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 29 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 30 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 31 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 32 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 2475692589056, "vavadallocationprotect": 4, "vavadcommitsize": 479232, "vavadmmfname": "", "vavadqueryresult": 0, "vavadregionsize": 1048576, "vavadregiontype": 131072 }, { "baseaddress": 2475693001760, "bytescopied": 312, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914561300, "event": "KERNEL_THREATINT_TASK_READVM", "id": 130, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319288292, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733275150315, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140733275150065, "addr_info": "KERNELBASE.dll", "idx": 2 }, { "addr": 140732928926288, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732924676049, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732921694947, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920592807, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920594801, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920584873, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 22 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 23 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 24 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 25 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 26 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 27 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 28 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 29 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 30 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 31 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 32 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 2475692589056, "vavadallocationprotect": 4, "vavadcommitsize": 479232, "vavadmmfname": "", "vavadqueryresult": 0, "vavadregionsize": 1048576, "vavadregiontype": 131072 }, { "baseaddress": 2475693002080, "bytescopied": 312, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914561400, "event": "KERNEL_THREATINT_TASK_READVM", "id": 131, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319288292, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733275150315, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140733275150065, "addr_info": "KERNELBASE.dll", "idx": 2 }, { "addr": 140732928926288, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732924676049, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732921694947, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920592807, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920594801, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920584873, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 22 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 23 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 24 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 25 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 26 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 27 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 28 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 29 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 30 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 31 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 32 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 2475692589056, "vavadallocationprotect": 4, "vavadcommitsize": 479232, "vavadmmfname": "", "vavadqueryresult": 0, "vavadregionsize": 1048576, "vavadregiontype": 131072 }, { "baseaddress": 2475693000160, "bytescopied": 312, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914561570, "event": "KERNEL_THREATINT_TASK_READVM", "id": 132, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319288292, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733275150315, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140733275150065, "addr_info": "KERNELBASE.dll", "idx": 2 }, { "addr": 140732928926288, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732924676049, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732921694947, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920592807, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920594801, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920584873, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 22 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 23 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 24 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 25 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 26 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 27 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 28 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 29 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 30 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 31 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 32 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 2475692589056, "vavadallocationprotect": 4, "vavadcommitsize": 479232, "vavadmmfname": "", "vavadqueryresult": 0, "vavadregionsize": 1048576, "vavadregiontype": 131072 }, { "baseaddress": 546687045656, "bytescopied": 8, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914561710, "event": "KERNEL_THREATINT_TASK_READVM", "id": 133, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319288292, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733275151392, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140733275151129, "addr_info": "KERNELBASE.dll", "idx": 2 }, { "addr": 140732928926912, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732924676091, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732921694947, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920592807, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920594801, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920584873, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 22 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 23 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 24 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 25 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 26 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 27 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 28 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 29 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 30 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 31 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 32 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 546685583360, "vavadallocationprotect": 4, "vavadcommitsize": 53248, "vavadmmfname": "", "vavadqueryresult": 0, "vavadregionsize": 2097152, "vavadregiontype": 131072 }, { "baseaddress": 140733320229984, "bytescopied": 8, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914561890, "event": "KERNEL_THREATINT_TASK_READVM", "id": 134, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319288292, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733275151460, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140733275151129, "addr_info": "KERNELBASE.dll", "idx": 2 }, { "addr": 140732928926912, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732924676091, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732921694947, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920592807, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920594801, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920584873, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 22 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 23 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 24 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 25 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 26 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 27 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 28 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 29 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 30 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 31 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 32 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 140733318627328, "vavadallocationprotect": 128, "vavadcommitsize": 65536, "vavadmmfname": "\\Device\\HarddiskVolume3\\Windows\\System32\\ntdll.dll", "vavadqueryresult": 0, "vavadregionsize": 2195456, "vavadregiontype": 16777216 }, { "baseaddress": 2475692598368, "bytescopied": 136, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914562020, "event": "KERNEL_THREATINT_TASK_READVM", "id": 135, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319288292, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733275151537, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140733275151129, "addr_info": "KERNELBASE.dll", "idx": 2 }, { "addr": 140732928926912, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732924676091, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732921694947, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920592807, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920594801, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920584873, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 22 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 23 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 24 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 25 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 26 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 27 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 28 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 29 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 30 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 31 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 32 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 2475692589056, "vavadallocationprotect": 4, "vavadcommitsize": 479232, "vavadmmfname": "", "vavadqueryresult": 0, "vavadregionsize": 1048576, "vavadregiontype": 131072 }, { "baseaddress": 140703039684608, "bytescopied": 264, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914562530, "event": "KERNEL_THREATINT_TASK_READVM", "id": 136, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319298196, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140732928936309, "addr_info": "mpengine.dll", "idx": 1 }, { "addr": 140732921705544, "addr_info": "mpengine.dll", "idx": 2 }, { "addr": 140732924676374, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732921694947, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732920592807, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920594801, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920584873, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 21 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 22 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 23 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 24 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 25 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 26 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 27 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 28 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 29 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 30 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 31 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 140703039684608, "vavadallocationprotect": 128, "vavadcommitsize": 16384, "vavadmmfname": "\\Device\\HarddiskVolume3\\Users\\hacker\\Desktop\\b\\redtest3.exe", "vavadqueryresult": 0, "vavadregionsize": 192512, "vavadregiontype": 16777216 }, { "baseaddress": 140703039684872, "bytescopied": 264, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914562720, "event": "KERNEL_THREATINT_TASK_READVM", "id": 137, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319298196, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140732928936309, "addr_info": "mpengine.dll", "idx": 1 }, { "addr": 140732921705544, "addr_info": "mpengine.dll", "idx": 2 }, { "addr": 140732924676479, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732921694947, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732920592807, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920594801, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920584873, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 21 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 22 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 23 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 24 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 25 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 26 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 27 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 28 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 29 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 30 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 31 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 140703039684608, "vavadallocationprotect": 128, "vavadcommitsize": 16384, "vavadmmfname": "\\Device\\HarddiskVolume3\\Users\\hacker\\Desktop\\b\\redtest3.exe", "vavadqueryresult": 0, "vavadregionsize": 192512, "vavadregiontype": 16777216 }, { "baseaddress": 140703039685136, "bytescopied": 280, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914562910, "event": "KERNEL_THREATINT_TASK_READVM", "id": 138, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319298196, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140732928936309, "addr_info": "mpengine.dll", "idx": 1 }, { "addr": 140732921705544, "addr_info": "mpengine.dll", "idx": 2 }, { "addr": 140732924676973, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732921694947, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732920592807, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920594801, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920584873, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 21 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 22 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 23 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 24 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 25 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 26 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 27 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 28 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 29 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 30 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 31 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 140703039684608, "vavadallocationprotect": 128, "vavadcommitsize": 16384, "vavadmmfname": "\\Device\\HarddiskVolume3\\Users\\hacker\\Desktop\\b\\redtest3.exe", "vavadqueryresult": 0, "vavadregionsize": 192512, "vavadregiontype": 16777216 }, { "baseaddress": 140703039684608, "bytescopied": 4096, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914563680, "event": "KERNEL_THREATINT_TASK_READVM", "id": 139, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319298196, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140732928936309, "addr_info": "mpengine.dll", "idx": 1 }, { "addr": 140732921705544, "addr_info": "mpengine.dll", "idx": 2 }, { "addr": 140732921697828, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732920749845, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732920748881, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920748370, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732921897546, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732921897329, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920593195, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732920594801, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732920584873, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 22 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 23 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 24 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 25 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 26 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 27 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 28 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 29 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 30 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 31 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 32 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 33 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 34 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 35 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 140703039684608, "vavadallocationprotect": 128, "vavadcommitsize": 16384, "vavadmmfname": "\\Device\\HarddiskVolume3\\Users\\hacker\\Desktop\\b\\redtest3.exe", "vavadqueryresult": 0, "vavadregionsize": 192512, "vavadregiontype": 16777216 }, { "baseaddress": 140703039873024, "bytescopied": 4096, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914565810, "event": "KERNEL_THREATINT_TASK_READVM", "id": 140, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319298196, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140732928936309, "addr_info": "mpengine.dll", "idx": 1 }, { "addr": 140732921705544, "addr_info": "mpengine.dll", "idx": 2 }, { "addr": 140732921697828, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732920749845, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732920748881, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920748370, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732921895078, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732921898014, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920562498, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732920558791, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732920585037, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 22 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 23 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 24 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 25 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 26 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 27 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 28 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 29 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 30 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 31 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 32 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 33 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 34 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 35 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 140703039684608, "vavadallocationprotect": 128, "vavadcommitsize": 16384, "vavadmmfname": "\\Device\\HarddiskVolume3\\Users\\hacker\\Desktop\\b\\redtest3.exe", "vavadqueryresult": 0, "vavadregionsize": 192512, "vavadregiontype": 16777216 }, { "baseaddress": 140703039840256, "bytescopied": 4096, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914586640, "event": "KERNEL_THREATINT_TASK_READVM", "id": 141, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319298196, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140732928936309, "addr_info": "mpengine.dll", "idx": 1 }, { "addr": 140732921705544, "addr_info": "mpengine.dll", "idx": 2 }, { "addr": 140732921697828, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732920749845, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732920748881, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920748370, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920747873, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732932133904, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732925439882, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732925434653, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732931353995, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732920561795, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732920559045, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732920585037, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 22 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 23 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 24 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 25 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 26 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 27 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 28 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 29 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 30 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 31 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 32 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 33 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 34 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 35 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 36 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 37 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 38 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 140703039684608, "vavadallocationprotect": 128, "vavadcommitsize": 16384, "vavadmmfname": "\\Device\\HarddiskVolume3\\Users\\hacker\\Desktop\\b\\redtest3.exe", "vavadqueryresult": 0, "vavadregionsize": 192512, "vavadregiontype": 16777216 }, { "baseaddress": 140703039700992, "bytescopied": 4096, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914587200, "event": "KERNEL_THREATINT_TASK_READVM", "id": 142, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319298196, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140732928936309, "addr_info": "mpengine.dll", "idx": 1 }, { "addr": 140732921705544, "addr_info": "mpengine.dll", "idx": 2 }, { "addr": 140732921697828, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732920749845, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732920748881, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920748370, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920747873, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732925441441, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732925434653, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732931353995, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732920561795, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732920559045, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732920585037, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 22 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 23 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 24 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 25 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 26 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 27 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 28 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 29 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 30 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 31 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 32 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 33 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 34 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 35 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 36 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 37 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 140703039684608, "vavadallocationprotect": 128, "vavadcommitsize": 16384, "vavadmmfname": "\\Device\\HarddiskVolume3\\Users\\hacker\\Desktop\\b\\redtest3.exe", "vavadqueryresult": 0, "vavadregionsize": 192512, "vavadregiontype": 16777216 }, { "baseaddress": 140703039868928, "bytescopied": 4096, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914589000, "event": "KERNEL_THREATINT_TASK_READVM", "id": 143, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319298196, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140732928936309, "addr_info": "mpengine.dll", "idx": 1 }, { "addr": 140732921705544, "addr_info": "mpengine.dll", "idx": 2 }, { "addr": 140732921697828, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732920749845, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732920748881, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920748370, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920747873, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920747060, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920744596, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921217093, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732922181660, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732922180370, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732922249736, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732925441770, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732925434653, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732931353995, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732920561795, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732920559045, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732920585037, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 22 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 23 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 24 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 25 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 26 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 27 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 28 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 29 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 30 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 31 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 32 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 33 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 34 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 35 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 36 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 37 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 38 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 39 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 40 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 41 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 42 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 43 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 140703039684608, "vavadallocationprotect": 128, "vavadcommitsize": 16384, "vavadmmfname": "\\Device\\HarddiskVolume3\\Users\\hacker\\Desktop\\b\\redtest3.exe", "vavadqueryresult": 0, "vavadregionsize": 192512, "vavadregiontype": 16777216 }, { "baseaddress": 140703039795200, "bytescopied": 4096, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914589580, "event": "KERNEL_THREATINT_TASK_READVM", "id": 144, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319298196, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140732928936309, "addr_info": "mpengine.dll", "idx": 1 }, { "addr": 140732921705544, "addr_info": "mpengine.dll", "idx": 2 }, { "addr": 140732921697828, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732920749845, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732920748881, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920748370, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920747873, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920663497, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920498641, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732920494257, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732923098983, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732925441829, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732925434653, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732931353995, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732920561795, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920559045, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732920585037, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 22 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 23 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 24 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 25 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 26 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 27 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 28 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 29 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 30 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 31 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 32 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 33 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 34 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 35 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 36 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 37 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 38 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 39 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 40 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 41 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 140703039684608, "vavadallocationprotect": 128, "vavadcommitsize": 16384, "vavadmmfname": "\\Device\\HarddiskVolume3\\Users\\hacker\\Desktop\\b\\redtest3.exe", "vavadqueryresult": 0, "vavadregionsize": 192512, "vavadregiontype": 16777216 }, { "baseaddress": 140703039844352, "bytescopied": 4096, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914589980, "event": "KERNEL_THREATINT_TASK_READVM", "id": 145, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319298196, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140732928936309, "addr_info": "mpengine.dll", "idx": 1 }, { "addr": 140732921705544, "addr_info": "mpengine.dll", "idx": 2 }, { "addr": 140732921697828, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732920749845, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732920748881, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920748370, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920747873, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920663497, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920498641, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732920494257, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732923097909, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732925441829, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732925434653, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732931353995, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732920561795, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920559045, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732920585037, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 22 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 23 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 24 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 25 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 26 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 27 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 28 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 29 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 30 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 31 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 32 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 33 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 34 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 35 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 36 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 37 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 38 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 39 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 40 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 41 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 140703039684608, "vavadallocationprotect": 128, "vavadcommitsize": 16384, "vavadmmfname": "\\Device\\HarddiskVolume3\\Users\\hacker\\Desktop\\b\\redtest3.exe", "vavadqueryresult": 0, "vavadregionsize": 192512, "vavadregiontype": 16777216 }, { "baseaddress": 140703039688704, "bytescopied": 4096, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914591900, "event": "KERNEL_THREATINT_TASK_READVM", "id": 146, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319298196, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140732928936309, "addr_info": "mpengine.dll", "idx": 1 }, { "addr": 140732921705544, "addr_info": "mpengine.dll", "idx": 2 }, { "addr": 140732921697828, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732920749845, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732920748881, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920748370, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732923088690, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732923088437, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732923092086, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732923092584, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732923092407, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732923089713, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732923089455, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732923089057, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732925442692, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732925434653, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732931353995, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732920561795, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732920559045, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732920585037, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 22 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 23 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 24 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 25 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 26 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 27 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 28 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 29 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 30 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 31 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 32 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 33 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 34 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 35 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 36 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 37 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 38 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 39 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 40 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 41 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 42 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 43 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 44 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 140703039684608, "vavadallocationprotect": 128, "vavadcommitsize": 16384, "vavadmmfname": "\\Device\\HarddiskVolume3\\Users\\hacker\\Desktop\\b\\redtest3.exe", "vavadqueryresult": 0, "vavadregionsize": 192512, "vavadregiontype": 16777216 }, { "baseaddress": 140703039848448, "bytescopied": 4096, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914597220, "event": "KERNEL_THREATINT_TASK_READVM", "id": 147, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319298196, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140732928936309, "addr_info": "mpengine.dll", "idx": 1 }, { "addr": 140732921705544, "addr_info": "mpengine.dll", "idx": 2 }, { "addr": 140732921697828, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732920749845, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732920748881, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920748370, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920747873, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732926438794, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920627459, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732923933500, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732923933103, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732923932685, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732925442692, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732925434653, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732931353995, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920561795, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732920559045, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732920585037, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 22 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 23 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 24 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 25 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 26 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 27 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 28 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 29 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 30 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 31 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 32 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 33 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 34 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 35 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 36 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 37 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 38 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 39 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 40 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 41 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 42 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 140703039684608, "vavadallocationprotect": 128, "vavadcommitsize": 16384, "vavadmmfname": "\\Device\\HarddiskVolume3\\Users\\hacker\\Desktop\\b\\redtest3.exe", "vavadqueryresult": 0, "vavadregionsize": 192512, "vavadregiontype": 16777216 }, { "baseaddress": 140703039856640, "bytescopied": 4096, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914598050, "event": "KERNEL_THREATINT_TASK_READVM", "id": 148, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319298196, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140732928936309, "addr_info": "mpengine.dll", "idx": 1 }, { "addr": 140732921705544, "addr_info": "mpengine.dll", "idx": 2 }, { "addr": 140732921697828, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732920749845, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732920748881, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920748370, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920747873, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732926438794, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920627459, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732923933500, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732923933103, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732923932685, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732925442692, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732925434653, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732931353995, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920561795, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732920559045, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732920585037, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 22 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 23 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 24 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 25 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 26 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 27 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 28 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 29 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 30 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 31 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 32 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 33 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 34 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 35 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 36 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 37 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 38 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 39 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 40 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 41 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 42 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 140703039684608, "vavadallocationprotect": 128, "vavadcommitsize": 16384, "vavadmmfname": "\\Device\\HarddiskVolume3\\Users\\hacker\\Desktop\\b\\redtest3.exe", "vavadqueryresult": 0, "vavadregionsize": 192512, "vavadregiontype": 16777216 }, { "baseaddress": 140703039832064, "bytescopied": 4096, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914612270, "event": "KERNEL_THREATINT_TASK_READVM", "id": 149, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319298196, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140732928936309, "addr_info": "mpengine.dll", "idx": 1 }, { "addr": 140732921705544, "addr_info": "mpengine.dll", "idx": 2 }, { "addr": 140732921697828, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732920749845, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732920748881, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920748370, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920747873, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920663497, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920498641, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732920494257, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732922447537, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732925442692, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732925434653, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732931353995, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732920561795, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920559045, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732920585037, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 22 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 23 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 24 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 25 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 26 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 27 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 28 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 29 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 30 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 31 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 32 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 33 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 34 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 35 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 36 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 37 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 38 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 39 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 40 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 41 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 140703039684608, "vavadallocationprotect": 128, "vavadcommitsize": 16384, "vavadmmfname": "\\Device\\HarddiskVolume3\\Users\\hacker\\Desktop\\b\\redtest3.exe", "vavadqueryresult": 0, "vavadregionsize": 192512, "vavadregiontype": 16777216 }, { "baseaddress": 140703039799296, "bytescopied": 4096, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914622050, "event": "KERNEL_THREATINT_TASK_READVM", "id": 150, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319298196, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140732928936309, "addr_info": "mpengine.dll", "idx": 1 }, { "addr": 140732921705544, "addr_info": "mpengine.dll", "idx": 2 }, { "addr": 140732921697828, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732920749845, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732920748881, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920748370, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920747873, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920663497, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920498641, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732920495213, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732920608959, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 1778859315482, "addr_info": "NOT_IMAGE", "idx": 12 }, { "addr": 140732920843217, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732920834097, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732920827713, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920830668, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732920825246, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732920356483, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732920355319, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732925442692, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732925434653, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140732931353995, "addr_info": "mpengine.dll", "idx": 22 }, { "addr": 140732920561795, "addr_info": "mpengine.dll", "idx": 23 }, { "addr": 140732920559045, "addr_info": "mpengine.dll", "idx": 24 }, { "addr": 140732920585037, "addr_info": "mpengine.dll", "idx": 25 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 26 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 27 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 28 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 29 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 30 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 31 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 32 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 33 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 34 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 35 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 36 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 37 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 38 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 39 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 40 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 41 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 42 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 43 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 44 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 45 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 46 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 47 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 48 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 49 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 140703039684608, "vavadallocationprotect": 128, "vavadcommitsize": 16384, "vavadmmfname": "\\Device\\HarddiskVolume3\\Users\\hacker\\Desktop\\b\\redtest3.exe", "vavadqueryresult": 0, "vavadregionsize": 192512, "vavadregiontype": 16777216 }, { "baseaddress": 140703039852544, "bytescopied": 4096, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914622400, "event": "KERNEL_THREATINT_TASK_READVM", "id": 151, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319298196, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140732928936309, "addr_info": "mpengine.dll", "idx": 1 }, { "addr": 140732921705544, "addr_info": "mpengine.dll", "idx": 2 }, { "addr": 140732921697828, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732920749845, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732920748881, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920748370, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920747873, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920663497, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920498641, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732920495213, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732920608959, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 1778859315482, "addr_info": "NOT_IMAGE", "idx": 12 }, { "addr": 140732920843217, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732920834097, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732920827713, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920830668, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732920825246, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732920356483, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732920355319, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732925442692, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732925434653, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140732931353995, "addr_info": "mpengine.dll", "idx": 22 }, { "addr": 140732920561795, "addr_info": "mpengine.dll", "idx": 23 }, { "addr": 140732920559045, "addr_info": "mpengine.dll", "idx": 24 }, { "addr": 140732920585037, "addr_info": "mpengine.dll", "idx": 25 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 26 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 27 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 28 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 29 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 30 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 31 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 32 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 33 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 34 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 35 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 36 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 37 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 38 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 39 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 40 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 41 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 42 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 43 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 44 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 45 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 46 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 47 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 48 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 49 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 140703039684608, "vavadallocationprotect": 128, "vavadcommitsize": 16384, "vavadmmfname": "\\Device\\HarddiskVolume3\\Users\\hacker\\Desktop\\b\\redtest3.exe", "vavadqueryresult": 0, "vavadregionsize": 192512, "vavadregiontype": 16777216 }, { "desiredaccess": 4096, "etw_event_id": 5, "etw_pid": 1260, "etw_process": "MsMpEng.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Audit-API-Calls", "etw_tid": 1032, "etw_time": 134271933911487870, "event": "PspLogAuditOpenProcessEvent", "id": 152, "returncode": 0, "stack_trace": [ { "addr": 140733319287492, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733275222902, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140732921777221, "addr_info": "mpengine.dll", "idx": 2 }, { "addr": 140732921722584, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732925021799, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732925021163, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732925020867, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732921916435, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732921585731, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732921580287, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921579861, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921174413, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732921172268, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732921171926, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732921170133, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732921169556, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732929341080, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732929340803, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 18 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 19 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 20 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 21 } ], "targetprocessid": 3620, "trace_id": 41, "type": "etw" }, { "desiredaccess": 1048, "etw_event_id": 5, "etw_pid": 1260, "etw_process": "MsMpEng.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Audit-API-Calls", "etw_tid": 8724, "etw_time": 134271933914557420, "event": "PspLogAuditOpenProcessEvent", "id": 153, "returncode": 0, "stack_trace": [ { "addr": 140733319287492, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733274989678, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140732924675866, "addr_info": "mpengine.dll", "idx": 2 }, { "addr": 140732921694947, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732920592807, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732920594801, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920584873, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 20 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 21 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 22 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 23 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 24 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 25 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 26 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 27 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 28 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 29 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 30 } ], "targetprocessid": 3620, "trace_id": 41, "type": "etw" }, { "baseaddress": 140703039864832, "bytescopied": 4096, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914622670, "event": "KERNEL_THREATINT_TASK_READVM", "id": 154, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319298196, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140732928936309, "addr_info": "mpengine.dll", "idx": 1 }, { "addr": 140732921705544, "addr_info": "mpengine.dll", "idx": 2 }, { "addr": 140732921697828, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732920749845, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732920748881, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920748370, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920747873, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920663497, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920498641, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732920494257, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732920608959, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 1778859315482, "addr_info": "NOT_IMAGE", "idx": 12 }, { "addr": 140732920843217, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732920834097, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732920827713, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920830668, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732920825246, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732920356483, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732920355319, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732925442692, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732925434653, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140732931353995, "addr_info": "mpengine.dll", "idx": 22 }, { "addr": 140732920561795, "addr_info": "mpengine.dll", "idx": 23 }, { "addr": 140732920559045, "addr_info": "mpengine.dll", "idx": 24 }, { "addr": 140732920585037, "addr_info": "mpengine.dll", "idx": 25 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 26 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 27 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 28 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 29 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 30 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 31 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 32 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 33 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 34 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 35 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 36 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 37 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 38 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 39 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 40 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 41 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 42 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 43 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 44 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 45 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 46 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 47 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 48 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 49 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 140703039684608, "vavadallocationprotect": 128, "vavadcommitsize": 16384, "vavadmmfname": "\\Device\\HarddiskVolume3\\Users\\hacker\\Desktop\\b\\redtest3.exe", "vavadqueryresult": 0, "vavadregionsize": 192512, "vavadregiontype": 16777216 }, { "baseaddress": 140703039692800, "bytescopied": 4096, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914623650, "event": "KERNEL_THREATINT_TASK_READVM", "id": 155, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319298196, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140732928936309, "addr_info": "mpengine.dll", "idx": 1 }, { "addr": 140732921705544, "addr_info": "mpengine.dll", "idx": 2 }, { "addr": 140732921697828, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732920749845, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732920748881, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920748370, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920747873, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920663497, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920498641, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732920495213, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732924926468, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732924923702, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732920603924, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732920775614, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732920764723, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920830251, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732920825246, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732920356483, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732920355319, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732925442692, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732925434653, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140732931353995, "addr_info": "mpengine.dll", "idx": 22 }, { "addr": 140732920561795, "addr_info": "mpengine.dll", "idx": 23 }, { "addr": 140732920559045, "addr_info": "mpengine.dll", "idx": 24 }, { "addr": 140732920585037, "addr_info": "mpengine.dll", "idx": 25 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 26 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 27 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 28 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 29 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 30 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 31 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 32 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 33 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 34 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 35 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 36 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 37 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 38 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 39 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 40 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 41 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 42 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 43 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 44 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 45 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 46 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 47 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 48 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 49 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 140703039684608, "vavadallocationprotect": 128, "vavadcommitsize": 16384, "vavadmmfname": "\\Device\\HarddiskVolume3\\Users\\hacker\\Desktop\\b\\redtest3.exe", "vavadqueryresult": 0, "vavadregionsize": 192512, "vavadregiontype": 16777216 }, { "baseaddress": 140703039827968, "bytescopied": 4096, "callingprocesscreatetime": 134271932394527820, "callingprocessid": 1260, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238597, "callingthreadcreatetime": 134271933024473920, "callingthreadid": 8724, "etw_event_id": 13, "etw_pid": 1260, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 8724, "etw_time": 134271933914623890, "event": "KERNEL_THREATINT_TASK_READVM", "id": 156, "operationstatus": 0, "process_name": "MsMpEng.exe", "stack_trace": [ { "addr": 140733319298196, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140732928936309, "addr_info": "mpengine.dll", "idx": 1 }, { "addr": 140732921705544, "addr_info": "mpengine.dll", "idx": 2 }, { "addr": 140732921697828, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732920749845, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732920748881, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920748370, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920747873, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920663497, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920498641, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732920494257, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732924924059, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732920603924, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732920775614, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732920764723, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732920830251, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732920825246, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732920356483, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732920355319, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732925442692, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732925434653, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732931353995, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140732920561795, "addr_info": "mpengine.dll", "idx": 22 }, { "addr": 140732920559045, "addr_info": "mpengine.dll", "idx": 23 }, { "addr": 140732920585037, "addr_info": "mpengine.dll", "idx": 24 }, { "addr": 140732920585750, "addr_info": "mpengine.dll", "idx": 25 }, { "addr": 140732921708302, "addr_info": "mpengine.dll", "idx": 26 }, { "addr": 140732921767525, "addr_info": "mpengine.dll", "idx": 27 }, { "addr": 140732923485353, "addr_info": "mpengine.dll", "idx": 28 }, { "addr": 140732922774145, "addr_info": "mpengine.dll", "idx": 29 }, { "addr": 140732922780192, "addr_info": "mpengine.dll", "idx": 30 }, { "addr": 140732922773452, "addr_info": "mpengine.dll", "idx": 31 }, { "addr": 140732920160527, "addr_info": "mpengine.dll", "idx": 32 }, { "addr": 140732930644929, "addr_info": "mpengine.dll", "idx": 33 }, { "addr": 140732924977124, "addr_info": "mpengine.dll", "idx": 34 }, { "addr": 140732925000993, "addr_info": "mpengine.dll", "idx": 35 }, { "addr": 140732923487345, "addr_info": "mpengine.dll", "idx": 36 }, { "addr": 140732923479557, "addr_info": "mpengine.dll", "idx": 37 }, { "addr": 140733085513649, "addr_info": "mpsvc.dll", "idx": 38 }, { "addr": 140733085762857, "addr_info": "mpsvc.dll", "idx": 39 }, { "addr": 140733086652659, "addr_info": "mpsvc.dll", "idx": 40 }, { "addr": 140733086652291, "addr_info": "mpsvc.dll", "idx": 41 }, { "addr": 140733086734909, "addr_info": "mpsvc.dll", "idx": 42 }, { "addr": 140733083892344, "addr_info": "MpClient.dll", "idx": 43 }, { "addr": 140733083892067, "addr_info": "MpClient.dll", "idx": 44 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 45 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 46 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 47 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 48 } ], "targetprocesscreatetime": 134271933909597060, "targetprocessid": 3620, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238807, "trace_id": 41, "type": "etw", "vavadallocationbase": 140703039684608, "vavadallocationprotect": 128, "vavadcommitsize": 16384, "vavadmmfname": "\\Device\\HarddiskVolume3\\Users\\hacker\\Desktop\\b\\redtest3.exe", "vavadqueryresult": 0, "vavadregionsize": 192512, "vavadregiontype": 16777216 }, { "baseaddress": 2344576548864, "callingprocesscreatetime": 134271933909597060, "callingprocessid": 3620, "callingprocessprotection": "unsupported", "callingprocesssectionsignaturelevel": "unsupported", "callingprocesssignaturelevel": "unsupported", "callingprocessstartkey": 3659174697238807, "callingthreadcreatetime": 134271933909597070, "callingthreadid": 7148, "etw_event_id": 2, "etw_pid": 3620, "etw_provider_name": "Microsoft-Windows-Threat-Intelligence", "etw_tid": 7148, "etw_time": 134271933960644740, "event": "KERNEL_THREATINT_TASK_PROTECTVM", "id": 157, "lastprotectionmask": "RWX", "originalprocesscreatetime": 134271933909597060, "originalprocessid": 3620, "originalprocessprotection": "unsupported", "originalprocesssectionsignaturelevel": "unsupported", "originalprocesssignaturelevel": "unsupported", "originalprocessstartkey": 3659174697238807, "process_name": "redtest3.exe", "protectionmask": "R-X", "regionsize": 102400, "stack_trace": [ { "addr": 140733319288836, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733275297412, "addr_info": "KERNELBASE.dll:.text", "idx": 1 }, { "addr": 140703039693612, "addr_info": "redtest3.exe:.text", "idx": 2 }, { "addr": 140703039702818, "addr_info": "redtest3.exe:.text", "idx": 3 }, { "addr": 140703039703776, "addr_info": "redtest3.exe:.text", "idx": 4 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL:.text", "idx": 5 }, { "addr": 140733318999928, "addr_info": "ntdll.dll:.text", "idx": 6 } ], "targetprocesscreatetime": 134271933910302100, "targetprocessid": 4868, "targetprocessprotection": "unsupported", "targetprocesssectionsignaturelevel": "unsupported", "targetprocesssignaturelevel": "unsupported", "targetprocessstartkey": 3659174697238808, "trace_id": 41, "type": "etw", "vavadallocationbase": 2344576548864, "vavadallocationprotect": 64, "vavadcommitsize": 102400, "vavadmmfname": "", "vavadqueryresult": 0, "vavadregionsize": 102400, "vavadregiontype": 131072 }, { "etw_event_id": 3, "etw_pid": 3620, "etw_process": "redtest3.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Process", "etw_tid": 7148, "etw_time": 134271934010778930, "event": "ThreadStartStart ", "id": 158, "processid": 4868, "stack_trace": [ { "addr": 140733319292628, "addr_info": "ntdll.dll:.text", "idx": 0 }, { "addr": 140733275063711, "addr_info": "KERNELBASE.dll:.text", "idx": 1 }, { "addr": 140733289377944, "addr_info": "KERNEL32.DLL:.text", "idx": 2 }, { "addr": 140703039694124, "addr_info": "redtest3.exe:.text", "idx": 3 }, { "addr": 140703039702818, "addr_info": "redtest3.exe:.text", "idx": 4 }, { "addr": 140703039703776, "addr_info": "redtest3.exe:.text", "idx": 5 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL:.text", "idx": 6 }, { "addr": 140733318999928, "addr_info": "ntdll.dll:.text", "idx": 7 } ], "stackbase": 18446626998455611000, "stacklimit": 18446626998455587000, "startaddr": 2344576548864, "subprocesstag": 0, "tebbase": 652747059200, "threadid": 3568, "trace_id": 41, "type": "etw", "userstackbase": 652750094336, "userstacklimit": 652750090240, "win32startaddr": 2344576548864 }, { "desiredaccess": 4096, "etw_event_id": 5, "etw_pid": 1260, "etw_process": "MsMpEng.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Audit-API-Calls", "etw_tid": 3300, "etw_time": 134271934010825650, "event": "PspLogAuditOpenProcessEvent", "id": 159, "returncode": 0, "stack_trace": [ { "addr": 140733319287492, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733275222902, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140732921777221, "addr_info": "mpengine.dll", "idx": 2 }, { "addr": 140732921722584, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732920706353, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732920221141, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732920221644, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732920213570, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732920278094, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732920863473, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732920275319, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732920264529, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732920260309, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732920255682, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732920254314, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140732931243564, "addr_info": "mpengine.dll", "idx": 15 }, { "addr": 140732921533295, "addr_info": "mpengine.dll", "idx": 16 }, { "addr": 140732921529379, "addr_info": "mpengine.dll", "idx": 17 }, { "addr": 140732921529174, "addr_info": "mpengine.dll", "idx": 18 }, { "addr": 140732921155379, "addr_info": "mpengine.dll", "idx": 19 }, { "addr": 140732925614546, "addr_info": "mpengine.dll", "idx": 20 }, { "addr": 140732927921146, "addr_info": "mpengine.dll", "idx": 21 }, { "addr": 140732921174413, "addr_info": "mpengine.dll", "idx": 22 }, { "addr": 140732921172268, "addr_info": "mpengine.dll", "idx": 23 }, { "addr": 140732921171926, "addr_info": "mpengine.dll", "idx": 24 }, { "addr": 140732921170133, "addr_info": "mpengine.dll", "idx": 25 }, { "addr": 140732921169556, "addr_info": "mpengine.dll", "idx": 26 }, { "addr": 140732929341080, "addr_info": "mpengine.dll", "idx": 27 }, { "addr": 140732929340803, "addr_info": "mpengine.dll", "idx": 28 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 29 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 30 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 31 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 32 } ], "targetprocessid": 3620, "trace_id": 41, "type": "etw" }, { "desiredaccess": 5136, "etw_event_id": 5, "etw_pid": 1260, "etw_process": "MsMpEng.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Audit-API-Calls", "etw_tid": 3412, "etw_time": 134271934011322240, "event": "PspLogAuditOpenProcessEvent", "id": 160, "returncode": 0, "stack_trace": [ { "addr": 140733319287492, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733274989678, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140732921250766, "addr_info": "mpengine.dll", "idx": 2 }, { "addr": 140732921250247, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732922672087, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732922671120, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732921179278, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140732921174752, "addr_info": "mpengine.dll", "idx": 7 }, { "addr": 140732921174289, "addr_info": "mpengine.dll", "idx": 8 }, { "addr": 140732921172268, "addr_info": "mpengine.dll", "idx": 9 }, { "addr": 140732921171926, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732921170133, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140732921169556, "addr_info": "mpengine.dll", "idx": 12 }, { "addr": 140732929341080, "addr_info": "mpengine.dll", "idx": 13 }, { "addr": 140732929340803, "addr_info": "mpengine.dll", "idx": 14 }, { "addr": 140733319031018, "addr_info": "ntdll.dll", "idx": 15 }, { "addr": 140733318848182, "addr_info": "ntdll.dll", "idx": 16 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 17 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 18 } ], "targetprocessid": 3620, "trace_id": 41, "type": "etw" }, { "desiredaccess": 4096, "etw_event_id": 5, "etw_pid": 1260, "etw_process": "MsMpEng.exe", "etw_provider_name": "Microsoft-Windows-Kernel-Audit-API-Calls", "etw_tid": 3688, "etw_time": 134271934031285860, "event": "PspLogAuditOpenProcessEvent", "id": 161, "returncode": 0, "stack_trace": [ { "addr": 140733319287492, "addr_info": "ntdll.dll", "idx": 0 }, { "addr": 140733274989678, "addr_info": "KERNELBASE.dll", "idx": 1 }, { "addr": 140732921250766, "addr_info": "mpengine.dll", "idx": 2 }, { "addr": 140732921249976, "addr_info": "mpengine.dll", "idx": 3 }, { "addr": 140732926096785, "addr_info": "mpengine.dll", "idx": 4 }, { "addr": 140732926095728, "addr_info": "mpengine.dll", "idx": 5 }, { "addr": 140732921190516, "addr_info": "mpengine.dll", "idx": 6 }, { "addr": 140733307933569, "addr_info": "sechost.dll", "idx": 7 }, { "addr": 140733307932730, "addr_info": "sechost.dll", "idx": 8 }, { "addr": 140733307946802, "addr_info": "sechost.dll", "idx": 9 }, { "addr": 140732928743717, "addr_info": "mpengine.dll", "idx": 10 }, { "addr": 140732930350463, "addr_info": "mpengine.dll", "idx": 11 }, { "addr": 140733289211293, "addr_info": "KERNEL32.DLL", "idx": 12 }, { "addr": 140733318999928, "addr_info": "ntdll.dll", "idx": 13 } ], "targetprocessid": 3620, "trace_id": 41, "type": "etw" } ]