﻿EVENT 0.000: Windows Kernel/EventTrace PID=20648; TID=12420; PName=Process(20648); ProceNum=0; DataLen=526; BufferSize=65,536; Version=83,951,626; ProviderVersion=18,362; NumberOfProcessors=12; EndTime=19/05/04 16:58:22.38...; TimerResolution=156,250; MaxFileSize=0; LogFileMode=537,004,033; BuffersWritten=88; StartBuffers=1; PointerSize=8; EventsLost=0; CPUSpeed=3,696; BootTime=19/04/24 08:21:58.50...; PerfFreq=10,000,000; StartTime=19/05/04 16:58:22.32...; ReservedFlags=1; BuffersLost=0; SessionName=BPerfRelogger; LogFileName=E:\perfview\src\Trac...; UtcOffsetMinutes=480; 
EVENT 0.000: KernelTraceControl/MetaData/EventInfo PID=0; TID=0; PName=Idle; ProceNum=0; DataLen=1328; 
EVENT 0.000: Windows Kernel/SysConfig/SystemPaths PID=0; TID=0; PName=Idle; ProceNum=0; DataLen=64; SystemDirectory=C:\Windows\system32; SystemWindowsDirectory=C:\Windows\; 
EVENT 0.000: Windows Kernel/SysConfig/VolumeMapping PID=0; TID=0; PName=Idle; ProceNum=0; DataLen=12; NtPath=\??\; DosPath=; 
EVENT 0.000: Windows Kernel/SysConfig/VolumeMapping PID=0; TID=0; PName=Idle; ProceNum=0; DataLen=50; NtPath=\SystemRoot\; DosPath=C:\Windows\; 
EVENT 0.000: Windows Kernel/SysConfig/VolumeMapping PID=0; TID=0; PName=Idle; ProceNum=0; DataLen=58; NtPath=\Device\HarddiskVolu...; DosPath=D:\; 
EVENT 0.000: Windows Kernel/SysConfig/VolumeMapping PID=0; TID=0; PName=Idle; ProceNum=0; DataLen=58; NtPath=\Device\HarddiskVolu...; DosPath=C:\; 
EVENT 0.000: Windows Kernel/SysConfig/VolumeMapping PID=0; TID=0; PName=Idle; ProceNum=0; DataLen=58; NtPath=\Device\LanmanRedire...; DosPath=\\; 
EVENT 0.000: Windows Kernel/SysConfig/VolumeMapping PID=0; TID=0; PName=Idle; ProceNum=0; DataLen=32; NtPath=\Device\Mup\; DosPath=\\; 
EVENT 0.000: Windows Kernel/SysConfig/VolumeMapping PID=0; TID=0; PName=Idle; ProceNum=0; DataLen=52; NtPath=\Device\vmsmb\; DosPath=\\?\VMSMB\; 
EVENT 0.000: Windows Kernel/SysConfig/VolumeMapping PID=0; TID=0; PName=Idle; ProceNum=0; DataLen=12; NtPath=\\; DosPath=\\; 
EVENT 0.000: KernelTraceControl/MetaData/EventInfo PID=-1; TID=-1; PName=; ProceNum=2; DataLen=624; 
EVENT 0.000: Windows Kernel/EventTrace/EndExtension PID=-1; TID=-1; PName=; ProceNum=2; DataLen=36; GroupMask1=0; GroupMask2=0; GroupMask3=0; GroupMask4=0; GroupMask5=0; GroupMask6=0; GroupMask7=0; GroupMask8=0; KernelEventVersion=70; 
EVENT 0.000: KernelTraceControl/MetaData/EventInfo PID=-1; TID=-1; PName=; ProceNum=2; DataLen=624; 
EVENT 0.000: Windows Kernel/EventTrace/Extension PID=-1; TID=-1; PName=; ProceNum=2; DataLen=36; GroupMask1=268,435,456; GroupMask2=0; GroupMask3=0; GroupMask4=0; GroupMask5=0; GroupMask6=0; GroupMask7=0; GroupMask8=0; KernelEventVersion=70; 
EVENT 0.000: KernelTraceControl/MetaData/EventInfo PID=-1; TID=-1; PName=; ProceNum=2; DataLen=216; 
EVENT 0.000: Windows Kernel/EventTrace/RundownComplete PID=-1; TID=-1; PName=; ProceNum=2; DataLen=0; 
EVENT 0.000: Windows Kernel/EventTrace/EndExtension PID=-1; TID=-1; PName=; ProceNum=2; DataLen=36; GroupMask1=268,435,456; GroupMask2=0; GroupMask3=0; GroupMask4=0; GroupMask5=0; GroupMask6=0; GroupMask7=0; GroupMask8=0; KernelEventVersion=70; 
EVENT 0.000: KernelTraceControl/MetaData/EventInfo PID=-1; TID=-1; PName=; ProceNum=11; DataLen=368; 
EVENT 0.000: Windows Kernel/PerfInfo/Sample PID=-1; TID=9984; PName=; ProceNum=11; DataLen=16; InstructionPointer=0xfffff8027cb7a50c; ProcessorNumber=11; Priority=9; ExecutingDPC=False; ExecutingISR=False; Rank=0; Count=1; 
EVENT 0.000: Windows Kernel/EventTrace/Extension PID=-1; TID=-1; PName=; ProceNum=11; DataLen=36; GroupMask1=16,777,223; GroupMask2=2; GroupMask3=0; GroupMask4=0; GroupMask5=0; GroupMask6=0; GroupMask7=0; GroupMask8=0; KernelEventVersion=70; 
EVENT 0.000: KernelTraceControl/MetaData/EventInfo PID=-1; TID=-1; PName=; ProceNum=11; DataLen=760; 
EVENT 0.000: Windows Kernel/Process/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=75; ProcessID=0; ParentID=0; ImageFileName=Idle; PageDirectoryBase=0x001aa000; Flags=None; SessionID=-1; ExitStatus=0; UniqueProcessKey=0xfffff8027cf899c0; CommandLine=; PackageFullName=; ApplicationID=; 
EVENT 0.000: KernelTraceControl/MetaData/EventInfo PID=0; TID=0; PName=Idle; ProceNum=11; DataLen=848; 
EVENT 0.000: Windows Kernel/Process/DCStart PID=4; TID=-1; PName=System; ProceNum=11; DataLen=77; ProcessID=4; ParentID=0; ImageFileName=System; PageDirectoryBase=0x001aa000; Flags=Protected; SessionID=-1; ExitStatus=259; UniqueProcessKey=0xffffc50f5927c2c0; CommandLine=; PackageFullName=; ApplicationID=; 
EVENT 0.000: KernelTraceControl/MetaData/EventInfo PID=-1; TID=-1; PName=; ProceNum=11; DataLen=832; 
EVENT 0.000: KernelTraceControl/ImageID PID=4; TID=-1; PName=System; ProceNum=11; DataLen=44; ImageBase=0x775a0000; ImageSize=1,679,360; ProcessID=0; TimeDateStamp=-1,682,131,799; BuildTime=52/10/18 03:38:17.00...; OriginalFileName=ntdll.dll; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=4; TID=-1; PName=System; ProceNum=11; DataLen=158; ImageBase=0x775a0000; ImageSize=1,679,360; ImageChecksum=1,701,371; TimeDateStamp=0; DefaultBase=0x775a0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\SysWOW64\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=4; TID=-1; PName=System; ProceNum=11; DataLen=48; ImageBase=0x7ffc265c0000; ImageSize=200,704; ProcessID=0; TimeDateStamp=-511,048,328; BuildTime=89/11/27 08:36:08.00...; OriginalFileName=vertdll.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=4; TID=-1; PName=System; ProceNum=11; DataLen=44; ImageBase=0x7ffc265c0000; GuidSig=a10a4aba-6f4f-af79-6...; Age=1; PDBFileName=vertdll.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=4; TID=-1; PName=System; ProceNum=11; DataLen=162; ImageBase=0x7ffc265c0000; ImageSize=200,704; ImageChecksum=188,053; TimeDateStamp=0; DefaultBase=0x7ffc265c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=4; TID=-1; PName=System; ProceNum=11; DataLen=44; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ProcessID=0; TimeDateStamp=-1,523,876,758; BuildTime=57/10/23 19:22:18.00...; OriginalFileName=ntdll.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=4; TID=-1; PName=System; ProceNum=11; DataLen=42; ImageBase=0x7ffc26600000; GuidSig=b54f3499-813e-bcf1-3...; Age=1; PDBFileName=ntdll.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=4; TID=-1; PName=System; ProceNum=11; DataLen=158; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ImageChecksum=2,058,600; TimeDateStamp=0; DefaultBase=0x7ffc26600000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff8027ca00000; ImageSize=11,214,848; ProcessID=0; TimeDateStamp=-185,646,297; BuildTime=00/03/21 14:03:19.00...; OriginalFileName=ntkrnlmp.exe; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff8027ca00000; GuidSig=06602688-9fbd-b618-b...; Age=1; PDBFileName=ntkrnlmp.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=124; ImageBase=0xfffff8027ca00000; ImageSize=11,214,848; ImageChecksum=9,931,433; TimeDateStamp=-185,646,297; DefaultBase=0x00000000; BuildTime=00/03/21 14:03:19.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=40; ImageBase=0xfffff8027c95d000; ImageSize=667,648; ProcessID=0; TimeDateStamp=-845,975,435; BuildTime=79/04/17 21:17:41.00...; OriginalFileName=hal.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=40; ImageBase=0xfffff8027c95d000; GuidSig=50122536-9a90-f0ef-1...; Age=1; PDBFileName=hal.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=114; ImageBase=0xfffff8027c95d000; ImageSize=667,648; ImageChecksum=666,027; TimeDateStamp=-845,975,435; DefaultBase=0x00000000; BuildTime=79/04/17 21:17:41.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=38; ImageBase=0xfffff8027de00000; ImageSize=45,056; ProcessID=0; TimeDateStamp=1,517,671,716; BuildTime=18/02/03 15:28:36.00...; OriginalFileName=kd.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=39; ImageBase=0xfffff8027de00000; GuidSig=a10ea7ac-d099-c095-4...; Age=1; PDBFileName=kd.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=112; ImageBase=0xfffff8027de00000; ImageSize=45,056; ImageChecksum=41,143; TimeDateStamp=1,517,671,716; DefaultBase=0x00000000; BuildTime=18/02/03 15:28:36.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=76; ImageBase=0xfffff8027de10000; ImageSize=2,101,248; ProcessID=0; TimeDateStamp=629,975,834; BuildTime=89/12/18 09:17:14.00...; OriginalFileName=mcupdate_GenuineInte...; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=58; ImageBase=0xfffff8027de10000; GuidSig=8b4d1347-9e3b-ca41-4...; Age=1; PDBFileName=mcupdate_GenuineInte...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=150; ImageBase=0xfffff8027de10000; ImageSize=2,101,248; ImageChecksum=2,067,044; TimeDateStamp=629,975,834; DefaultBase=0x00000000; BuildTime=89/12/18 09:17:14.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=46; ImageBase=0xfffff8027e070000; ImageSize=393,216; ProcessID=0; TimeDateStamp=-1,910,878,443; BuildTime=45/07/19 14:54:13.00...; OriginalFileName=krpcdd.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=42; ImageBase=0xfffff8027e070000; GuidSig=316a5f72-33ae-a0d3-b...; Age=1; PDBFileName=msrpc.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=134; ImageBase=0xfffff8027e070000; ImageSize=393,216; ImageChecksum=417,836; TimeDateStamp=-1,910,878,443; DefaultBase=0x00000000; BuildTime=45/07/19 14:54:13.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=46; ImageBase=0xfffff8027e040000; ImageSize=172,032; ProcessID=0; TimeDateStamp=-1,554,044,682; BuildTime=56/11/08 15:23:34.00...; OriginalFileName=ksecdd.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=43; ImageBase=0xfffff8027e040000; GuidSig=72117324-c058-036a-8...; Age=1; PDBFileName=ksecdd.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=136; ImageBase=0xfffff8027e040000; ImageSize=172,032; ImageChecksum=172,516; TimeDateStamp=-1,554,044,682; DefaultBase=0x00000000; BuildTime=56/11/08 15:23:34.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=52; ImageBase=0xfffff8027e020000; ImageSize=69,632; ProcessID=0; TimeDateStamp=-1,785,850,702; BuildTime=49/07/05 16:49:54.00...; OriginalFileName=werkernel.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=46; ImageBase=0xfffff8027e020000; GuidSig=e09c9fa8-7c1f-446d-a...; Age=1; PDBFileName=WerKernel.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=142; ImageBase=0xfffff8027e020000; ImageSize=69,632; ImageChecksum=83,727; TimeDateStamp=-1,785,850,702; DefaultBase=0x00000000; BuildTime=49/07/05 16:49:54.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=42; ImageBase=0xfffff8027e110000; ImageSize=425,984; ProcessID=0; TimeDateStamp=1,199,565,607; BuildTime=08/01/05 20:40:07.00...; OriginalFileName=Clfs.Sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=41; ImageBase=0xfffff8027e110000; GuidSig=3592fc0a-894f-5fe6-4...; Age=1; PDBFileName=clfs.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=132; ImageBase=0xfffff8027e110000; ImageSize=425,984; ImageChecksum=449,233; TimeDateStamp=1,199,565,607; DefaultBase=0x00000000; BuildTime=08/01/05 20:40:07.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=38; ImageBase=0xfffff8027e0e0000; ImageSize=159,744; ProcessID=0; TimeDateStamp=719,017,114; BuildTime=92/10/13 22:58:34.00...; OriginalFileName=tm.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=39; ImageBase=0xfffff8027e0e0000; GuidSig=0d068ddd-9d7a-3f84-8...; Age=1; PDBFileName=tm.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=128; ImageBase=0xfffff8027e0e0000; ImageSize=159,744; ImageChecksum=175,426; TimeDateStamp=719,017,114; DefaultBase=0x00000000; BuildTime=92/10/13 22:58:34.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff8027e180000; ImageSize=106,496; ProcessID=0; TimeDateStamp=-1,306,550,822; BuildTime=64/09/12 03:41:14.00...; OriginalFileName=pshed.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=42; ImageBase=0xfffff8027e180000; GuidSig=2ded8f70-61da-1462-e...; Age=1; PDBFileName=pshed.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=118; ImageBase=0xfffff8027e180000; ImageSize=106,496; ImageChecksum=140,567; TimeDateStamp=-1,306,550,822; DefaultBase=0x00000000; BuildTime=64/09/12 03:41:14.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=48; ImageBase=0xfffff8027e1a0000; ImageSize=45,056; ProcessID=0; TimeDateStamp=254,809,604; BuildTime=78/01/28 04:26:44.00...; OriginalFileName=bootvid.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff8027e1a0000; GuidSig=f6d88914-2b3a-0391-4...; Age=1; PDBFileName=bootvid.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=122; ImageBase=0xfffff8027e1a0000; ImageSize=45,056; ImageChecksum=85,411; TimeDateStamp=254,809,604; DefaultBase=0x00000000; BuildTime=78/01/28 04:26:44.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=46; ImageBase=0xfffff8027e310000; ImageSize=462,848; ProcessID=0; TimeDateStamp=802,061,416; BuildTime=95/06/02 02:50:16.00...; OriginalFileName=fltMgr.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=43; ImageBase=0xfffff8027e310000; GuidSig=86770ac4-a8d7-05d9-1...; Age=1; PDBFileName=fltMgr.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=136; ImageBase=0xfffff8027e310000; ImageSize=462,848; ImageChecksum=463,935; TimeDateStamp=802,061,416; DefaultBase=0x00000000; BuildTime=95/06/02 02:50:16.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=46; ImageBase=0xfffff8027e200000; ImageSize=1,069,056; ProcessID=0; TimeDateStamp=1,552,947,087; BuildTime=19/03/18 22:11:27.00...; OriginalFileName=clipsp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=43; ImageBase=0xfffff8027e200000; GuidSig=53cabdfd-0b57-4b1f-a...; Age=1; PDBFileName=clipsp.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=136; ImageBase=0xfffff8027e200000; ImageSize=1,069,056; ImageChecksum=1,070,672; TimeDateStamp=1,552,947,087; DefaultBase=0x00000000; BuildTime=19/03/18 22:11:27.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff8027e1b0000; ImageSize=57,344; ProcessID=0; TimeDateStamp=-940,563,788; BuildTime=76/04/18 02:45:08.00...; OriginalFileName=cmimcext.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff8027e1b0000; GuidSig=1c36f5a0-4ee9-1bf9-b...; Age=1; PDBFileName=cmimcext.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=140; ImageBase=0xfffff8027e1b0000; ImageSize=57,344; ImageChecksum=44,602; TimeDateStamp=-940,563,788; DefaultBase=0x00000000; BuildTime=76/04/18 02:45:08.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=48; ImageBase=0xfffff8027e1c0000; ImageSize=49,152; ProcessID=0; TimeDateStamp=-1,161,267,240; BuildTime=69/04/20 16:14:16.00...; OriginalFileName=ntosext.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff8027e1c0000; GuidSig=e149a8b6-c2fb-98ca-b...; Age=1; PDBFileName=ntosext.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=138; ImageBase=0xfffff8027e1c0000; ImageSize=49,152; ImageChecksum=42,379; TimeDateStamp=-1,161,267,240; DefaultBase=0x00000000; BuildTime=69/04/20 16:14:16.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=38; ImageBase=0xfffff8027e390000; ImageSize=901,120; ProcessID=0; TimeDateStamp=-898,377,901; BuildTime=77/08/19 09:03:15.00...; OriginalFileName=ci.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=39; ImageBase=0xfffff8027e390000; GuidSig=b03cb569-e454-b6a9-3...; Age=1; PDBFileName=ci.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=112; ImageBase=0xfffff8027e390000; ImageSize=901,120; ImageChecksum=931,702; TimeDateStamp=-898,377,901; DefaultBase=0x00000000; BuildTime=77/08/19 09:03:15.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=40; ImageBase=0xfffff8027e470000; ImageSize=770,048; ProcessID=0; TimeDateStamp=1,699,034,417; BuildTime=23/11/03 18:00:17.00...; OriginalFileName=cng.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=40; ImageBase=0xfffff8027e470000; GuidSig=17c6d2fc-c5c9-3f83-7...; Age=1; PDBFileName=cng.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=130; ImageBase=0xfffff8027e470000; ImageSize=770,048; ImageChecksum=780,054; TimeDateStamp=1,699,034,417; DefaultBase=0x00000000; BuildTime=23/11/03 18:00:17.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff8027e530000; ImageSize=872,448; ProcessID=0; TimeDateStamp=292,185,482; BuildTime=79/04/05 18:38:02.00...; OriginalFileName=wdf01000.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff8027e530000; GuidSig=f785eb0a-2ef3-f130-d...; Age=1; PDBFileName=Wdf01000.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=140; ImageBase=0xfffff8027e530000; ImageSize=872,448; ImageChecksum=865,095; TimeDateStamp=292,185,482; DefaultBase=0x00000000; BuildTime=79/04/05 18:38:02.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=46; ImageBase=0xfffff8027e1d0000; ImageSize=77,824; ProcessID=0; TimeDateStamp=993,617,792; BuildTime=01/06/27 04:56:32.00...; OriginalFileName=wdfldr.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=43; ImageBase=0xfffff8027e1d0000; GuidSig=d44323a0-1e82-4a86-1...; Age=1; PDBFileName=wdfldr.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=136; ImageBase=0xfffff8027e1d0000; ImageSize=77,824; ImageChecksum=93,881; TimeDateStamp=993,617,792; DefaultBase=0x00000000; BuildTime=01/06/27 04:56:32.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=56; ImageBase=0xfffff8027e610000; ImageSize=65,536; ProcessID=0; TimeDateStamp=883,245,617; BuildTime=97/12/27 18:00:17.00...; OriginalFileName=WppRecorder.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=48; ImageBase=0xfffff8027e610000; GuidSig=7ed15338-7c4d-8664-b...; Age=1; PDBFileName=wpprecorder.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=146; ImageBase=0xfffff8027e610000; ImageSize=65,536; ImageChecksum=96,351; TimeDateStamp=883,245,617; DefaultBase=0x00000000; BuildTime=97/12/27 18:00:17.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=66; ImageBase=0xfffff8027e1f0000; ImageSize=61,440; ProcessID=0; TimeDateStamp=-1,167,187,130; BuildTime=69/02/11 03:49:26.00...; OriginalFileName=SleepStudyHelper.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=53; ImageBase=0xfffff8027e1f0000; GuidSig=c72fec77-eed6-e3d0-0...; Age=1; PDBFileName=SleepStudyHelper.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=156; ImageBase=0xfffff8027e1f0000; ImageSize=61,440; ImageChecksum=86,020; TimeDateStamp=-1,167,187,130; DefaultBase=0x00000000; BuildTime=69/02/11 03:49:26.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=46; ImageBase=0xfffff8027e630000; ImageSize=151,552; ProcessID=0; TimeDateStamp=730,983,858; BuildTime=93/03/01 11:04:18.00...; OriginalFileName=acpiex.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=43; ImageBase=0xfffff8027e630000; GuidSig=405e9376-b8b8-1a01-b...; Age=1; PDBFileName=acpiex.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=136; ImageBase=0xfffff8027e630000; ImageSize=151,552; ImageChecksum=191,876; TimeDateStamp=730,983,858; DefaultBase=0x00000000; BuildTime=93/03/01 11:04:18.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff8027e660000; ImageSize=299,008; ProcessID=0; TimeDateStamp=-95,318,966; BuildTime=03/01/31 00:58:50.00...; OriginalFileName=mssecflt.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff8027e660000; GuidSig=f4420c98-375d-8ffc-2...; Age=1; PDBFileName=mssecflt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=140; ImageBase=0xfffff8027e660000; ImageSize=299,008; ImageChecksum=337,921; TimeDateStamp=-95,318,966; DefaultBase=0x00000000; BuildTime=03/01/31 00:58:50.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=52; ImageBase=0xfffff8027e6b0000; ImageSize=106,496; ProcessID=0; TimeDateStamp=-128,867,947; BuildTime=02/01/07 17:49:09.00...; OriginalFileName=SgrmAgent.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=46; ImageBase=0xfffff8027e6b0000; GuidSig=a62f1abf-3230-d73f-c...; Age=1; PDBFileName=SgrmAgent.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=142; ImageBase=0xfffff8027e6b0000; ImageSize=106,496; ImageChecksum=121,785; TimeDateStamp=-128,867,947; DefaultBase=0x00000000; BuildTime=02/01/07 17:49:09.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=42; ImageBase=0xfffff8027e6d0000; ImageSize=40,960; ProcessID=0; TimeDateStamp=-2,032,798,522; BuildTime=41/09/07 12:12:54.00...; OriginalFileName=lxss.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=41; ImageBase=0xfffff8027e6d0000; GuidSig=a50e0ede-9d65-dc98-3...; Age=1; PDBFileName=lxss.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=132; ImageBase=0xfffff8027e6d0000; ImageSize=40,960; ImageChecksum=32,497; TimeDateStamp=-2,032,798,522; DefaultBase=0x00000000; BuildTime=41/09/07 12:12:54.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=46; ImageBase=0xfffff8027e6e0000; ImageSize=1,138,688; ProcessID=0; TimeDateStamp=-558,553,993; BuildTime=88/05/26 12:35:03.00...; OriginalFileName=lxcore.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=43; ImageBase=0xfffff8027e6e0000; GuidSig=90e38c60-e7d2-68d1-d...; Age=1; PDBFileName=lxcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=136; ImageBase=0xfffff8027e6e0000; ImageSize=1,138,688; ImageChecksum=1,153,555; TimeDateStamp=-558,553,993; DefaultBase=0x00000000; BuildTime=88/05/26 12:35:03.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=42; ImageBase=0xfffff8027e800000; ImageSize=835,584; ProcessID=0; TimeDateStamp=1,669,033,389; BuildTime=22/11/21 12:23:09.00...; OriginalFileName=ACPI.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=41; ImageBase=0xfffff8027e800000; GuidSig=a30c7413-c3ea-f4c8-9...; Age=1; PDBFileName=acpi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=132; ImageBase=0xfffff8027e800000; ImageSize=835,584; ImageChecksum=834,956; TimeDateStamp=1,669,033,389; DefaultBase=0x00000000; BuildTime=22/11/21 12:23:09.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=46; ImageBase=0xfffff8027e8d0000; ImageSize=49,152; ProcessID=0; TimeDateStamp=1,493,311,037; BuildTime=17/04/27 16:37:17.00...; OriginalFileName=WmiLib.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=43; ImageBase=0xfffff8027e8d0000; GuidSig=d4ec58be-fb82-7dfa-7...; Age=1; PDBFileName=wmilib.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=136; ImageBase=0xfffff8027e8d0000; ImageSize=49,152; ImageChecksum=55,399; TimeDateStamp=1,493,311,037; DefaultBase=0x00000000; BuildTime=17/04/27 16:37:17.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff8027e900000; ImageSize=299,008; ProcessID=0; TimeDateStamp=-1,977,910,928; BuildTime=43/06/04 18:46:08.00...; OriginalFileName=intelpep.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff8027e900000; GuidSig=fd97fbac-82d7-1416-3...; Age=1; PDBFileName=intelpep.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=140; ImageBase=0xfffff8027e900000; ImageSize=299,008; ImageChecksum=313,010; TimeDateStamp=-1,977,910,928; DefaultBase=0x00000000; BuildTime=43/06/04 18:46:08.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=66; ImageBase=0xfffff8027e950000; ImageSize=94,208; ProcessID=0; TimeDateStamp=-879,374,787; BuildTime=78/03/27 07:41:49.00...; OriginalFileName=WindowsTrustedRT.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=53; ImageBase=0xfffff8027e950000; GuidSig=d67e2059-b349-b8a4-a...; Age=1; PDBFileName=WindowsTrustedRT.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=156; ImageBase=0xfffff8027e950000; ImageSize=94,208; ImageChecksum=77,994; TimeDateStamp=-879,374,787; DefaultBase=0x00000000; BuildTime=78/03/27 07:41:49.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=76; ImageBase=0xfffff8027e970000; ImageSize=45,056; ProcessID=0; TimeDateStamp=1,364,078,627; BuildTime=13/03/23 22:43:47.00...; OriginalFileName=WindowsTrustedRTProx...; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=58; ImageBase=0xfffff8027e970000; GuidSig=545f24d0-4c8b-4a2d-e...; Age=1; PDBFileName=WindowsTrustedRTProx...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=166; ImageBase=0xfffff8027e970000; ImageSize=45,056; ImageChecksum=61,789; TimeDateStamp=1,364,078,627; DefaultBase=0x00000000; BuildTime=13/03/23 22:43:47.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=40; ImageBase=0xfffff8027e980000; ImageSize=86,016; ProcessID=0; TimeDateStamp=1,802,704,167; BuildTime=27/02/15 15:09:27.00...; OriginalFileName=pcw.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=40; ImageBase=0xfffff8027e980000; GuidSig=d95997e4-e5dd-d266-2...; Age=1; PDBFileName=pcw.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=130; ImageBase=0xfffff8027e980000; ImageSize=86,016; ImageChecksum=85,298; TimeDateStamp=1,802,704,167; DefaultBase=0x00000000; BuildTime=27/02/15 15:09:27.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff8027e9a0000; ImageSize=45,056; ProcessID=0; TimeDateStamp=1,581,713,934; BuildTime=20/02/14 20:58:54.00...; OriginalFileName=msisadrv.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff8027e9a0000; GuidSig=ff989e29-0c35-387a-f...; Age=1; PDBFileName=msisadrv.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=140; ImageBase=0xfffff8027e9a0000; ImageSize=45,056; ImageChecksum=77,067; TimeDateStamp=1,581,713,934; DefaultBase=0x00000000; BuildTime=20/02/14 20:58:54.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=40; ImageBase=0xfffff8027e9b0000; ImageSize=454,656; ProcessID=0; TimeDateStamp=-1,356,549,575; BuildTime=63/02/11 11:08:41.00...; OriginalFileName=pci.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=40; ImageBase=0xfffff8027e9b0000; GuidSig=964fd1f2-24be-d487-a...; Age=1; PDBFileName=pci.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=130; ImageBase=0xfffff8027e9b0000; ImageSize=454,656; ImageChecksum=460,548; TimeDateStamp=-1,356,549,575; DefaultBase=0x00000000; BuildTime=63/02/11 11:08:41.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff8027ea20000; ImageSize=77,824; ProcessID=0; TimeDateStamp=16,891,078; BuildTime=70/07/15 11:57:58.00...; OriginalFileName=vdrvroot.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff8027ea20000; GuidSig=5beca58e-a879-e6e6-5...; Age=1; PDBFileName=vdrvroot.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=140; ImageBase=0xfffff8027ea20000; ImageSize=77,824; ImageChecksum=83,379; TimeDateStamp=16,891,078; DefaultBase=0x00000000; BuildTime=70/07/15 11:57:58.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=40; ImageBase=0xfffff8027ea40000; ImageSize=208,896; ProcessID=0; TimeDateStamp=-1,695,621,685; BuildTime=52/05/15 00:26:51.00...; OriginalFileName=pdc.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=40; ImageBase=0xfffff8027ea40000; GuidSig=bf3c14ef-c68f-6d5b-5...; Age=1; PDBFileName=PDC.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=130; ImageBase=0xfffff8027ea40000; ImageSize=208,896; ImageChecksum=228,280; TimeDateStamp=-1,695,621,685; DefaultBase=0x00000000; BuildTime=52/05/15 00:26:51.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=66; ImageBase=0xfffff8027ea80000; ImageSize=102,400; ProcessID=0; TimeDateStamp=-209,645,305; BuildTime=99/06/16 19:39:51.00...; OriginalFileName=EventAggregation.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=40; ImageBase=0xfffff8027ea80000; GuidSig=864864bc-f970-444d-7...; Age=1; PDBFileName=CEA.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=130; ImageBase=0xfffff8027ea80000; ImageSize=102,400; ImageChecksum=134,144; TimeDateStamp=-209,645,305; DefaultBase=0x00000000; BuildTime=99/06/16 19:39:51.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=48; ImageBase=0xfffff8027eaa0000; ImageSize=196,608; ProcessID=0; TimeDateStamp=261,019,342; BuildTime=78/04/10 01:22:22.00...; OriginalFileName=partmgr.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff8027eaa0000; GuidSig=85303929-97c1-b78a-9...; Age=1; PDBFileName=partmgr.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=138; ImageBase=0xfffff8027eaa0000; ImageSize=196,608; ImageChecksum=223,190; TimeDateStamp=261,019,342; DefaultBase=0x00000000; BuildTime=78/04/10 01:22:22.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=52; ImageBase=0xfffff8027eae0000; ImageSize=675,840; ProcessID=0; TimeDateStamp=-595,412,635; BuildTime=87/03/26 22:04:21.00...; OriginalFileName=spaceport.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=46; ImageBase=0xfffff8027eae0000; GuidSig=258eb012-c275-7525-c...; Age=1; PDBFileName=spaceport.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=142; ImageBase=0xfffff8027eae0000; ImageSize=675,840; ImageChecksum=680,796; TimeDateStamp=-595,412,635; DefaultBase=0x00000000; BuildTime=87/03/26 22:04:21.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=46; ImageBase=0xfffff8027eb90000; ImageSize=106,496; ProcessID=0; TimeDateStamp=555,544,438; BuildTime=87/08/09 21:53:58.00...; OriginalFileName=volmgr.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=43; ImageBase=0xfffff8027eb90000; GuidSig=53f2e600-057e-1438-7...; Age=1; PDBFileName=volmgr.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=136; ImageBase=0xfffff8027eb90000; ImageSize=106,496; ImageChecksum=132,522; TimeDateStamp=555,544,438; DefaultBase=0x00000000; BuildTime=87/08/09 21:53:58.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=48; ImageBase=0xfffff8027ebb0000; ImageSize=405,504; ProcessID=0; TimeDateStamp=-688,691,529; BuildTime=84/04/11 07:16:07.00...; OriginalFileName=volmgrx.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff8027ebb0000; GuidSig=ebd91a0b-e862-88d0-3...; Age=1; PDBFileName=volmgrx.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=138; ImageBase=0xfffff8027ebb0000; ImageSize=405,504; ImageChecksum=405,390; TimeDateStamp=-688,691,529; DefaultBase=0x00000000; BuildTime=84/04/11 07:16:07.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff8027ec20000; ImageSize=126,976; ProcessID=0; TimeDateStamp=606,974,047; BuildTime=89/03/27 03:54:07.00...; OriginalFileName=mountmgr.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff8027ec20000; GuidSig=1581f475-37b1-a59b-2...; Age=1; PDBFileName=mountmgr.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=140; ImageBase=0xfffff8027ec20000; ImageSize=126,976; ImageChecksum=126,200; TimeDateStamp=606,974,047; DefaultBase=0x00000000; BuildTime=89/03/27 03:54:07.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff8027ec40000; ImageSize=188,416; ProcessID=0; TimeDateStamp=941,520,827; BuildTime=99/11/02 05:33:47.00...; OriginalFileName=storahci.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff8027ec40000; GuidSig=3ea236a9-2511-a8c4-2...; Age=1; PDBFileName=storahci.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=140; ImageBase=0xfffff8027ec40000; ImageSize=188,416; ImageChecksum=197,933; TimeDateStamp=941,520,827; DefaultBase=0x00000000; BuildTime=99/11/02 05:33:47.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff8027ec70000; ImageSize=663,552; ProcessID=0; TimeDateStamp=-1,500,328,357; BuildTime=58/07/23 08:35:39.00...; OriginalFileName=storport.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff8027ec70000; GuidSig=3616ecb9-b39b-07aa-5...; Age=1; PDBFileName=storport.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=140; ImageBase=0xfffff8027ec70000; ImageSize=663,552; ImageChecksum=688,695; TimeDateStamp=-1,500,328,357; DefaultBase=0x00000000; BuildTime=58/07/23 08:35:39.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff8027ed20000; ImageSize=159,744; ProcessID=0; TimeDateStamp=1,710,215,156; BuildTime=24/03/12 03:45:56.00...; OriginalFileName=stornvme.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff8027ed20000; GuidSig=4576de17-a7a6-1b9e-3...; Age=1; PDBFileName=stornvme.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=140; ImageBase=0xfffff8027ed20000; ImageSize=159,744; ImageChecksum=145,319; TimeDateStamp=1,710,215,156; DefaultBase=0x00000000; BuildTime=24/03/12 03:45:56.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=56; ImageBase=0xfffff8027ed50000; ImageSize=110,592; ProcessID=0; TimeDateStamp=1,382,859,266; BuildTime=13/10/27 07:34:26.00...; OriginalFileName=EhStorClass.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=48; ImageBase=0xfffff8027ed50000; GuidSig=13045120-a7f3-d7e3-b...; Age=1; PDBFileName=EhStorClass.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=146; ImageBase=0xfffff8027ed50000; ImageSize=110,592; ImageChecksum=111,760; TimeDateStamp=1,382,859,266; DefaultBase=0x00000000; BuildTime=13/10/27 07:34:26.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff8027ed70000; ImageSize=106,496; ProcessID=0; TimeDateStamp=616,295,712; BuildTime=89/07/13 01:15:12.00...; OriginalFileName=FileInfo.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff8027ed70000; GuidSig=0bafb751-b8c5-27ec-e...; Age=1; PDBFileName=fileinfo.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=140; ImageBase=0xfffff8027ed70000; ImageSize=106,496; ImageChecksum=138,092; TimeDateStamp=616,295,712; DefaultBase=0x00000000; BuildTime=89/07/13 01:15:12.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=40; ImageBase=0xfffff8027ed90000; ImageSize=249,856; ProcessID=0; TimeDateStamp=1,018,647,367; BuildTime=02/04/12 21:36:07.00...; OriginalFileName=wof.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=40; ImageBase=0xfffff8027ed90000; GuidSig=8937c48c-f1d6-acbd-8...; Age=1; PDBFileName=wof.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=130; ImageBase=0xfffff8027ed90000; ImageSize=249,856; ImageChecksum=231,537; TimeDateStamp=1,018,647,367; DefaultBase=0x00000000; BuildTime=02/04/12 21:36:07.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff8027edd0000; ImageSize=352,256; ProcessID=0; TimeDateStamp=-312,395,305; BuildTime=96/03/14 13:59:51.00...; OriginalFileName=WdFilter.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff8027edd0000; GuidSig=930c9872-5542-483b-f...; Age=1; PDBFileName=WdFilter.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=146; ImageBase=0xfffff8027edd0000; ImageSize=352,256; ImageChecksum=352,433; TimeDateStamp=-312,395,305; DefaultBase=0x00000000; BuildTime=96/03/14 13:59:51.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=42; ImageBase=0xfffff8027ee30000; ImageSize=2,744,320; ProcessID=0; TimeDateStamp=945,805,094; BuildTime=99/12/21 19:38:14.00...; OriginalFileName=ntfs.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=41; ImageBase=0xfffff8027ee30000; GuidSig=6a7ac1fd-8ab2-c820-5...; Age=1; PDBFileName=ntfs.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=132; ImageBase=0xfffff8027ee30000; ImageSize=2,744,320; ImageChecksum=2,745,851; TimeDateStamp=945,805,094; DefaultBase=0x00000000; BuildTime=99/12/21 19:38:14.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=46; ImageBase=0xfffff8027f0d0000; ImageSize=53,248; ProcessID=0; TimeDateStamp=1,240,019,642; BuildTime=09/04/18 01:54:02.00...; OriginalFileName=fs_rec.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=43; ImageBase=0xfffff8027f0d0000; GuidSig=3af03dfe-a5ec-0403-4...; Age=1; PDBFileName=fs_rec.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=136; ImageBase=0xfffff8027f0d0000; ImageSize=53,248; ImageChecksum=94,667; TimeDateStamp=1,240,019,642; DefaultBase=0x00000000; BuildTime=09/04/18 01:54:02.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=42; ImageBase=0xfffff8027f0e0000; ImageSize=1,515,520; ProcessID=0; TimeDateStamp=-1,496,253,666; BuildTime=58/09/08 12:27:10.00...; OriginalFileName=NDIS.SYS; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=41; ImageBase=0xfffff8027f0e0000; GuidSig=68154161-90a1-cd55-a...; Age=1; PDBFileName=ndis.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=132; ImageBase=0xfffff8027f0e0000; ImageSize=1,515,520; ImageChecksum=1,506,298; TimeDateStamp=-1,496,253,666; DefaultBase=0x00000000; BuildTime=58/09/08 12:27:10.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff8027f260000; ImageSize=606,208; ProcessID=0; TimeDateStamp=-438,944,994; BuildTime=92/03/10 21:18:22.00...; OriginalFileName=netio.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=42; ImageBase=0xfffff8027f260000; GuidSig=53d56809-2724-3804-a...; Age=1; PDBFileName=netio.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=134; ImageBase=0xfffff8027f260000; ImageSize=606,208; ImageChecksum=589,500; TimeDateStamp=-438,944,994; DefaultBase=0x00000000; BuildTime=92/03/10 21:18:22.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=48; ImageBase=0xfffff8027f300000; ImageSize=204,800; ProcessID=0; TimeDateStamp=1,003,887,220; BuildTime=01/10/24 01:33:40.00...; OriginalFileName=ksecpkg.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff8027f300000; GuidSig=7fd7387d-fa71-e3ba-f...; Age=1; PDBFileName=ksecpkg.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=138; ImageBase=0xfffff8027f300000; ImageSize=204,800; ImageChecksum=188,363; TimeDateStamp=1,003,887,220; DefaultBase=0x00000000; BuildTime=01/10/24 01:33:40.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff8027f340000; ImageSize=3,055,616; ProcessID=0; TimeDateStamp=-1,510,672,424; BuildTime=58/03/25 15:14:32.00...; OriginalFileName=tcpip.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=42; ImageBase=0xfffff8027f340000; GuidSig=01f6b0a0-fb2a-d74e-e...; Age=1; PDBFileName=tcpip.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=134; ImageBase=0xfffff8027f340000; ImageSize=3,055,616; ImageChecksum=3,033,273; TimeDateStamp=-1,510,672,424; DefaultBase=0x00000000; BuildTime=58/03/25 15:14:32.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff8027f630000; ImageSize=499,712; ProcessID=0; TimeDateStamp=1,489,102,573; BuildTime=17/03/09 23:36:13.00...; OriginalFileName=fwpkclnt.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff8027f630000; GuidSig=a08eca7c-5100-fe98-1...; Age=1; PDBFileName=fwpkclnt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=140; ImageBase=0xfffff8027f630000; ImageSize=499,712; ImageChecksum=537,699; TimeDateStamp=1,489,102,573; DefaultBase=0x00000000; BuildTime=17/03/09 23:36:13.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=48; ImageBase=0xfffff8027f6b0000; ImageSize=196,608; ProcessID=0; TimeDateStamp=1,279,600,237; BuildTime=10/07/20 04:30:37.00...; OriginalFileName=WFPLWFS.SYS; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff8027f6b0000; GuidSig=e5fd60d5-89f7-7e25-d...; Age=1; PDBFileName=wfplwfs.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=138; ImageBase=0xfffff8027f6b0000; ImageSize=196,608; ImageChecksum=207,054; TimeDateStamp=1,279,600,237; DefaultBase=0x00000000; BuildTime=10/07/20 04:30:37.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff8027f6f0000; ImageSize=65,536; ProcessID=0; TimeDateStamp=1,248,170,822; BuildTime=09/07/21 10:07:02.00...; OriginalFileName=vmsproxy.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff8027f6f0000; GuidSig=3c4688a7-5993-c708-2...; Age=1; PDBFileName=VmsProxy.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=140; ImageBase=0xfffff8027f6f0000; ImageSize=65,536; ImageChecksum=55,795; TimeDateStamp=1,248,170,822; DefaultBase=0x00000000; BuildTime=09/07/21 10:07:02.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff8027f710000; ImageSize=131,072; ProcessID=0; TimeDateStamp=2,022,426,469; BuildTime=34/02/01 17:07:49.00...; OriginalFileName=vmbkmclr.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff8027f710000; GuidSig=43026efb-34f4-f4ef-0...; Age=1; PDBFileName=vmbkmclr.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=140; ImageBase=0xfffff8027f710000; ImageSize=131,072; ImageChecksum=138,925; TimeDateStamp=2,022,426,469; DefaultBase=0x00000000; BuildTime=34/02/01 17:07:49.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=58; ImageBase=0xfffff8027f740000; ImageSize=61,440; ProcessID=0; TimeDateStamp=-950,123,547; BuildTime=75/12/29 11:15:49.00...; OriginalFileName=VmsProxyHNic.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=49; ImageBase=0xfffff8027f740000; GuidSig=1414b13d-6a7c-a3a6-f...; Age=1; PDBFileName=VmsProxyHNic.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=148; ImageBase=0xfffff8027f740000; ImageSize=61,440; ImageChecksum=97,953; TimeDateStamp=-950,123,547; DefaultBase=0x00000000; BuildTime=75/12/29 11:15:49.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=46; ImageBase=0xfffff8027f750000; ImageSize=823,296; ProcessID=0; TimeDateStamp=1,719,238,996; BuildTime=24/06/24 14:23:16.00...; OriginalFileName=FVEVOL.SYS; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=43; ImageBase=0xfffff8027f750000; GuidSig=27d5eac3-7cdb-1be8-8...; Age=1; PDBFileName=fvevol.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=136; ImageBase=0xfffff8027f750000; ImageSize=823,296; ImageChecksum=846,865; TimeDateStamp=1,719,238,996; DefaultBase=0x00000000; BuildTime=24/06/24 14:23:16.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=46; ImageBase=0xfffff8027f820000; ImageSize=45,056; ProcessID=0; TimeDateStamp=-1,528,168,966; BuildTime=57/09/04 03:05:30.00...; OriginalFileName=volume.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=43; ImageBase=0xfffff8027f820000; GuidSig=0cb1cd36-1c7a-9a59-e...; Age=1; PDBFileName=volume.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=136; ImageBase=0xfffff8027f820000; ImageSize=45,056; ImageChecksum=55,665; TimeDateStamp=-1,528,168,966; DefaultBase=0x00000000; BuildTime=57/09/04 03:05:30.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=48; ImageBase=0xfffff8027f830000; ImageSize=446,464; ProcessID=0; TimeDateStamp=410,449,203; BuildTime=83/01/03 13:40:03.00...; OriginalFileName=volsnap.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff8027f830000; GuidSig=4a2a8157-b3c7-afc7-8...; Age=1; PDBFileName=volsnap.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=138; ImageBase=0xfffff8027f830000; ImageSize=446,464; ImageChecksum=465,982; TimeDateStamp=410,449,203; DefaultBase=0x00000000; BuildTime=83/01/03 13:40:03.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff8027f8a0000; ImageSize=319,488; ProcessID=0; TimeDateStamp=-196,030,797; BuildTime=99/11/21 09:28:19.00...; OriginalFileName=rdyboost.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff8027f8a0000; GuidSig=549804ac-488f-4b75-9...; Age=1; PDBFileName=rdyboost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=140; ImageBase=0xfffff8027f8a0000; ImageSize=319,488; ImageChecksum=311,199; TimeDateStamp=-196,030,797; DefaultBase=0x00000000; BuildTime=99/11/21 09:28:19.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=40; ImageBase=0xfffff8027f8f0000; ImageSize=151,552; ProcessID=0; TimeDateStamp=1,449,001,745; BuildTime=15/12/01 20:29:05.00...; OriginalFileName=MUP.SYS; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=40; ImageBase=0xfffff8027f8f0000; GuidSig=fd01f157-0367-00af-3...; Age=1; PDBFileName=mup.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=130; ImageBase=0xfffff8027f8f0000; ImageSize=151,552; ImageChecksum=161,407; TimeDateStamp=1,449,001,745; DefaultBase=0x00000000; BuildTime=15/12/01 20:29:05.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=46; ImageBase=0xfffff8027f920000; ImageSize=73,728; ProcessID=0; TimeDateStamp=416,624,090; BuildTime=83/03/16 00:54:50.00...; OriginalFileName=iorate.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=43; ImageBase=0xfffff8027f920000; GuidSig=70ba68d4-2ba6-1730-c...; Age=1; PDBFileName=iorate.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=136; ImageBase=0xfffff8027f920000; ImageSize=73,728; ImageChecksum=73,572; TimeDateStamp=416,624,090; DefaultBase=0x00000000; BuildTime=83/03/16 00:54:50.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=42; ImageBase=0xfffff8027f950000; ImageSize=114,688; ProcessID=0; TimeDateStamp=944,762,861; BuildTime=99/12/09 18:07:41.00...; OriginalFileName=disk.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=41; ImageBase=0xfffff8027f950000; GuidSig=dbb4c594-0216-bfcc-2...; Age=1; PDBFileName=disk.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=132; ImageBase=0xfffff8027f950000; ImageSize=114,688; ImageChecksum=128,598; TimeDateStamp=944,762,861; DefaultBase=0x00000000; BuildTime=99/12/09 18:07:41.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff8027f970000; ImageSize=438,272; ProcessID=0; TimeDateStamp=166,555,209; BuildTime=75/04/12 17:20:09.00...; OriginalFileName=Classpnp.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff8027f970000; GuidSig=824b67c6-b056-b408-6...; Age=1; PDBFileName=classpnp.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=140; ImageBase=0xfffff8027f970000; ImageSize=438,272; ImageChecksum=440,369; TimeDateStamp=166,555,209; DefaultBase=0x00000000; BuildTime=75/04/12 17:20:09.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff80280bd0000; ImageSize=118,784; ProcessID=0; TimeDateStamp=696,634,131; BuildTime=92/01/28 21:28:51.00...; OriginalFileName=crashdmp.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff80280bd0000; GuidSig=988f3852-338c-1db5-d...; Age=1; PDBFileName=crashdmp.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=140; ImageBase=0xfffff80280bd0000; ImageSize=118,784; ImageChecksum=151,101; TimeDateStamp=696,634,131; DefaultBase=0x00000000; BuildTime=92/01/28 21:28:51.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff8027feb0000; ImageSize=196,608; ProcessID=0; TimeDateStamp=-1,620,374,661; BuildTime=54/10/02 22:23:55.00...; OriginalFileName=cdrom.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=42; ImageBase=0xfffff8027feb0000; GuidSig=13001ccf-6d99-85a7-d...; Age=1; PDBFileName=cdrom.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=134; ImageBase=0xfffff8027feb0000; ImageSize=196,608; ImageChecksum=191,786; TimeDateStamp=-1,620,374,661; DefaultBase=0x00000000; BuildTime=54/10/02 22:23:55.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=52; ImageBase=0xfffff8027fef0000; ImageSize=86,016; ProcessID=0; TimeDateStamp=1,319,990,209; BuildTime=11/10/30 15:56:49.00...; OriginalFileName=filecrypt.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=46; ImageBase=0xfffff8027fef0000; GuidSig=84aedbd5-6acb-2106-3...; Age=1; PDBFileName=filecrypt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=142; ImageBase=0xfffff8027fef0000; ImageSize=86,016; ImageChecksum=121,231; TimeDateStamp=1,319,990,209; DefaultBase=0x00000000; BuildTime=11/10/30 15:56:49.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=40; ImageBase=0xfffff8027ff10000; ImageSize=57,344; ProcessID=0; TimeDateStamp=-1,772,377,039; BuildTime=49/12/08 15:30:57.00...; OriginalFileName=TBS.SYS; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=40; ImageBase=0xfffff8027ff10000; GuidSig=d64613fa-e91b-9ac6-7...; Age=1; PDBFileName=tbs.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=130; ImageBase=0xfffff8027ff10000; ImageSize=57,344; ImageChecksum=83,936; TimeDateStamp=-1,772,377,039; DefaultBase=0x00000000; BuildTime=49/12/08 15:30:57.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=42; ImageBase=0xfffff8027ff20000; ImageSize=40,960; ProcessID=0; TimeDateStamp=-400,422,789; BuildTime=93/05/30 17:55:07.00...; OriginalFileName=null.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=41; ImageBase=0xfffff8027ff20000; GuidSig=82188f52-046d-c44e-e...; Age=1; PDBFileName=null.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=132; ImageBase=0xfffff8027ff20000; ImageSize=40,960; ImageChecksum=65,094; TimeDateStamp=-400,422,789; DefaultBase=0x00000000; BuildTime=93/05/30 17:55:07.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=42; ImageBase=0xfffff8027ff30000; ImageSize=40,960; ProcessID=0; TimeDateStamp=1,385,087,514; BuildTime=13/11/22 02:31:54.00...; OriginalFileName=beep.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=41; ImageBase=0xfffff8027ff30000; GuidSig=a2dcb0a4-45e9-4671-2...; Age=1; PDBFileName=beep.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=132; ImageBase=0xfffff8027ff30000; ImageSize=40,960; ImageChecksum=33,044; TimeDateStamp=1,385,087,514; DefaultBase=0x00000000; BuildTime=13/11/22 02:31:54.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=48; ImageBase=0xfffff8027ff40000; ImageSize=3,633,152; ProcessID=0; TimeDateStamp=-263,405,882; BuildTime=97/10/02 14:10:14.00...; OriginalFileName=dxgkrnl.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff8027ff40000; GuidSig=ce03bf4d-a749-0071-a...; Age=1; PDBFileName=dxgkrnl.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=138; ImageBase=0xfffff8027ff40000; ImageSize=3,633,152; ImageChecksum=3,671,162; TimeDateStamp=-263,405,882; DefaultBase=0x00000000; BuildTime=97/10/02 14:10:14.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff802802c0000; ImageSize=90,112; ProcessID=0; TimeDateStamp=558,319,513; BuildTime=87/09/11 00:45:13.00...; OriginalFileName=watchdog.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff802802c0000; GuidSig=232baf6a-5c25-94f8-9...; Age=1; PDBFileName=watchdog.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=140; ImageBase=0xfffff802802c0000; ImageSize=90,112; ImageChecksum=74,984; TimeDateStamp=558,319,513; DefaultBase=0x00000000; BuildTime=87/09/11 00:45:13.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=58; ImageBase=0xfffff802802e0000; ImageSize=90,112; ProcessID=0; TimeDateStamp=1,315,833,313; BuildTime=11/09/12 13:15:13.00...; OriginalFileName=BasicDisplay.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=49; ImageBase=0xfffff802802e0000; GuidSig=388c2217-1357-2cbe-5...; Age=1; PDBFileName=BasicDisplay.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=266; ImageBase=0xfffff802802e0000; ImageSize=90,112; ImageChecksum=81,912; TimeDateStamp=1,315,833,313; DefaultBase=0x00000000; BuildTime=11/09/12 13:15:13.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=56; ImageBase=0xfffff80280300000; ImageSize=69,632; ProcessID=0; TimeDateStamp=-2,102,840,792; BuildTime=39/06/19 20:01:44.00...; OriginalFileName=BasicRender.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=48; ImageBase=0xfffff80280300000; GuidSig=9c399070-b183-475e-7...; Age=1; PDBFileName=BasicRender.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=262; ImageBase=0xfffff80280300000; ImageSize=69,632; ImageChecksum=75,053; TimeDateStamp=-2,102,840,792; DefaultBase=0x00000000; BuildTime=39/06/19 20:01:44.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=42; ImageBase=0xfffff80280320000; ImageSize=114,688; ProcessID=0; TimeDateStamp=-1,338,060,845; BuildTime=63/09/13 10:54:11.00...; OriginalFileName=npfs.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=41; ImageBase=0xfffff80280320000; GuidSig=d55ec1d1-5c78-bd2e-1...; Age=1; PDBFileName=npfs.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=132; ImageBase=0xfffff80280320000; ImageSize=114,688; ImageChecksum=96,572; TimeDateStamp=-1,338,060,845; DefaultBase=0x00000000; BuildTime=63/09/13 10:54:11.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=42; ImageBase=0xfffff80280340000; ImageSize=69,632; ProcessID=0; TimeDateStamp=-1,845,620,748; BuildTime=47/08/13 22:02:28.00...; OriginalFileName=MSFS.SYS; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=41; ImageBase=0xfffff80280340000; GuidSig=455c4394-95f6-46b2-e...; Age=1; PDBFileName=msfs.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=132; ImageBase=0xfffff80280340000; ImageSize=69,632; ImageChecksum=58,818; TimeDateStamp=-1,845,620,748; DefaultBase=0x00000000; BuildTime=47/08/13 22:02:28.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=40; ImageBase=0xfffff80280360000; ImageSize=155,648; ProcessID=0; TimeDateStamp=169,819,588; BuildTime=75/05/20 12:06:28.00...; OriginalFileName=tdx.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=40; ImageBase=0xfffff80280360000; GuidSig=42fdde04-9bbf-9e72-d...; Age=1; PDBFileName=tdx.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=130; ImageBase=0xfffff80280360000; ImageSize=155,648; ImageChecksum=197,092; TimeDateStamp=169,819,588; DefaultBase=0x00000000; BuildTime=75/05/20 12:06:28.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=40; ImageBase=0xfffff80280390000; ImageSize=65,536; ProcessID=0; TimeDateStamp=-1,992,268,384; BuildTime=42/12/20 14:35:12.00...; OriginalFileName=tdi.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=40; ImageBase=0xfffff80280390000; GuidSig=515c16b1-799f-673b-b...; Age=1; PDBFileName=tdi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=130; ImageBase=0xfffff80280390000; ImageSize=65,536; ImageChecksum=79,830; TimeDateStamp=-1,992,268,384; DefaultBase=0x00000000; BuildTime=42/12/20 14:35:12.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff802803b0000; ImageSize=364,544; ProcessID=0; TimeDateStamp=1,096,965,121; BuildTime=04/10/05 08:32:01.00...; OriginalFileName=netbt.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=42; ImageBase=0xfffff802803b0000; GuidSig=8812a317-5365-4747-8...; Age=1; PDBFileName=netbt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=134; ImageBase=0xfffff802803b0000; ImageSize=364,544; ImageChecksum=363,743; TimeDateStamp=1,096,965,121; DefaultBase=0x00000000; BuildTime=04/10/05 08:32:01.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=46; ImageBase=0xfffff80280410000; ImageSize=77,824; ProcessID=0; TimeDateStamp=-1,653,861,692; BuildTime=53/09/10 08:26:44.00...; OriginalFileName=afunix.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=43; ImageBase=0xfffff80280410000; GuidSig=3caed06c-9d46-066f-0...; Age=1; PDBFileName=afunix.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=136; ImageBase=0xfffff80280410000; ImageSize=77,824; ImageChecksum=57,691; TimeDateStamp=-1,653,861,692; DefaultBase=0x00000000; BuildTime=53/09/10 08:26:44.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=40; ImageBase=0xfffff80280430000; ImageSize=684,032; ProcessID=0; TimeDateStamp=-1,198,665,410; BuildTime=68/02/12 19:51:26.00...; OriginalFileName=afd.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=40; ImageBase=0xfffff80280430000; GuidSig=33d90fe9-57ed-f3f6-b...; Age=1; PDBFileName=afd.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=130; ImageBase=0xfffff80280430000; ImageSize=684,032; ImageChecksum=675,021; TimeDateStamp=-1,198,665,410; DefaultBase=0x00000000; BuildTime=68/02/12 19:51:26.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff802804e0000; ImageSize=106,496; ProcessID=0; TimeDateStamp=960,062,089; BuildTime=00/06/03 19:54:49.00...; OriginalFileName=vwififlt.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff802804e0000; GuidSig=4d12394e-a5ca-e32e-f...; Age=1; PDBFileName=vwififlt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=140; ImageBase=0xfffff802804e0000; ImageSize=106,496; ImageChecksum=79,225; TimeDateStamp=960,062,089; DefaultBase=0x00000000; BuildTime=00/06/03 19:54:49.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff80280500000; ImageSize=176,128; ProcessID=0; TimeDateStamp=-416,846,882; BuildTime=92/11/21 15:40:14.00...; OriginalFileName=pacer.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=42; ImageBase=0xfffff80280500000; GuidSig=a9e2c291-7e3f-f019-b...; Age=1; PDBFileName=pacer.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=134; ImageBase=0xfffff80280500000; ImageSize=176,128; ImageChecksum=190,725; TimeDateStamp=-416,846,882; DefaultBase=0x00000000; BuildTime=92/11/21 15:40:14.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=48; ImageBase=0xfffff80280530000; ImageSize=81,920; ProcessID=0; TimeDateStamp=-1,283,468,567; BuildTime=65/06/06 07:25:29.00...; OriginalFileName=NETBIOS.SYS; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff80280530000; GuidSig=ff4ab0ad-3ea8-8101-d...; Age=1; PDBFileName=netbios.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=138; ImageBase=0xfffff80280530000; ImageSize=81,920; ImageChecksum=106,770; TimeDateStamp=-1,283,468,567; DefaultBase=0x00000000; BuildTime=65/06/06 07:25:29.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff80280550000; ImageSize=503,808; ProcessID=0; TimeDateStamp=-2,080,742,542; BuildTime=40/03/01 14:25:54.00...; OriginalFileName=RDBSS.Sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=42; ImageBase=0xfffff80280550000; GuidSig=c84942c8-107d-0d0a-c...; Age=1; PDBFileName=rdbss.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=134; ImageBase=0xfffff80280550000; ImageSize=503,808; ImageChecksum=512,524; TimeDateStamp=-2,080,742,542; DefaultBase=0x00000000; BuildTime=40/03/01 14:25:54.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=40; ImageBase=0xfffff802805d0000; ImageSize=606,208; ProcessID=0; TimeDateStamp=-1,294,447,535; BuildTime=65/01/30 05:42:41.00...; OriginalFileName=CSC.Sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=40; ImageBase=0xfffff802805d0000; GuidSig=6406d03b-4b64-9b19-1...; Age=1; PDBFileName=csc.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=130; ImageBase=0xfffff802805d0000; ImageSize=606,208; ImageChecksum=631,515; TimeDateStamp=-1,294,447,535; DefaultBase=0x00000000; BuildTime=65/01/30 05:42:41.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff80280670000; ImageSize=73,728; ProcessID=0; TimeDateStamp=1,385,013,642; BuildTime=13/11/21 06:00:42.00...; OriginalFileName=nsiproxy.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff80280670000; GuidSig=fba23420-a92f-098d-6...; Age=1; PDBFileName=nsiproxy.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=140; ImageBase=0xfffff80280670000; ImageSize=73,728; ImageChecksum=108,240; TimeDateStamp=1,385,013,642; DefaultBase=0x00000000; BuildTime=13/11/21 06:00:42.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=52; ImageBase=0xfffff80280690000; ImageSize=53,248; ProcessID=0; TimeDateStamp=242,925,574; BuildTime=77/09/12 15:19:34.00...; OriginalFileName=npsvctrig.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=46; ImageBase=0xfffff80280690000; GuidSig=b881267d-3be4-1939-b...; Age=1; PDBFileName=NpSvcTrig.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=142; ImageBase=0xfffff80280690000; ImageSize=53,248; ImageChecksum=41,336; TimeDateStamp=242,925,574; DefaultBase=0x00000000; BuildTime=77/09/12 15:19:34.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=46; ImageBase=0xfffff802806a0000; ImageSize=65,536; ProcessID=0; TimeDateStamp=-421,768,675; BuildTime=92/09/25 16:30:21.00...; OriginalFileName=smbios.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff802806a0000; GuidSig=7ce0c1d2-dd53-b809-a...; Age=1; PDBFileName=mssmbios.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=140; ImageBase=0xfffff802806a0000; ImageSize=65,536; ImageChecksum=72,128; TimeDateStamp=-421,768,675; DefaultBase=0x00000000; BuildTime=92/09/25 16:30:21.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=58; ImageBase=0xfffff802806c0000; ImageSize=40,960; ProcessID=0; TimeDateStamp=214,057,620; BuildTime=76/10/13 12:27:00.00...; OriginalFileName=gpuenergydrv.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=49; ImageBase=0xfffff802806c0000; GuidSig=f68332b7-0fc0-0e9a-3...; Age=1; PDBFileName=gpuenergydrv.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=148; ImageBase=0xfffff802806c0000; ImageSize=40,960; ImageChecksum=33,960; TimeDateStamp=214,057,620; DefaultBase=0x00000000; BuildTime=76/10/13 12:27:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=52; ImageBase=0xfffff802806d0000; ImageSize=180,224; ProcessID=0; TimeDateStamp=-88,195,203; BuildTime=03/04/23 11:48:13.00...; OriginalFileName=dfsclient.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=41; ImageBase=0xfffff802806d0000; GuidSig=79985d12-5c68-abb0-7...; Age=1; PDBFileName=dfsc.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=132; ImageBase=0xfffff802806d0000; ImageSize=180,224; ImageChecksum=199,292; TimeDateStamp=-88,195,203; DefaultBase=0x00000000; BuildTime=03/04/23 11:48:13.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=40; ImageBase=0xfffff80280720000; ImageSize=90,112; ProcessID=0; TimeDateStamp=572,098,424; BuildTime=88/02/17 12:13:44.00...; OriginalFileName=bam.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=40; ImageBase=0xfffff80280720000; GuidSig=142d8840-1c88-ad0b-d...; Age=1; PDBFileName=bam.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=130; ImageBase=0xfffff80280720000; ImageSize=90,112; ImageChecksum=100,625; TimeDateStamp=572,098,424; DefaultBase=0x00000000; BuildTime=88/02/17 12:13:44.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=48; ImageBase=0xfffff80280740000; ImageSize=323,584; ProcessID=0; TimeDateStamp=-1,471,726,622; BuildTime=59/06/19 09:31:14.00...; OriginalFileName=ahcache.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff80280740000; GuidSig=8d0be327-3106-8c8d-7...; Age=1; PDBFileName=ahcache.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=138; ImageBase=0xfffff80280740000; ImageSize=323,584; ImageChecksum=353,922; TimeDateStamp=-1,471,726,622; DefaultBase=0x00000000; BuildTime=59/06/19 09:31:14.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=40; ImageBase=0xfffff80280790000; ImageSize=573,440; ProcessID=0; TimeDateStamp=-1,220,995,534; BuildTime=67/05/30 09:02:42.00...; OriginalFileName=vid.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=40; ImageBase=0xfffff80280790000; GuidSig=3c7e822d-efbd-fbdc-f...; Age=1; PDBFileName=Vid.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=130; ImageBase=0xfffff80280790000; ImageSize=573,440; ImageChecksum=570,576; TimeDateStamp=-1,220,995,534; DefaultBase=0x00000000; BuildTime=67/05/30 09:02:42.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=46; ImageBase=0xfffff80280820000; ImageSize=126,976; ProcessID=0; TimeDateStamp=408,695,194; BuildTime=82/12/14 06:26:34.00...; OriginalFileName=WinHvR.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=43; ImageBase=0xfffff80280820000; GuidSig=7154573e-d4d8-b524-f...; Age=1; PDBFileName=winhvr.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=136; ImageBase=0xfffff80280820000; ImageSize=126,976; ImageChecksum=138,722; TimeDateStamp=408,695,194; DefaultBase=0x00000000; BuildTime=82/12/14 06:26:34.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=58; ImageBase=0xfffff80280840000; ImageSize=69,632; ProcessID=0; TimeDateStamp=-263,137,770; BuildTime=97/10/05 16:38:46.00...; OriginalFileName=compositebus.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=49; ImageBase=0xfffff80280840000; GuidSig=11d5cea1-81ff-3222-f...; Age=1; PDBFileName=CompositeBus.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=266; ImageBase=0xfffff80280840000; ImageSize=69,632; ImageChecksum=89,615; TimeDateStamp=-263,137,770; DefaultBase=0x00000000; BuildTime=97/10/05 16:38:46.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff80280860000; ImageSize=53,248; ProcessID=0; TimeDateStamp=536,213,493; BuildTime=86/12/29 04:11:33.00...; OriginalFileName=kdnic.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=42; ImageBase=0xfffff80280860000; GuidSig=79c309d5-c253-60d0-a...; Age=1; PDBFileName=kdnic.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=134; ImageBase=0xfffff80280860000; ImageSize=53,248; ImageChecksum=61,775; TimeDateStamp=536,213,493; DefaultBase=0x00000000; BuildTime=86/12/29 04:11:33.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff802808d0000; ImageSize=86,016; ProcessID=0; TimeDateStamp=822,387,885; BuildTime=96/01/23 09:04:45.00...; OriginalFileName=umbus.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=42; ImageBase=0xfffff802808d0000; GuidSig=5ece6bed-b2be-2f7c-0...; Age=1; PDBFileName=UmBus.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=238; ImageBase=0xfffff802808d0000; ImageSize=86,016; ImageChecksum=70,299; TimeDateStamp=822,387,885; DefaultBase=0x00000000; BuildTime=96/01/23 09:04:45.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff80282a70000; ImageSize=17,268,736; ProcessID=0; TimeDateStamp=1,509,119,379; BuildTime=17/10/27 15:49:39.00...; OriginalFileName=nvlddmkm.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=144; ImageBase=0xfffff80282a70000; GuidSig=bec4f7ef-e3f1-4c73-8...; Age=1; PDBFileName=C:\dvs\p4\build\sw\r...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=258; ImageBase=0xfffff80282a70000; ImageSize=17,268,736; ImageChecksum=16,956,047; TimeDateStamp=1,509,119,379; DefaultBase=0x00000000; BuildTime=17/10/27 15:49:39.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff80283af0000; ImageSize=139,264; ProcessID=0; TimeDateStamp=-1,362,286,248; BuildTime=62/12/07 01:37:28.00...; OriginalFileName=hdaudbus.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff80283af0000; GuidSig=fc1a5e08-d711-82c5-6...; Age=1; PDBFileName=hdaudbus.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=140; ImageBase=0xfffff80283af0000; ImageSize=139,264; ImageChecksum=149,206; TimeDateStamp=-1,362,286,248; DefaultBase=0x00000000; BuildTime=62/12/07 01:37:28.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=48; ImageBase=0xfffff80283b20000; ImageSize=421,888; ProcessID=0; TimeDateStamp=-722,379,792; BuildTime=83/03/18 09:25:04.00...; OriginalFileName=portcls.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff80283b20000; GuidSig=f655a82f-495a-1180-7...; Age=1; PDBFileName=portcls.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=138; ImageBase=0xfffff80283b20000; ImageSize=421,888; ImageChecksum=433,014; TimeDateStamp=-722,379,792; DefaultBase=0x00000000; BuildTime=83/03/18 09:25:04.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=42; ImageBase=0xfffff80283b90000; ImageSize=135,168; ProcessID=0; TimeDateStamp=-1,545,572,432; BuildTime=57/02/14 16:47:44.00...; OriginalFileName=drmk.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=41; ImageBase=0xfffff80283b90000; GuidSig=c99e3766-009f-c196-f...; Age=1; PDBFileName=drmk.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=132; ImageBase=0xfffff80283b90000; ImageSize=135,168; ImageChecksum=102,912; TimeDateStamp=-1,545,572,432; DefaultBase=0x00000000; BuildTime=57/02/14 16:47:44.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=38; ImageBase=0xfffff80281e00000; ImageSize=491,520; ProcessID=0; TimeDateStamp=-802,234,875; BuildTime=80/09/05 03:27:01.00...; OriginalFileName=ks.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=39; ImageBase=0xfffff80281e00000; GuidSig=87a86f90-bd09-0bd2-8...; Age=1; PDBFileName=ks.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=128; ImageBase=0xfffff80281e00000; ImageSize=491,520; ImageChecksum=463,443; TimeDateStamp=-802,234,875; DefaultBase=0x00000000; BuildTime=80/09/05 03:27:01.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=48; ImageBase=0xfffff80281e80000; ImageSize=557,056; ProcessID=0; TimeDateStamp=-983,118,998; BuildTime=74/12/12 13:51:38.00...; OriginalFileName=usbxhci.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff80281e80000; GuidSig=bf5e1a4e-8c5f-57eb-6...; Age=1; PDBFileName=usbxhci.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=138; ImageBase=0xfffff80281e80000; ImageSize=557,056; ImageChecksum=582,026; TimeDateStamp=-983,118,998; DefaultBase=0x00000000; BuildTime=74/12/12 13:51:38.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff80281f10000; ImageSize=266,240; ProcessID=0; TimeDateStamp=69,633,331; BuildTime=72/03/16 22:35:31.00...; OriginalFileName=ucx01000.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff80281f10000; GuidSig=3f5bc931-fdd5-0695-c...; Age=1; PDBFileName=ucx01000.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=140; ImageBase=0xfffff80281f10000; ImageSize=266,240; ImageChecksum=255,643; TimeDateStamp=69,633,331; DefaultBase=0x00000000; BuildTime=72/03/16 22:35:31.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=58; ImageBase=0xfffff80281f60000; ImageSize=241,664; ProcessID=0; TimeDateStamp=1,523,457,992; BuildTime=18/04/11 14:46:32.00...; OriginalFileName=TeeDriverx64.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=130; ImageBase=0xfffff80281f60000; GuidSig=61815567-b24e-40f2-a...; Age=1; PDBFileName=D:\buildagent_prod\p...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=152; ImageBase=0xfffff80281f60000; ImageSize=241,664; ImageChecksum=261,952; TimeDateStamp=1,523,457,992; DefaultBase=0x00000000; BuildTime=18/04/11 14:46:32.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff80281fa0000; ImageSize=8,560,640; ProcessID=0; TimeDateStamp=1,539,832,107; BuildTime=18/10/18 03:08:27.00...; OriginalFileName=rtwlane.sys ; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff80281fa0000; GuidSig=ca07c3b2-fa32-4c49-a...; Age=1; PDBFileName=rtwlane.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=138; ImageBase=0xfffff80281fa0000; ImageSize=8,560,640; ImageChecksum=8,482,763; TimeDateStamp=1,539,832,107; DefaultBase=0x00000000; BuildTime=18/10/18 03:08:27.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=48; ImageBase=0xfffff802827d0000; ImageSize=958,464; ProcessID=0; TimeDateStamp=-97,227,203; BuildTime=03/01/08 22:54:53.00...; OriginalFileName=wdiwifi.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff802827d0000; GuidSig=8ad5ec3c-7974-a443-1...; Age=1; PDBFileName=WdiWiFi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=138; ImageBase=0xfffff802827d0000; ImageSize=958,464; ImageChecksum=960,725; TimeDateStamp=-97,227,203; DefaultBase=0x00000000; BuildTime=03/01/08 22:54:53.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff802828c0000; ImageSize=57,344; ProcessID=0; TimeDateStamp=1,329,274,078; BuildTime=12/02/15 02:47:58.00...; OriginalFileName=VWiFiBus.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff802828c0000; GuidSig=c2f086af-276b-27d9-d...; Age=1; PDBFileName=vwifibus.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=140; ImageBase=0xfffff802828c0000; ImageSize=57,344; ImageChecksum=81,694; TimeDateStamp=1,329,274,078; DefaultBase=0x00000000; BuildTime=12/02/15 02:47:58.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff802828d0000; ImageSize=581,632; ProcessID=0; TimeDateStamp=1,528,740,066; BuildTime=18/06/11 18:01:06.00...; OriginalFileName=e1i65x64.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff802828d0000; GuidSig=9865451d-8ca1-4d53-9...; Age=1; PDBFileName=e1i65x64.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=140; ImageBase=0xfffff802828d0000; ImageSize=581,632; ImageChecksum=565,309; TimeDateStamp=1,528,740,066; DefaultBase=0x00000000; BuildTime=18/06/11 18:01:06.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=48; ImageBase=0xfffff80282960000; ImageSize=49,152; ProcessID=0; TimeDateStamp=-1,350,632,219; BuildTime=63/04/20 22:51:17.00...; OriginalFileName=wmiacpi.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff80282960000; GuidSig=9ad98fd0-691d-3e49-e...; Age=1; PDBFileName=wmiacpi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=138; ImageBase=0xfffff80282960000; ImageSize=49,152; ImageChecksum=43,635; TimeDateStamp=-1,350,632,219; DefaultBase=0x00000000; BuildTime=63/04/20 22:51:17.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff80282970000; ImageSize=253,952; ProcessID=0; TimeDateStamp=-553,512,322; BuildTime=88/07/23 21:02:54.00...; OriginalFileName=intelppm.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff80282970000; GuidSig=8c01152a-1ef1-8e25-1...; Age=1; PDBFileName=intelppm.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=140; ImageBase=0xfffff80282970000; ImageSize=253,952; ImageChecksum=283,065; TimeDateStamp=-553,512,322; DefaultBase=0x00000000; BuildTime=88/07/23 21:02:54.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff802829b0000; ImageSize=45,056; ProcessID=0; TimeDateStamp=-2,136,256,242; BuildTime=38/05/29 01:57:34.00...; OriginalFileName=acpipagr.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff802829b0000; GuidSig=b52e2e20-5412-de23-8...; Age=1; PDBFileName=acpipagr.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=140; ImageBase=0xfffff802829b0000; ImageSize=45,056; ImageChecksum=54,424; TimeDateStamp=-2,136,256,242; DefaultBase=0x00000000; BuildTime=38/05/29 01:57:34.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=62; ImageBase=0xfffff802829c0000; ImageSize=53,248; ProcessID=0; TimeDateStamp=-770,227,958; BuildTime=81/09/10 14:15:38.00...; OriginalFileName=NdisVirtualBus.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=51; ImageBase=0xfffff802829c0000; GuidSig=0a75fc5e-15af-01d0-5...; Age=1; PDBFileName=NdisVirtualBus.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=152; ImageBase=0xfffff802829c0000; ImageSize=53,248; ImageChecksum=54,128; TimeDateStamp=-770,227,958; DefaultBase=0x00000000; BuildTime=81/09/10 14:15:38.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=46; ImageBase=0xfffff802829d0000; ImageSize=49,152; ProcessID=0; TimeDateStamp=-992,529,115; BuildTime=74/08/25 15:56:21.00...; OriginalFileName=swenum.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=43; ImageBase=0xfffff802829d0000; GuidSig=f89a9da1-3075-0583-3...; Age=1; PDBFileName=swenum.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=242; ImageBase=0xfffff802829d0000; ImageSize=49,152; ImageChecksum=48,445; TimeDateStamp=-992,529,115; DefaultBase=0x00000000; BuildTime=74/08/25 15:56:21.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=46; ImageBase=0xfffff802829e0000; ImageSize=57,344; ProcessID=0; TimeDateStamp=1,318,623,736; BuildTime=11/10/14 20:22:16.00...; OriginalFileName=RDPBUS.SYS; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=43; ImageBase=0xfffff802829e0000; GuidSig=a89728c1-0556-0416-1...; Age=1; PDBFileName=rdpbus.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=136; ImageBase=0xfffff802829e0000; ImageSize=57,344; ImageChecksum=74,411; TimeDateStamp=1,318,623,736; DefaultBase=0x00000000; BuildTime=11/10/14 20:22:16.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff802829f0000; ImageSize=225,280; ProcessID=0; TimeDateStamp=1,505,382,942; BuildTime=17/09/14 09:55:42.00...; OriginalFileName=nvhda.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=138; ImageBase=0xfffff802829f0000; GuidSig=3d49007a-e342-454b-8...; Age=1; PDBFileName=c:\u\workspace\Windo...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=140; ImageBase=0xfffff802829f0000; ImageSize=225,280; ImageChecksum=238,748; TimeDateStamp=1,505,382,942; DefaultBase=0x00000000; BuildTime=17/09/14 09:55:42.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=48; ImageBase=0xfffff80282a30000; ImageSize=61,440; ProcessID=0; TimeDateStamp=357,573,153; BuildTime=81/05/01 13:52:33.00...; OriginalFileName=ksthunk.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff80282a30000; GuidSig=3acb4a7b-b218-e9e5-8...; Age=1; PDBFileName=ksthunk.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=138; ImageBase=0xfffff80282a30000; ImageSize=61,440; ImageChecksum=70,010; TimeDateStamp=357,573,153; DefaultBase=0x00000000; BuildTime=81/05/01 13:52:33.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=48; ImageBase=0xfffff802808f0000; ImageSize=638,976; ProcessID=0; TimeDateStamp=-735,675,033; BuildTime=82/10/15 12:17:43.00...; OriginalFileName=usbhub3.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff802808f0000; GuidSig=494fadf6-bc0e-0b01-6...; Age=1; PDBFileName=usbhub3.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=138; ImageBase=0xfffff802808f0000; ImageSize=638,976; ImageChecksum=676,467; TimeDateStamp=-735,675,033; DefaultBase=0x00000000; BuildTime=82/10/15 12:17:43.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=42; ImageBase=0xfffff80282a40000; ImageSize=57,344; ProcessID=0; TimeDateStamp=-849,097,059; BuildTime=79/03/12 18:10:37.00...; OriginalFileName=usbd.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=41; ImageBase=0xfffff80282a40000; GuidSig=f0281333-c387-a0b9-9...; Age=1; PDBFileName=usbd.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=132; ImageBase=0xfffff80282a40000; ImageSize=57,344; ImageChecksum=77,085; TimeDateStamp=-849,097,059; DefaultBase=0x00000000; BuildTime=79/03/12 18:10:37.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=48; ImageBase=0xfffff80280990000; ImageSize=450,560; ProcessID=0; TimeDateStamp=-1,623,573,053; BuildTime=54/08/26 21:57:23.00...; OriginalFileName=HDAudio.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff80280990000; GuidSig=eca8ff89-20cb-4ce0-9...; Age=1; PDBFileName=HDAudio.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=138; ImageBase=0xfffff80280990000; ImageSize=450,560; ImageChecksum=475,095; TimeDateStamp=-1,623,573,053; DefaultBase=0x00000000; BuildTime=54/08/26 21:57:23.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=48; ImageBase=0xfffff80283bc0000; ImageSize=208,896; ProcessID=0; TimeDateStamp=1,563,095,505; BuildTime=19/07/14 09:11:45.00...; OriginalFileName=USBCCGP.SYS; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff80283bc0000; GuidSig=1307f2ed-9025-42a1-e...; Age=1; PDBFileName=usbccgp.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=138; ImageBase=0xfffff80283bc0000; ImageSize=208,896; ImageChecksum=244,761; TimeDateStamp=1,563,095,505; DefaultBase=0x00000000; BuildTime=19/07/14 09:11:45.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff80280a00000; ImageSize=323,584; ProcessID=0; TimeDateStamp=743,787,992; BuildTime=93/07/27 15:46:32.00...; OriginalFileName=usbvideo.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff80280a00000; GuidSig=0f61a79f-89ab-03ce-5...; Age=1; PDBFileName=usbvideo.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=140; ImageBase=0xfffff80280a00000; ImageSize=323,584; ImageChecksum=338,174; TimeDateStamp=743,787,992; DefaultBase=0x00000000; BuildTime=93/07/27 15:46:32.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff80280a50000; ImageSize=225,280; ProcessID=0; TimeDateStamp=1,561,228,624; BuildTime=19/06/22 18:37:04.00...; OriginalFileName=USBAudio.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff80280a50000; GuidSig=fa6be429-f128-ad96-f...; Age=1; PDBFileName=USBAudio.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=140; ImageBase=0xfffff80280a50000; ImageSize=225,280; ImageChecksum=222,606; TimeDateStamp=1,561,228,624; DefaultBase=0x00000000; BuildTime=19/06/22 18:37:04.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=46; ImageBase=0xfffff80282a50000; ImageSize=73,728; ProcessID=0; TimeDateStamp=2,073,135,614; BuildTime=35/09/11 15:00:14.00...; OriginalFileName=HIDUSB.SYS; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=43; ImageBase=0xfffff80282a50000; GuidSig=0408a7a0-8f71-f1c1-8...; Age=1; PDBFileName=hidusb.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=136; ImageBase=0xfffff80282a50000; ImageSize=73,728; ImageChecksum=72,411; TimeDateStamp=2,073,135,614; DefaultBase=0x00000000; BuildTime=35/09/11 15:00:14.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff80280a90000; ImageSize=241,664; ProcessID=0; TimeDateStamp=-724,508,954; BuildTime=83/02/21 17:59:02.00...; OriginalFileName=hidclass.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff80280a90000; GuidSig=531804ab-d6b8-d5a9-3...; Age=1; PDBFileName=hidclass.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=140; ImageBase=0xfffff80280a90000; ImageSize=241,664; ImageChecksum=223,065; TimeDateStamp=-724,508,954; DefaultBase=0x00000000; BuildTime=83/02/21 17:59:02.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff80280ad0000; ImageSize=77,824; ProcessID=0; TimeDateStamp=1,090,900,500; BuildTime=04/07/27 03:55:00.00...; OriginalFileName=hidparse.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff80280ad0000; GuidSig=bca7daa4-1e32-3151-0...; Age=1; PDBFileName=hidparse.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=140; ImageBase=0xfffff80280ad0000; ImageSize=77,824; ImageChecksum=62,412; TimeDateStamp=1,090,900,500; DefaultBase=0x00000000; BuildTime=04/07/27 03:55:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=46; ImageBase=0xfffff80280af0000; ImageSize=65,536; ProcessID=0; TimeDateStamp=-1,589,591,673; BuildTime=55/09/24 05:13:43.00...; OriginalFileName=mouhid.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=43; ImageBase=0xfffff80280af0000; GuidSig=ec59f073-0261-0bbc-d...; Age=1; PDBFileName=mouhid.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=136; ImageBase=0xfffff80280af0000; ImageSize=65,536; ImageChecksum=61,299; TimeDateStamp=-1,589,591,673; DefaultBase=0x00000000; BuildTime=55/09/24 05:13:43.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff80280b10000; ImageSize=77,824; ProcessID=0; TimeDateStamp=1,243,807,672; BuildTime=09/05/31 22:07:52.00...; OriginalFileName=mouclass.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff80280b10000; GuidSig=f0ee971c-150c-9df2-a...; Age=1; PDBFileName=mouclass.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=140; ImageBase=0xfffff80280b10000; ImageSize=77,824; ImageChecksum=127,349; TimeDateStamp=1,243,807,672; DefaultBase=0x00000000; BuildTime=09/05/31 22:07:52.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=46; ImageBase=0xfffff80280b30000; ImageSize=69,632; ProcessID=0; TimeDateStamp=1,291,226,279; BuildTime=10/12/01 17:57:59.00...; OriginalFileName=kbdhid.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=43; ImageBase=0xfffff80280b30000; GuidSig=18bf0bbf-79ae-9df8-8...; Age=1; PDBFileName=kbdhid.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=136; ImageBase=0xfffff80280b30000; ImageSize=69,632; ImageChecksum=54,819; TimeDateStamp=1,291,226,279; DefaultBase=0x00000000; BuildTime=10/12/01 17:57:59.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff80280b50000; ImageSize=81,920; ProcessID=0; TimeDateStamp=189,219,366; BuildTime=75/12/31 00:56:06.00...; OriginalFileName=kbdclass.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff80280b50000; GuidSig=3527c88f-0db0-e3c6-2...; Age=1; PDBFileName=kbdclass.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=140; ImageBase=0xfffff80280b50000; ImageSize=81,920; ImageChecksum=97,814; TimeDateStamp=189,219,366; DefaultBase=0x00000000; BuildTime=75/12/31 00:56:06.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=56; ImageBase=0xfffff802816d0000; ImageSize=827,392; ProcessID=0; TimeDateStamp=1,522,722,546; BuildTime=18/04/03 02:29:06.00...; OriginalFileName=RtkBtfilter.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=128; ImageBase=0xfffff802816d0000; GuidSig=dc43814c-b2a9-45f6-b...; Age=1; PDBFileName=D:\SVN\HostSW\win7-i...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=146; ImageBase=0xfffff802816d0000; ImageSize=827,392; ImageChecksum=780,912; TimeDateStamp=1,522,722,546; DefaultBase=0x00000000; BuildTime=18/04/03 02:29:06.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=46; ImageBase=0xfffff802817a0000; ImageSize=126,976; ProcessID=0; TimeDateStamp=-2,117,538,938; BuildTime=38/12/31 17:12:38.00...; OriginalFileName=bthusb.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=43; ImageBase=0xfffff802817a0000; GuidSig=2fcfb5c7-dcc9-af1f-a...; Age=1; PDBFileName=bthusb.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=136; ImageBase=0xfffff802817a0000; ImageSize=126,976; ImageChecksum=145,724; TimeDateStamp=-2,117,538,938; DefaultBase=0x00000000; BuildTime=38/12/31 17:12:38.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=48; ImageBase=0xfffff80280c00000; ImageSize=1,449,984; ProcessID=0; TimeDateStamp=1,158,032,955; BuildTime=06/09/12 03:49:15.00...; OriginalFileName=bthport.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff80280c00000; GuidSig=c4bea6d8-8097-154a-8...; Age=1; PDBFileName=bthport.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=138; ImageBase=0xfffff80280c00000; ImageSize=1,449,984; ImageChecksum=1,446,150; TimeDateStamp=1,158,032,955; DefaultBase=0x00000000; BuildTime=06/09/12 03:49:15.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=46; ImageBase=0xfffff80280d90000; ImageSize=237,568; ProcessID=0; TimeDateStamp=-1,048,160,012; BuildTime=72/11/19 18:54:44.00...; OriginalFileName=rfcomm.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=43; ImageBase=0xfffff80280d90000; GuidSig=10fb9efa-11ea-42d4-5...; Age=1; PDBFileName=rfcomm.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=136; ImageBase=0xfffff80280d90000; ImageSize=237,568; ImageChecksum=211,745; TimeDateStamp=-1,048,160,012; DefaultBase=0x00000000; BuildTime=72/11/19 18:54:44.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=46; ImageBase=0xfffff35e90720000; ImageSize=573,440; ProcessID=0; TimeDateStamp=2,072,189,039; BuildTime=35/08/31 16:03:59.00...; OriginalFileName=win32k.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=43; ImageBase=0xfffff35e90720000; GuidSig=6481ec65-b691-5b30-8...; Age=1; PDBFileName=win32k.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=120; ImageBase=0xfffff35e90720000; ImageSize=573,440; ImageChecksum=555,100; TimeDateStamp=2,072,189,039; DefaultBase=0x00000000; BuildTime=35/08/31 16:03:59.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=54; ImageBase=0xfffff35e90000000; ImageSize=3,825,664; ProcessID=0; TimeDateStamp=69,943,718; BuildTime=72/03/20 12:48:38.00...; OriginalFileName=win32kfull.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=47; ImageBase=0xfffff35e90000000; GuidSig=096b8c3f-772a-6950-c...; Age=1; PDBFileName=win32kfull.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=128; ImageBase=0xfffff35e90000000; ImageSize=3,825,664; ImageChecksum=3,774,070; TimeDateStamp=69,943,718; DefaultBase=0x00000000; BuildTime=72/03/20 12:48:38.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=54; ImageBase=0xfffff35e903b0000; ImageSize=2,838,528; ProcessID=0; TimeDateStamp=575,697,316; BuildTime=88/03/30 03:55:16.00...; OriginalFileName=win32kbase.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=47; ImageBase=0xfffff35e903b0000; GuidSig=2df5abe8-2461-b866-1...; Age=1; PDBFileName=win32kbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=128; ImageBase=0xfffff35e903b0000; ImageSize=2,838,528; ImageChecksum=2,841,232; TimeDateStamp=575,697,316; DefaultBase=0x00000000; BuildTime=88/03/30 03:55:16.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=158; ImageBase=0xfffff802814b0000; ImageSize=57,344; ImageChecksum=80,245; TimeDateStamp=1,368,004,285; DefaultBase=0x00000000; BuildTime=13/05/08 09:11:25.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=150; ImageBase=0xfffff802814f0000; ImageSize=159,744; ImageChecksum=145,319; TimeDateStamp=1,710,215,156; DefaultBase=0x00000000; BuildTime=24/03/12 03:45:56.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=148; ImageBase=0xfffff80281540000; ImageSize=118,784; ImageChecksum=133,695; TimeDateStamp=-1,051,484,911; DefaultBase=0x00000000; BuildTime=72/10/12 07:19:45.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=48; ImageBase=0xfffff80281560000; ImageSize=897,024; ProcessID=0; TimeDateStamp=-465,319,799; BuildTime=91/05/10 14:58:17.00...; OriginalFileName=dxgmms2.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff80281560000; GuidSig=090b20ff-0fe1-c976-b...; Age=1; PDBFileName=dxgmms2.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=138; ImageBase=0xfffff80281560000; ImageSize=897,024; ImageChecksum=940,222; TimeDateStamp=-465,319,799; DefaultBase=0x00000000; BuildTime=91/05/10 14:58:17.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=48; ImageBase=0xfffff80281640000; ImageSize=90,112; ProcessID=0; TimeDateStamp=-1,321,455,183; BuildTime=64/03/23 15:35:13.00...; OriginalFileName=monitor.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff80281640000; GuidSig=8b6041a3-61ce-0981-4...; Age=1; PDBFileName=monitor.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=138; ImageBase=0xfffff80281640000; ImageSize=90,112; ImageChecksum=87,907; TimeDateStamp=-1,321,455,183; DefaultBase=0x00000000; BuildTime=64/03/23 15:35:13.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=46; ImageBase=0xfffff80281660000; ImageSize=327,680; ProcessID=0; TimeDateStamp=708,900,165; BuildTime=92/06/18 20:42:45.00...; OriginalFileName=WUDFRd.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=43; ImageBase=0xfffff80281660000; GuidSig=0f049a58-31a3-09ca-a...; Age=1; PDBFileName=WUDFRd.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=136; ImageBase=0xfffff80281660000; ImageSize=327,680; ImageChecksum=343,930; TimeDateStamp=708,900,165; DefaultBase=0x00000000; BuildTime=92/06/18 20:42:45.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=40; ImageBase=0xfffff35e90670000; ImageSize=294,912; ProcessID=0; TimeDateStamp=-432,108,557; BuildTime=92/05/29 00:18:59.00...; OriginalFileName=cdd.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=40; ImageBase=0xfffff35e90670000; GuidSig=9ee3a14c-76f5-a9e0-c...; Age=1; PDBFileName=cdd.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=114; ImageBase=0xfffff35e90670000; ImageSize=294,912; ImageChecksum=311,249; TimeDateStamp=-432,108,557; DefaultBase=0x00000000; BuildTime=92/05/29 00:18:59.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=66; ImageBase=0xfffff802816c0000; ImageSize=53,248; ProcessID=0; TimeDateStamp=-654,094,238; BuildTime=85/05/16 17:37:38.00...; OriginalFileName=rdpvideominiport.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=53; ImageBase=0xfffff802816c0000; GuidSig=48e6f82d-71fd-779d-c...; Age=1; PDBFileName=rdpvideominiport.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=156; ImageBase=0xfffff802816c0000; ImageSize=53,248; ImageChecksum=87,315; TimeDateStamp=-654,094,238; DefaultBase=0x00000000; BuildTime=85/05/16 17:37:38.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff802817c0000; ImageSize=172,032; ProcessID=0; TimeDateStamp=145,287,210; BuildTime=74/08/09 13:33:30.00...; OriginalFileName=luafv.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=42; ImageBase=0xfffff802817c0000; GuidSig=5b0c775d-5a9f-19f0-e...; Age=1; PDBFileName=luafv.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=134; ImageBase=0xfffff802817c0000; ImageSize=172,032; ImageChecksum=204,542; TimeDateStamp=145,287,210; DefaultBase=0x00000000; BuildTime=74/08/09 13:33:30.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff80280e30000; ImageSize=221,184; ProcessID=0; TimeDateStamp=-386,668,492; BuildTime=93/11/05 22:33:24.00...; OriginalFileName=wcifs.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=42; ImageBase=0xfffff80280e30000; GuidSig=9e2b165d-e990-2d02-9...; Age=1; PDBFileName=wcifs.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=134; ImageBase=0xfffff80280e30000; ImageSize=221,184; ImageChecksum=245,237; TimeDateStamp=-386,668,492; DefaultBase=0x00000000; BuildTime=93/11/05 22:33:24.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff80280e70000; ImageSize=192,512; ProcessID=0; TimeDateStamp=-466,579,780; BuildTime=91/04/26 00:58:36.00...; OriginalFileName=RDPDR.SYS; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=42; ImageBase=0xfffff80280e70000; GuidSig=c92bfede-667f-950a-9...; Age=1; PDBFileName=rdpdr.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=134; ImageBase=0xfffff80280e70000; ImageSize=192,512; ImageChecksum=218,214; TimeDateStamp=-466,579,780; DefaultBase=0x00000000; BuildTime=91/04/26 00:58:36.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=46; ImageBase=0xfffff80280ea0000; ImageSize=487,424; ProcessID=0; TimeDateStamp=217,237,455; BuildTime=76/11/19 07:44:15.00...; OriginalFileName=cldflt.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=43; ImageBase=0xfffff80280ea0000; GuidSig=d039111c-b0f6-6388-3...; Age=1; PDBFileName=cldflt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=136; ImageBase=0xfffff80280ea0000; ImageSize=487,424; ImageChecksum=512,152; TimeDateStamp=217,237,455; DefaultBase=0x00000000; BuildTime=76/11/19 07:44:15.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff80280f20000; ImageSize=81,920; ProcessID=0; TimeDateStamp=1,055,134,573; BuildTime=03/06/09 04:56:13.00...; OriginalFileName=mmcss.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=42; ImageBase=0xfffff80280f20000; GuidSig=bb5b8c18-69d7-5765-0...; Age=1; PDBFileName=mmcss.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=134; ImageBase=0xfffff80280f20000; ImageSize=81,920; ImageChecksum=86,268; TimeDateStamp=1,055,134,573; DefaultBase=0x00000000; BuildTime=03/06/09 04:56:13.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=54; ImageBase=0xfffff80280f40000; ImageSize=106,496; ProcessID=0; TimeDateStamp=-679,712,312; BuildTime=84/07/24 05:29:44.00...; OriginalFileName=storqosflt.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=47; ImageBase=0xfffff80280f40000; GuidSig=0b4c9665-3cfb-5e3e-1...; Age=1; PDBFileName=storqosflt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=144; ImageBase=0xfffff80280f40000; ImageSize=106,496; ImageChecksum=110,821; TimeDateStamp=-679,712,312; DefaultBase=0x00000000; BuildTime=84/07/24 05:29:44.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff80280f60000; ImageSize=159,744; ProcessID=0; TimeDateStamp=-243,076,856; BuildTime=98/05/25 21:07:20.00...; OriginalFileName=TsUsbHub.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff80280f60000; GuidSig=e3126a73-4087-96bb-d...; Age=1; PDBFileName=TsUsbHub.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=140; ImageBase=0xfffff80280f60000; ImageSize=159,744; ImageChecksum=194,536; TimeDateStamp=-243,076,856; DefaultBase=0x00000000; BuildTime=98/05/25 21:07:20.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=48; ImageBase=0xfffff80280f90000; ImageSize=151,552; ProcessID=0; TimeDateStamp=-746,639,819; BuildTime=82/06/10 14:31:17.00...; OriginalFileName=browser.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=43; ImageBase=0xfffff80280f90000; GuidSig=93736f95-86e9-e446-3...; Age=1; PDBFileName=bowser.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=136; ImageBase=0xfffff80280f90000; ImageSize=151,552; ImageChecksum=119,521; TimeDateStamp=-746,639,819; DefaultBase=0x00000000; BuildTime=82/06/10 14:31:17.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=48; ImageBase=0xfffff80280fc0000; ImageSize=229,376; ProcessID=0; TimeDateStamp=-703,629,213; BuildTime=83/10/21 09:54:43.00...; OriginalFileName=winquic.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff80280fc0000; GuidSig=f614f83f-dfaf-fa5d-9...; Age=1; PDBFileName=winquic.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=138; ImageBase=0xfffff80280fc0000; ImageSize=229,376; ImageChecksum=207,452; TimeDateStamp=-703,629,213; DefaultBase=0x00000000; BuildTime=83/10/21 09:54:43.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=46; ImageBase=0xfffff80281000000; ImageSize=585,728; ProcessID=0; TimeDateStamp=-1,161,019,876; BuildTime=69/04/23 12:57:00.00...; OriginalFileName=MRXSMB.Sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=43; ImageBase=0xfffff80281000000; GuidSig=006c9d8f-9cff-feb0-6...; Age=1; PDBFileName=mrxsmb.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=136; ImageBase=0xfffff80281000000; ImageSize=585,728; ImageChecksum=614,203; TimeDateStamp=-1,161,019,876; DefaultBase=0x00000000; BuildTime=69/04/23 12:57:00.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff80281090000; ImageSize=282,624; ProcessID=0; TimeDateStamp=659,375,434; BuildTime=90/11/23 15:50:34.00...; OriginalFileName=MRXSMB20.Sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff80281090000; GuidSig=878fd87c-d0cf-4061-0...; Age=1; PDBFileName=mrxsmb20.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=140; ImageBase=0xfffff80281090000; ImageSize=282,624; ImageChecksum=311,212; TimeDateStamp=659,375,434; DefaultBase=0x00000000; BuildTime=90/11/23 15:50:34.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=46; ImageBase=0xfffff80281100000; ImageSize=102,400; ProcessID=0; TimeDateStamp=365,105,290; BuildTime=81/07/27 18:08:10.00...; OriginalFileName=MSLLDP.SYS; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=43; ImageBase=0xfffff80281100000; GuidSig=ac1ab92a-212d-4836-a...; Age=1; PDBFileName=mslldp.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=136; ImageBase=0xfffff80281100000; ImageSize=102,400; ImageChecksum=92,037; TimeDateStamp=365,105,290; DefaultBase=0x00000000; BuildTime=81/07/27 18:08:10.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=46; ImageBase=0xfffff80281120000; ImageSize=98,304; ProcessID=0; TimeDateStamp=1,887,343,368; BuildTime=29/10/22 06:02:48.00...; OriginalFileName=LLTDIO.SYS; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=43; ImageBase=0xfffff80281120000; GuidSig=286e3e67-6e21-a1d2-5...; Age=1; PDBFileName=lltdio.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=136; ImageBase=0xfffff80281120000; ImageSize=98,304; ImageChecksum=125,384; TimeDateStamp=1,887,343,368; DefaultBase=0x00000000; BuildTime=29/10/22 06:02:48.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=46; ImageBase=0xfffff80281140000; ImageSize=110,592; ProcessID=0; TimeDateStamp=-308,751,890; BuildTime=96/04/25 18:03:26.00...; OriginalFileName=RSPNDR.SYS; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=43; ImageBase=0xfffff80281140000; GuidSig=b890f401-ffee-e8d9-c...; Age=1; PDBFileName=rspndr.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=136; ImageBase=0xfffff80281140000; ImageSize=110,592; ImageChecksum=148,517; TimeDateStamp=-308,751,890; DefaultBase=0x00000000; BuildTime=96/04/25 18:03:26.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff80281160000; ImageSize=2,465,792; ProcessID=0; TimeDateStamp=222,944,317; BuildTime=77/01/24 08:58:37.00...; OriginalFileName=vmswitch.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff80281160000; GuidSig=289b4e72-105e-27f9-0...; Age=1; PDBFileName=vmswitch.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=140; ImageBase=0xfffff80281160000; ImageSize=2,465,792; ImageChecksum=2,450,867; TimeDateStamp=222,944,317; DefaultBase=0x00000000; BuildTime=77/01/24 08:58:37.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=46; ImageBase=0xfffff802813c0000; ImageSize=118,784; ProcessID=0; TimeDateStamp=466,975,995; BuildTime=84/10/18 19:33:15.00...; OriginalFileName=WANARP.SYS; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=43; ImageBase=0xfffff802813c0000; GuidSig=1640da6c-63f7-b2e8-8...; Age=1; PDBFileName=wanarp.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=136; ImageBase=0xfffff802813c0000; ImageSize=118,784; ImageChecksum=131,676; TimeDateStamp=466,975,995; DefaultBase=0x00000000; BuildTime=84/10/18 19:33:15.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff802813e0000; ImageSize=729,088; ProcessID=0; TimeDateStamp=-1,280,132,100; BuildTime=65/07/14 22:13:16.00...; OriginalFileName=NWiFi.SYS; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=42; ImageBase=0xfffff802813e0000; GuidSig=4967bed8-9a46-2e76-8...; Age=1; PDBFileName=nwifi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=134; ImageBase=0xfffff802813e0000; ImageSize=729,088; ImageChecksum=762,072; TimeDateStamp=-1,280,132,100; DefaultBase=0x00000000; BuildTime=65/07/14 22:13:16.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=48; ImageBase=0xfffff80280b70000; ImageSize=98,304; ProcessID=0; TimeDateStamp=956,113,134; BuildTime=00/04/19 02:58:54.00...; OriginalFileName=NDISUIO.SYS; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff80280b70000; GuidSig=3aa0caac-e3cb-d3fb-e...; Age=1; PDBFileName=ndisuio.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=138; ImageBase=0xfffff80280b70000; ImageSize=98,304; ImageChecksum=84,796; TimeDateStamp=956,113,134; DefaultBase=0x00000000; BuildTime=00/04/19 02:58:54.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=42; ImageBase=0xfffff80285770000; ImageSize=1,327,104; ProcessID=0; TimeDateStamp=-150,379,763; BuildTime=01/05/03 18:18:53.00...; OriginalFileName=http.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=41; ImageBase=0xfffff80285770000; GuidSig=1dd31cee-a19c-27c5-f...; Age=1; PDBFileName=http.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=132; ImageBase=0xfffff80285770000; ImageSize=1,327,104; ImageChecksum=1,363,792; TimeDateStamp=-150,379,763; DefaultBase=0x00000000; BuildTime=01/05/03 18:18:53.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=46; ImageBase=0xfffff802858c0000; ImageSize=106,496; ProcessID=0; TimeDateStamp=2,103,112,432; BuildTime=36/08/23 13:53:52.00...; OriginalFileName=mpsdrv.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=43; ImageBase=0xfffff802858c0000; GuidSig=11aef823-9100-4067-c...; Age=1; PDBFileName=mpsdrv.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=136; ImageBase=0xfffff802858c0000; ImageSize=106,496; ImageChecksum=108,699; TimeDateStamp=2,103,112,432; DefaultBase=0x00000000; BuildTime=36/08/23 13:53:52.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=48; ImageBase=0xfffff802858e0000; ImageSize=77,824; ProcessID=0; TimeDateStamp=988,317,805; BuildTime=01/04/26 20:43:25.00...; OriginalFileName=vwifimp.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff802858e0000; GuidSig=a9a55e6f-da09-57f0-a...; Age=1; PDBFileName=vwifimp.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=138; ImageBase=0xfffff802858e0000; ImageSize=77,824; ImageChecksum=51,405; TimeDateStamp=988,317,805; DefaultBase=0x00000000; BuildTime=01/04/26 20:43:25.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=46; ImageBase=0xfffff80285900000; ImageSize=876,544; ProcessID=0; TimeDateStamp=430,570,370; BuildTime=83/08/24 10:52:50.00...; OriginalFileName=PEAuth.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=43; ImageBase=0xfffff80285900000; GuidSig=a07999bb-5521-41a5-3...; Age=1; PDBFileName=PEAuth.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=136; ImageBase=0xfffff80285900000; ImageSize=876,544; ImageChecksum=864,510; TimeDateStamp=430,570,370; DefaultBase=0x00000000; BuildTime=83/08/24 10:52:50.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=40; ImageBase=0xfffff80284e00000; ImageSize=159,744; ProcessID=0; TimeDateStamp=594,696,456; BuildTime=88/11/05 01:27:36.00...; OriginalFileName=ndu.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=40; ImageBase=0xfffff80284e00000; GuidSig=c7688078-4fac-cb84-8...; Age=1; PDBFileName=ndu.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=130; ImageBase=0xfffff80284e00000; ImageSize=159,744; ImageChecksum=138,995; TimeDateStamp=594,696,456; DefaultBase=0x00000000; BuildTime=88/11/05 01:27:36.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff80284e30000; ImageSize=81,920; ProcessID=0; TimeDateStamp=877,770,281; BuildTime=97/10/25 09:04:41.00...; OriginalFileName=tcpipreg.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff80284e30000; GuidSig=66f074db-44a7-e63c-7...; Age=1; PDBFileName=tcpipreg.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=140; ImageBase=0xfffff80284e30000; ImageSize=81,920; ImageChecksum=64,494; TimeDateStamp=877,770,281; DefaultBase=0x00000000; BuildTime=97/10/25 09:04:41.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=46; ImageBase=0xfffff80284e50000; ImageSize=335,872; ProcessID=0; TimeDateStamp=1,598,699,156; BuildTime=20/08/29 11:05:56.00...; OriginalFileName=SRVNET.SYS; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=43; ImageBase=0xfffff80284e50000; GuidSig=d72719a4-ab2c-7d0d-9...; Age=1; PDBFileName=srvnet.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=136; ImageBase=0xfffff80284e50000; ImageSize=335,872; ImageChecksum=326,944; TimeDateStamp=1,598,699,156; DefaultBase=0x00000000; BuildTime=20/08/29 11:05:56.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=42; ImageBase=0xfffff80284eb0000; ImageSize=802,816; ProcessID=0; TimeDateStamp=-869,555,408; BuildTime=78/07/18 23:18:08.00...; OriginalFileName=SRV2.SYS; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=41; ImageBase=0xfffff80284eb0000; GuidSig=505a36bc-0657-6d8f-8...; Age=1; PDBFileName=srv2.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=132; ImageBase=0xfffff80284eb0000; ImageSize=802,816; ImageChecksum=800,952; TimeDateStamp=-869,555,408; DefaultBase=0x00000000; BuildTime=78/07/18 23:18:08.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=48; ImageBase=0xfffff80284f80000; ImageSize=118,784; ProcessID=0; TimeDateStamp=1,858,511,333; BuildTime=28/11/22 13:08:53.00...; OriginalFileName=rassstp.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff80284f80000; GuidSig=06d6a5fe-7700-13a8-9...; Age=1; PDBFileName=rassstp.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=138; ImageBase=0xfffff80284f80000; ImageSize=118,784; ImageChecksum=89,915; TimeDateStamp=1,858,511,333; DefaultBase=0x00000000; BuildTime=28/11/22 13:08:53.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=48; ImageBase=0xfffff80284fa0000; ImageSize=262,144; ProcessID=0; TimeDateStamp=504,550,399; BuildTime=85/12/27 16:53:19.00...; OriginalFileName=ndproxy.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff80284fa0000; GuidSig=cf3b6b6d-2736-6448-9...; Age=1; PDBFileName=ndproxy.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=138; ImageBase=0xfffff80284fa0000; ImageSize=262,144; ImageChecksum=247,850; TimeDateStamp=504,550,399; DefaultBase=0x00000000; BuildTime=85/12/27 16:53:19.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff80284ff0000; ImageSize=159,744; ProcessID=0; TimeDateStamp=-1,452,605,587; BuildTime=60/01/26 16:55:09.00...; OriginalFileName=agilevpn.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff80284ff0000; GuidSig=056b0254-ce25-2b19-d...; Age=1; PDBFileName=AgileVpn.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=140; ImageBase=0xfffff80284ff0000; ImageSize=159,744; ImageChecksum=165,921; TimeDateStamp=-1,452,605,587; DefaultBase=0x00000000; BuildTime=60/01/26 16:55:09.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=48; ImageBase=0xfffff80285020000; ImageSize=139,264; ProcessID=0; TimeDateStamp=-1,482,014,642; BuildTime=59/02/20 07:44:14.00...; OriginalFileName=rasl2tp.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff80285020000; GuidSig=cc558324-5f6d-88e4-3...; Age=1; PDBFileName=rasl2tp.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=138; ImageBase=0xfffff80285020000; ImageSize=139,264; ImageChecksum=118,742; TimeDateStamp=-1,482,014,642; DefaultBase=0x00000000; BuildTime=59/02/20 07:44:14.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=48; ImageBase=0xfffff80285050000; ImageSize=131,072; ProcessID=0; TimeDateStamp=1,418,278,288; BuildTime=14/12/11 06:11:28.00...; OriginalFileName=RASPPTP.SYS; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff80285050000; GuidSig=94206a1d-b6f2-61f5-7...; Age=1; PDBFileName=raspptp.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=138; ImageBase=0xfffff80285050000; ImageSize=131,072; ImageChecksum=117,092; TimeDateStamp=1,418,278,288; DefaultBase=0x00000000; BuildTime=14/12/11 06:11:28.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff80285080000; ImageSize=114,688; ProcessID=0; TimeDateStamp=87,719,282; BuildTime=72/10/12 06:28:02.00...; OriginalFileName=raspppoe.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff80285080000; GuidSig=f8b11951-3d44-2885-9...; Age=1; PDBFileName=raspppoe.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=140; ImageBase=0xfffff80285080000; ImageSize=114,688; ImageChecksum=108,078; TimeDateStamp=87,719,282; DefaultBase=0x00000000; BuildTime=72/10/12 06:28:02.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff802850a0000; ImageSize=61,440; ProcessID=0; TimeDateStamp=1,762,462,981; BuildTime=25/11/06 21:03:01.00...; OriginalFileName=NDISTAPI.SYS; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff802850a0000; GuidSig=f7eb8b48-72e6-7c56-5...; Age=1; PDBFileName=ndistapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=140; ImageBase=0xfffff802850a0000; ImageSize=61,440; ImageChecksum=80,336; TimeDateStamp=1,762,462,981; DefaultBase=0x00000000; BuildTime=25/11/06 21:03:01.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=48; ImageBase=0xfffff802850b0000; ImageSize=237,568; ProcessID=0; TimeDateStamp=-79,445,747; BuildTime=03/08/02 18:12:29.00...; OriginalFileName=NDISWAN.SYS; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff802850b0000; GuidSig=c2bc342c-463c-6240-7...; Age=1; PDBFileName=ndiswan.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=138; ImageBase=0xfffff802850b0000; ImageSize=237,568; ImageChecksum=214,025; TimeDateStamp=-79,445,747; DefaultBase=0x00000000; BuildTime=03/08/02 18:12:29.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=46; ImageBase=0xfffff80285110000; ImageSize=77,824; ProcessID=0; TimeDateStamp=-1,360,552,774; BuildTime=62/12/27 03:08:42.00...; OriginalFileName=condrv.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=43; ImageBase=0xfffff80285110000; GuidSig=de7e3c52-d8ef-149e-6...; Age=1; PDBFileName=condrv.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=136; ImageBase=0xfffff80285110000; ImageSize=77,824; ImageChecksum=68,164; TimeDateStamp=-1,360,552,774; DefaultBase=0x00000000; BuildTime=62/12/27 03:08:42.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff802851d0000; ImageSize=73,728; ProcessID=0; TimeDateStamp=-572,060,901; BuildTime=87/12/22 04:39:55.00...; OriginalFileName=wdnisdrv.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff802851d0000; GuidSig=3a8affd6-c5a0-60f6-1...; Age=1; PDBFileName=WdNisDrv.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=146; ImageBase=0xfffff802851d0000; ImageSize=73,728; ImageChecksum=106,576; TimeDateStamp=-572,060,901; DefaultBase=0x00000000; BuildTime=87/12/22 04:39:55.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff802851f0000; ImageSize=106,496; ProcessID=0; TimeDateStamp=723,765,515; BuildTime=92/12/07 21:58:35.00...; OriginalFileName=P9RDR.SYS; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=42; ImageBase=0xfffff802851f0000; GuidSig=b116e55e-1a75-1ca0-5...; Age=1; PDBFileName=p9rdr.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=134; ImageBase=0xfffff802851f0000; ImageSize=106,496; ImageChecksum=131,059; TimeDateStamp=723,765,515; DefaultBase=0x00000000; BuildTime=92/12/07 21:58:35.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=48; ImageBase=0xfffff80285310000; ImageSize=135,168; ProcessID=0; TimeDateStamp=-83,425,790; BuildTime=03/06/17 16:38:26.00...; OriginalFileName=bindflt.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff80285310000; GuidSig=64ff30ea-a111-7168-f...; Age=1; PDBFileName=bindflt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=138; ImageBase=0xfffff80285310000; ImageSize=135,168; ImageChecksum=127,910; TimeDateStamp=-83,425,790; DefaultBase=0x00000000; BuildTime=03/06/17 16:38:26.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=112; ImageBase=0xfffff80285340000; ImageSize=122,880; ProcessID=0; TimeDateStamp=-1,886,237,828; BuildTime=46/04/30 19:31:08.00...; OriginalFileName=Microsoft.Bluetooth....; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=76; ImageBase=0xfffff80285340000; GuidSig=6d65e83e-a1f3-af31-7...; Age=1; PDBFileName=Microsoft.Bluetooth....; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=202; ImageBase=0xfffff80285340000; ImageSize=122,880; ImageChecksum=114,336; TimeDateStamp=-1,886,237,828; DefaultBase=0x00000000; BuildTime=46/04/30 19:31:08.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=48; ImageBase=0xfffff80285360000; ImageSize=139,264; ProcessID=0; TimeDateStamp=488,701,000; BuildTime=85/06/27 06:16:40.00...; OriginalFileName=bthenum.SYS; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=44; ImageBase=0xfffff80285360000; GuidSig=e6e83377-413a-b403-3...; Age=1; PDBFileName=bthenum.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=138; ImageBase=0xfffff80285360000; ImageSize=139,264; ImageChecksum=141,442; TimeDateStamp=488,701,000; DefaultBase=0x00000000; BuildTime=85/06/27 06:16:40.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=46; ImageBase=0xfffff80285390000; ImageSize=155,648; ProcessID=0; TimeDateStamp=551,685,276; BuildTime=87/06/26 05:54:36.00...; OriginalFileName=bthpan.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=43; ImageBase=0xfffff80285390000; GuidSig=2f80740d-7512-ba95-0...; Age=1; PDBFileName=bthpan.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=136; ImageBase=0xfffff80285390000; ImageSize=155,648; ImageChecksum=191,570; TimeDateStamp=551,685,276; DefaultBase=0x00000000; BuildTime=87/06/26 05:54:36.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=50; ImageBase=0xfffff80285400000; ImageSize=81,920; ProcessID=0; TimeDateStamp=1,522,638,876; BuildTime=18/04/02 03:14:36.00...; OriginalFileName=qwavedrv.sys; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=0; TID=9984; PName=Idle; ProceNum=11; DataLen=45; ImageBase=0xfffff80285400000; GuidSig=679e6fb7-3db0-df33-f...; Age=1; PDBFileName=qwavedrv.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=0; TID=-1; PName=Idle; ProceNum=11; DataLen=140; ImageBase=0xfffff80285400000; ImageSize=81,920; ImageChecksum=85,544; TimeDateStamp=1,522,638,876; DefaultBase=0x00000000; BuildTime=18/04/02 03:14:36.00...; FileName=C:\Windows\system32\...; 
EVENT 0.000: Windows Kernel/Process/DCStart PID=144; TID=-1; PName=Registry; ProceNum=11; DataLen=79; ProcessID=144; ParentID=4; ImageFileName=Registry; PageDirectoryBase=0x00592000; Flags=Protected; SessionID=-1; ExitStatus=259; UniqueProcessKey=0xffffc50f592f3080; CommandLine=; PackageFullName=; ApplicationID=; 
EVENT 0.000: Windows Kernel/Process/DCStart PID=468; TID=-1; PName=smss; ProceNum=2; DataLen=137; ProcessID=468; ParentID=4; ImageFileName=smss.exe; PageDirectoryBase=0xffb0a2000; Flags=Protected; SessionID=-1; ExitStatus=259; UniqueProcessKey=0xffffc50f5d02d240; CommandLine=\SystemRoot\System32...; PackageFullName=; ApplicationID=; 
EVENT 0.000: KernelTraceControl/ImageID PID=468; TID=-1; PName=smss; ProceNum=2; DataLen=42; ImageBase=0x7ff73a8f0000; ImageSize=155,648; ProcessID=0; TimeDateStamp=1,583,649,631; BuildTime=20/03/08 06:40:31.00...; OriginalFileName=smss.exe; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=468; TID=-1; PName=smss; ProceNum=2; DataLen=41; ImageBase=0x7ff73a8f0000; GuidSig=03b02331-5844-1abf-b...; Age=1; PDBFileName=smss.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=468; TID=-1; PName=smss; ProceNum=2; DataLen=156; ImageBase=0x7ff73a8f0000; ImageSize=155,648; ImageChecksum=202,817; TimeDateStamp=0; DefaultBase=0x7ff73a8f0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=468; TID=-1; PName=smss; ProceNum=2; DataLen=44; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ProcessID=0; TimeDateStamp=-1,523,876,758; BuildTime=57/10/23 19:22:18.00...; OriginalFileName=ntdll.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=468; TID=-1; PName=smss; ProceNum=2; DataLen=42; ImageBase=0x7ffc26600000; GuidSig=b54f3499-813e-bcf1-3...; Age=1; PDBFileName=ntdll.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=468; TID=-1; PName=smss; ProceNum=2; DataLen=158; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ImageChecksum=2,058,600; TimeDateStamp=0; DefaultBase=0x7ffc26600000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: Windows Kernel/Process/DCStart PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=568; ProcessID=672; ParentID=660; ImageFileName=csrss.exe; PageDirectoryBase=0x101777c000; Flags=Protected; SessionID=0; ExitStatus=259; UniqueProcessKey=0xffffc50f5ff53080; CommandLine=%SystemRoot%\system3...; PackageFullName=; ApplicationID=; 
EVENT 0.000: Windows Kernel/PerfInfo/Sample PID=4; TID=92; PName=System; ProceNum=10; DataLen=16; InstructionPointer=0xfffff8027cbc3ae2; ProcessorNumber=10; Priority=23; ExecutingDPC=False; ExecutingISR=False; Rank=0; Count=1; 
EVENT 0.000: Windows Kernel/PerfInfo/Sample PID=2684; TID=2728; PName=MemCompression; ProceNum=8; DataLen=16; InstructionPointer=0xfffff8027cbc0379; ProcessorNumber=8; Priority=12; ExecutingDPC=False; ExecutingISR=True; Rank=0; Count=1; 
EVENT 0.000: Windows Kernel/PerfInfo/Sample PID=2684; TID=2732; PName=MemCompression; ProceNum=1; DataLen=16; InstructionPointer=0xfffff8027ca50932; ProcessorNumber=1; Priority=7; ExecutingDPC=False; ExecutingISR=False; Rank=0; Count=1; 
EVENT 0.000: KernelTraceControl/ImageID PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=44; ImageBase=0x7ff7c6f60000; ImageSize=28,672; ProcessID=0; TimeDateStamp=2,029,701,991; BuildTime=34/04/26 22:06:31.00...; OriginalFileName=CSRSS.Exe; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=42; ImageBase=0x7ff7c6f60000; GuidSig=fedf7396-216a-b75e-8...; Age=1; PDBFileName=csrss.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=158; ImageBase=0x7ff7c6f60000; ImageSize=28,672; ImageChecksum=23,220; TimeDateStamp=0; DefaultBase=0x7ff7c6f60000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=40; ImageBase=0x7ffc23320000; ImageSize=643,072; ProcessID=0; TimeDateStamp=128,890,829; BuildTime=74/01/31 19:00:29.00...; OriginalFileName=SXS.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=40; ImageBase=0x7ffc23320000; GuidSig=b4b3ab1e-25b9-89d5-2...; Age=1; PDBFileName=sxs.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=154; ImageBase=0x7ffc23320000; ImageSize=643,072; ImageChecksum=638,719; TimeDateStamp=0; DefaultBase=0x7ffc23320000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=46; ImageBase=0x7ffc23430000; ImageSize=53,248; ProcessID=0; TimeDateStamp=188,086,796; BuildTime=75/12/17 22:19:56.00...; OriginalFileName=sxssrv.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=43; ImageBase=0x7ffc23430000; GuidSig=d783ab44-9294-32b2-a...; Age=1; PDBFileName=sxssrv.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=160; ImageBase=0x7ffc23430000; ImageSize=53,248; ImageChecksum=61,884; TimeDateStamp=0; DefaultBase=0x7ffc23430000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=52; ImageBase=0x7ffc23440000; ImageSize=135,168; ProcessID=0; TimeDateStamp=1,915,274,196; BuildTime=30/09/10 12:36:36.00...; OriginalFileName=winsrvext.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=46; ImageBase=0x7ffc23440000; GuidSig=27165418-3fec-b07f-c...; Age=1; PDBFileName=winsrvext.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=166; ImageBase=0x7ffc23440000; ImageSize=135,168; ImageChecksum=99,046; TimeDateStamp=0; DefaultBase=0x7ffc23440000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=46; ImageBase=0x7ffc23470000; ImageSize=86,016; ProcessID=0; TimeDateStamp=1,283,798,798; BuildTime=10/09/06 18:46:38.00...; OriginalFileName=winsrv.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=43; ImageBase=0x7ffc23470000; GuidSig=0ea2a790-d000-671b-6...; Age=1; PDBFileName=winsrv.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=160; ImageBase=0x7ffc23470000; ImageSize=86,016; ImageChecksum=123,212; TimeDateStamp=0; DefaultBase=0x7ffc23470000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=48; ImageBase=0x7ffc23490000; ImageSize=86,016; ProcessID=0; TimeDateStamp=-1,798,881,040; BuildTime=49/02/04 21:17:36.00...; OriginalFileName=basesrv.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=44; ImageBase=0x7ffc23490000; GuidSig=e98a8667-901c-bd26-f...; Age=1; PDBFileName=basesrv.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=162; ImageBase=0x7ffc23490000; ImageSize=86,016; ImageChecksum=97,379; TimeDateStamp=0; DefaultBase=0x7ffc23490000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=46; ImageBase=0x7ffc234b0000; ImageSize=98,304; ProcessID=0; TimeDateStamp=-2,144,350,698; BuildTime=38/02/24 09:29:58.00...; OriginalFileName=CSRSrv.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=43; ImageBase=0x7ffc234b0000; GuidSig=a82d330a-03c7-329c-3...; Age=1; PDBFileName=csrsrv.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=160; ImageBase=0x7ffc234b0000; ImageSize=98,304; ImageChecksum=118,353; TimeDateStamp=0; DefaultBase=0x7ffc234b0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=50; ImageBase=0x7ffc235c0000; ImageSize=303,104; ProcessID=0; TimeDateStamp=-1,347,769,430; BuildTime=63/05/24 02:04:26.00...; OriginalFileName=CFGMGR32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=45; ImageBase=0x7ffc235c0000; GuidSig=c951ee8e-a9b3-8ebf-a...; Age=1; PDBFileName=cfgmgr32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=164; ImageBase=0x7ffc235c0000; ImageSize=303,104; ImageChecksum=322,106; TimeDateStamp=0; DefaultBase=0x7ffc235c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=50; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ProcessID=0; TimeDateStamp=1,555,946,369; BuildTime=19/04/22 15:19:29.00...; OriginalFileName=ucrtbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=45; ImageBase=0x7ffc23d90000; GuidSig=faceb612-020d-68fb-b...; Age=1; PDBFileName=ucrtbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=164; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ImageChecksum=1,052,117; TimeDateStamp=0; DefaultBase=0x7ffc23d90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=46; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ProcessID=0; TimeDateStamp=1,396,962,555; BuildTime=14/04/08 13:09:15.00...; OriginalFileName=Win32u.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=43; ImageBase=0x7ffc23eb0000; GuidSig=bc2e49ab-e46d-2e93-b...; Age=1; PDBFileName=win32u.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=160; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ImageChecksum=177,968; TimeDateStamp=0; DefaultBase=0x7ffc23eb0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=54; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ProcessID=0; TimeDateStamp=439,410,971; BuildTime=83/12/04 18:36:11.00...; OriginalFileName=Kernelbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=47; ImageBase=0x7ffc23ee0000; GuidSig=44c8ec9a-a0ea-4f98-d...; Age=1; PDBFileName=kernelbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=168; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ImageChecksum=2,793,344; TimeDateStamp=0; DefaultBase=0x7ffc23ee0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=44; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ProcessID=0; TimeDateStamp=1,868,443,751; BuildTime=29/03/17 12:09:11.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=46; ImageBase=0x7ffc24190000; GuidSig=e5a785df-0333-6a66-6...; Age=1; PDBFileName=gdi32full.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=166; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ImageChecksum=1,696,264; TimeDateStamp=0; DefaultBase=0x7ffc24190000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=66; ImageBase=0x7ffc24390000; ImageSize=528,384; ProcessID=0; TimeDateStamp=1,774,320,825; BuildTime=26/03/24 02:53:45.00...; OriginalFileName=bcryptprimitives.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=53; ImageBase=0x7ffc24390000; GuidSig=54a1b493-8222-f67e-4...; Age=1; PDBFileName=bcryptprimitives.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=180; ImageBase=0x7ffc24390000; ImageSize=528,384; ImageChecksum=562,796; TimeDateStamp=0; DefaultBase=0x7ffc24390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=52; ImageBase=0x7ffc24420000; ImageSize=647,168; ProcessID=0; TimeDateStamp=545,597,548; BuildTime=87/04/16 18:52:28.00...; OriginalFileName=msvcp_win.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=46; ImageBase=0x7ffc24420000; GuidSig=de65fef9-16bb-6b73-d...; Age=1; PDBFileName=msvcp_win.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=166; ImageBase=0x7ffc24420000; ImageSize=647,168; ImageChecksum=686,408; TimeDateStamp=0; DefaultBase=0x7ffc24420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=48; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ProcessID=0; TimeDateStamp=1,691,891,946; BuildTime=23/08/13 01:59:06.00...; OriginalFileName=COMBASE.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=44; ImageBase=0x7ffc246c0000; GuidSig=d15b0ee4-2a16-5244-2...; Age=1; PDBFileName=combase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=162; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ImageChecksum=3,387,881; TimeDateStamp=0; DefaultBase=0x7ffc246c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=50; ImageBase=0x7ffc24be0000; ImageSize=729,088; ProcessID=0; TimeDateStamp=775,814,378; BuildTime=94/08/02 07:59:38.00...; OriginalFileName=kernel32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=45; ImageBase=0x7ffc24be0000; GuidSig=47a44f0c-c47f-b6a1-f...; Age=1; PDBFileName=kernel32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=164; ImageBase=0x7ffc24be0000; ImageSize=729,088; ImageChecksum=723,980; TimeDateStamp=0; DefaultBase=0x7ffc24be0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=44; ImageBase=0x7ffc24da0000; ImageSize=155,648; ProcessID=0; TimeDateStamp=-1,867,374,302; BuildTime=46/12/05 03:23:14.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=42; ImageBase=0x7ffc24da0000; GuidSig=209ad405-837d-061e-f...; Age=1; PDBFileName=gdi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=158; ImageBase=0x7ffc24da0000; ImageSize=155,648; ImageChecksum=194,403; TimeDateStamp=0; DefaultBase=0x7ffc24da0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=46; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ProcessID=0; TimeDateStamp=87,082,528; BuildTime=72/10/04 21:35:28.00...; OriginalFileName=rpcrt4.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=43; ImageBase=0x7ffc25f70000; GuidSig=a3028d6b-45da-0062-4...; Age=1; PDBFileName=rpcrt4.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=160; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ImageChecksum=1,199,090; TimeDateStamp=0; DefaultBase=0x7ffc25f70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=46; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ProcessID=0; TimeDateStamp=-1,431,966,518; BuildTime=60/09/21 13:59:38.00...; OriginalFileName=user32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=43; ImageBase=0x7ffc26420000; GuidSig=bc4cc7cc-9a33-b8a6-6...; Age=1; PDBFileName=user32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=160; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ImageChecksum=1,700,392; TimeDateStamp=0; DefaultBase=0x7ffc26420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=44; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ProcessID=0; TimeDateStamp=-1,523,876,758; BuildTime=57/10/23 19:22:18.00...; OriginalFileName=ntdll.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=42; ImageBase=0x7ffc26600000; GuidSig=b54f3499-813e-bcf1-3...; Age=1; PDBFileName=ntdll.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=672; TID=-1; PName=csrss; ProceNum=2; DataLen=158; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ImageChecksum=2,058,600; TimeDateStamp=0; DefaultBase=0x7ffc26600000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: Windows Kernel/Process/DCStart PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=104; ProcessID=764; ParentID=660; ImageFileName=wininit.exe; PageDirectoryBase=0x100f3cb000; Flags=Protected; SessionID=0; ExitStatus=259; UniqueProcessKey=0xffffc50f60cca080; CommandLine=wininit.exe; PackageFullName=; ApplicationID=; 
EVENT 0.000: KernelTraceControl/ImageID PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=48; ImageBase=0x7ff7a42c0000; ImageSize=380,928; ProcessID=0; TimeDateStamp=314,224,487; BuildTime=79/12/16 20:34:47.00...; OriginalFileName=WinInit.exe; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=44; ImageBase=0x7ff7a42c0000; GuidSig=b927fa45-7bac-fca0-6...; Age=1; PDBFileName=wininit.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=162; ImageBase=0x7ff7a42c0000; ImageSize=380,928; ImageChecksum=400,835; TimeDateStamp=0; DefaultBase=0x7ff7a42c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=46; ImageBase=0x7ffc21e20000; ImageSize=188,416; ProcessID=0; TimeDateStamp=157,235,662; BuildTime=74/12/25 20:34:22.00...; OriginalFileName=fwbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=43; ImageBase=0x7ffc21e20000; GuidSig=89b14238-fca7-5326-c...; Age=1; PDBFileName=fwbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=160; ImageBase=0x7ffc21e20000; ImageSize=188,416; ImageChecksum=220,140; TimeDateStamp=0; DefaultBase=0x7ffc21e20000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=56; ImageBase=0x7ffc21e80000; ImageSize=573,440; ProcessID=0; TimeDateStamp=775,848,894; BuildTime=94/08/02 17:34:54.00...; OriginalFileName=FirewallAPI.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=48; ImageBase=0x7ffc21e80000; GuidSig=f1e3fecf-4859-996c-0...; Age=1; PDBFileName=FirewallAPI.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=170; ImageBase=0x7ffc21e80000; ImageSize=573,440; ImageChecksum=603,289; TimeDateStamp=0; DefaultBase=0x7ffc21e80000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=48; ImageBase=0x7ffc21f10000; ImageSize=159,744; ProcessID=0; TimeDateStamp=1,559,901,462; BuildTime=19/06/07 09:57:42.00...; OriginalFileName=profext.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=44; ImageBase=0x7ffc21f10000; GuidSig=05bc393b-6d24-9e52-f...; Age=1; PDBFileName=profext.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=162; ImageBase=0x7ffc21f10000; ImageSize=159,744; ImageChecksum=184,416; TimeDateStamp=0; DefaultBase=0x7ffc21f10000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=50; ImageBase=0x7ffc22420000; ImageSize=237,568; ProcessID=0; TimeDateStamp=1,353,705,264; BuildTime=12/11/23 21:14:24.00...; OriginalFileName=iphlpapi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=45; ImageBase=0x7ffc22420000; GuidSig=a3177875-244a-46c8-b...; Age=1; PDBFileName=iphlpapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=164; ImageBase=0x7ffc22420000; ImageSize=237,568; ImageChecksum=252,735; TimeDateStamp=0; DefaultBase=0x7ffc22420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=46; ImageBase=0x7ffc22460000; ImageSize=827,392; ProcessID=0; TimeDateStamp=-1,912,355,972; BuildTime=45/07/02 12:28:44.00...; OriginalFileName=dnsapi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=43; ImageBase=0x7ffc22460000; GuidSig=77e3a024-129c-5dab-b...; Age=1; PDBFileName=dnsapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=160; ImageBase=0x7ffc22460000; ImageSize=827,392; ImageChecksum=850,901; TimeDateStamp=0; DefaultBase=0x7ffc22460000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=48; ImageBase=0x7ffc226c0000; ImageSize=421,888; ProcessID=0; TimeDateStamp=414,127,772; BuildTime=83/02/15 03:29:32.00...; OriginalFileName=mswsock.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=44; ImageBase=0x7ffc226c0000; GuidSig=96babb0d-8e64-884b-6...; Age=1; PDBFileName=mswsock.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=162; ImageBase=0x7ffc226c0000; ImageSize=421,888; ImageChecksum=420,926; TimeDateStamp=0; DefaultBase=0x7ffc226c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=48; ImageBase=0x7ffc22e10000; ImageSize=200,704; ProcessID=0; TimeDateStamp=-648,125,799; BuildTime=85/07/24 19:31:37.00...; OriginalFileName=ntmarta.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=44; ImageBase=0x7ffc22e10000; GuidSig=d28b6be6-17ca-2646-7...; Age=1; PDBFileName=ntmarta.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=162; ImageBase=0x7ffc22e10000; ImageSize=200,704; ImageChecksum=211,194; TimeDateStamp=0; DefaultBase=0x7ffc22e10000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=48; ImageBase=0x7ffc233c0000; ImageSize=192,512; ProcessID=0; TimeDateStamp=621,642,292; BuildTime=89/09/12 22:24:52.00...; OriginalFileName=sspicli.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=44; ImageBase=0x7ffc233c0000; GuidSig=823d5a41-e0d7-02a7-9...; Age=1; PDBFileName=sspicli.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=162; ImageBase=0x7ffc233c0000; ImageSize=192,512; ImageChecksum=235,306; TimeDateStamp=0; DefaultBase=0x7ffc233c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=48; ImageBase=0x7ffc233f0000; ImageSize=151,552; ProcessID=0; TimeDateStamp=-157,143,252; BuildTime=01/02/14 11:34:04.00...; OriginalFileName=userenv.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=44; ImageBase=0x7ffc233f0000; GuidSig=1a734def-8e54-a706-f...; Age=1; PDBFileName=userenv.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=162; ImageBase=0x7ffc233f0000; ImageSize=151,552; ImageChecksum=176,304; TimeDateStamp=0; DefaultBase=0x7ffc233f0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=54; ImageBase=0x7ffc23420000; ImageSize=57,344; ProcessID=0; TimeDateStamp=922,275,536; BuildTime=99/03/24 11:38:56.00...; OriginalFileName=WinInitExt.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=47; ImageBase=0x7ffc23420000; GuidSig=acb8d866-fca4-ab5b-b...; Age=1; PDBFileName=wininitext.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=168; ImageBase=0x7ffc23420000; ImageSize=57,344; ImageChecksum=45,360; TimeDateStamp=0; DefaultBase=0x7ffc23420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=48; ImageBase=0x7ffc23550000; ImageSize=126,976; ProcessID=0; TimeDateStamp=-87,365,952; BuildTime=03/05/03 02:09:04.00...; OriginalFileName=PROFAPI.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=44; ImageBase=0x7ffc23550000; GuidSig=d3e9e0b2-6dc3-e775-b...; Age=1; PDBFileName=profapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=162; ImageBase=0x7ffc23550000; ImageSize=126,976; ImageChecksum=153,678; TimeDateStamp=0; DefaultBase=0x7ffc23550000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=46; ImageBase=0x7ffc23590000; ImageSize=155,648; ProcessID=0; TimeDateStamp=-1,248,142,761; BuildTime=66/07/20 04:08:55.00...; OriginalFileName=bcrypt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=43; ImageBase=0x7ffc23590000; GuidSig=1a472182-0367-8386-d...; Age=1; PDBFileName=bcrypt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=160; ImageBase=0x7ffc23590000; ImageSize=155,648; ImageChecksum=157,312; TimeDateStamp=0; DefaultBase=0x7ffc23590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=50; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ProcessID=0; TimeDateStamp=1,555,946,369; BuildTime=19/04/22 15:19:29.00...; OriginalFileName=ucrtbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=45; ImageBase=0x7ffc23d90000; GuidSig=faceb612-020d-68fb-b...; Age=1; PDBFileName=ucrtbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=164; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ImageChecksum=1,052,117; TimeDateStamp=0; DefaultBase=0x7ffc23d90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=46; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ProcessID=0; TimeDateStamp=1,396,962,555; BuildTime=14/04/08 13:09:15.00...; OriginalFileName=Win32u.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=43; ImageBase=0x7ffc23eb0000; GuidSig=bc2e49ab-e46d-2e93-b...; Age=1; PDBFileName=win32u.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=160; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ImageChecksum=177,968; TimeDateStamp=0; DefaultBase=0x7ffc23eb0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=54; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ProcessID=0; TimeDateStamp=439,410,971; BuildTime=83/12/04 18:36:11.00...; OriginalFileName=Kernelbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=47; ImageBase=0x7ffc23ee0000; GuidSig=44c8ec9a-a0ea-4f98-d...; Age=1; PDBFileName=kernelbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=168; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ImageChecksum=2,793,344; TimeDateStamp=0; DefaultBase=0x7ffc23ee0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=44; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ProcessID=0; TimeDateStamp=1,868,443,751; BuildTime=29/03/17 12:09:11.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=46; ImageBase=0x7ffc24190000; GuidSig=e5a785df-0333-6a66-6...; Age=1; PDBFileName=gdi32full.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=166; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ImageChecksum=1,696,264; TimeDateStamp=0; DefaultBase=0x7ffc24190000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=66; ImageBase=0x7ffc24390000; ImageSize=528,384; ProcessID=0; TimeDateStamp=1,774,320,825; BuildTime=26/03/24 02:53:45.00...; OriginalFileName=bcryptprimitives.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=53; ImageBase=0x7ffc24390000; GuidSig=54a1b493-8222-f67e-4...; Age=1; PDBFileName=bcryptprimitives.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=180; ImageBase=0x7ffc24390000; ImageSize=528,384; ImageChecksum=562,796; TimeDateStamp=0; DefaultBase=0x7ffc24390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=52; ImageBase=0x7ffc24420000; ImageSize=647,168; ProcessID=0; TimeDateStamp=545,597,548; BuildTime=87/04/16 18:52:28.00...; OriginalFileName=msvcp_win.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=46; ImageBase=0x7ffc24420000; GuidSig=de65fef9-16bb-6b73-d...; Age=1; PDBFileName=msvcp_win.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=166; ImageBase=0x7ffc24420000; ImageSize=647,168; ImageChecksum=686,408; TimeDateStamp=0; DefaultBase=0x7ffc24420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=48; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ProcessID=0; TimeDateStamp=1,691,891,946; BuildTime=23/08/13 01:59:06.00...; OriginalFileName=COMBASE.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=44; ImageBase=0x7ffc246c0000; GuidSig=d15b0ee4-2a16-5244-2...; Age=1; PDBFileName=combase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=162; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ImageChecksum=3,387,881; TimeDateStamp=0; DefaultBase=0x7ffc246c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=50; ImageBase=0x7ffc24b30000; ImageSize=667,648; ProcessID=0; TimeDateStamp=-1,762,261,787; BuildTime=50/04/04 17:18:29.00...; OriginalFileName=advapi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=45; ImageBase=0x7ffc24b30000; GuidSig=549260e6-7474-8391-e...; Age=1; PDBFileName=advapi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=164; ImageBase=0x7ffc24b30000; ImageSize=667,648; ImageChecksum=662,904; TimeDateStamp=0; DefaultBase=0x7ffc24b30000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=50; ImageBase=0x7ffc24be0000; ImageSize=729,088; ProcessID=0; TimeDateStamp=775,814,378; BuildTime=94/08/02 07:59:38.00...; OriginalFileName=kernel32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=45; ImageBase=0x7ffc24be0000; GuidSig=47a44f0c-c47f-b6a1-f...; Age=1; PDBFileName=kernel32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=164; ImageBase=0x7ffc24be0000; ImageSize=729,088; ImageChecksum=723,980; TimeDateStamp=0; DefaultBase=0x7ffc24be0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=44; ImageBase=0x7ffc24da0000; ImageSize=155,648; ProcessID=0; TimeDateStamp=-1,867,374,302; BuildTime=46/12/05 03:23:14.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=42; ImageBase=0x7ffc24da0000; GuidSig=209ad405-837d-061e-f...; Age=1; PDBFileName=gdi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=158; ImageBase=0x7ffc24da0000; ImageSize=155,648; ImageChecksum=194,403; TimeDateStamp=0; DefaultBase=0x7ffc24da0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=46; ImageBase=0x7ffc24eb0000; ImageSize=454,656; ProcessID=0; TimeDateStamp=252,347,079; BuildTime=77/12/30 16:24:39.00...; OriginalFileName=ws2_32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=43; ImageBase=0x7ffc24eb0000; GuidSig=94268932-d2c5-c3db-4...; Age=1; PDBFileName=ws2_32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=160; ImageBase=0x7ffc24eb0000; ImageSize=454,656; ImageChecksum=456,525; TimeDateStamp=0; DefaultBase=0x7ffc24eb0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: Windows Kernel/PerfInfo/Sample PID=0; TID=0; PName=Idle; ProceNum=3; DataLen=16; InstructionPointer=0xfffff8027ca83218; ProcessorNumber=3; Priority=0; ExecutingDPC=False; ExecutingISR=True; Rank=0; Count=1; 
EVENT 0.000: KernelTraceControl/ImageID PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=46; ImageBase=0x7ffc25390000; ImageSize=647,168; ProcessID=0; TimeDateStamp=-172,101,673; BuildTime=00/08/25 08:27:03.00...; OriginalFileName=msvcrt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=43; ImageBase=0x7ffc25390000; GuidSig=1fea8db6-b57f-5fbf-a...; Age=1; PDBFileName=msvcrt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=160; ImageBase=0x7ffc25390000; ImageSize=647,168; ImageChecksum=678,174; TimeDateStamp=0; DefaultBase=0x7ffc25390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=48; ImageBase=0x7ffc25590000; ImageSize=618,496; ProcessID=0; TimeDateStamp=-136,044,297; BuildTime=01/10/16 16:23:19.00...; OriginalFileName=sechost.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=44; ImageBase=0x7ffc25590000; GuidSig=0f733965-b12f-7923-b...; Age=1; PDBFileName=sechost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=162; ImageBase=0x7ffc25590000; ImageSize=618,496; ImageChecksum=662,974; TimeDateStamp=0; DefaultBase=0x7ffc25590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=46; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ProcessID=0; TimeDateStamp=87,082,528; BuildTime=72/10/04 21:35:28.00...; OriginalFileName=rpcrt4.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=43; ImageBase=0x7ffc25f70000; GuidSig=a3028d6b-45da-0062-4...; Age=1; PDBFileName=rpcrt4.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=160; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ImageChecksum=1,199,090; TimeDateStamp=0; DefaultBase=0x7ffc25f70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=40; ImageBase=0x7ffc26410000; ImageSize=32,768; ProcessID=0; TimeDateStamp=1,693,425,343; BuildTime=23/08/30 19:55:43.00...; OriginalFileName=nsi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=40; ImageBase=0x7ffc26410000; GuidSig=7c67fb7d-8805-fe58-4...; Age=1; PDBFileName=nsi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=154; ImageBase=0x7ffc26410000; ImageSize=32,768; ImageChecksum=32,664; TimeDateStamp=0; DefaultBase=0x7ffc26410000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=46; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ProcessID=0; TimeDateStamp=-1,431,966,518; BuildTime=60/09/21 13:59:38.00...; OriginalFileName=user32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=43; ImageBase=0x7ffc26420000; GuidSig=bc4cc7cc-9a33-b8a6-6...; Age=1; PDBFileName=user32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=160; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ImageChecksum=1,700,392; TimeDateStamp=0; DefaultBase=0x7ffc26420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=44; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ProcessID=0; TimeDateStamp=-1,523,876,758; BuildTime=57/10/23 19:22:18.00...; OriginalFileName=ntdll.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=42; ImageBase=0x7ffc26600000; GuidSig=b54f3499-813e-bcf1-3...; Age=1; PDBFileName=ntdll.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=764; TID=-1; PName=wininit; ProceNum=2; DataLen=158; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ImageChecksum=2,058,600; TimeDateStamp=0; DefaultBase=0x7ffc26600000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: Windows Kernel/Process/DCStart PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=568; ProcessID=772; ParentID=756; ImageFileName=csrss.exe; PageDirectoryBase=0x464d38000; Flags=Protected; SessionID=1; ExitStatus=259; UniqueProcessKey=0xffffc50f60cdf140; CommandLine=%SystemRoot%\system3...; PackageFullName=; ApplicationID=; 
EVENT 0.000: KernelTraceControl/ImageID PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=44; ImageBase=0x7ff7c6f60000; ImageSize=28,672; ProcessID=0; TimeDateStamp=2,029,701,991; BuildTime=34/04/26 22:06:31.00...; OriginalFileName=CSRSS.Exe; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=42; ImageBase=0x7ff7c6f60000; GuidSig=fedf7396-216a-b75e-8...; Age=1; PDBFileName=csrss.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=158; ImageBase=0x7ff7c6f60000; ImageSize=28,672; ImageChecksum=23,220; TimeDateStamp=0; DefaultBase=0x7ff7c6f60000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=40; ImageBase=0x7ffc23320000; ImageSize=643,072; ProcessID=0; TimeDateStamp=128,890,829; BuildTime=74/01/31 19:00:29.00...; OriginalFileName=SXS.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=40; ImageBase=0x7ffc23320000; GuidSig=b4b3ab1e-25b9-89d5-2...; Age=1; PDBFileName=sxs.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=154; ImageBase=0x7ffc23320000; ImageSize=643,072; ImageChecksum=638,719; TimeDateStamp=0; DefaultBase=0x7ffc23320000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: Windows Kernel/PerfInfo/Sample PID=-1; TID=9984; PName=; ProceNum=2; DataLen=16; InstructionPointer=0xfffff8027ca2cfce; ProcessorNumber=2; Priority=9; ExecutingDPC=False; ExecutingISR=False; Rank=0; Count=1; 
EVENT 0.000: KernelTraceControl/ImageID PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=46; ImageBase=0x7ffc23430000; ImageSize=53,248; ProcessID=0; TimeDateStamp=188,086,796; BuildTime=75/12/17 22:19:56.00...; OriginalFileName=sxssrv.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=43; ImageBase=0x7ffc23430000; GuidSig=d783ab44-9294-32b2-a...; Age=1; PDBFileName=sxssrv.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=160; ImageBase=0x7ffc23430000; ImageSize=53,248; ImageChecksum=61,884; TimeDateStamp=0; DefaultBase=0x7ffc23430000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=52; ImageBase=0x7ffc23440000; ImageSize=135,168; ProcessID=0; TimeDateStamp=1,915,274,196; BuildTime=30/09/10 12:36:36.00...; OriginalFileName=winsrvext.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=46; ImageBase=0x7ffc23440000; GuidSig=27165418-3fec-b07f-c...; Age=1; PDBFileName=winsrvext.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=166; ImageBase=0x7ffc23440000; ImageSize=135,168; ImageChecksum=99,046; TimeDateStamp=0; DefaultBase=0x7ffc23440000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=46; ImageBase=0x7ffc23470000; ImageSize=86,016; ProcessID=0; TimeDateStamp=1,283,798,798; BuildTime=10/09/06 18:46:38.00...; OriginalFileName=winsrv.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=43; ImageBase=0x7ffc23470000; GuidSig=0ea2a790-d000-671b-6...; Age=1; PDBFileName=winsrv.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=160; ImageBase=0x7ffc23470000; ImageSize=86,016; ImageChecksum=123,212; TimeDateStamp=0; DefaultBase=0x7ffc23470000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=48; ImageBase=0x7ffc23490000; ImageSize=86,016; ProcessID=0; TimeDateStamp=-1,798,881,040; BuildTime=49/02/04 21:17:36.00...; OriginalFileName=basesrv.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=44; ImageBase=0x7ffc23490000; GuidSig=e98a8667-901c-bd26-f...; Age=1; PDBFileName=basesrv.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=162; ImageBase=0x7ffc23490000; ImageSize=86,016; ImageChecksum=97,379; TimeDateStamp=0; DefaultBase=0x7ffc23490000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=46; ImageBase=0x7ffc234b0000; ImageSize=98,304; ProcessID=0; TimeDateStamp=-2,144,350,698; BuildTime=38/02/24 09:29:58.00...; OriginalFileName=CSRSrv.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=43; ImageBase=0x7ffc234b0000; GuidSig=a82d330a-03c7-329c-3...; Age=1; PDBFileName=csrsrv.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=160; ImageBase=0x7ffc234b0000; ImageSize=98,304; ImageChecksum=118,353; TimeDateStamp=0; DefaultBase=0x7ffc234b0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=50; ImageBase=0x7ffc235c0000; ImageSize=303,104; ProcessID=0; TimeDateStamp=-1,347,769,430; BuildTime=63/05/24 02:04:26.00...; OriginalFileName=CFGMGR32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=45; ImageBase=0x7ffc235c0000; GuidSig=c951ee8e-a9b3-8ebf-a...; Age=1; PDBFileName=cfgmgr32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=164; ImageBase=0x7ffc235c0000; ImageSize=303,104; ImageChecksum=322,106; TimeDateStamp=0; DefaultBase=0x7ffc235c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=50; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ProcessID=0; TimeDateStamp=1,555,946,369; BuildTime=19/04/22 15:19:29.00...; OriginalFileName=ucrtbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=45; ImageBase=0x7ffc23d90000; GuidSig=faceb612-020d-68fb-b...; Age=1; PDBFileName=ucrtbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=164; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ImageChecksum=1,052,117; TimeDateStamp=0; DefaultBase=0x7ffc23d90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=46; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ProcessID=0; TimeDateStamp=1,396,962,555; BuildTime=14/04/08 13:09:15.00...; OriginalFileName=Win32u.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=43; ImageBase=0x7ffc23eb0000; GuidSig=bc2e49ab-e46d-2e93-b...; Age=1; PDBFileName=win32u.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=160; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ImageChecksum=177,968; TimeDateStamp=0; DefaultBase=0x7ffc23eb0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=54; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ProcessID=0; TimeDateStamp=439,410,971; BuildTime=83/12/04 18:36:11.00...; OriginalFileName=Kernelbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=47; ImageBase=0x7ffc23ee0000; GuidSig=44c8ec9a-a0ea-4f98-d...; Age=1; PDBFileName=kernelbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=168; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ImageChecksum=2,793,344; TimeDateStamp=0; DefaultBase=0x7ffc23ee0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=44; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ProcessID=0; TimeDateStamp=1,868,443,751; BuildTime=29/03/17 12:09:11.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=46; ImageBase=0x7ffc24190000; GuidSig=e5a785df-0333-6a66-6...; Age=1; PDBFileName=gdi32full.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=166; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ImageChecksum=1,696,264; TimeDateStamp=0; DefaultBase=0x7ffc24190000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=66; ImageBase=0x7ffc24390000; ImageSize=528,384; ProcessID=0; TimeDateStamp=1,774,320,825; BuildTime=26/03/24 02:53:45.00...; OriginalFileName=bcryptprimitives.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=53; ImageBase=0x7ffc24390000; GuidSig=54a1b493-8222-f67e-4...; Age=1; PDBFileName=bcryptprimitives.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=180; ImageBase=0x7ffc24390000; ImageSize=528,384; ImageChecksum=562,796; TimeDateStamp=0; DefaultBase=0x7ffc24390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=52; ImageBase=0x7ffc24420000; ImageSize=647,168; ProcessID=0; TimeDateStamp=545,597,548; BuildTime=87/04/16 18:52:28.00...; OriginalFileName=msvcp_win.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=46; ImageBase=0x7ffc24420000; GuidSig=de65fef9-16bb-6b73-d...; Age=1; PDBFileName=msvcp_win.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=166; ImageBase=0x7ffc24420000; ImageSize=647,168; ImageChecksum=686,408; TimeDateStamp=0; DefaultBase=0x7ffc24420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=48; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ProcessID=0; TimeDateStamp=1,691,891,946; BuildTime=23/08/13 01:59:06.00...; OriginalFileName=COMBASE.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=44; ImageBase=0x7ffc246c0000; GuidSig=d15b0ee4-2a16-5244-2...; Age=1; PDBFileName=combase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=162; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ImageChecksum=3,387,881; TimeDateStamp=0; DefaultBase=0x7ffc246c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=50; ImageBase=0x7ffc24be0000; ImageSize=729,088; ProcessID=0; TimeDateStamp=775,814,378; BuildTime=94/08/02 07:59:38.00...; OriginalFileName=kernel32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=45; ImageBase=0x7ffc24be0000; GuidSig=47a44f0c-c47f-b6a1-f...; Age=1; PDBFileName=kernel32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=164; ImageBase=0x7ffc24be0000; ImageSize=729,088; ImageChecksum=723,980; TimeDateStamp=0; DefaultBase=0x7ffc24be0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=44; ImageBase=0x7ffc24da0000; ImageSize=155,648; ProcessID=0; TimeDateStamp=-1,867,374,302; BuildTime=46/12/05 03:23:14.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=42; ImageBase=0x7ffc24da0000; GuidSig=209ad405-837d-061e-f...; Age=1; PDBFileName=gdi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=158; ImageBase=0x7ffc24da0000; ImageSize=155,648; ImageChecksum=194,403; TimeDateStamp=0; DefaultBase=0x7ffc24da0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=46; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ProcessID=0; TimeDateStamp=87,082,528; BuildTime=72/10/04 21:35:28.00...; OriginalFileName=rpcrt4.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=43; ImageBase=0x7ffc25f70000; GuidSig=a3028d6b-45da-0062-4...; Age=1; PDBFileName=rpcrt4.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=160; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ImageChecksum=1,199,090; TimeDateStamp=0; DefaultBase=0x7ffc25f70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=46; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ProcessID=0; TimeDateStamp=-1,431,966,518; BuildTime=60/09/21 13:59:38.00...; OriginalFileName=user32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=43; ImageBase=0x7ffc26420000; GuidSig=bc4cc7cc-9a33-b8a6-6...; Age=1; PDBFileName=user32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=160; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ImageChecksum=1,700,392; TimeDateStamp=0; DefaultBase=0x7ffc26420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=44; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ProcessID=0; TimeDateStamp=-1,523,876,758; BuildTime=57/10/23 19:22:18.00...; OriginalFileName=ntdll.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=42; ImageBase=0x7ffc26600000; GuidSig=b54f3499-813e-bcf1-3...; Age=1; PDBFileName=ntdll.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=772; TID=-1; PName=csrss; ProceNum=2; DataLen=158; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ImageChecksum=2,058,600; TimeDateStamp=0; DefaultBase=0x7ffc26600000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: Windows Kernel/Process/DCStart PID=836; TID=-1; PName=services; ProceNum=2; DataLen=147; ProcessID=836; ParentID=764; ImageFileName=services.exe; PageDirectoryBase=0x1011191000; Flags=Protected; SessionID=0; ExitStatus=259; UniqueProcessKey=0xffffc50f5ffa54c0; CommandLine=C:\Windows\system32\...; PackageFullName=; ApplicationID=; 
EVENT 0.000: KernelTraceControl/ImageID PID=836; TID=-1; PName=services; ProceNum=2; DataLen=50; ImageBase=0x7ff61d050000; ImageSize=684,032; ProcessID=0; TimeDateStamp=-1,402,227,903; BuildTime=61/08/31 18:43:13.00...; OriginalFileName=services.exe; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=836; TID=-1; PName=services; ProceNum=2; DataLen=45; ImageBase=0x7ff61d050000; GuidSig=b0fc3cbd-5f8d-8cd8-8...; Age=1; PDBFileName=services.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=836; TID=-1; PName=services; ProceNum=2; DataLen=164; ImageBase=0x7ff61d050000; ImageSize=684,032; ImageChecksum=709,239; TimeDateStamp=0; DefaultBase=0x7ff61d050000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=836; TID=-1; PName=services; ProceNum=2; DataLen=44; ImageBase=0x7ffc16cc0000; ImageSize=118,784; ProcessID=0; TimeDateStamp=-305,149,675; BuildTime=96/06/06 10:40:21.00...; OriginalFileName=SPINF.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=836; TID=-1; PName=services; ProceNum=2; DataLen=42; ImageBase=0x7ffc16cc0000; GuidSig=fa32edd9-d98a-5a21-5...; Age=1; PDBFileName=spinf.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=836; TID=-1; PName=services; ProceNum=2; DataLen=158; ImageBase=0x7ffc16cc0000; ImageSize=118,784; ImageChecksum=162,184; TimeDateStamp=0; DefaultBase=0x7ffc16cc0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=836; TID=-1; PName=services; ProceNum=2; DataLen=54; ImageBase=0x7ffc1e970000; ImageSize=86,016; ProcessID=0; TimeDateStamp=525,713,861; BuildTime=86/08/29 15:37:41.00...; OriginalFileName=usermgrcli.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=836; TID=-1; PName=services; ProceNum=2; DataLen=47; ImageBase=0x7ffc1e970000; GuidSig=26f569a5-8783-27b0-0...; Age=1; PDBFileName=usermgrcli.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=836; TID=-1; PName=services; ProceNum=2; DataLen=168; ImageBase=0x7ffc1e970000; ImageSize=86,016; ImageChecksum=138,081; TimeDateStamp=0; DefaultBase=0x7ffc1e970000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=836; TID=-1; PName=services; ProceNum=2; DataLen=46; ImageBase=0x7ffc1f980000; ImageSize=32,768; ProcessID=0; TimeDateStamp=-236,881,493; BuildTime=98/08/05 14:03:23.00...; OriginalFileName=dabapi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=836; TID=-1; PName=services; ProceNum=2; DataLen=43; ImageBase=0x7ffc1f980000; GuidSig=5020c7dc-a979-6518-5...; Age=1; PDBFileName=dabapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=836; TID=-1; PName=services; ProceNum=2; DataLen=160; ImageBase=0x7ffc1f980000; ImageSize=32,768; ImageChecksum=65,064; TimeDateStamp=0; DefaultBase=0x7ffc1f980000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=836; TID=-1; PName=services; ProceNum=2; DataLen=48; ImageBase=0x7ffc20960000; ImageSize=585,728; ProcessID=0; TimeDateStamp=-9,148,100; BuildTime=05/10/24 09:19:56.00...; OriginalFileName=Apphelp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=836; TID=-1; PName=services; ProceNum=2; DataLen=44; ImageBase=0x7ffc20960000; GuidSig=b37f976c-be76-5dae-9...; Age=1; PDBFileName=apphelp.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=836; TID=-1; PName=services; ProceNum=2; DataLen=162; ImageBase=0x7ffc20960000; ImageSize=585,728; ImageChecksum=594,685; TimeDateStamp=0; DefaultBase=0x7ffc20960000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=836; TID=-1; PName=services; ProceNum=2; DataLen=50; ImageBase=0x7ffc20f00000; ImageSize=167,936; ProcessID=0; TimeDateStamp=-189,693,732; BuildTime=00/02/02 17:46:04.00...; OriginalFileName=rmclient.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=836; TID=-1; PName=services; ProceNum=2; DataLen=45; ImageBase=0x7ffc20f00000; GuidSig=d9b2eec0-1750-fc20-8...; Age=1; PDBFileName=RmClient.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=836; TID=-1; PName=services; ProceNum=2; DataLen=164; ImageBase=0x7ffc20f00000; ImageSize=167,936; ImageChecksum=187,354; TimeDateStamp=0; DefaultBase=0x7ffc20f00000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=836; TID=-1; PName=services; ProceNum=2; DataLen=46; ImageBase=0x7ffc215b0000; ImageSize=155,648; ProcessID=0; TimeDateStamp=1,301,162,960; BuildTime=11/03/26 18:09:20.00...; OriginalFileName=SRVCLI.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=836; TID=-1; PName=services; ProceNum=2; DataLen=43; ImageBase=0x7ffc215b0000; GuidSig=4f2bb083-9346-16fb-6...; Age=1; PDBFileName=srvcli.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=836; TID=-1; PName=services; ProceNum=2; DataLen=160; ImageBase=0x7ffc215b0000; ImageSize=155,648; ImageChecksum=128,276; TimeDateStamp=0; DefaultBase=0x7ffc215b0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=836; TID=-1; PName=services; ProceNum=2; DataLen=58; ImageBase=0x7ffc21fd0000; ImageSize=192,512; ProcessID=0; TimeDateStamp=-639,405,391; BuildTime=85/11/02 17:51:45.00...; OriginalFileName=WUDFPlatform.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=836; TID=-1; PName=services; ProceNum=2; DataLen=49; ImageBase=0x7ffc21fd0000; GuidSig=6eb7b8bc-4f80-c9e5-f...; Age=1; PDBFileName=WUDFPlatform.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=836; TID=-1; PName=services; ProceNum=2; DataLen=172; ImageBase=0x7ffc21fd0000; ImageSize=192,512; ImageChecksum=247,581; TimeDateStamp=0; DefaultBase=0x7ffc21fd0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=836; TID=-1; PName=services; ProceNum=2; DataLen=44; ImageBase=0x7ffc22000000; ImageSize=303,104; ProcessID=0; TimeDateStamp=-1,775,967,220; BuildTime=49/10/28 02:14:36.00...; OriginalFileName=authz.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=836; TID=-1; PName=services; ProceNum=2; DataLen=42; ImageBase=0x7ffc22000000; GuidSig=f7ab524f-49bc-eb09-0...; Age=1; PDBFileName=authz.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=836; TID=-1; PName=services; ProceNum=2; DataLen=158; ImageBase=0x7ffc22000000; ImageSize=303,104; ImageChecksum=299,134; TimeDateStamp=0; DefaultBase=0x7ffc22000000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=836; TID=-1; PName=services; ProceNum=2; DataLen=46; ImageBase=0x7ffc220b0000; ImageSize=536,576; ProcessID=0; TimeDateStamp=2,129,249,110; BuildTime=37/06/22 02:05:10.00...; OriginalFileName=scesrv.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=836; TID=-1; PName=services; ProceNum=2; DataLen=43; ImageBase=0x7ffc220b0000; GuidSig=43ead1f3-aeba-5ac0-a...; Age=1; PDBFileName=scesrv.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=836; TID=-1; PName=services; ProceNum=2; DataLen=160; ImageBase=0x7ffc220b0000; ImageSize=536,576; ImageChecksum=571,978; TimeDateStamp=0; DefaultBase=0x7ffc220b0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=836; TID=-1; PName=services; ProceNum=2; DataLen=48; ImageBase=0x7ffc226c0000; ImageSize=421,888; ProcessID=0; TimeDateStamp=414,127,772; BuildTime=83/02/15 03:29:32.00...; OriginalFileName=mswsock.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=836; TID=-1; PName=services; ProceNum=2; DataLen=44; ImageBase=0x7ffc226c0000; GuidSig=96babb0d-8e64-884b-6...; Age=1; PDBFileName=mswsock.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=836; TID=-1; PName=services; ProceNum=2; DataLen=162; ImageBase=0x7ffc226c0000; ImageSize=421,888; ImageChecksum=420,926; TimeDateStamp=0; DefaultBase=0x7ffc226c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=836; TID=-1; PName=services; ProceNum=2; DataLen=54; ImageBase=0x7ffc232d0000; ImageSize=172,032; ProcessID=0; TimeDateStamp=564,545,050; BuildTime=87/11/22 02:04:10.00...; OriginalFileName=devinfoset.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=836; TID=-1; PName=services; ProceNum=2; DataLen=43; ImageBase=0x7ffc232d0000; GuidSig=bf3fb10c-179d-a551-d...; Age=1; PDBFileName=devobj.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=836; TID=-1; PName=services; ProceNum=2; DataLen=160; ImageBase=0x7ffc232d0000; ImageSize=172,032; ImageChecksum=212,309; TimeDateStamp=0; DefaultBase=0x7ffc232d0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=836; TID=-1; PName=services; ProceNum=2; DataLen=66; ImageBase=0x7ffc23300000; ImageSize=98,304; ProcessID=0; TimeDateStamp=-297,978,839; BuildTime=96/08/28 10:34:17.00...; OriginalFileName=EventAggregation.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=836; TID=-1; PName=services; ProceNum=2; DataLen=53; ImageBase=0x7ffc23300000; GuidSig=09f09e24-5676-0e17-9...; Age=1; PDBFileName=EventAggregation.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=836; TID=-1; PName=services; ProceNum=2; DataLen=180; ImageBase=0x7ffc23300000; ImageSize=98,304; ImageChecksum=114,278; TimeDateStamp=0; DefaultBase=0x7ffc23300000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=836; TID=-1; PName=services; ProceNum=2; DataLen=48; ImageBase=0x7ffc233c0000; ImageSize=192,512; ProcessID=0; TimeDateStamp=621,642,292; BuildTime=89/09/12 22:24:52.00...; OriginalFileName=sspicli.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=836; TID=-1; PName=services; ProceNum=2; DataLen=44; ImageBase=0x7ffc233c0000; GuidSig=823d5a41-e0d7-02a7-9...; Age=1; PDBFileName=sspicli.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=836; TID=-1; PName=services; ProceNum=2; DataLen=162; ImageBase=0x7ffc233c0000; ImageSize=192,512; ImageChecksum=235,306; TimeDateStamp=0; DefaultBase=0x7ffc233c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=836; TID=-1; PName=services; ProceNum=2; DataLen=62; ImageBase=0x7ffc23530000; ImageSize=69,632; ProcessID=0; TimeDateStamp=96,400,242; BuildTime=73/01/20 17:50:42.00...; OriginalFileName=kernel.appcore.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=836; TID=-1; PName=services; ProceNum=2; DataLen=51; ImageBase=0x7ffc23530000; GuidSig=b44a2a63-8a5c-a8d8-1...; Age=1; PDBFileName=Kernel.Appcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=836; TID=-1; PName=services; ProceNum=2; DataLen=176; ImageBase=0x7ffc23530000; ImageSize=69,632; ImageChecksum=91,565; TimeDateStamp=0; DefaultBase=0x7ffc23530000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=836; TID=-1; PName=services; ProceNum=2; DataLen=48; ImageBase=0x7ffc23550000; ImageSize=126,976; ProcessID=0; TimeDateStamp=-87,365,952; BuildTime=03/05/03 02:09:04.00...; OriginalFileName=PROFAPI.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=836; TID=-1; PName=services; ProceNum=2; DataLen=44; ImageBase=0x7ffc23550000; GuidSig=d3e9e0b2-6dc3-e775-b...; Age=1; PDBFileName=profapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=836; TID=-1; PName=services; ProceNum=2; DataLen=162; ImageBase=0x7ffc23550000; ImageSize=126,976; ImageChecksum=153,678; TimeDateStamp=0; DefaultBase=0x7ffc23550000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=836; TID=-1; PName=services; ProceNum=2; DataLen=50; ImageBase=0x7ffc235c0000; ImageSize=303,104; ProcessID=0; TimeDateStamp=-1,347,769,430; BuildTime=63/05/24 02:04:26.00...; OriginalFileName=CFGMGR32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=836; TID=-1; PName=services; ProceNum=2; DataLen=45; ImageBase=0x7ffc235c0000; GuidSig=c951ee8e-a9b3-8ebf-a...; Age=1; PDBFileName=cfgmgr32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=836; TID=-1; PName=services; ProceNum=2; DataLen=164; ImageBase=0x7ffc235c0000; ImageSize=303,104; ImageChecksum=322,106; TimeDateStamp=0; DefaultBase=0x7ffc235c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=836; TID=-1; PName=services; ProceNum=2; DataLen=50; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ProcessID=0; TimeDateStamp=1,555,946,369; BuildTime=19/04/22 15:19:29.00...; OriginalFileName=ucrtbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=836; TID=-1; PName=services; ProceNum=2; DataLen=45; ImageBase=0x7ffc23d90000; GuidSig=faceb612-020d-68fb-b...; Age=1; PDBFileName=ucrtbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=836; TID=-1; PName=services; ProceNum=2; DataLen=164; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ImageChecksum=1,052,117; TimeDateStamp=0; DefaultBase=0x7ffc23d90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=836; TID=-1; PName=services; ProceNum=2; DataLen=54; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ProcessID=0; TimeDateStamp=439,410,971; BuildTime=83/12/04 18:36:11.00...; OriginalFileName=Kernelbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=836; TID=-1; PName=services; ProceNum=2; DataLen=47; ImageBase=0x7ffc23ee0000; GuidSig=44c8ec9a-a0ea-4f98-d...; Age=1; PDBFileName=kernelbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=836; TID=-1; PName=services; ProceNum=2; DataLen=168; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ImageChecksum=2,793,344; TimeDateStamp=0; DefaultBase=0x7ffc23ee0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=836; TID=-1; PName=services; ProceNum=2; DataLen=66; ImageBase=0x7ffc24390000; ImageSize=528,384; ProcessID=0; TimeDateStamp=1,774,320,825; BuildTime=26/03/24 02:53:45.00...; OriginalFileName=bcryptprimitives.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=836; TID=-1; PName=services; ProceNum=2; DataLen=53; ImageBase=0x7ffc24390000; GuidSig=54a1b493-8222-f67e-4...; Age=1; PDBFileName=bcryptprimitives.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=836; TID=-1; PName=services; ProceNum=2; DataLen=180; ImageBase=0x7ffc24390000; ImageSize=528,384; ImageChecksum=562,796; TimeDateStamp=0; DefaultBase=0x7ffc24390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=836; TID=-1; PName=services; ProceNum=2; DataLen=48; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ProcessID=0; TimeDateStamp=1,691,891,946; BuildTime=23/08/13 01:59:06.00...; OriginalFileName=COMBASE.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=836; TID=-1; PName=services; ProceNum=2; DataLen=44; ImageBase=0x7ffc246c0000; GuidSig=d15b0ee4-2a16-5244-2...; Age=1; PDBFileName=combase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=836; TID=-1; PName=services; ProceNum=2; DataLen=162; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ImageChecksum=3,387,881; TimeDateStamp=0; DefaultBase=0x7ffc246c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=836; TID=-1; PName=services; ProceNum=2; DataLen=50; ImageBase=0x7ffc24b30000; ImageSize=667,648; ProcessID=0; TimeDateStamp=-1,762,261,787; BuildTime=50/04/04 17:18:29.00...; OriginalFileName=advapi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=836; TID=-1; PName=services; ProceNum=2; DataLen=45; ImageBase=0x7ffc24b30000; GuidSig=549260e6-7474-8391-e...; Age=1; PDBFileName=advapi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=836; TID=-1; PName=services; ProceNum=2; DataLen=164; ImageBase=0x7ffc24b30000; ImageSize=667,648; ImageChecksum=662,904; TimeDateStamp=0; DefaultBase=0x7ffc24b30000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=836; TID=-1; PName=services; ProceNum=2; DataLen=50; ImageBase=0x7ffc24be0000; ImageSize=729,088; ProcessID=0; TimeDateStamp=775,814,378; BuildTime=94/08/02 07:59:38.00...; OriginalFileName=kernel32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=836; TID=-1; PName=services; ProceNum=2; DataLen=45; ImageBase=0x7ffc24be0000; GuidSig=47a44f0c-c47f-b6a1-f...; Age=1; PDBFileName=kernel32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=836; TID=-1; PName=services; ProceNum=2; DataLen=164; ImageBase=0x7ffc24be0000; ImageSize=729,088; ImageChecksum=723,980; TimeDateStamp=0; DefaultBase=0x7ffc24be0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=836; TID=-1; PName=services; ProceNum=2; DataLen=46; ImageBase=0x7ffc24eb0000; ImageSize=454,656; ProcessID=0; TimeDateStamp=252,347,079; BuildTime=77/12/30 16:24:39.00...; OriginalFileName=ws2_32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=836; TID=-1; PName=services; ProceNum=2; DataLen=43; ImageBase=0x7ffc24eb0000; GuidSig=94268932-d2c5-c3db-4...; Age=1; PDBFileName=ws2_32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=836; TID=-1; PName=services; ProceNum=2; DataLen=160; ImageBase=0x7ffc24eb0000; ImageSize=454,656; ImageChecksum=456,525; TimeDateStamp=0; DefaultBase=0x7ffc24eb0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=836; TID=-1; PName=services; ProceNum=2; DataLen=46; ImageBase=0x7ffc25390000; ImageSize=647,168; ProcessID=0; TimeDateStamp=-172,101,673; BuildTime=00/08/25 08:27:03.00...; OriginalFileName=msvcrt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=836; TID=-1; PName=services; ProceNum=2; DataLen=43; ImageBase=0x7ffc25390000; GuidSig=1fea8db6-b57f-5fbf-a...; Age=1; PDBFileName=msvcrt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=836; TID=-1; PName=services; ProceNum=2; DataLen=160; ImageBase=0x7ffc25390000; ImageSize=647,168; ImageChecksum=678,174; TimeDateStamp=0; DefaultBase=0x7ffc25390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=836; TID=-1; PName=services; ProceNum=2; DataLen=48; ImageBase=0x7ffc25590000; ImageSize=618,496; ProcessID=0; TimeDateStamp=-136,044,297; BuildTime=01/10/16 16:23:19.00...; OriginalFileName=sechost.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=836; TID=-1; PName=services; ProceNum=2; DataLen=44; ImageBase=0x7ffc25590000; GuidSig=0f733965-b12f-7923-b...; Age=1; PDBFileName=sechost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=836; TID=-1; PName=services; ProceNum=2; DataLen=162; ImageBase=0x7ffc25590000; ImageSize=618,496; ImageChecksum=662,974; TimeDateStamp=0; DefaultBase=0x7ffc25590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=836; TID=-1; PName=services; ProceNum=2; DataLen=46; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ProcessID=0; TimeDateStamp=87,082,528; BuildTime=72/10/04 21:35:28.00...; OriginalFileName=rpcrt4.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=836; TID=-1; PName=services; ProceNum=2; DataLen=43; ImageBase=0x7ffc25f70000; GuidSig=a3028d6b-45da-0062-4...; Age=1; PDBFileName=rpcrt4.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=836; TID=-1; PName=services; ProceNum=2; DataLen=160; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ImageChecksum=1,199,090; TimeDateStamp=0; DefaultBase=0x7ffc25f70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=836; TID=-1; PName=services; ProceNum=2; DataLen=44; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ProcessID=0; TimeDateStamp=-1,523,876,758; BuildTime=57/10/23 19:22:18.00...; OriginalFileName=ntdll.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=836; TID=-1; PName=services; ProceNum=2; DataLen=42; ImageBase=0x7ffc26600000; GuidSig=b54f3499-813e-bcf1-3...; Age=1; PDBFileName=ntdll.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=836; TID=-1; PName=services; ProceNum=2; DataLen=158; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ImageChecksum=2,058,600; TimeDateStamp=0; DefaultBase=0x7ffc26600000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: Windows Kernel/Process/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=138; ProcessID=876; ParentID=764; ImageFileName=lsass.exe; PageDirectoryBase=0x1000403000; Flags=None; SessionID=0; ExitStatus=259; UniqueProcessKey=0xffffc50f60d391c0; CommandLine=C:\Windows\system32\...; PackageFullName=; ApplicationID=; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=46; ImageBase=0x1d9fb050000; ImageSize=12,288; ProcessID=0; TimeDateStamp=-1,695,660,304; BuildTime=52/05/14 13:43:12.00...; OriginalFileName=mspriv.dll; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=162; ImageBase=0x1d9fb050000; ImageSize=12,288; ImageChecksum=31,909; TimeDateStamp=0; DefaultBase=0x180000000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=44; ImageBase=0x7ff77d1f0000; ImageSize=69,632; ProcessID=0; TimeDateStamp=-709,952,909; BuildTime=83/08/09 05:19:47.00...; OriginalFileName=lsass.exe; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=42; ImageBase=0x7ff77d1f0000; GuidSig=fe087ae8-c12e-f68a-9...; Age=1; PDBFileName=lsass.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=158; ImageBase=0x7ff77d1f0000; ImageSize=69,632; ImageChecksum=105,759; TimeDateStamp=0; DefaultBase=0x7ff77d1f0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=54; ImageBase=0x7ffbe7a30000; ImageSize=139,264; ProcessID=0; TimeDateStamp=-2,140,238,884; BuildTime=38/04/12 23:40:12.00...; OriginalFileName=CertPolEng.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=47; ImageBase=0x7ffbe7a30000; GuidSig=d31511f0-77ab-2bad-0...; Age=1; PDBFileName=CertPolEng.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=168; ImageBase=0x7ffbe7a30000; ImageSize=139,264; ImageChecksum=182,193; TimeDateStamp=0; DefaultBase=0x7ffbe7a30000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=50; ImageBase=0x7ffbfa990000; ImageSize=385,024; ProcessID=0; TimeDateStamp=1,695,705,445; BuildTime=23/09/26 05:17:25.00...; OriginalFileName=vaultsvc.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=45; ImageBase=0x7ffbfa990000; GuidSig=45c7a84b-9252-91bd-e...; Age=1; PDBFileName=vaultsvc.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=164; ImageBase=0x7ffbfa990000; ImageSize=385,024; ImageChecksum=422,074; TimeDateStamp=0; DefaultBase=0x7ffbfa990000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=50; ImageBase=0x7ffc03860000; ImageSize=499,712; ProcessID=0; TimeDateStamp=1,661,540,749; BuildTime=22/08/26 19:05:49.00...; OriginalFileName=cryptngc.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=45; ImageBase=0x7ffc03860000; GuidSig=f6a3c1a3-9116-be18-7...; Age=1; PDBFileName=cryptngc.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=164; ImageBase=0x7ffc03860000; ImageSize=499,712; ImageChecksum=527,719; TimeDateStamp=0; DefaultBase=0x7ffc03860000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=46; ImageBase=0x7ffc09220000; ImageSize=978,944; ProcessID=0; TimeDateStamp=2,036,285,388; BuildTime=34/07/12 02:49:48.00...; OriginalFileName=PCPKsp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=43; ImageBase=0x7ffc09220000; GuidSig=b3df16af-09d6-c0a8-3...; Age=1; PDBFileName=PCPKsp.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=160; ImageBase=0x7ffc09220000; ImageSize=978,944; ImageChecksum=1,001,353; TimeDateStamp=0; DefaultBase=0x7ffc09220000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=50; ImageBase=0x7ffc0bd00000; ImageSize=192,512; ProcessID=0; TimeDateStamp=-1,285,618,788; BuildTime=65/05/12 10:08:28.00...; OriginalFileName=CRYPTNET.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=45; ImageBase=0x7ffc0bd00000; GuidSig=f33ec695-d00b-0f47-8...; Age=1; PDBFileName=cryptnet.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=164; ImageBase=0x7ffc0bd00000; ImageSize=192,512; ImageChecksum=176,280; TimeDateStamp=0; DefaultBase=0x7ffc0bd00000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=48; ImageBase=0x7ffc19910000; ImageSize=49,152; ProcessID=0; TimeDateStamp=1,355,887,353; BuildTime=12/12/19 03:22:33.00...; OriginalFileName=dsparse.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=44; ImageBase=0x7ffc19910000; GuidSig=0f54269b-523c-a253-3...; Age=1; PDBFileName=dsparse.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=162; ImageBase=0x7ffc19910000; ImageSize=49,152; ImageChecksum=47,894; TimeDateStamp=0; DefaultBase=0x7ffc19910000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=50; ImageBase=0x7ffc1a1f0000; ImageSize=114,688; ProcessID=0; TimeDateStamp=1,793,862,508; BuildTime=26/11/05 07:08:28.00...; OriginalFileName=dhcpcsvc.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=45; ImageBase=0x7ffc1a1f0000; GuidSig=de3c2223-bf00-e267-1...; Age=1; PDBFileName=dhcpcsvc.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=164; ImageBase=0x7ffc1a1f0000; ImageSize=114,688; ImageChecksum=107,768; TimeDateStamp=0; DefaultBase=0x7ffc1a1f0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=52; ImageBase=0x7ffc1a210000; ImageSize=90,112; ProcessID=0; TimeDateStamp=494,039,709; BuildTime=85/08/28 01:15:09.00...; OriginalFileName=dhcpcsvc6.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=46; ImageBase=0x7ffc1a210000; GuidSig=841082fb-8eb9-70ce-2...; Age=1; PDBFileName=dhcpcsvc6.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=166; ImageBase=0x7ffc1a210000; ImageSize=90,112; ImageChecksum=109,812; TimeDateStamp=0; DefaultBase=0x7ffc1a210000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=40; ImageBase=0x7ffc1a4b0000; ImageSize=57,344; ProcessID=0; TimeDateStamp=327,414,202; BuildTime=80/05/17 12:23:22.00...; OriginalFileName=TBS.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=40; ImageBase=0x7ffc1a4b0000; GuidSig=43326428-8f37-7872-0...; Age=1; PDBFileName=tbs.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=154; ImageBase=0x7ffc1a4b0000; ImageSize=57,344; ImageChecksum=95,784; TimeDateStamp=0; DefaultBase=0x7ffc1a4b0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=48; ImageBase=0x7ffc1b790000; ImageSize=389,120; ProcessID=0; TimeDateStamp=2,036,898,759; BuildTime=34/07/19 05:12:39.00...; OriginalFileName=wevtapi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=44; ImageBase=0x7ffc1b790000; GuidSig=fe24c9ce-9500-e622-0...; Age=1; PDBFileName=wevtapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=162; ImageBase=0x7ffc1b790000; ImageSize=389,120; ImageChecksum=404,506; TimeDateStamp=0; DefaultBase=0x7ffc1b790000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=46; ImageBase=0x7ffc1b990000; ImageSize=106,496; ProcessID=0; TimeDateStamp=1,885,732,100; BuildTime=29/10/03 14:28:20.00...; OriginalFileName=keyiso.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=43; ImageBase=0x7ffc1b990000; GuidSig=9dbf529d-fc12-57ba-7...; Age=1; PDBFileName=keyiso.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=160; ImageBase=0x7ffc1b990000; ImageSize=106,496; ImageChecksum=136,772; TimeDateStamp=0; DefaultBase=0x7ffc1b990000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=58; ImageBase=0x7ffc1ce10000; ImageSize=303,104; ProcessID=0; TimeDateStamp=-1,939,050,916; BuildTime=44/08/27 13:13:00.00...; OriginalFileName=ngcpopkeysrv.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=49; ImageBase=0x7ffc1ce10000; GuidSig=7e1437a2-8ecf-fd04-a...; Age=1; PDBFileName=ngcpopkeysrv.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=172; ImageBase=0x7ffc1ce10000; ImageSize=303,104; ImageChecksum=293,353; TimeDateStamp=0; DefaultBase=0x7ffc1ce10000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=50; ImageBase=0x7ffc1d260000; ImageSize=270,336; ProcessID=0; TimeDateStamp=-397,220,398; BuildTime=93/07/06 19:28:18.00...; OriginalFileName=LOGONCLI.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=45; ImageBase=0x7ffc1d260000; GuidSig=a44b87ca-253c-1d9b-f...; Age=1; PDBFileName=logoncli.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=164; ImageBase=0x7ffc1d260000; ImageSize=270,336; ImageChecksum=297,692; TimeDateStamp=0; DefaultBase=0x7ffc1d260000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=46; ImageBase=0x7ffc1e9f0000; ImageSize=40,960; ProcessID=0; TimeDateStamp=-1,834,992,718; BuildTime=47/12/14 22:16:18.00...; OriginalFileName=DSROLE.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=43; ImageBase=0x7ffc1e9f0000; GuidSig=04f0c896-ea30-0933-2...; Age=1; PDBFileName=dsrole.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=160; ImageBase=0x7ffc1e9f0000; ImageSize=40,960; ImageChecksum=66,801; TimeDateStamp=0; DefaultBase=0x7ffc1e9f0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=48; ImageBase=0x7ffc21270000; ImageSize=49,152; ProcessID=0; TimeDateStamp=1,908,117,114; BuildTime=30/06/19 16:31:54.00...; OriginalFileName=secur32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=44; ImageBase=0x7ffc21270000; GuidSig=4a3a7640-7d4e-89ff-5...; Age=1; PDBFileName=secur32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=162; ImageBase=0x7ffc21270000; ImageSize=49,152; ImageChecksum=55,688; TimeDateStamp=0; DefaultBase=0x7ffc21270000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=74; ImageBase=0x7ffc21470000; ImageSize=139,264; ProcessID=0; TimeDateStamp=-359,363,371; BuildTime=94/09/17 23:18:45.00...; OriginalFileName=SecureTimeAggregator...; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=57; ImageBase=0x7ffc21470000; GuidSig=2b080d6c-c37d-85e3-1...; Age=1; PDBFileName=SecureTimeAggregator...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=188; ImageBase=0x7ffc21470000; ImageSize=139,264; ImageChecksum=108,529; TimeDateStamp=0; DefaultBase=0x7ffc21470000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=58; ImageBase=0x7ffc214c0000; ImageSize=86,016; ProcessID=0; TimeDateStamp=1,872,893,629; BuildTime=29/05/08 00:13:49.00...; OriginalFileName=mskeyprotect.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=49; ImageBase=0x7ffc214c0000; GuidSig=4bae97e8-7589-2fd4-b...; Age=1; PDBFileName=mskeyprotect.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=172; ImageBase=0x7ffc214c0000; ImageSize=86,016; ImageChecksum=83,374; TimeDateStamp=0; DefaultBase=0x7ffc214c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=46; ImageBase=0x7ffc214e0000; ImageSize=159,744; ProcessID=0; TimeDateStamp=1,812,037,391; BuildTime=27/06/03 15:43:11.00...; OriginalFileName=dssenh.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=43; ImageBase=0x7ffc214e0000; GuidSig=154e44c0-6d23-4920-6...; Age=1; PDBFileName=dssenh.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=160; ImageBase=0x7ffc214e0000; ImageSize=159,744; ImageChecksum=211,619; TimeDateStamp=0; DefaultBase=0x7ffc214e0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=54; ImageBase=0x7ffc21510000; ImageSize=364,544; ProcessID=0; TimeDateStamp=-2,063,697,751; BuildTime=40/09/14 21:05:45.00...; OriginalFileName=ncryptprov.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=47; ImageBase=0x7ffc21510000; GuidSig=7483e3a7-5201-aaa0-c...; Age=1; PDBFileName=ncryptprov.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=168; ImageBase=0x7ffc21510000; ImageSize=364,544; ImageChecksum=380,273; TimeDateStamp=0; DefaultBase=0x7ffc21510000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=54; ImageBase=0x7ffc21570000; ImageSize=151,552; ProcessID=0; TimeDateStamp=226,275,606; BuildTime=77/03/03 22:20:06.00...; OriginalFileName=ncryptsslp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=47; ImageBase=0x7ffc21570000; GuidSig=3a6ec407-7dca-5b85-0...; Age=1; PDBFileName=ncryptsslp.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=168; ImageBase=0x7ffc21570000; ImageSize=151,552; ImageChecksum=198,289; TimeDateStamp=0; DefaultBase=0x7ffc21570000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=44; ImageBase=0x7ffc21ad0000; ImageSize=139,264; ProcessID=0; TimeDateStamp=-1,174,313,774; BuildTime=68/11/20 16:12:02.00...; OriginalFileName=gpapi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=42; ImageBase=0x7ffc21ad0000; GuidSig=75a8e246-9e74-629f-3...; Age=1; PDBFileName=gpapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=158; ImageBase=0x7ffc21ad0000; ImageSize=139,264; ImageChecksum=174,936; TimeDateStamp=0; DefaultBase=0x7ffc21ad0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=46; ImageBase=0x7ffc21f70000; ImageSize=376,832; ProcessID=0; TimeDateStamp=43,988,838; BuildTime=71/05/25 03:07:18.00...; OriginalFileName=winsta.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=43; ImageBase=0x7ffc21f70000; GuidSig=b854bf05-e0a2-5b01-7...; Age=1; PDBFileName=winsta.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=160; ImageBase=0x7ffc21f70000; ImageSize=376,832; ImageChecksum=387,708; TimeDateStamp=0; DefaultBase=0x7ffc21f70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=44; ImageBase=0x7ffc22000000; ImageSize=303,104; ProcessID=0; TimeDateStamp=-1,775,967,220; BuildTime=49/10/28 02:14:36.00...; OriginalFileName=authz.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=42; ImageBase=0x7ffc22000000; GuidSig=f7ab524f-49bc-eb09-0...; Age=1; PDBFileName=authz.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=158; ImageBase=0x7ffc22000000; ImageSize=303,104; ImageChecksum=299,134; TimeDateStamp=0; DefaultBase=0x7ffc22000000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=46; ImageBase=0x7ffc22050000; ImageSize=299,008; ProcessID=0; TimeDateStamp=-2,089,948,232; BuildTime=39/11/16 01:17:44.00...; OriginalFileName=scecli.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=43; ImageBase=0x7ffc22050000; GuidSig=f94ca245-666e-3ceb-5...; Age=1; PDBFileName=scecli.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=160; ImageBase=0x7ffc22050000; ImageSize=299,008; ImageChecksum=324,460; TimeDateStamp=0; DefaultBase=0x7ffc22050000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=44; ImageBase=0x7ffc220a0000; ImageSize=49,152; ProcessID=0; TimeDateStamp=-952,497,793; BuildTime=75/12/01 23:45:03.00...; OriginalFileName=kdcpw.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=42; ImageBase=0x7ffc220a0000; GuidSig=55380f71-1628-c4ad-5...; Age=1; PDBFileName=kdcpw.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=158; ImageBase=0x7ffc220a0000; ImageSize=49,152; ImageChecksum=81,151; TimeDateStamp=0; DefaultBase=0x7ffc220a0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=48; ImageBase=0x7ffc22140000; ImageSize=49,152; ProcessID=0; TimeDateStamp=-947,340,238; BuildTime=76/01/30 16:24:18.00...; OriginalFileName=SspiSrv.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=44; ImageBase=0x7ffc22140000; GuidSig=3714240b-0ed3-6bcc-8...; Age=1; PDBFileName=sspisrv.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=162; ImageBase=0x7ffc22140000; ImageSize=49,152; ImageChecksum=84,094; TimeDateStamp=0; DefaultBase=0x7ffc22140000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=50; ImageBase=0x7ffc22150000; ImageSize=225,280; ProcessID=0; TimeDateStamp=-1,543,946,610; BuildTime=57/03/05 12:24:46.00...; OriginalFileName=dpapisrv.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=45; ImageBase=0x7ffc22150000; GuidSig=8d027119-f89a-a226-1...; Age=1; PDBFileName=dpapisrv.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=164; ImageBase=0x7ffc22150000; ImageSize=225,280; ImageChecksum=230,356; TimeDateStamp=0; DefaultBase=0x7ffc22150000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=52; ImageBase=0x7ffc22190000; ImageSize=106,496; ProcessID=0; TimeDateStamp=-1,032,795,497; BuildTime=73/05/16 14:49:59.00...; OriginalFileName=EFSLSAEXT.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=46; ImageBase=0x7ffc22190000; GuidSig=019001d9-066e-8ca5-b...; Age=1; PDBFileName=efslsaext.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=166; ImageBase=0x7ffc22190000; ImageSize=106,496; ImageChecksum=117,538; TimeDateStamp=0; DefaultBase=0x7ffc22190000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=50; ImageBase=0x7ffc221b0000; ImageSize=561,152; ProcessID=0; TimeDateStamp=78,261,937; BuildTime=72/06/24 19:25:37.00...; OriginalFileName=schannel.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=45; ImageBase=0x7ffc221b0000; GuidSig=6bdcdeba-3b92-d2d9-1...; Age=1; PDBFileName=schannel.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=164; ImageBase=0x7ffc221b0000; ImageSize=561,152; ImageChecksum=599,838; TimeDateStamp=0; DefaultBase=0x7ffc221b0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=48; ImageBase=0x7ffc22240000; ImageSize=241,664; ProcessID=0; TimeDateStamp=-384,487,792; BuildTime=93/12/01 04:18:24.00...; OriginalFileName=WDIGEST.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=44; ImageBase=0x7ffc22240000; GuidSig=95f99907-b915-6f9b-5...; Age=1; PDBFileName=wdigest.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=162; ImageBase=0x7ffc22240000; ImageSize=241,664; ImageChecksum=253,643; TimeDateStamp=0; DefaultBase=0x7ffc22240000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=46; ImageBase=0x7ffc22280000; ImageSize=208,896; ProcessID=0; TimeDateStamp=-96,717,502; BuildTime=03/01/14 20:29:54.00...; OriginalFileName=rsaenh.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=43; ImageBase=0x7ffc22280000; GuidSig=97af5588-54c0-a219-f...; Age=1; PDBFileName=rsaenh.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=160; ImageBase=0x7ffc22280000; ImageSize=208,896; ImageChecksum=251,829; TimeDateStamp=0; DefaultBase=0x7ffc22280000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=44; ImageBase=0x7ffc222c0000; ImageSize=40,960; ProcessID=0; TimeDateStamp=-929,607,282; BuildTime=76/08/22 22:13:34.00...; OriginalFileName=dpapi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=42; ImageBase=0x7ffc222c0000; GuidSig=6f32740c-1701-84ad-b...; Age=1; PDBFileName=dpapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=158; ImageBase=0x7ffc222c0000; ImageSize=40,960; ImageChecksum=43,532; TimeDateStamp=0; DefaultBase=0x7ffc222c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=80; ImageBase=0x7ffc222d0000; ImageSize=294,912; ProcessID=0; TimeDateStamp=-920,174,122; BuildTime=76/12/10 02:32:54.00...; OriginalFileName=MicrosoftAccountClou...; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=60; ImageBase=0x7ffc222d0000; GuidSig=b9967363-d1de-17c9-5...; Age=1; PDBFileName=MicrosoftAccountClou...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=194; ImageBase=0x7ffc222d0000; ImageSize=294,912; ImageChecksum=317,391; TimeDateStamp=0; DefaultBase=0x7ffc222d0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=48; ImageBase=0x7ffc22320000; ImageSize=487,424; ProcessID=0; TimeDateStamp=-1,609,234,099; BuildTime=55/02/08 20:59:57.00...; OriginalFileName=cloudAP.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=44; ImageBase=0x7ffc22320000; GuidSig=7226ad52-cee5-0931-0...; Age=1; PDBFileName=cloudAP.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=162; ImageBase=0x7ffc22320000; ImageSize=487,424; ImageChecksum=507,670; TimeDateStamp=0; DefaultBase=0x7ffc22320000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=44; ImageBase=0x7ffc223a0000; ImageSize=278,528; ProcessID=0; TimeDateStamp=632,410,073; BuildTime=90/01/15 13:27:53.00...; OriginalFileName=pku2u.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=42; ImageBase=0x7ffc223a0000; GuidSig=cd869e3a-e11b-47fe-4...; Age=1; PDBFileName=pku2u.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=158; ImageBase=0x7ffc223a0000; ImageSize=278,528; ImageChecksum=287,908; TimeDateStamp=0; DefaultBase=0x7ffc223a0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=44; ImageBase=0x7ffc223f0000; ImageSize=172,032; ProcessID=0; TimeDateStamp=-303,628,398; BuildTime=96/06/24 01:14:58.00...; OriginalFileName=TSpkg.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=42; ImageBase=0x7ffc223f0000; GuidSig=1bbadf56-c87c-521d-0...; Age=1; PDBFileName=TSpkg.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=158; ImageBase=0x7ffc223f0000; ImageSize=172,032; ImageChecksum=205,183; TimeDateStamp=0; DefaultBase=0x7ffc223f0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=50; ImageBase=0x7ffc22420000; ImageSize=237,568; ProcessID=0; TimeDateStamp=1,353,705,264; BuildTime=12/11/23 21:14:24.00...; OriginalFileName=iphlpapi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=45; ImageBase=0x7ffc22420000; GuidSig=a3177875-244a-46c8-b...; Age=1; PDBFileName=iphlpapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=164; ImageBase=0x7ffc22420000; ImageSize=237,568; ImageChecksum=252,735; TimeDateStamp=0; DefaultBase=0x7ffc22420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=46; ImageBase=0x7ffc22460000; ImageSize=827,392; ProcessID=0; TimeDateStamp=-1,912,355,972; BuildTime=45/07/02 12:28:44.00...; OriginalFileName=dnsapi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=43; ImageBase=0x7ffc22460000; GuidSig=77e3a024-129c-5dab-b...; Age=1; PDBFileName=dnsapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=160; ImageBase=0x7ffc22460000; ImageSize=827,392; ImageChecksum=850,901; TimeDateStamp=0; DefaultBase=0x7ffc22460000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=50; ImageBase=0x7ffc22530000; ImageSize=49,152; ProcessID=0; TimeDateStamp=2,074,299,887; BuildTime=35/09/25 02:24:47.00...; OriginalFileName=NETUTILS.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=45; ImageBase=0x7ffc22530000; GuidSig=5c5ce532-d78d-35ad-c...; Age=1; PDBFileName=netutils.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=164; ImageBase=0x7ffc22530000; ImageSize=49,152; ImageChecksum=85,437; TimeDateStamp=0; DefaultBase=0x7ffc22530000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=66; ImageBase=0x7ffc22540000; ImageSize=57,344; ProcessID=0; TimeDateStamp=-1,783,362,743; BuildTime=49/08/03 11:55:53.00...; OriginalFileName="gmsaclient.DYNLINK"; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=47; ImageBase=0x7ffc22540000; GuidSig=ba3030e2-1bcb-444c-2...; Age=1; PDBFileName=gmsaclient.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=168; ImageBase=0x7ffc22540000; ImageSize=57,344; ImageChecksum=85,978; TimeDateStamp=0; DefaultBase=0x7ffc22540000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=50; ImageBase=0x7ffc22550000; ImageSize=888,832; ProcessID=0; TimeDateStamp=-1,404,060,583; BuildTime=61/08/10 13:38:33.00...; OriginalFileName=NetLogon.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=45; ImageBase=0x7ffc22550000; GuidSig=02fd819c-55a8-8ee6-7...; Age=1; PDBFileName=netlogon.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=164; ImageBase=0x7ffc22550000; ImageSize=888,832; ImageChecksum=865,501; TimeDateStamp=0; DefaultBase=0x7ffc22550000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=54; ImageBase=0x7ffc22630000; ImageSize=53,248; ProcessID=0; TimeDateStamp=-1,481,996,771; BuildTime=59/02/20 12:42:05.00...; OriginalFileName=NtlmShared.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=47; ImageBase=0x7ffc22630000; GuidSig=6b0ef484-881c-773a-b...; Age=1; PDBFileName=NtlmShared.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=168; ImageBase=0x7ffc22630000; ImageSize=53,248; ImageChecksum=68,032; TimeDateStamp=0; DefaultBase=0x7ffc22630000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=46; ImageBase=0x7ffc22640000; ImageSize=487,424; ProcessID=0; TimeDateStamp=-1,940,114,644; BuildTime=44/08/15 05:44:12.00...; OriginalFileName=MSV1_0.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=43; ImageBase=0x7ffc22640000; GuidSig=b1bdce7a-f083-1cac-f...; Age=1; PDBFileName=msv1_0.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=160; ImageBase=0x7ffc22640000; ImageSize=487,424; ImageChecksum=528,525; TimeDateStamp=0; DefaultBase=0x7ffc22640000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=48; ImageBase=0x7ffc226c0000; ImageSize=421,888; ProcessID=0; TimeDateStamp=414,127,772; BuildTime=83/02/15 03:29:32.00...; OriginalFileName=mswsock.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=44; ImageBase=0x7ffc226c0000; GuidSig=96babb0d-8e64-884b-6...; Age=1; PDBFileName=mswsock.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=162; ImageBase=0x7ffc226c0000; ImageSize=421,888; ImageChecksum=420,926; TimeDateStamp=0; DefaultBase=0x7ffc226c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=50; ImageBase=0x7ffc22730000; ImageSize=86,016; ProcessID=0; TimeDateStamp=-975,283,468; BuildTime=75/03/13 06:23:48.00...; OriginalFileName=cryptdll.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=45; ImageBase=0x7ffc22730000; GuidSig=b09167fe-56a9-ede0-2...; Age=1; PDBFileName=cryptdll.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=164; ImageBase=0x7ffc22730000; ImageSize=86,016; ImageChecksum=71,894; TimeDateStamp=0; DefaultBase=0x7ffc22730000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=66; ImageBase=0x7ffc22750000; ImageSize=163,840; ProcessID=0; TimeDateStamp=-5,977,886; BuildTime=05/11/30 01:56:50.00...; OriginalFileName=KerbClientSHared.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=53; ImageBase=0x7ffc22750000; GuidSig=5d534e9c-66f2-c30b-3...; Age=1; PDBFileName=KerbClientShared.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=180; ImageBase=0x7ffc22750000; ImageSize=163,840; ImageChecksum=163,228; TimeDateStamp=0; DefaultBase=0x7ffc22750000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=50; ImageBase=0x7ffc22780000; ImageSize=1,060,864; ProcessID=0; TimeDateStamp=1,229,898,460; BuildTime=08/12/21 22:27:40.00...; OriginalFileName=kerberos.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=45; ImageBase=0x7ffc22780000; GuidSig=44e9ae52-c921-bf00-5...; Age=1; PDBFileName=KERBEROS.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=164; ImageBase=0x7ffc22780000; ImageSize=1,060,864; ImageChecksum=1,042,521; TimeDateStamp=0; DefaultBase=0x7ffc22780000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=52; ImageBase=0x7ffc22890000; ImageSize=49,152; ProcessID=0; TimeDateStamp=-17,821,274; BuildTime=05/07/16 00:07:02.00...; OriginalFileName=cryptbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=46; ImageBase=0x7ffc22890000; GuidSig=7588b6a3-bd73-2904-7...; Age=1; PDBFileName=cryptbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=166; ImageBase=0x7ffc22890000; ImageSize=49,152; ImageChecksum=64,645; TimeDateStamp=0; DefaultBase=0x7ffc22890000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=50; ImageBase=0x7ffc228a0000; ImageSize=151,552; ProcessID=0; TimeDateStamp=-694,377,239; BuildTime=84/02/05 11:54:17.00...; OriginalFileName=negoexts.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=45; ImageBase=0x7ffc228a0000; GuidSig=6a559102-f22d-ec42-f...; Age=1; PDBFileName=negoexts.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=164; ImageBase=0x7ffc228a0000; ImageSize=151,552; ImageChecksum=124,086; TimeDateStamp=0; DefaultBase=0x7ffc228a0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=50; ImageBase=0x7ffc228d0000; ImageSize=172,032; ProcessID=0; TimeDateStamp=1,912,110,850; BuildTime=30/08/04 21:54:10.00...; OriginalFileName=JOINUTIL.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=45; ImageBase=0x7ffc228d0000; GuidSig=17b706f9-2002-cb30-2...; Age=1; PDBFileName=joinutil.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=164; ImageBase=0x7ffc228d0000; ImageSize=172,032; ImageChecksum=168,713; TimeDateStamp=0; DefaultBase=0x7ffc228d0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=52; ImageBase=0x7ffc22900000; ImageSize=86,016; ProcessID=0; TimeDateStamp=-38,287,444; BuildTime=04/11/21 03:04:12.00...; OriginalFileName=NETPROVFW.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=46; ImageBase=0x7ffc22900000; GuidSig=ea08afa4-ff4b-ad5f-9...; Age=1; PDBFileName=netprovfw.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=166; ImageBase=0x7ffc22900000; ImageSize=86,016; ImageChecksum=113,005; TimeDateStamp=0; DefaultBase=0x7ffc22900000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=46; ImageBase=0x7ffc22920000; ImageSize=94,208; ProcessID=0; TimeDateStamp=327,216,314; BuildTime=80/05/15 05:25:14.00...; OriginalFileName=WKSCLI.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=43; ImageBase=0x7ffc22920000; GuidSig=7ea191fe-cb13-d326-8...; Age=1; PDBFileName=wkscli.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=160; ImageBase=0x7ffc22920000; ImageSize=94,208; ImageChecksum=120,976; TimeDateStamp=0; DefaultBase=0x7ffc22920000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=42; ImageBase=0x7ffc22940000; ImageSize=167,936; ProcessID=0; TimeDateStamp=1,085,565,188; BuildTime=04/05/26 09:53:08.00...; OriginalFileName=wldp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=41; ImageBase=0x7ffc22940000; GuidSig=3d0180e1-0317-7a96-e...; Age=1; PDBFileName=WLDP.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=156; ImageBase=0x7ffc22940000; ImageSize=167,936; ImageChecksum=190,611; TimeDateStamp=0; DefaultBase=0x7ffc22940000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=46; ImageBase=0x7ffc22970000; ImageSize=241,664; ProcessID=0; TimeDateStamp=-232,261,050; BuildTime=98/09/28 01:30:46.00...; OriginalFileName=ntasn1.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=43; ImageBase=0x7ffc22970000; GuidSig=6b406a9e-4f8b-5ac5-c...; Age=1; PDBFileName=ntasn1.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=160; ImageBase=0x7ffc22970000; ImageSize=241,664; ImageChecksum=243,110; TimeDateStamp=0; DefaultBase=0x7ffc22970000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=46; ImageBase=0x7ffc22c40000; ImageSize=155,648; ProcessID=0; TimeDateStamp=800,597,648; BuildTime=95/05/16 04:14:08.00...; OriginalFileName=ncrypt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=43; ImageBase=0x7ffc22c40000; GuidSig=d2e25da6-8b7d-b60f-0...; Age=1; PDBFileName=ncrypt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=160; ImageBase=0x7ffc22c40000; ImageSize=155,648; ImageChecksum=154,749; TimeDateStamp=0; DefaultBase=0x7ffc22c40000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=46; ImageBase=0x7ffc22c70000; ImageSize=958,464; ProcessID=0; TimeDateStamp=-553,804,926; BuildTime=88/07/20 11:46:10.00...; OriginalFileName=samsrv.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=43; ImageBase=0x7ffc22c70000; GuidSig=9ee87748-9c32-9907-9...; Age=1; PDBFileName=samsrv.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=160; ImageBase=0x7ffc22c70000; ImageSize=958,464; ImageChecksum=980,699; TimeDateStamp=0; DefaultBase=0x7ffc22c70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=48; ImageBase=0x7ffc22e10000; ImageSize=200,704; ProcessID=0; TimeDateStamp=-648,125,799; BuildTime=85/07/24 19:31:37.00...; OriginalFileName=ntmarta.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=44; ImageBase=0x7ffc22e10000; GuidSig=d28b6be6-17ca-2646-7...; Age=1; PDBFileName=ntmarta.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=162; ImageBase=0x7ffc22e10000; ImageSize=200,704; ImageChecksum=211,194; TimeDateStamp=0; DefaultBase=0x7ffc22e10000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=46; ImageBase=0x7ffc22e50000; ImageSize=1,703,936; ProcessID=0; TimeDateStamp=-1,694,444,608; BuildTime=52/05/28 15:24:48.00...; OriginalFileName=lsasrv.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=43; ImageBase=0x7ffc22e50000; GuidSig=24e8fe30-36ab-b881-4...; Age=1; PDBFileName=lsasrv.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=160; ImageBase=0x7ffc22e50000; ImageSize=1,703,936; ImageChecksum=1,694,325; TimeDateStamp=0; DefaultBase=0x7ffc22e50000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=48; ImageBase=0x7ffc233c0000; ImageSize=192,512; ProcessID=0; TimeDateStamp=621,642,292; BuildTime=89/09/12 22:24:52.00...; OriginalFileName=sspicli.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=44; ImageBase=0x7ffc233c0000; GuidSig=823d5a41-e0d7-02a7-9...; Age=1; PDBFileName=sspicli.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=162; ImageBase=0x7ffc233c0000; ImageSize=192,512; ImageChecksum=235,306; TimeDateStamp=0; DefaultBase=0x7ffc233c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=48; ImageBase=0x7ffc233f0000; ImageSize=151,552; ProcessID=0; TimeDateStamp=-157,143,252; BuildTime=01/02/14 11:34:04.00...; OriginalFileName=userenv.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=44; ImageBase=0x7ffc233f0000; GuidSig=1a734def-8e54-a706-f...; Age=1; PDBFileName=userenv.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=162; ImageBase=0x7ffc233f0000; ImageSize=151,552; ImageChecksum=176,304; TimeDateStamp=0; DefaultBase=0x7ffc233f0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=44; ImageBase=0x7ffc234d0000; ImageSize=65,536; ProcessID=0; TimeDateStamp=-1,563,634,669; BuildTime=56/07/20 15:30:27.00...; OriginalFileName=umpdc.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=42; ImageBase=0x7ffc234d0000; GuidSig=1504cc55-3edb-4294-a...; Age=1; PDBFileName=UMPDC.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=158; ImageBase=0x7ffc234d0000; ImageSize=65,536; ImageChecksum=55,709; TimeDateStamp=0; DefaultBase=0x7ffc234d0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=50; ImageBase=0x7ffc234e0000; ImageSize=303,104; ProcessID=0; TimeDateStamp=-37,463,926; BuildTime=04/11/30 15:49:30.00...; OriginalFileName=POWRPROF.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=45; ImageBase=0x7ffc234e0000; GuidSig=bae22f43-6c95-a7d5-0...; Age=1; PDBFileName=powrprof.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=164; ImageBase=0x7ffc234e0000; ImageSize=303,104; ImageChecksum=321,827; TimeDateStamp=0; DefaultBase=0x7ffc234e0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=62; ImageBase=0x7ffc23530000; ImageSize=69,632; ProcessID=0; TimeDateStamp=96,400,242; BuildTime=73/01/20 17:50:42.00...; OriginalFileName=kernel.appcore.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=51; ImageBase=0x7ffc23530000; GuidSig=b44a2a63-8a5c-a8d8-1...; Age=1; PDBFileName=Kernel.Appcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=176; ImageBase=0x7ffc23530000; ImageSize=69,632; ImageChecksum=91,565; TimeDateStamp=0; DefaultBase=0x7ffc23530000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=48; ImageBase=0x7ffc23550000; ImageSize=126,976; ProcessID=0; TimeDateStamp=-87,365,952; BuildTime=03/05/03 02:09:04.00...; OriginalFileName=PROFAPI.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=44; ImageBase=0x7ffc23550000; GuidSig=d3e9e0b2-6dc3-e775-b...; Age=1; PDBFileName=profapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=162; ImageBase=0x7ffc23550000; ImageSize=126,976; ImageChecksum=153,678; TimeDateStamp=0; DefaultBase=0x7ffc23550000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=46; ImageBase=0x7ffc23570000; ImageSize=73,728; ProcessID=0; TimeDateStamp=-457,022,433; BuildTime=91/08/14 15:47:43.00...; OriginalFileName=msasn1.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=43; ImageBase=0x7ffc23570000; GuidSig=ff420efb-35b1-0aa7-6...; Age=1; PDBFileName=msasn1.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=160; ImageBase=0x7ffc23570000; ImageSize=73,728; ImageChecksum=79,097; TimeDateStamp=0; DefaultBase=0x7ffc23570000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=46; ImageBase=0x7ffc23590000; ImageSize=155,648; ProcessID=0; TimeDateStamp=-1,248,142,761; BuildTime=66/07/20 04:08:55.00...; OriginalFileName=bcrypt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=43; ImageBase=0x7ffc23590000; GuidSig=1a472182-0367-8386-d...; Age=1; PDBFileName=bcrypt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=160; ImageBase=0x7ffc23590000; ImageSize=155,648; ImageChecksum=157,312; TimeDateStamp=0; DefaultBase=0x7ffc23590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=50; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ProcessID=0; TimeDateStamp=1,555,946,369; BuildTime=19/04/22 15:19:29.00...; OriginalFileName=ucrtbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=45; ImageBase=0x7ffc23d90000; GuidSig=faceb612-020d-68fb-b...; Age=1; PDBFileName=ucrtbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=164; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ImageChecksum=1,052,117; TimeDateStamp=0; DefaultBase=0x7ffc23d90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=48; ImageBase=0x7ffc23e90000; ImageSize=94,208; ProcessID=0; TimeDateStamp=-1,525,668,879; BuildTime=57/10/03 01:33:37.00...; OriginalFileName=cryptsp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=44; ImageBase=0x7ffc23e90000; GuidSig=7618debe-ac0f-9998-7...; Age=1; PDBFileName=cryptsp.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=162; ImageBase=0x7ffc23e90000; ImageSize=94,208; ImageChecksum=133,544; TimeDateStamp=0; DefaultBase=0x7ffc23e90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=54; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ProcessID=0; TimeDateStamp=439,410,971; BuildTime=83/12/04 18:36:11.00...; OriginalFileName=Kernelbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=47; ImageBase=0x7ffc23ee0000; GuidSig=44c8ec9a-a0ea-4f98-d...; Age=1; PDBFileName=kernelbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=168; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ImageChecksum=2,793,344; TimeDateStamp=0; DefaultBase=0x7ffc23ee0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=50; ImageBase=0x7ffc24330000; ImageSize=376,832; ProcessID=0; TimeDateStamp=1,670,486,148; BuildTime=22/12/08 07:55:48.00...; OriginalFileName=WINTRUST.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=45; ImageBase=0x7ffc24330000; GuidSig=ef819cd6-e971-2b01-0...; Age=1; PDBFileName=wintrust.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=164; ImageBase=0x7ffc24330000; ImageSize=376,832; ImageChecksum=380,837; TimeDateStamp=0; DefaultBase=0x7ffc24330000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=66; ImageBase=0x7ffc24390000; ImageSize=528,384; ProcessID=0; TimeDateStamp=1,774,320,825; BuildTime=26/03/24 02:53:45.00...; OriginalFileName=bcryptprimitives.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=53; ImageBase=0x7ffc24390000; GuidSig=54a1b493-8222-f67e-4...; Age=1; PDBFileName=bcryptprimitives.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=180; ImageBase=0x7ffc24390000; ImageSize=528,384; ImageChecksum=562,796; TimeDateStamp=0; DefaultBase=0x7ffc24390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=52; ImageBase=0x7ffc24420000; ImageSize=647,168; ProcessID=0; TimeDateStamp=545,597,548; BuildTime=87/04/16 18:52:28.00...; OriginalFileName=msvcp_win.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=46; ImageBase=0x7ffc24420000; GuidSig=de65fef9-16bb-6b73-d...; Age=1; PDBFileName=msvcp_win.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=166; ImageBase=0x7ffc24420000; ImageSize=647,168; ImageChecksum=686,408; TimeDateStamp=0; DefaultBase=0x7ffc24420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=48; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ProcessID=0; TimeDateStamp=135,099,696; BuildTime=74/04/13 15:41:36.00...; OriginalFileName=CRYPT32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=44; ImageBase=0x7ffc244c0000; GuidSig=8c840cbc-1c63-bfb7-6...; Age=1; PDBFileName=crypt32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=162; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ImageChecksum=1,341,835; TimeDateStamp=0; DefaultBase=0x7ffc244c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=48; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ProcessID=0; TimeDateStamp=1,691,891,946; BuildTime=23/08/13 01:59:06.00...; OriginalFileName=COMBASE.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=44; ImageBase=0x7ffc246c0000; GuidSig=d15b0ee4-2a16-5244-2...; Age=1; PDBFileName=combase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=162; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ImageChecksum=3,387,881; TimeDateStamp=0; DefaultBase=0x7ffc246c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=50; ImageBase=0x7ffc24b30000; ImageSize=667,648; ProcessID=0; TimeDateStamp=-1,762,261,787; BuildTime=50/04/04 17:18:29.00...; OriginalFileName=advapi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=45; ImageBase=0x7ffc24b30000; GuidSig=549260e6-7474-8391-e...; Age=1; PDBFileName=advapi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=164; ImageBase=0x7ffc24b30000; ImageSize=667,648; ImageChecksum=662,904; TimeDateStamp=0; DefaultBase=0x7ffc24b30000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=50; ImageBase=0x7ffc24be0000; ImageSize=729,088; ProcessID=0; TimeDateStamp=775,814,378; BuildTime=94/08/02 07:59:38.00...; OriginalFileName=kernel32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=45; ImageBase=0x7ffc24be0000; GuidSig=47a44f0c-c47f-b6a1-f...; Age=1; PDBFileName=kernel32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=164; ImageBase=0x7ffc24be0000; ImageSize=729,088; ImageChecksum=723,980; TimeDateStamp=0; DefaultBase=0x7ffc24be0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=48; ImageBase=0x7ffc24ca0000; ImageSize=425,984; ProcessID=0; TimeDateStamp=402,771,166; BuildTime=82/10/06 16:52:46.00...; OriginalFileName=WLDAP32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=44; ImageBase=0x7ffc24ca0000; GuidSig=abfb3f82-2347-e7de-9...; Age=1; PDBFileName=wldap32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=162; ImageBase=0x7ffc24ca0000; ImageSize=425,984; ImageChecksum=436,918; TimeDateStamp=0; DefaultBase=0x7ffc24ca0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=46; ImageBase=0x7ffc24eb0000; ImageSize=454,656; ProcessID=0; TimeDateStamp=252,347,079; BuildTime=77/12/30 16:24:39.00...; OriginalFileName=ws2_32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=43; ImageBase=0x7ffc24eb0000; GuidSig=94268932-d2c5-c3db-4...; Age=1; PDBFileName=ws2_32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=160; ImageBase=0x7ffc24eb0000; ImageSize=454,656; ImageChecksum=456,525; TimeDateStamp=0; DefaultBase=0x7ffc24eb0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=46; ImageBase=0x7ffc25390000; ImageSize=647,168; ProcessID=0; TimeDateStamp=-172,101,673; BuildTime=00/08/25 08:27:03.00...; OriginalFileName=msvcrt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=43; ImageBase=0x7ffc25390000; GuidSig=1fea8db6-b57f-5fbf-a...; Age=1; PDBFileName=msvcrt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=160; ImageBase=0x7ffc25390000; ImageSize=647,168; ImageChecksum=678,174; TimeDateStamp=0; DefaultBase=0x7ffc25390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=48; ImageBase=0x7ffc25590000; ImageSize=618,496; ProcessID=0; TimeDateStamp=-136,044,297; BuildTime=01/10/16 16:23:19.00...; OriginalFileName=sechost.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=44; ImageBase=0x7ffc25590000; GuidSig=0f733965-b12f-7923-b...; Age=1; PDBFileName=sechost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=162; ImageBase=0x7ffc25590000; ImageSize=618,496; ImageChecksum=662,974; TimeDateStamp=0; DefaultBase=0x7ffc25590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=46; ImageBase=0x7ffc256e0000; ImageSize=692,224; ProcessID=0; TimeDateStamp=1,221,584,444; BuildTime=08/09/16 17:00:44.00...; OriginalFileName=SHCORE.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=43; ImageBase=0x7ffc256e0000; GuidSig=3921dcf6-eafa-cc85-7...; Age=1; PDBFileName=shcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=160; ImageBase=0x7ffc256e0000; ImageSize=692,224; ImageChecksum=745,271; TimeDateStamp=0; DefaultBase=0x7ffc256e0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=50; ImageBase=0x7ffc25e80000; ImageSize=118,784; ProcessID=0; TimeDateStamp=331,349,049; BuildTime=80/07/02 01:24:09.00...; OriginalFileName=IMAGEHLP.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=45; ImageBase=0x7ffc25e80000; GuidSig=b100f2aa-7653-e1ab-3...; Age=1; PDBFileName=imagehlp.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=164; ImageBase=0x7ffc25e80000; ImageSize=118,784; ImageChecksum=163,995; TimeDateStamp=0; DefaultBase=0x7ffc25e80000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=50; ImageBase=0x7ffc25ea0000; ImageSize=802,816; ProcessID=0; TimeDateStamp=-1,108,332,853; BuildTime=70/12/24 08:14:03.00...; OriginalFileName=OLEAUT32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=45; ImageBase=0x7ffc25ea0000; GuidSig=2dfa946d-f7be-e09f-3...; Age=1; PDBFileName=oleaut32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=164; ImageBase=0x7ffc25ea0000; ImageSize=802,816; ImageChecksum=845,595; TimeDateStamp=0; DefaultBase=0x7ffc25ea0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=46; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ProcessID=0; TimeDateStamp=87,082,528; BuildTime=72/10/04 21:35:28.00...; OriginalFileName=rpcrt4.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=43; ImageBase=0x7ffc25f70000; GuidSig=a3028d6b-45da-0062-4...; Age=1; PDBFileName=rpcrt4.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=160; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ImageChecksum=1,199,090; TimeDateStamp=0; DefaultBase=0x7ffc25f70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=40; ImageBase=0x7ffc26410000; ImageSize=32,768; ProcessID=0; TimeDateStamp=1,693,425,343; BuildTime=23/08/30 19:55:43.00...; OriginalFileName=nsi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=40; ImageBase=0x7ffc26410000; GuidSig=7c67fb7d-8805-fe58-4...; Age=1; PDBFileName=nsi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=154; ImageBase=0x7ffc26410000; ImageSize=32,768; ImageChecksum=32,664; TimeDateStamp=0; DefaultBase=0x7ffc26410000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=44; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ProcessID=0; TimeDateStamp=-1,523,876,758; BuildTime=57/10/23 19:22:18.00...; OriginalFileName=ntdll.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=42; ImageBase=0x7ffc26600000; GuidSig=b54f3499-813e-bcf1-3...; Age=1; PDBFileName=ntdll.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=876; TID=-1; PName=lsass; ProceNum=2; DataLen=158; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ImageChecksum=2,058,600; TimeDateStamp=0; DefaultBase=0x7ffc26600000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: Windows Kernel/Process/DCStart PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=202; ProcessID=1,000; ParentID=836; ImageFileName=svchost.exe; PageDirectoryBase=0x101a587000; Flags=None; SessionID=0; ExitStatus=259; UniqueProcessKey=0xffffc50f60d873c0; CommandLine=C:\Windows\system32\...; PackageFullName=; ApplicationID=; 
EVENT 0.000: KernelTraceControl/ImageID PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=48; ImageBase=0x7ff6295b0000; ImageSize=65,536; ProcessID=0; TimeDateStamp=852,935,184; BuildTime=97/01/10 22:26:24.00...; OriginalFileName=svchost.exe; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=44; ImageBase=0x7ff6295b0000; GuidSig=ef7b3786-4e54-5d5e-c...; Age=1; PDBFileName=svchost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=162; ImageBase=0x7ff6295b0000; ImageSize=65,536; ImageChecksum=68,124; TimeDateStamp=0; DefaultBase=0x7ff6295b0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=50; ImageBase=0x7ffc21e50000; ImageSize=147,456; ProcessID=0; TimeDateStamp=-698,251,252; BuildTime=83/12/22 15:47:24.00...; OriginalFileName=Umpnpmgr.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=45; ImageBase=0x7ffc21e50000; GuidSig=a3b69bff-78c4-cfbc-6...; Age=1; PDBFileName=umpnpmgr.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=164; ImageBase=0x7ffc21e50000; ImageSize=147,456; ImageChecksum=157,671; TimeDateStamp=0; DefaultBase=0x7ffc21e50000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=42; ImageBase=0x7ffc22940000; ImageSize=167,936; ProcessID=0; TimeDateStamp=1,085,565,188; BuildTime=04/05/26 09:53:08.00...; OriginalFileName=wldp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=41; ImageBase=0x7ffc22940000; GuidSig=3d0180e1-0317-7a96-e...; Age=1; PDBFileName=WLDP.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=156; ImageBase=0x7ffc22940000; ImageSize=167,936; ImageChecksum=190,611; TimeDateStamp=0; DefaultBase=0x7ffc22940000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=46; ImageBase=0x7ffc23570000; ImageSize=73,728; ProcessID=0; TimeDateStamp=-457,022,433; BuildTime=91/08/14 15:47:43.00...; OriginalFileName=msasn1.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=43; ImageBase=0x7ffc23570000; GuidSig=ff420efb-35b1-0aa7-6...; Age=1; PDBFileName=msasn1.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=160; ImageBase=0x7ffc23570000; ImageSize=73,728; ImageChecksum=79,097; TimeDateStamp=0; DefaultBase=0x7ffc23570000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=50; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ProcessID=0; TimeDateStamp=1,555,946,369; BuildTime=19/04/22 15:19:29.00...; OriginalFileName=ucrtbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=45; ImageBase=0x7ffc23d90000; GuidSig=faceb612-020d-68fb-b...; Age=1; PDBFileName=ucrtbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=164; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ImageChecksum=1,052,117; TimeDateStamp=0; DefaultBase=0x7ffc23d90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=54; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ProcessID=0; TimeDateStamp=439,410,971; BuildTime=83/12/04 18:36:11.00...; OriginalFileName=Kernelbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=47; ImageBase=0x7ffc23ee0000; GuidSig=44c8ec9a-a0ea-4f98-d...; Age=1; PDBFileName=kernelbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=168; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ImageChecksum=2,793,344; TimeDateStamp=0; DefaultBase=0x7ffc23ee0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=50; ImageBase=0x7ffc24330000; ImageSize=376,832; ProcessID=0; TimeDateStamp=1,670,486,148; BuildTime=22/12/08 07:55:48.00...; OriginalFileName=WINTRUST.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=45; ImageBase=0x7ffc24330000; GuidSig=ef819cd6-e971-2b01-0...; Age=1; PDBFileName=wintrust.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=164; ImageBase=0x7ffc24330000; ImageSize=376,832; ImageChecksum=380,837; TimeDateStamp=0; DefaultBase=0x7ffc24330000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=66; ImageBase=0x7ffc24390000; ImageSize=528,384; ProcessID=0; TimeDateStamp=1,774,320,825; BuildTime=26/03/24 02:53:45.00...; OriginalFileName=bcryptprimitives.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=53; ImageBase=0x7ffc24390000; GuidSig=54a1b493-8222-f67e-4...; Age=1; PDBFileName=bcryptprimitives.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=180; ImageBase=0x7ffc24390000; ImageSize=528,384; ImageChecksum=562,796; TimeDateStamp=0; DefaultBase=0x7ffc24390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=48; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ProcessID=0; TimeDateStamp=135,099,696; BuildTime=74/04/13 15:41:36.00...; OriginalFileName=CRYPT32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=44; ImageBase=0x7ffc244c0000; GuidSig=8c840cbc-1c63-bfb7-6...; Age=1; PDBFileName=crypt32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=162; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ImageChecksum=1,341,835; TimeDateStamp=0; DefaultBase=0x7ffc244c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=48; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ProcessID=0; TimeDateStamp=1,691,891,946; BuildTime=23/08/13 01:59:06.00...; OriginalFileName=COMBASE.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=44; ImageBase=0x7ffc246c0000; GuidSig=d15b0ee4-2a16-5244-2...; Age=1; PDBFileName=combase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=162; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ImageChecksum=3,387,881; TimeDateStamp=0; DefaultBase=0x7ffc246c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=50; ImageBase=0x7ffc24be0000; ImageSize=729,088; ProcessID=0; TimeDateStamp=775,814,378; BuildTime=94/08/02 07:59:38.00...; OriginalFileName=kernel32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=45; ImageBase=0x7ffc24be0000; GuidSig=47a44f0c-c47f-b6a1-f...; Age=1; PDBFileName=kernel32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=164; ImageBase=0x7ffc24be0000; ImageSize=729,088; ImageChecksum=723,980; TimeDateStamp=0; DefaultBase=0x7ffc24be0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=46; ImageBase=0x7ffc25390000; ImageSize=647,168; ProcessID=0; TimeDateStamp=-172,101,673; BuildTime=00/08/25 08:27:03.00...; OriginalFileName=msvcrt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=43; ImageBase=0x7ffc25390000; GuidSig=1fea8db6-b57f-5fbf-a...; Age=1; PDBFileName=msvcrt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=160; ImageBase=0x7ffc25390000; ImageSize=647,168; ImageChecksum=678,174; TimeDateStamp=0; DefaultBase=0x7ffc25390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=48; ImageBase=0x7ffc25590000; ImageSize=618,496; ProcessID=0; TimeDateStamp=-136,044,297; BuildTime=01/10/16 16:23:19.00...; OriginalFileName=sechost.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=44; ImageBase=0x7ffc25590000; GuidSig=0f733965-b12f-7923-b...; Age=1; PDBFileName=sechost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=162; ImageBase=0x7ffc25590000; ImageSize=618,496; ImageChecksum=662,974; TimeDateStamp=0; DefaultBase=0x7ffc25590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=46; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ProcessID=0; TimeDateStamp=87,082,528; BuildTime=72/10/04 21:35:28.00...; OriginalFileName=rpcrt4.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=43; ImageBase=0x7ffc25f70000; GuidSig=a3028d6b-45da-0062-4...; Age=1; PDBFileName=rpcrt4.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=160; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ImageChecksum=1,199,090; TimeDateStamp=0; DefaultBase=0x7ffc25f70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=44; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ProcessID=0; TimeDateStamp=-1,523,876,758; BuildTime=57/10/23 19:22:18.00...; OriginalFileName=ntdll.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=42; ImageBase=0x7ffc26600000; GuidSig=b54f3499-813e-bcf1-3...; Age=1; PDBFileName=ntdll.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1000; TID=-1; PName=svchost; ProceNum=4; DataLen=158; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ImageChecksum=2,058,600; TimeDateStamp=0; DefaultBase=0x7ffc26600000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: Windows Kernel/Process/DCStart PID=104; TID=-1; PName=svchost; ProceNum=4; DataLen=178; ProcessID=104; ParentID=836; ImageFileName=svchost.exe; PageDirectoryBase=0x101a886000; Flags=None; SessionID=0; ExitStatus=259; UniqueProcessKey=0xffffc50f60d8d380; CommandLine=C:\Windows\system32\...; PackageFullName=; ApplicationID=; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ff6295b0000; ImageSize=65,536; ProcessID=0; TimeDateStamp=852,935,184; BuildTime=97/01/10 22:26:24.00...; OriginalFileName=svchost.exe; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ff6295b0000; GuidSig=ef7b3786-4e54-5d5e-c...; Age=1; PDBFileName=svchost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ff6295b0000; ImageSize=65,536; ImageChecksum=68,124; TimeDateStamp=0; DefaultBase=0x7ff6295b0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=54; ImageBase=0x7ffbf79f0000; ImageSize=73,728; ProcessID=0; TimeDateStamp=425,824,833; BuildTime=83/06/30 12:40:33.00...; OriginalFileName=TaskSchdPS.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=47; ImageBase=0x7ffbf79f0000; GuidSig=d22628c1-cb6b-134a-3...; Age=1; PDBFileName=TaskSchdPS.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=168; ImageBase=0x7ffbf79f0000; ImageSize=73,728; ImageChecksum=96,111; TimeDateStamp=0; DefaultBase=0x7ffbf79f0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=80; ImageBase=0x7ffc03770000; ImageSize=114,688; ProcessID=0; TimeDateStamp=673,732,498; BuildTime=91/05/08 19:54:58.00...; OriginalFileName="LicenseManagerApi.D...; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=54; ImageBase=0x7ffc03770000; GuidSig=8c81a544-85de-32f3-c...; Age=1; PDBFileName=LicenseManagerApi.pd...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=182; ImageBase=0x7ffc03770000; ImageSize=114,688; ImageChecksum=103,980; TimeDateStamp=0; DefaultBase=0x7ffc03770000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc03790000; ImageSize=323,584; ProcessID=0; TimeDateStamp=-1,046,143,486; BuildTime=72/12/13 03:03:30.00...; OriginalFileName=capauthz.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc03790000; GuidSig=f3e6040e-0f5a-e497-9...; Age=1; PDBFileName=capauthz.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc03790000; ImageSize=323,584; ImageChecksum=329,930; TimeDateStamp=0; DefaultBase=0x7ffc03790000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=78; ImageBase=0x7ffc04970000; ImageSize=495,616; ProcessID=0; TimeDateStamp=-1,815,447,834; BuildTime=48/07/28 03:24:22.00...; OriginalFileName=OneCoreCommonProxySt...; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=59; ImageBase=0x7ffc04970000; GuidSig=b02b2453-78f9-7203-5...; Age=1; PDBFileName=OneCoreCommonProxySt...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=192; ImageBase=0x7ffc04970000; ImageSize=495,616; ImageChecksum=520,411; TimeDateStamp=0; DefaultBase=0x7ffc04970000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=52; ImageBase=0x7ffc069c0000; ImageSize=245,760; ProcessID=0; TimeDateStamp=1,961,330,995; BuildTime=32/02/25 14:09:55.00...; OriginalFileName=container.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc069c0000; GuidSig=f460c0f4-84d1-efa2-c...; Age=1; PDBFileName=container.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc069c0000; ImageSize=245,760; ImageChecksum=276,221; TimeDateStamp=0; DefaultBase=0x7ffc069c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc06a00000; ImageSize=684,032; ProcessID=0; TimeDateStamp=1,071,126,594; BuildTime=03/12/11 07:09:54.00...; OriginalFileName=daxexec.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc06a00000; GuidSig=18dc3241-0262-7150-c...; Age=1; PDBFileName=daxexec.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc06a00000; ImageSize=684,032; ImageChecksum=678,229; TimeDateStamp=0; DefaultBase=0x7ffc06a00000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=86; ImageBase=0x7ffc06f70000; ImageSize=77,824; ProcessID=0; TimeDateStamp=-430,648,207; BuildTime=92/06/14 21:58:09.00...; OriginalFileName=SebBackgroundManager...; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=63; ImageBase=0x7ffc06f70000; GuidSig=81619ccf-9a2f-ec49-d...; Age=1; PDBFileName=SebBackgroundManager...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=200; ImageBase=0x7ffc06f70000; ImageSize=77,824; ImageChecksum=122,338; TimeDateStamp=0; DefaultBase=0x7ffc06f70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=84; ImageBase=0x7ffc06f90000; ImageSize=90,112; ProcessID=0; TimeDateStamp=1,087,643,792; BuildTime=04/06/19 11:16:32.00...; OriginalFileName=SmartCardBackgroundP...; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=62; ImageBase=0x7ffc06f90000; GuidSig=38cfcdb4-1ab6-41c2-d...; Age=1; PDBFileName=SmartCardBackgroundP...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=198; ImageBase=0x7ffc06f90000; ImageSize=90,112; ImageChecksum=109,561; TimeDateStamp=0; DefaultBase=0x7ffc06f90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=86; ImageBase=0x7ffc070a0000; ImageSize=196,608; ProcessID=0; TimeDateStamp=-172,367,548; BuildTime=00/08/22 06:35:48.00...; OriginalFileName=ACPBackgroundManager...; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=63; ImageBase=0x7ffc070a0000; GuidSig=164d7dbe-006d-e975-3...; Age=1; PDBFileName=ACPBackgroundManager...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=200; ImageBase=0x7ffc070a0000; ImageSize=196,608; ImageChecksum=185,360; TimeDateStamp=0; DefaultBase=0x7ffc070a0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=62; ImageBase=0x7ffc07230000; ImageSize=102,400; ProcessID=0; TimeDateStamp=637,029,004; BuildTime=90/03/10 00:30:04.00...; OriginalFileName=ExecModelProxy.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=51; ImageBase=0x7ffc07230000; GuidSig=00678d31-3115-de94-0...; Age=1; PDBFileName=ExecModelProxy.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=176; ImageBase=0x7ffc07230000; ImageSize=102,400; ImageChecksum=123,213; TimeDateStamp=0; DefaultBase=0x7ffc07230000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=76; ImageBase=0x7ffc09310000; ImageSize=86,016; ProcessID=0; TimeDateStamp=1,569,974,753; BuildTime=19/10/02 00:05:53.00...; OriginalFileName=BackgroundMediaPolic...; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=58; ImageBase=0x7ffc09310000; GuidSig=48cc716f-c435-d42e-0...; Age=1; PDBFileName=BackgroundMediaPolic...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=190; ImageBase=0x7ffc09310000; ImageSize=86,016; ImageChecksum=109,702; TimeDateStamp=0; DefaultBase=0x7ffc09310000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=156; ImageBase=0x7ffc09330000; ImageSize=126,976; ProcessID=0; TimeDateStamp=1,266,467,855; BuildTime=10/02/18 04:37:35.00...; OriginalFileName=Windows.Networking.B...; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=98; ImageBase=0x7ffc09330000; GuidSig=1cd22633-f164-586f-3...; Age=1; PDBFileName=Windows.Networking.B...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=270; ImageBase=0x7ffc09330000; ImageSize=126,976; ImageChecksum=122,213; TimeDateStamp=0; DefaultBase=0x7ffc09330000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=64; ImageBase=0x7ffc0aef0000; ImageSize=327,680; ProcessID=0; TimeDateStamp=-1,583,400,106; BuildTime=55/12/04 21:06:30.00...; OriginalFileName=ExecModelClient.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=52; ImageBase=0x7ffc0aef0000; GuidSig=2691829e-8793-d53f-4...; Age=1; PDBFileName=ExecModelClient.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=178; ImageBase=0x7ffc0aef0000; ImageSize=327,680; ImageChecksum=323,697; TimeDateStamp=0; DefaultBase=0x7ffc0aef0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=52; ImageBase=0x7ffc11c70000; ImageSize=40,960; ProcessID=0; TimeDateStamp=1,537,672,213; BuildTime=18/09/23 03:10:13.00...; OriginalFileName=filterLib.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc11c70000; GuidSig=15599307-8ba3-729e-a...; Age=1; PDBFileName=fltLib.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc11c70000; ImageSize=40,960; ImageChecksum=44,887; TimeDateStamp=0; DefaultBase=0x7ffc11c70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=84; ImageBase=0x7ffc12040000; ImageSize=1,265,664; ProcessID=0; TimeDateStamp=-1,902,823,923; BuildTime=45/10/20 20:16:13.00...; OriginalFileName=Windows.StateReposit...; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=62; ImageBase=0x7ffc12040000; GuidSig=48ef3ff1-69e6-4495-f...; Age=1; PDBFileName=Windows.StateReposit...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=198; ImageBase=0x7ffc12040000; ImageSize=1,265,664; ImageChecksum=1,295,312; TimeDateStamp=0; DefaultBase=0x7ffc12040000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=88; ImageBase=0x7ffc145a0000; ImageSize=65,536; ProcessID=0; TimeDateStamp=381,201,412; BuildTime=82/01/30 01:16:52.00...; OriginalFileName=Windows.StateReposit...; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=64; ImageBase=0x7ffc145a0000; GuidSig=e02325ec-1e93-f568-3...; Age=1; PDBFileName=Windows.StateReposit...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=202; ImageBase=0x7ffc145a0000; ImageSize=65,536; ImageChecksum=47,348; TimeDateStamp=0; DefaultBase=0x7ffc145a0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc1a440000; ImageSize=45,056; ProcessID=0; TimeDateStamp=1,065,599,305; BuildTime=03/10/08 07:48:25.00...; OriginalFileName=winnsi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc1a440000; GuidSig=fbe97a95-acd1-25a6-8...; Age=1; PDBFileName=winnsi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc1a440000; ImageSize=45,056; ImageChecksum=85,292; TimeDateStamp=0; DefaultBase=0x7ffc1a440000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=84; ImageBase=0x7ffc1c5c0000; ImageSize=7,770,112; ProcessID=0; TimeDateStamp=-1,131,996,070; BuildTime=70/03/25 11:07:06.00...; OriginalFileName=OneCoreUAPCommonProx...; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=62; ImageBase=0x7ffc1c5c0000; GuidSig=94e428c9-8918-e01d-f...; Age=1; PDBFileName=OneCoreUAPCommonProx...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=198; ImageBase=0x7ffc1c5c0000; ImageSize=7,770,112; ImageChecksum=7,847,302; TimeDateStamp=0; DefaultBase=0x7ffc1c5c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: Windows Kernel/PerfInfo/Sample PID=-1; TID=9984; PName=; ProceNum=2; DataLen=16; InstructionPointer=0xfffff8027ca2facf; ProcessorNumber=2; Priority=9; ExecutingDPC=False; ExecutingISR=False; Rank=0; Count=1; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=38; ImageBase=0x7ffc1d0d0000; ImageSize=49,152; ProcessID=0; TimeDateStamp=271,701,914; BuildTime=78/08/11 16:45:14.00...; OriginalFileName=bi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=39; ImageBase=0x7ffc1d0d0000; GuidSig=750b35ae-26a8-fa1a-d...; Age=1; PDBFileName=bi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=152; ImageBase=0x7ffc1d0d0000; ImageSize=49,152; ImageChecksum=46,380; TimeDateStamp=0; DefaultBase=0x7ffc1d0d0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=54; ImageBase=0x7ffc1e970000; ImageSize=86,016; ProcessID=0; TimeDateStamp=525,713,861; BuildTime=86/08/29 15:37:41.00...; OriginalFileName=usermgrcli.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=47; ImageBase=0x7ffc1e970000; GuidSig=26f569a5-8783-27b0-0...; Age=1; PDBFileName=usermgrcli.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=168; ImageBase=0x7ffc1e970000; ImageSize=86,016; ImageChecksum=138,081; TimeDateStamp=0; DefaultBase=0x7ffc1e970000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=60; ImageBase=0x7ffc1eac0000; ImageSize=524,288; ProcessID=0; TimeDateStamp=970,085,465; BuildTime=00/09/27 20:11:05.00...; OriginalFileName=PolicyManager.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc1eac0000; GuidSig=263d8dd8-e39f-0946-0...; Age=1; PDBFileName=policymanager.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=174; ImageBase=0x7ffc1eac0000; ImageSize=524,288; ImageChecksum=516,279; TimeDateStamp=0; DefaultBase=0x7ffc1eac0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc1f0f0000; ImageSize=978,944; ProcessID=0; TimeDateStamp=2,097,505,968; BuildTime=36/06/19 16:32:48.00...; OriginalFileName=propsys.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc1f0f0000; GuidSig=f17d0756-2273-c8ff-e...; Age=1; PDBFileName=propsys.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc1f0f0000; ImageSize=978,944; ImageChecksum=990,621; TimeDateStamp=0; DefaultBase=0x7ffc1f0f0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc1f210000; ImageSize=77,824; ProcessID=0; TimeDateStamp=1,097,789,430; BuildTime=04/10/14 21:30:30.00...; OriginalFileName=wtsapi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc1f210000; GuidSig=2da85aef-00d2-fb45-8...; Age=1; PDBFileName=wtsapi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc1f210000; ImageSize=77,824; ImageChecksum=127,847; TimeDateStamp=0; DefaultBase=0x7ffc1f210000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=58; ImageBase=0x7ffc1f260000; ImageSize=565,248; ProcessID=0; TimeDateStamp=-2,109,210,886; BuildTime=39/04/07 02:33:30.00...; OriginalFileName=msvcp110_win.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=49; ImageBase=0x7ffc1f260000; GuidSig=8b3306f1-7c4d-d8b8-0...; Age=1; PDBFileName=msvcp110_win.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=172; ImageBase=0x7ffc1f260000; ImageSize=565,248; ImageChecksum=591,592; TimeDateStamp=0; DefaultBase=0x7ffc1f260000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=60; ImageBase=0x7ffc205a0000; ImageSize=868,352; ProcessID=0; TimeDateStamp=270,157,240; BuildTime=78/07/24 19:40:40.00...; OriginalFileName=CoreMessaging.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc205a0000; GuidSig=f77a6f37-b916-eb3a-b...; Age=1; PDBFileName=CoreMessaging.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=174; ImageBase=0x7ffc205a0000; ImageSize=868,352; ImageChecksum=871,099; TimeDateStamp=0; DefaultBase=0x7ffc205a0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=40; ImageBase=0x7ffc206b0000; ImageSize=135,168; ProcessID=0; TimeDateStamp=1,414,555,979; BuildTime=14/10/29 04:12:59.00...; OriginalFileName=dab.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=40; ImageBase=0x7ffc206b0000; GuidSig=8242d052-c28b-2774-0...; Age=1; PDBFileName=dab.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=154; ImageBase=0x7ffc206b0000; ImageSize=135,168; ImageChecksum=144,434; TimeDateStamp=0; DefaultBase=0x7ffc206b0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=52; ImageBase=0x7ffc20910000; ImageSize=266,240; ProcessID=0; TimeDateStamp=972,189,211; BuildTime=00/10/22 04:33:31.00...; OriginalFileName=BrokerLib.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc20910000; GuidSig=f423664f-cf3d-9472-1...; Age=1; PDBFileName=BrokerLib.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc20910000; ImageSize=266,240; ImageChecksum=287,821; TimeDateStamp=0; DefaultBase=0x7ffc20910000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc20960000; ImageSize=585,728; ProcessID=0; TimeDateStamp=-9,148,100; BuildTime=05/10/24 09:19:56.00...; OriginalFileName=Apphelp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc20960000; GuidSig=b37f976c-be76-5dae-9...; Age=1; PDBFileName=apphelp.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc20960000; ImageSize=585,728; ImageChecksum=594,685; TimeDateStamp=0; DefaultBase=0x7ffc20960000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=82; ImageBase=0x7ffc209f0000; ImageSize=299,008; ProcessID=0; TimeDateStamp=1,801,535,057; BuildTime=27/02/02 02:24:17.00...; OriginalFileName=SystemEventsBrokerSe...; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=61; ImageBase=0x7ffc209f0000; GuidSig=d257e8fe-cb6b-d95b-8...; Age=1; PDBFileName=SystemEventsBrokerSe...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=196; ImageBase=0x7ffc209f0000; ImageSize=299,008; ImageChecksum=282,187; TimeDateStamp=0; DefaultBase=0x7ffc209f0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=74; ImageBase=0x7ffc20a60000; ImageSize=155,648; ProcessID=0; TimeDateStamp=-335,295,132; BuildTime=95/06/23 12:56:04.00...; OriginalFileName=ResourcePolicyServer...; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=57; ImageBase=0x7ffc20a60000; GuidSig=46f64e92-d887-c2e6-5...; Age=1; PDBFileName=ResourcePolicyServer...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=188; ImageBase=0x7ffc20a60000; ImageSize=155,648; ImageChecksum=171,914; TimeDateStamp=0; DefaultBase=0x7ffc20a60000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=70; ImageBase=0x7ffc20a90000; ImageSize=69,632; ProcessID=0; TimeDateStamp=1,207,773,975; BuildTime=08/04/09 20:46:15.00...; OriginalFileName=embeddedmodesvcapi.d...; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=55; ImageBase=0x7ffc20a90000; GuidSig=fe23447d-870b-c6dd-e...; Age=1; PDBFileName=embeddedmodesvcapi.p...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=184; ImageBase=0x7ffc20a90000; ImageSize=69,632; ImageChecksum=64,667; TimeDateStamp=0; DefaultBase=0x7ffc20a90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=64; ImageBase=0x7ffc20b80000; ImageSize=2,465,792; ProcessID=0; TimeDateStamp=1,123,054,026; BuildTime=05/08/03 07:27:06.00...; OriginalFileName=twinapi.appcore.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=52; ImageBase=0x7ffc20b80000; GuidSig=da642c52-541e-6baa-4...; Age=1; PDBFileName=twinapi.appcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=178; ImageBase=0x7ffc20b80000; ImageSize=2,465,792; ImageChecksum=2,536,066; TimeDateStamp=0; DefaultBase=0x7ffc20b80000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=74; ImageBase=0x7ffc20de0000; ImageSize=81,920; ProcessID=0; TimeDateStamp=1,495,708,820; BuildTime=17/05/25 10:40:20.00...; OriginalFileName=ResourcePolicyClient...; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=57; ImageBase=0x7ffc20de0000; GuidSig=fa740123-f74b-9099-1...; Age=1; PDBFileName=ResourcePolicyClient...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=188; ImageBase=0x7ffc20de0000; ImageSize=81,920; ImageChecksum=74,827; TimeDateStamp=0; DefaultBase=0x7ffc20de0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc20e00000; ImageSize=823,296; ProcessID=0; TimeDateStamp=-1,831,907,979; BuildTime=48/01/19 15:08:37.00...; OriginalFileName=bisrv.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc20e00000; GuidSig=16034765-1fef-4a77-2...; Age=1; PDBFileName=bisrv.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc20e00000; ImageSize=823,296; ImageChecksum=854,564; TimeDateStamp=0; DefaultBase=0x7ffc20e00000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc20f00000; ImageSize=167,936; ProcessID=0; TimeDateStamp=-189,693,732; BuildTime=00/02/02 17:46:04.00...; OriginalFileName=rmclient.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc20f00000; GuidSig=d9b2eec0-1750-fc20-8...; Age=1; PDBFileName=RmClient.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc20f00000; ImageSize=167,936; ImageChecksum=187,354; TimeDateStamp=0; DefaultBase=0x7ffc20f00000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=68; ImageBase=0x7ffc20fe0000; ImageSize=749,568; ProcessID=0; TimeDateStamp=1,462,111,150; BuildTime=16/05/01 13:59:10.00...; OriginalFileName=PSMServiceExtHost.dl...; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=54; ImageBase=0x7ffc20fe0000; GuidSig=3b02320a-4238-a1c6-4...; Age=1; PDBFileName=PsmServiceExtHost.pd...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=182; ImageBase=0x7ffc20fe0000; ImageSize=749,568; ImageChecksum=786,383; TimeDateStamp=0; DefaultBase=0x7ffc20fe0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc210a0000; ImageSize=262,144; ProcessID=0; TimeDateStamp=771,766,867; BuildTime=94/06/16 11:41:07.00...; OriginalFileName=psmsrv.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc210a0000; GuidSig=7e71df37-f5d1-1106-8...; Age=1; PDBFileName=psmsrv.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc210a0000; ImageSize=262,144; ImageChecksum=287,732; TimeDateStamp=0; DefaultBase=0x7ffc210a0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc21120000; ImageSize=1,290,240; ProcessID=0; TimeDateStamp=193,361,355; BuildTime=76/02/16 23:29:15.00...; OriginalFileName=rpcss.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc21120000; GuidSig=fafeca9d-6833-abf6-0...; Age=1; PDBFileName=rpcss.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc21120000; ImageSize=1,290,240; ImageChecksum=1,282,690; TimeDateStamp=0; DefaultBase=0x7ffc21120000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=40; ImageBase=0x7ffc21450000; ImageSize=57,344; ProcessID=0; TimeDateStamp=1,341,062,757; BuildTime=12/06/30 13:25:57.00...; OriginalFileName=hid.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=40; ImageBase=0x7ffc21450000; GuidSig=c56adcae-0493-03c4-1...; Age=1; PDBFileName=hid.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=154; ImageBase=0x7ffc21450000; ImageSize=57,344; ImageChecksum=74,973; TimeDateStamp=0; DefaultBase=0x7ffc21450000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=74; ImageBase=0x7ffc215e0000; ImageSize=65,536; ProcessID=0; TimeDateStamp=1,807,796,904; BuildTime=27/04/15 13:48:24.00...; OriginalFileName=OnDemandBrokerClient...; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=57; ImageBase=0x7ffc215e0000; GuidSig=167f683d-8a06-9630-b...; Age=1; PDBFileName=OnDemandBrokerClient...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=188; ImageBase=0x7ffc215e0000; ImageSize=65,536; ImageChecksum=101,924; TimeDateStamp=0; DefaultBase=0x7ffc215e0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc21ad0000; ImageSize=139,264; ProcessID=0; TimeDateStamp=-1,174,313,774; BuildTime=68/11/20 16:12:02.00...; OriginalFileName=gpapi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc21ad0000; GuidSig=75a8e246-9e74-629f-3...; Age=1; PDBFileName=gpapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc21ad0000; ImageSize=139,264; ImageChecksum=174,936; TimeDateStamp=0; DefaultBase=0x7ffc21ad0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=62; ImageBase=0x7ffc21b00000; ImageSize=86,016; ProcessID=0; TimeDateStamp=1,589,330,491; BuildTime=20/05/13 00:41:31.00...; OriginalFileName=umpo-overrides.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=51; ImageBase=0x7ffc21b00000; GuidSig=92c4d411-af60-faf0-6...; Age=1; PDBFileName=umpo-overrides.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=176; ImageBase=0x7ffc21b00000; ImageSize=86,016; ImageChecksum=74,401; TimeDateStamp=0; DefaultBase=0x7ffc21b00000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc21b20000; ImageSize=434,176; ProcessID=0; TimeDateStamp=-2,140,043,044; BuildTime=38/04/15 06:04:12.00...; OriginalFileName=mintdh.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc21b20000; GuidSig=f467381e-03d7-b949-9...; Age=1; PDBFileName=mintdh.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc21b20000; ImageSize=434,176; ImageChecksum=442,979; TimeDateStamp=0; DefaultBase=0x7ffc21b20000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc21b90000; ImageSize=131,072; ProcessID=0; TimeDateStamp=-1,139,896,690; BuildTime=69/12/24 00:30:06.00...; OriginalFileName=DXCore.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc21b90000; GuidSig=33bb03a6-a0d1-2ce8-8...; Age=1; PDBFileName=DXCore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc21b90000; ImageSize=131,072; ImageChecksum=173,498; TimeDateStamp=0; DefaultBase=0x7ffc21b90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc21bb0000; ImageSize=958,464; ProcessID=0; TimeDateStamp=1,511,252,964; BuildTime=17/11/21 08:29:24.00...; OriginalFileName=dxgi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=41; ImageBase=0x7ffc21bb0000; GuidSig=5e9cc76a-64eb-6cdf-7...; Age=1; PDBFileName=dxgi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=156; ImageBase=0x7ffc21bb0000; ImageSize=958,464; ImageChecksum=997,190; TimeDateStamp=0; DefaultBase=0x7ffc21bb0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=40; ImageBase=0x7ffc21ca0000; ImageSize=802,816; ProcessID=0; TimeDateStamp=618,175,844; BuildTime=89/08/03 19:30:44.00...; OriginalFileName=tdh.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=40; ImageBase=0x7ffc21ca0000; GuidSig=b6b50067-646f-5454-4...; Age=1; PDBFileName=tdh.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=154; ImageBase=0x7ffc21ca0000; ImageSize=802,816; ImageChecksum=776,774; TimeDateStamp=0; DefaultBase=0x7ffc21ca0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc21d70000; ImageSize=131,072; ProcessID=0; TimeDateStamp=-930,605,263; BuildTime=76/08/11 09:00:33.00...; OriginalFileName=Umpoext.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc21d70000; GuidSig=382f88e5-ef98-e801-8...; Age=1; PDBFileName=umpoext.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc21d70000; ImageSize=131,072; ImageChecksum=141,578; TimeDateStamp=0; DefaultBase=0x7ffc21d70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc21d90000; ImageSize=155,648; ProcessID=0; TimeDateStamp=1,815,732,627; BuildTime=27/07/16 10:10:27.00...; OriginalFileName=sppc.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=41; ImageBase=0x7ffc21d90000; GuidSig=03b44fc2-c1f9-f76c-5...; Age=1; PDBFileName=sppc.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=156; ImageBase=0x7ffc21d90000; ImageSize=155,648; ImageChecksum=197,421; TimeDateStamp=0; DefaultBase=0x7ffc21d90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=40; ImageBase=0x7ffc21dc0000; ImageSize=159,744; ProcessID=0; TimeDateStamp=-1,388,064,996; BuildTime=62/02/11 16:51:40.00...; OriginalFileName=slc.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=40; ImageBase=0x7ffc21dc0000; GuidSig=fc19fd5c-ba36-4b57-9...; Age=1; PDBFileName=SLC.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=154; ImageBase=0x7ffc21dc0000; ImageSize=159,744; ImageChecksum=164,577; TimeDateStamp=0; DefaultBase=0x7ffc21dc0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc21df0000; ImageSize=180,224; ProcessID=0; TimeDateStamp=-167,953,011; BuildTime=00/10/12 08:51:25.00...; OriginalFileName=Umpo.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=41; ImageBase=0x7ffc21df0000; GuidSig=af4c129d-b9b7-7695-d...; Age=1; PDBFileName=umpo.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=156; ImageBase=0x7ffc21df0000; ImageSize=180,224; ImageChecksum=188,154; TimeDateStamp=0; DefaultBase=0x7ffc21df0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc21f70000; ImageSize=376,832; ProcessID=0; TimeDateStamp=43,988,838; BuildTime=71/05/25 03:07:18.00...; OriginalFileName=winsta.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc21f70000; GuidSig=b854bf05-e0a2-5b01-7...; Age=1; PDBFileName=winsta.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc21f70000; ImageSize=376,832; ImageChecksum=387,708; TimeDateStamp=0; DefaultBase=0x7ffc21f70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc22280000; ImageSize=208,896; ProcessID=0; TimeDateStamp=-96,717,502; BuildTime=03/01/14 20:29:54.00...; OriginalFileName=rsaenh.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc22280000; GuidSig=97af5588-54c0-a219-f...; Age=1; PDBFileName=rsaenh.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc22280000; ImageSize=208,896; ImageChecksum=251,829; TimeDateStamp=0; DefaultBase=0x7ffc22280000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc22420000; ImageSize=237,568; ProcessID=0; TimeDateStamp=1,353,705,264; BuildTime=12/11/23 21:14:24.00...; OriginalFileName=iphlpapi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc22420000; GuidSig=a3177875-244a-46c8-b...; Age=1; PDBFileName=iphlpapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc22420000; ImageSize=237,568; ImageChecksum=252,735; TimeDateStamp=0; DefaultBase=0x7ffc22420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=52; ImageBase=0x7ffc22890000; ImageSize=49,152; ProcessID=0; TimeDateStamp=-17,821,274; BuildTime=05/07/16 00:07:02.00...; OriginalFileName=cryptbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc22890000; GuidSig=7588b6a3-bd73-2904-7...; Age=1; PDBFileName=cryptbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc22890000; ImageSize=49,152; ImageChecksum=64,645; TimeDateStamp=0; DefaultBase=0x7ffc22890000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc22940000; ImageSize=167,936; ProcessID=0; TimeDateStamp=1,085,565,188; BuildTime=04/05/26 09:53:08.00...; OriginalFileName=wldp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=41; ImageBase=0x7ffc22940000; GuidSig=3d0180e1-0317-7a96-e...; Age=1; PDBFileName=WLDP.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=156; ImageBase=0x7ffc22940000; ImageSize=167,936; ImageChecksum=190,611; TimeDateStamp=0; DefaultBase=0x7ffc22940000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc22e10000; ImageSize=200,704; ProcessID=0; TimeDateStamp=-648,125,799; BuildTime=85/07/24 19:31:37.00...; OriginalFileName=ntmarta.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc22e10000; GuidSig=d28b6be6-17ca-2646-7...; Age=1; PDBFileName=ntmarta.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc22e10000; ImageSize=200,704; ImageChecksum=211,194; TimeDateStamp=0; DefaultBase=0x7ffc22e10000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=40; ImageBase=0x7ffc231f0000; ImageSize=892,928; ProcessID=0; TimeDateStamp=2,111,532,338; BuildTime=36/11/29 00:45:38.00...; OriginalFileName=wer.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=40; ImageBase=0x7ffc231f0000; GuidSig=a1278137-525d-b14c-7...; Age=1; PDBFileName=Wer.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=154; ImageBase=0x7ffc231f0000; ImageSize=892,928; ImageChecksum=901,754; TimeDateStamp=0; DefaultBase=0x7ffc231f0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=54; ImageBase=0x7ffc232d0000; ImageSize=172,032; ProcessID=0; TimeDateStamp=564,545,050; BuildTime=87/11/22 02:04:10.00...; OriginalFileName=devinfoset.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc232d0000; GuidSig=bf3fb10c-179d-a551-d...; Age=1; PDBFileName=devobj.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc232d0000; ImageSize=172,032; ImageChecksum=212,309; TimeDateStamp=0; DefaultBase=0x7ffc232d0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=66; ImageBase=0x7ffc23300000; ImageSize=98,304; ProcessID=0; TimeDateStamp=-297,978,839; BuildTime=96/08/28 10:34:17.00...; OriginalFileName=EventAggregation.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=53; ImageBase=0x7ffc23300000; GuidSig=09f09e24-5676-0e17-9...; Age=1; PDBFileName=EventAggregation.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=180; ImageBase=0x7ffc23300000; ImageSize=98,304; ImageChecksum=114,278; TimeDateStamp=0; DefaultBase=0x7ffc23300000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc233c0000; ImageSize=192,512; ProcessID=0; TimeDateStamp=621,642,292; BuildTime=89/09/12 22:24:52.00...; OriginalFileName=sspicli.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc233c0000; GuidSig=823d5a41-e0d7-02a7-9...; Age=1; PDBFileName=sspicli.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc233c0000; ImageSize=192,512; ImageChecksum=235,306; TimeDateStamp=0; DefaultBase=0x7ffc233c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc233f0000; ImageSize=151,552; ProcessID=0; TimeDateStamp=-157,143,252; BuildTime=01/02/14 11:34:04.00...; OriginalFileName=userenv.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc233f0000; GuidSig=1a734def-8e54-a706-f...; Age=1; PDBFileName=userenv.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc233f0000; ImageSize=151,552; ImageChecksum=176,304; TimeDateStamp=0; DefaultBase=0x7ffc233f0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc234d0000; ImageSize=65,536; ProcessID=0; TimeDateStamp=-1,563,634,669; BuildTime=56/07/20 15:30:27.00...; OriginalFileName=umpdc.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc234d0000; GuidSig=1504cc55-3edb-4294-a...; Age=1; PDBFileName=UMPDC.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc234d0000; ImageSize=65,536; ImageChecksum=55,709; TimeDateStamp=0; DefaultBase=0x7ffc234d0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc234e0000; ImageSize=303,104; ProcessID=0; TimeDateStamp=-37,463,926; BuildTime=04/11/30 15:49:30.00...; OriginalFileName=POWRPROF.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc234e0000; GuidSig=bae22f43-6c95-a7d5-0...; Age=1; PDBFileName=powrprof.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc234e0000; ImageSize=303,104; ImageChecksum=321,827; TimeDateStamp=0; DefaultBase=0x7ffc234e0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=62; ImageBase=0x7ffc23530000; ImageSize=69,632; ProcessID=0; TimeDateStamp=96,400,242; BuildTime=73/01/20 17:50:42.00...; OriginalFileName=kernel.appcore.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=51; ImageBase=0x7ffc23530000; GuidSig=b44a2a63-8a5c-a8d8-1...; Age=1; PDBFileName=Kernel.Appcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=176; ImageBase=0x7ffc23530000; ImageSize=69,632; ImageChecksum=91,565; TimeDateStamp=0; DefaultBase=0x7ffc23530000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc23550000; ImageSize=126,976; ProcessID=0; TimeDateStamp=-87,365,952; BuildTime=03/05/03 02:09:04.00...; OriginalFileName=PROFAPI.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc23550000; GuidSig=d3e9e0b2-6dc3-e775-b...; Age=1; PDBFileName=profapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc23550000; ImageSize=126,976; ImageChecksum=153,678; TimeDateStamp=0; DefaultBase=0x7ffc23550000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23570000; ImageSize=73,728; ProcessID=0; TimeDateStamp=-457,022,433; BuildTime=91/08/14 15:47:43.00...; OriginalFileName=msasn1.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23570000; GuidSig=ff420efb-35b1-0aa7-6...; Age=1; PDBFileName=msasn1.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23570000; ImageSize=73,728; ImageChecksum=79,097; TimeDateStamp=0; DefaultBase=0x7ffc23570000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23590000; ImageSize=155,648; ProcessID=0; TimeDateStamp=-1,248,142,761; BuildTime=66/07/20 04:08:55.00...; OriginalFileName=bcrypt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23590000; GuidSig=1a472182-0367-8386-d...; Age=1; PDBFileName=bcrypt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23590000; ImageSize=155,648; ImageChecksum=157,312; TimeDateStamp=0; DefaultBase=0x7ffc23590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc235c0000; ImageSize=303,104; ProcessID=0; TimeDateStamp=-1,347,769,430; BuildTime=63/05/24 02:04:26.00...; OriginalFileName=CFGMGR32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc235c0000; GuidSig=c951ee8e-a9b3-8ebf-a...; Age=1; PDBFileName=cfgmgr32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc235c0000; ImageSize=303,104; ImageChecksum=322,106; TimeDateStamp=0; DefaultBase=0x7ffc235c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=64; ImageBase=0x7ffc23610000; ImageSize=7,843,840; ProcessID=0; TimeDateStamp=-1,549,850,267; BuildTime=56/12/27 04:30:29.00...; OriginalFileName=Windows.Storage.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=52; ImageBase=0x7ffc23610000; GuidSig=d9102742-5b8c-0068-1...; Age=1; PDBFileName=Windows.Storage.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=178; ImageBase=0x7ffc23610000; ImageSize=7,843,840; ImageChecksum=7,937,261; TimeDateStamp=0; DefaultBase=0x7ffc23610000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ProcessID=0; TimeDateStamp=1,555,946,369; BuildTime=19/04/22 15:19:29.00...; OriginalFileName=ucrtbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc23d90000; GuidSig=faceb612-020d-68fb-b...; Age=1; PDBFileName=ucrtbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ImageChecksum=1,052,117; TimeDateStamp=0; DefaultBase=0x7ffc23d90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc23e90000; ImageSize=94,208; ProcessID=0; TimeDateStamp=-1,525,668,879; BuildTime=57/10/03 01:33:37.00...; OriginalFileName=cryptsp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc23e90000; GuidSig=7618debe-ac0f-9998-7...; Age=1; PDBFileName=cryptsp.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc23e90000; ImageSize=94,208; ImageChecksum=133,544; TimeDateStamp=0; DefaultBase=0x7ffc23e90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ProcessID=0; TimeDateStamp=1,396,962,555; BuildTime=14/04/08 13:09:15.00...; OriginalFileName=Win32u.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23eb0000; GuidSig=bc2e49ab-e46d-2e93-b...; Age=1; PDBFileName=win32u.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ImageChecksum=177,968; TimeDateStamp=0; DefaultBase=0x7ffc23eb0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=54; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ProcessID=0; TimeDateStamp=439,410,971; BuildTime=83/12/04 18:36:11.00...; OriginalFileName=Kernelbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=47; ImageBase=0x7ffc23ee0000; GuidSig=44c8ec9a-a0ea-4f98-d...; Age=1; PDBFileName=kernelbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=168; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ImageChecksum=2,793,344; TimeDateStamp=0; DefaultBase=0x7ffc23ee0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ProcessID=0; TimeDateStamp=1,868,443,751; BuildTime=29/03/17 12:09:11.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc24190000; GuidSig=e5a785df-0333-6a66-6...; Age=1; PDBFileName=gdi32full.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ImageChecksum=1,696,264; TimeDateStamp=0; DefaultBase=0x7ffc24190000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24330000; ImageSize=376,832; ProcessID=0; TimeDateStamp=1,670,486,148; BuildTime=22/12/08 07:55:48.00...; OriginalFileName=WINTRUST.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24330000; GuidSig=ef819cd6-e971-2b01-0...; Age=1; PDBFileName=wintrust.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24330000; ImageSize=376,832; ImageChecksum=380,837; TimeDateStamp=0; DefaultBase=0x7ffc24330000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=66; ImageBase=0x7ffc24390000; ImageSize=528,384; ProcessID=0; TimeDateStamp=1,774,320,825; BuildTime=26/03/24 02:53:45.00...; OriginalFileName=bcryptprimitives.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=53; ImageBase=0x7ffc24390000; GuidSig=54a1b493-8222-f67e-4...; Age=1; PDBFileName=bcryptprimitives.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=180; ImageBase=0x7ffc24390000; ImageSize=528,384; ImageChecksum=562,796; TimeDateStamp=0; DefaultBase=0x7ffc24390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=52; ImageBase=0x7ffc24420000; ImageSize=647,168; ProcessID=0; TimeDateStamp=545,597,548; BuildTime=87/04/16 18:52:28.00...; OriginalFileName=msvcp_win.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc24420000; GuidSig=de65fef9-16bb-6b73-d...; Age=1; PDBFileName=msvcp_win.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc24420000; ImageSize=647,168; ImageChecksum=686,408; TimeDateStamp=0; DefaultBase=0x7ffc24420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ProcessID=0; TimeDateStamp=135,099,696; BuildTime=74/04/13 15:41:36.00...; OriginalFileName=CRYPT32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc244c0000; GuidSig=8c840cbc-1c63-bfb7-6...; Age=1; PDBFileName=crypt32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ImageChecksum=1,341,835; TimeDateStamp=0; DefaultBase=0x7ffc244c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ProcessID=0; TimeDateStamp=1,691,891,946; BuildTime=23/08/13 01:59:06.00...; OriginalFileName=COMBASE.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc246c0000; GuidSig=d15b0ee4-2a16-5244-2...; Age=1; PDBFileName=combase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ImageChecksum=3,387,881; TimeDateStamp=0; DefaultBase=0x7ffc246c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24b30000; ImageSize=667,648; ProcessID=0; TimeDateStamp=-1,762,261,787; BuildTime=50/04/04 17:18:29.00...; OriginalFileName=advapi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24b30000; GuidSig=549260e6-7474-8391-e...; Age=1; PDBFileName=advapi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24b30000; ImageSize=667,648; ImageChecksum=662,904; TimeDateStamp=0; DefaultBase=0x7ffc24b30000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24be0000; ImageSize=729,088; ProcessID=0; TimeDateStamp=775,814,378; BuildTime=94/08/02 07:59:38.00...; OriginalFileName=kernel32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24be0000; GuidSig=47a44f0c-c47f-b6a1-f...; Age=1; PDBFileName=kernel32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24be0000; ImageSize=729,088; ImageChecksum=723,980; TimeDateStamp=0; DefaultBase=0x7ffc24be0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc24d40000; ImageSize=335,872; ProcessID=0; TimeDateStamp=-125,797,471; BuildTime=02/02/12 06:43:45.00...; OriginalFileName=SHLWAPI.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24d40000; GuidSig=8b7db15a-0b89-93df-4...; Age=1; PDBFileName=shlwapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc24d40000; ImageSize=335,872; ImageChecksum=385,032; TimeDateStamp=0; DefaultBase=0x7ffc24d40000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24da0000; ImageSize=155,648; ProcessID=0; TimeDateStamp=-1,867,374,302; BuildTime=46/12/05 03:23:14.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc24da0000; GuidSig=209ad405-837d-061e-f...; Age=1; PDBFileName=gdi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc24da0000; ImageSize=155,648; ImageChecksum=194,403; TimeDateStamp=0; DefaultBase=0x7ffc24da0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24dd0000; ImageSize=483,328; ProcessID=0; TimeDateStamp=2,094,009,598; BuildTime=36/05/10 05:19:58.00...; OriginalFileName=COML2.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc24dd0000; GuidSig=1b7a443a-a66f-075a-5...; Age=1; PDBFileName=coml2.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc24dd0000; ImageSize=483,328; ImageChecksum=521,990; TimeDateStamp=0; DefaultBase=0x7ffc24dd0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc25390000; ImageSize=647,168; ProcessID=0; TimeDateStamp=-172,101,673; BuildTime=00/08/25 08:27:03.00...; OriginalFileName=msvcrt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc25390000; GuidSig=1fea8db6-b57f-5fbf-a...; Age=1; PDBFileName=msvcrt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc25390000; ImageSize=647,168; ImageChecksum=678,174; TimeDateStamp=0; DefaultBase=0x7ffc25390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc25430000; ImageSize=1,400,832; ProcessID=0; TimeDateStamp=1,171,436,857; BuildTime=07/02/14 07:07:37.00...; OriginalFileName=OLE32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc25430000; GuidSig=ec385cee-495b-f162-5...; Age=1; PDBFileName=ole32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc25430000; ImageSize=1,400,832; ImageChecksum=1,434,873; TimeDateStamp=0; DefaultBase=0x7ffc25430000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc25590000; ImageSize=618,496; ProcessID=0; TimeDateStamp=-136,044,297; BuildTime=01/10/16 16:23:19.00...; OriginalFileName=sechost.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc25590000; GuidSig=0f733965-b12f-7923-b...; Age=1; PDBFileName=sechost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc25590000; ImageSize=618,496; ImageChecksum=662,974; TimeDateStamp=0; DefaultBase=0x7ffc25590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc25630000; ImageSize=663,552; ProcessID=0; TimeDateStamp=-1,794,760,561; BuildTime=49/03/24 13:52:15.00...; OriginalFileName=CLBCATQ.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc25630000; GuidSig=da759f99-b2bb-75c2-1...; Age=1; PDBFileName=CLBCatQ.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc25630000; ImageSize=663,552; ImageChecksum=684,075; TimeDateStamp=0; DefaultBase=0x7ffc25630000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc256e0000; ImageSize=692,224; ProcessID=0; TimeDateStamp=1,221,584,444; BuildTime=08/09/16 17:00:44.00...; OriginalFileName=SHCORE.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc256e0000; GuidSig=3921dcf6-eafa-cc85-7...; Age=1; PDBFileName=shcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc256e0000; ImageSize=692,224; ImageChecksum=745,271; TimeDateStamp=0; DefaultBase=0x7ffc256e0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc25ea0000; ImageSize=802,816; ProcessID=0; TimeDateStamp=-1,108,332,853; BuildTime=70/12/24 08:14:03.00...; OriginalFileName=OLEAUT32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc25ea0000; GuidSig=2dfa946d-f7be-e09f-3...; Age=1; PDBFileName=oleaut32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc25ea0000; ImageSize=802,816; ImageChecksum=845,595; TimeDateStamp=0; DefaultBase=0x7ffc25ea0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ProcessID=0; TimeDateStamp=87,082,528; BuildTime=72/10/04 21:35:28.00...; OriginalFileName=rpcrt4.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc25f70000; GuidSig=a3028d6b-45da-0062-4...; Age=1; PDBFileName=rpcrt4.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ImageChecksum=1,199,090; TimeDateStamp=0; DefaultBase=0x7ffc25f70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=40; ImageBase=0x7ffc26410000; ImageSize=32,768; ProcessID=0; TimeDateStamp=1,693,425,343; BuildTime=23/08/30 19:55:43.00...; OriginalFileName=nsi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=40; ImageBase=0x7ffc26410000; GuidSig=7c67fb7d-8805-fe58-4...; Age=1; PDBFileName=nsi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=154; ImageBase=0x7ffc26410000; ImageSize=32,768; ImageChecksum=32,664; TimeDateStamp=0; DefaultBase=0x7ffc26410000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ProcessID=0; TimeDateStamp=-1,431,966,518; BuildTime=60/09/21 13:59:38.00...; OriginalFileName=user32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc26420000; GuidSig=bc4cc7cc-9a33-b8a6-6...; Age=1; PDBFileName=user32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ImageChecksum=1,700,392; TimeDateStamp=0; DefaultBase=0x7ffc26420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ProcessID=0; TimeDateStamp=-1,523,876,758; BuildTime=57/10/23 19:22:18.00...; OriginalFileName=ntdll.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc26600000; GuidSig=b54f3499-813e-bcf1-3...; Age=1; PDBFileName=ntdll.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=104; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ImageChecksum=2,058,600; TimeDateStamp=0; DefaultBase=0x7ffc26600000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: Windows Kernel/Process/DCStart PID=428; TID=-1; PName=fontdrvhost; ProceNum=4; DataLen=128; ProcessID=428; ParentID=764; ImageFileName=fontdrvhost.exe; PageDirectoryBase=0x101aa74000; Flags=None; SessionID=0; ExitStatus=259; UniqueProcessKey=0xffffc50f60d8c2c0; CommandLine="fontdrvhost.exe"; PackageFullName=; ApplicationID=; 
EVENT 0.000: KernelTraceControl/ImageID PID=428; TID=-1; PName=fontdrvhost; ProceNum=4; DataLen=56; ImageBase=0x7ff738b60000; ImageSize=839,680; ProcessID=0; TimeDateStamp=-832,071,347; BuildTime=79/09/25 19:32:29.00...; OriginalFileName=fontdrvhost.exe; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=428; TID=-1; PName=fontdrvhost; ProceNum=4; DataLen=48; ImageBase=0x7ff738b60000; GuidSig=40f9301e-e776-2d37-b...; Age=1; PDBFileName=fontdrvhost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=428; TID=-1; PName=fontdrvhost; ProceNum=4; DataLen=170; ImageBase=0x7ff738b60000; ImageSize=839,680; ImageChecksum=844,122; TimeDateStamp=0; DefaultBase=0x7ff738b60000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=428; TID=-1; PName=fontdrvhost; ProceNum=4; DataLen=50; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ProcessID=0; TimeDateStamp=1,555,946,369; BuildTime=19/04/22 15:19:29.00...; OriginalFileName=ucrtbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=428; TID=-1; PName=fontdrvhost; ProceNum=4; DataLen=45; ImageBase=0x7ffc23d90000; GuidSig=faceb612-020d-68fb-b...; Age=1; PDBFileName=ucrtbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=428; TID=-1; PName=fontdrvhost; ProceNum=4; DataLen=164; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ImageChecksum=1,052,117; TimeDateStamp=0; DefaultBase=0x7ffc23d90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=428; TID=-1; PName=fontdrvhost; ProceNum=4; DataLen=46; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ProcessID=0; TimeDateStamp=1,396,962,555; BuildTime=14/04/08 13:09:15.00...; OriginalFileName=Win32u.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=428; TID=-1; PName=fontdrvhost; ProceNum=4; DataLen=43; ImageBase=0x7ffc23eb0000; GuidSig=bc2e49ab-e46d-2e93-b...; Age=1; PDBFileName=win32u.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=428; TID=-1; PName=fontdrvhost; ProceNum=4; DataLen=160; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ImageChecksum=177,968; TimeDateStamp=0; DefaultBase=0x7ffc23eb0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=428; TID=-1; PName=fontdrvhost; ProceNum=4; DataLen=54; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ProcessID=0; TimeDateStamp=439,410,971; BuildTime=83/12/04 18:36:11.00...; OriginalFileName=Kernelbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=428; TID=-1; PName=fontdrvhost; ProceNum=4; DataLen=47; ImageBase=0x7ffc23ee0000; GuidSig=44c8ec9a-a0ea-4f98-d...; Age=1; PDBFileName=kernelbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=428; TID=-1; PName=fontdrvhost; ProceNum=4; DataLen=168; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ImageChecksum=2,793,344; TimeDateStamp=0; DefaultBase=0x7ffc23ee0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=428; TID=-1; PName=fontdrvhost; ProceNum=4; DataLen=52; ImageBase=0x7ffc24420000; ImageSize=647,168; ProcessID=0; TimeDateStamp=545,597,548; BuildTime=87/04/16 18:52:28.00...; OriginalFileName=msvcp_win.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=428; TID=-1; PName=fontdrvhost; ProceNum=4; DataLen=46; ImageBase=0x7ffc24420000; GuidSig=de65fef9-16bb-6b73-d...; Age=1; PDBFileName=msvcp_win.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=428; TID=-1; PName=fontdrvhost; ProceNum=4; DataLen=166; ImageBase=0x7ffc24420000; ImageSize=647,168; ImageChecksum=686,408; TimeDateStamp=0; DefaultBase=0x7ffc24420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=428; TID=-1; PName=fontdrvhost; ProceNum=4; DataLen=50; ImageBase=0x7ffc24be0000; ImageSize=729,088; ProcessID=0; TimeDateStamp=775,814,378; BuildTime=94/08/02 07:59:38.00...; OriginalFileName=kernel32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=428; TID=-1; PName=fontdrvhost; ProceNum=4; DataLen=45; ImageBase=0x7ffc24be0000; GuidSig=47a44f0c-c47f-b6a1-f...; Age=1; PDBFileName=kernel32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=428; TID=-1; PName=fontdrvhost; ProceNum=4; DataLen=164; ImageBase=0x7ffc24be0000; ImageSize=729,088; ImageChecksum=723,980; TimeDateStamp=0; DefaultBase=0x7ffc24be0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=428; TID=-1; PName=fontdrvhost; ProceNum=4; DataLen=44; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ProcessID=0; TimeDateStamp=-1,523,876,758; BuildTime=57/10/23 19:22:18.00...; OriginalFileName=ntdll.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=428; TID=-1; PName=fontdrvhost; ProceNum=4; DataLen=42; ImageBase=0x7ffc26600000; GuidSig=b54f3499-813e-bcf1-3...; Age=1; PDBFileName=ntdll.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=428; TID=-1; PName=fontdrvhost; ProceNum=4; DataLen=158; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ImageChecksum=2,058,600; TimeDateStamp=0; DefaultBase=0x7ffc26600000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: Windows Kernel/Process/DCStart PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=1107; ProcessID=616; ParentID=836; ImageFileName=WUDFHost.exe; PageDirectoryBase=0x101a852000; Flags=None; SessionID=0; ExitStatus=259; UniqueProcessKey=0xffffc50f60d8a080; CommandLine="C:\Windows\System32...; PackageFullName=; ApplicationID=; 
EVENT 0.000: KernelTraceControl/ImageID PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=50; ImageBase=0x7ff648970000; ImageSize=274,432; ProcessID=0; TimeDateStamp=781,583,733; BuildTime=94/10/08 02:35:33.00...; OriginalFileName=WUDFHost.exe; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=45; ImageBase=0x7ff648970000; GuidSig=41850bd0-1d73-6420-5...; Age=1; PDBFileName=WUDFHost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=164; ImageBase=0x7ff648970000; ImageSize=274,432; ImageChecksum=319,295; TimeDateStamp=0; DefaultBase=0x7ff648970000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=54; ImageBase=0x7ffc21380000; ImageSize=679,936; ProcessID=0; TimeDateStamp=-622,190,562; BuildTime=86/05/20 23:45:34.00...; OriginalFileName=Wudfx02000.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=47; ImageBase=0x7ffc21380000; GuidSig=6248d5fa-5270-860a-8...; Age=1; PDBFileName=Wudfx02000.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=168; ImageBase=0x7ffc21380000; ImageSize=679,936; ImageChecksum=686,231; TimeDateStamp=0; DefaultBase=0x7ffc21380000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=52; ImageBase=0x7ffc21430000; ImageSize=69,632; ProcessID=0; TimeDateStamp=-1,699,043,949; BuildTime=52/04/05 09:49:07.00...; OriginalFileName=HelloFace.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=46; ImageBase=0x7ffc21430000; GuidSig=cdca5dc6-c0fc-a519-b...; Age=1; PDBFileName=HelloFace.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=192; ImageBase=0x7ffc21430000; ImageSize=69,632; ImageChecksum=65,502; TimeDateStamp=0; DefaultBase=0x7ffc21430000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=58; ImageBase=0x7ffc21fd0000; ImageSize=192,512; ProcessID=0; TimeDateStamp=-639,405,391; BuildTime=85/11/02 17:51:45.00...; OriginalFileName=WUDFPlatform.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=49; ImageBase=0x7ffc21fd0000; GuidSig=6eb7b8bc-4f80-c9e5-f...; Age=1; PDBFileName=WUDFPlatform.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=172; ImageBase=0x7ffc21fd0000; ImageSize=192,512; ImageChecksum=247,581; TimeDateStamp=0; DefaultBase=0x7ffc21fd0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=48; ImageBase=0x7ffc22ff0000; ImageSize=2,048,000; ProcessID=0; TimeDateStamp=-531,918,104; BuildTime=89/03/30 19:26:32.00...; OriginalFileName=DBGHELP.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=44; ImageBase=0x7ffc22ff0000; GuidSig=3136b409-d05f-c857-5...; Age=1; PDBFileName=dbghelp.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=162; ImageBase=0x7ffc22ff0000; ImageSize=2,048,000; ImageChecksum=1,952,331; TimeDateStamp=0; DefaultBase=0x7ffc22ff0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=54; ImageBase=0x7ffc232d0000; ImageSize=172,032; ProcessID=0; TimeDateStamp=564,545,050; BuildTime=87/11/22 02:04:10.00...; OriginalFileName=devinfoset.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=43; ImageBase=0x7ffc232d0000; GuidSig=bf3fb10c-179d-a551-d...; Age=1; PDBFileName=devobj.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=160; ImageBase=0x7ffc232d0000; ImageSize=172,032; ImageChecksum=212,309; TimeDateStamp=0; DefaultBase=0x7ffc232d0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=48; ImageBase=0x7ffc233c0000; ImageSize=192,512; ProcessID=0; TimeDateStamp=621,642,292; BuildTime=89/09/12 22:24:52.00...; OriginalFileName=sspicli.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=44; ImageBase=0x7ffc233c0000; GuidSig=823d5a41-e0d7-02a7-9...; Age=1; PDBFileName=sspicli.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=162; ImageBase=0x7ffc233c0000; ImageSize=192,512; ImageChecksum=235,306; TimeDateStamp=0; DefaultBase=0x7ffc233c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=62; ImageBase=0x7ffc23530000; ImageSize=69,632; ProcessID=0; TimeDateStamp=96,400,242; BuildTime=73/01/20 17:50:42.00...; OriginalFileName=kernel.appcore.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=51; ImageBase=0x7ffc23530000; GuidSig=b44a2a63-8a5c-a8d8-1...; Age=1; PDBFileName=Kernel.Appcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=176; ImageBase=0x7ffc23530000; ImageSize=69,632; ImageChecksum=91,565; TimeDateStamp=0; DefaultBase=0x7ffc23530000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=50; ImageBase=0x7ffc235c0000; ImageSize=303,104; ProcessID=0; TimeDateStamp=-1,347,769,430; BuildTime=63/05/24 02:04:26.00...; OriginalFileName=CFGMGR32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=45; ImageBase=0x7ffc235c0000; GuidSig=c951ee8e-a9b3-8ebf-a...; Age=1; PDBFileName=cfgmgr32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=164; ImageBase=0x7ffc235c0000; ImageSize=303,104; ImageChecksum=322,106; TimeDateStamp=0; DefaultBase=0x7ffc235c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=50; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ProcessID=0; TimeDateStamp=1,555,946,369; BuildTime=19/04/22 15:19:29.00...; OriginalFileName=ucrtbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=45; ImageBase=0x7ffc23d90000; GuidSig=faceb612-020d-68fb-b...; Age=1; PDBFileName=ucrtbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=164; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ImageChecksum=1,052,117; TimeDateStamp=0; DefaultBase=0x7ffc23d90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=54; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ProcessID=0; TimeDateStamp=439,410,971; BuildTime=83/12/04 18:36:11.00...; OriginalFileName=Kernelbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=47; ImageBase=0x7ffc23ee0000; GuidSig=44c8ec9a-a0ea-4f98-d...; Age=1; PDBFileName=kernelbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=168; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ImageChecksum=2,793,344; TimeDateStamp=0; DefaultBase=0x7ffc23ee0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=66; ImageBase=0x7ffc24390000; ImageSize=528,384; ProcessID=0; TimeDateStamp=1,774,320,825; BuildTime=26/03/24 02:53:45.00...; OriginalFileName=bcryptprimitives.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=53; ImageBase=0x7ffc24390000; GuidSig=54a1b493-8222-f67e-4...; Age=1; PDBFileName=bcryptprimitives.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=180; ImageBase=0x7ffc24390000; ImageSize=528,384; ImageChecksum=562,796; TimeDateStamp=0; DefaultBase=0x7ffc24390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=48; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ProcessID=0; TimeDateStamp=1,691,891,946; BuildTime=23/08/13 01:59:06.00...; OriginalFileName=COMBASE.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=44; ImageBase=0x7ffc246c0000; GuidSig=d15b0ee4-2a16-5244-2...; Age=1; PDBFileName=combase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=162; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ImageChecksum=3,387,881; TimeDateStamp=0; DefaultBase=0x7ffc246c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24b30000; ImageSize=667,648; ProcessID=0; TimeDateStamp=-1,762,261,787; BuildTime=50/04/04 17:18:29.00...; OriginalFileName=advapi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24b30000; GuidSig=549260e6-7474-8391-e...; Age=1; PDBFileName=advapi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24b30000; ImageSize=667,648; ImageChecksum=662,904; TimeDateStamp=0; DefaultBase=0x7ffc24b30000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24be0000; ImageSize=729,088; ProcessID=0; TimeDateStamp=775,814,378; BuildTime=94/08/02 07:59:38.00...; OriginalFileName=kernel32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24be0000; GuidSig=47a44f0c-c47f-b6a1-f...; Age=1; PDBFileName=kernel32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24be0000; ImageSize=729,088; ImageChecksum=723,980; TimeDateStamp=0; DefaultBase=0x7ffc24be0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=46; ImageBase=0x7ffc25390000; ImageSize=647,168; ProcessID=0; TimeDateStamp=-172,101,673; BuildTime=00/08/25 08:27:03.00...; OriginalFileName=msvcrt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=43; ImageBase=0x7ffc25390000; GuidSig=1fea8db6-b57f-5fbf-a...; Age=1; PDBFileName=msvcrt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=160; ImageBase=0x7ffc25390000; ImageSize=647,168; ImageChecksum=678,174; TimeDateStamp=0; DefaultBase=0x7ffc25390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=48; ImageBase=0x7ffc25590000; ImageSize=618,496; ProcessID=0; TimeDateStamp=-136,044,297; BuildTime=01/10/16 16:23:19.00...; OriginalFileName=sechost.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=44; ImageBase=0x7ffc25590000; GuidSig=0f733965-b12f-7923-b...; Age=1; PDBFileName=sechost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=162; ImageBase=0x7ffc25590000; ImageSize=618,496; ImageChecksum=662,974; TimeDateStamp=0; DefaultBase=0x7ffc25590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=46; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ProcessID=0; TimeDateStamp=87,082,528; BuildTime=72/10/04 21:35:28.00...; OriginalFileName=rpcrt4.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=43; ImageBase=0x7ffc25f70000; GuidSig=a3028d6b-45da-0062-4...; Age=1; PDBFileName=rpcrt4.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=160; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ImageChecksum=1,199,090; TimeDateStamp=0; DefaultBase=0x7ffc25f70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=44; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ProcessID=0; TimeDateStamp=-1,523,876,758; BuildTime=57/10/23 19:22:18.00...; OriginalFileName=ntdll.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=42; ImageBase=0x7ffc26600000; GuidSig=b54f3499-813e-bcf1-3...; Age=1; PDBFileName=ntdll.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=616; TID=-1; PName=WUDFHost; ProceNum=2; DataLen=158; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ImageChecksum=2,058,600; TimeDateStamp=0; DefaultBase=0x7ffc26600000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: Windows Kernel/Process/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=107; ProcessID=1,036; ParentID=756; ImageFileName=winlogon.exe; PageDirectoryBase=0x1023905000; Flags=None; SessionID=1; ExitStatus=259; UniqueProcessKey=0xffffc50f60e52080; CommandLine=winlogon.exe; PackageFullName=; ApplicationID=; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=50; ImageBase=0x7ff7a3c10000; ImageSize=864,256; ProcessID=0; TimeDateStamp=876,397,638; BuildTime=97/10/09 11:47:18.00...; OriginalFileName=WINLOGON.EXE; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=45; ImageBase=0x7ff7a3c10000; GuidSig=66d32917-af3f-a7ed-1...; Age=1; PDBFileName=winlogon.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=164; ImageBase=0x7ff7a3c10000; ImageSize=864,256; ImageChecksum=906,782; TimeDateStamp=0; DefaultBase=0x7ff7a3c10000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=54; ImageBase=0x7ffc1e970000; ImageSize=86,016; ProcessID=0; TimeDateStamp=525,713,861; BuildTime=86/08/29 15:37:41.00...; OriginalFileName=usermgrcli.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=47; ImageBase=0x7ffc1e970000; GuidSig=26f569a5-8783-27b0-0...; Age=1; PDBFileName=usermgrcli.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=168; ImageBase=0x7ffc1e970000; ImageSize=86,016; ImageChecksum=138,081; TimeDateStamp=0; DefaultBase=0x7ffc1e970000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=40; ImageBase=0x7ffc1eff0000; ImageSize=110,592; ProcessID=0; TimeDateStamp=1,471,302,955; BuildTime=16/08/15 23:15:55.00...; OriginalFileName=mpr.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=40; ImageBase=0x7ffc1eff0000; GuidSig=6b495f2d-5e3d-02c4-0...; Age=1; PDBFileName=mpr.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=154; ImageBase=0x7ffc1eff0000; ImageSize=110,592; ImageChecksum=138,892; TimeDateStamp=0; DefaultBase=0x7ffc1eff0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=58; ImageBase=0x7ffc1f260000; ImageSize=565,248; ProcessID=0; TimeDateStamp=-2,109,210,886; BuildTime=39/04/07 02:33:30.00...; OriginalFileName=msvcp110_win.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=49; ImageBase=0x7ffc1f260000; GuidSig=8b3306f1-7c4d-d8b8-0...; Age=1; PDBFileName=msvcp110_win.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=172; ImageBase=0x7ffc1f260000; ImageSize=565,248; ImageChecksum=591,592; TimeDateStamp=0; DefaultBase=0x7ffc1f260000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=44; ImageBase=0x7ffc1f2f0000; ImageSize=847,872; ProcessID=0; TimeDateStamp=-1,232,270,509; BuildTime=67/01/19 21:06:27.00...; OriginalFileName=dsreg.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=42; ImageBase=0x7ffc1f2f0000; GuidSig=f987b292-17e2-c30f-1...; Age=1; PDBFileName=dsreg.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=158; ImageBase=0x7ffc1f2f0000; ImageSize=847,872; ImageChecksum=860,365; TimeDateStamp=0; DefaultBase=0x7ffc1f2f0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=48; ImageBase=0x7ffc20960000; ImageSize=585,728; ProcessID=0; TimeDateStamp=-9,148,100; BuildTime=05/10/24 09:19:56.00...; OriginalFileName=Apphelp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=44; ImageBase=0x7ffc20960000; GuidSig=b37f976c-be76-5dae-9...; Age=1; PDBFileName=apphelp.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=162; ImageBase=0x7ffc20960000; ImageSize=585,728; ImageChecksum=594,685; TimeDateStamp=0; DefaultBase=0x7ffc20960000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=48; ImageBase=0x7ffc20a40000; ImageSize=77,824; ProcessID=0; TimeDateStamp=1,473,610,242; BuildTime=16/09/11 16:10:42.00...; OriginalFileName=DWMInit.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=44; ImageBase=0x7ffc20a40000; GuidSig=a33eff4d-8b4f-7215-0...; Age=1; PDBFileName=dwminit.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=162; ImageBase=0x7ffc20a40000; ImageSize=77,824; ImageChecksum=116,411; TimeDateStamp=0; DefaultBase=0x7ffc20a40000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=48; ImageBase=0x7ffc20ab0000; ImageSize=626,688; ProcessID=0; TimeDateStamp=-35,801,546; BuildTime=04/12/19 21:35:50.00...; OriginalFileName=UxTheme.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=44; ImageBase=0x7ffc20ab0000; GuidSig=46b4bea9-d4a7-aa5b-6...; Age=1; PDBFileName=UxTheme.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=162; ImageBase=0x7ffc20ab0000; ImageSize=626,688; ImageChecksum=614,047; TimeDateStamp=0; DefaultBase=0x7ffc20ab0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=46; ImageBase=0x7ffc20b50000; ImageSize=118,784; ProcessID=0; TimeDateStamp=1,641,424,195; BuildTime=22/01/05 23:09:55.00...; OriginalFileName=UXINIT.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=43; ImageBase=0x7ffc20b50000; GuidSig=028973b1-4658-42db-f...; Age=1; PDBFileName=UXInit.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=160; ImageBase=0x7ffc20b50000; ImageSize=118,784; ImageChecksum=126,892; TimeDateStamp=0; DefaultBase=0x7ffc20b50000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=46; ImageBase=0x7ffc20ed0000; ImageSize=184,320; ProcessID=0; TimeDateStamp=-387,540,599; BuildTime=93/10/26 20:18:17.00...; OriginalFileName=dwmapi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=43; ImageBase=0x7ffc20ed0000; GuidSig=0d061d68-1544-eff4-4...; Age=1; PDBFileName=dwmapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=160; ImageBase=0x7ffc20ed0000; ImageSize=184,320; ImageChecksum=211,409; TimeDateStamp=0; DefaultBase=0x7ffc20ed0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=46; ImageBase=0x7ffc21e20000; ImageSize=188,416; ProcessID=0; TimeDateStamp=157,235,662; BuildTime=74/12/25 20:34:22.00...; OriginalFileName=fwbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=43; ImageBase=0x7ffc21e20000; GuidSig=89b14238-fca7-5326-c...; Age=1; PDBFileName=fwbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=160; ImageBase=0x7ffc21e20000; ImageSize=188,416; ImageChecksum=220,140; TimeDateStamp=0; DefaultBase=0x7ffc21e20000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=56; ImageBase=0x7ffc21e80000; ImageSize=573,440; ProcessID=0; TimeDateStamp=775,848,894; BuildTime=94/08/02 17:34:54.00...; OriginalFileName=FirewallAPI.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=48; ImageBase=0x7ffc21e80000; GuidSig=f1e3fecf-4859-996c-0...; Age=1; PDBFileName=FirewallAPI.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=170; ImageBase=0x7ffc21e80000; ImageSize=573,440; ImageChecksum=603,289; TimeDateStamp=0; DefaultBase=0x7ffc21e80000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=48; ImageBase=0x7ffc21f10000; ImageSize=159,744; ProcessID=0; TimeDateStamp=1,559,901,462; BuildTime=19/06/07 09:57:42.00...; OriginalFileName=profext.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=44; ImageBase=0x7ffc21f10000; GuidSig=05bc393b-6d24-9e52-f...; Age=1; PDBFileName=profext.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=162; ImageBase=0x7ffc21f10000; ImageSize=159,744; ImageChecksum=184,416; TimeDateStamp=0; DefaultBase=0x7ffc21f10000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=46; ImageBase=0x7ffc21f70000; ImageSize=376,832; ProcessID=0; TimeDateStamp=43,988,838; BuildTime=71/05/25 03:07:18.00...; OriginalFileName=winsta.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=43; ImageBase=0x7ffc21f70000; GuidSig=b854bf05-e0a2-5b01-7...; Age=1; PDBFileName=winsta.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=160; ImageBase=0x7ffc21f70000; ImageSize=376,832; ImageChecksum=387,708; TimeDateStamp=0; DefaultBase=0x7ffc21f70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=44; ImageBase=0x7ffc22000000; ImageSize=303,104; ProcessID=0; TimeDateStamp=-1,775,967,220; BuildTime=49/10/28 02:14:36.00...; OriginalFileName=authz.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=42; ImageBase=0x7ffc22000000; GuidSig=f7ab524f-49bc-eb09-0...; Age=1; PDBFileName=authz.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=158; ImageBase=0x7ffc22000000; ImageSize=303,104; ImageChecksum=299,134; TimeDateStamp=0; DefaultBase=0x7ffc22000000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=44; ImageBase=0x7ffc222c0000; ImageSize=40,960; ProcessID=0; TimeDateStamp=-929,607,282; BuildTime=76/08/22 22:13:34.00...; OriginalFileName=dpapi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=42; ImageBase=0x7ffc222c0000; GuidSig=6f32740c-1701-84ad-b...; Age=1; PDBFileName=dpapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=158; ImageBase=0x7ffc222c0000; ImageSize=40,960; ImageChecksum=43,532; TimeDateStamp=0; DefaultBase=0x7ffc222c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=50; ImageBase=0x7ffc22420000; ImageSize=237,568; ProcessID=0; TimeDateStamp=1,353,705,264; BuildTime=12/11/23 21:14:24.00...; OriginalFileName=iphlpapi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=45; ImageBase=0x7ffc22420000; GuidSig=a3177875-244a-46c8-b...; Age=1; PDBFileName=iphlpapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=164; ImageBase=0x7ffc22420000; ImageSize=237,568; ImageChecksum=252,735; TimeDateStamp=0; DefaultBase=0x7ffc22420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=46; ImageBase=0x7ffc22460000; ImageSize=827,392; ProcessID=0; TimeDateStamp=-1,912,355,972; BuildTime=45/07/02 12:28:44.00...; OriginalFileName=dnsapi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=43; ImageBase=0x7ffc22460000; GuidSig=77e3a024-129c-5dab-b...; Age=1; PDBFileName=dnsapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=160; ImageBase=0x7ffc22460000; ImageSize=827,392; ImageChecksum=850,901; TimeDateStamp=0; DefaultBase=0x7ffc22460000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=50; ImageBase=0x7ffc22530000; ImageSize=49,152; ProcessID=0; TimeDateStamp=2,074,299,887; BuildTime=35/09/25 02:24:47.00...; OriginalFileName=NETUTILS.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=45; ImageBase=0x7ffc22530000; GuidSig=5c5ce532-d78d-35ad-c...; Age=1; PDBFileName=netutils.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=164; ImageBase=0x7ffc22530000; ImageSize=49,152; ImageChecksum=85,437; TimeDateStamp=0; DefaultBase=0x7ffc22530000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=52; ImageBase=0x7ffc22890000; ImageSize=49,152; ProcessID=0; TimeDateStamp=-17,821,274; BuildTime=05/07/16 00:07:02.00...; OriginalFileName=cryptbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=46; ImageBase=0x7ffc22890000; GuidSig=7588b6a3-bd73-2904-7...; Age=1; PDBFileName=cryptbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=166; ImageBase=0x7ffc22890000; ImageSize=49,152; ImageChecksum=64,645; TimeDateStamp=0; DefaultBase=0x7ffc22890000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=46; ImageBase=0x7ffc22920000; ImageSize=94,208; ProcessID=0; TimeDateStamp=327,216,314; BuildTime=80/05/15 05:25:14.00...; OriginalFileName=WKSCLI.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=43; ImageBase=0x7ffc22920000; GuidSig=7ea191fe-cb13-d326-8...; Age=1; PDBFileName=wkscli.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=160; ImageBase=0x7ffc22920000; ImageSize=94,208; ImageChecksum=120,976; TimeDateStamp=0; DefaultBase=0x7ffc22920000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=48; ImageBase=0x7ffc22e10000; ImageSize=200,704; ProcessID=0; TimeDateStamp=-648,125,799; BuildTime=85/07/24 19:31:37.00...; OriginalFileName=ntmarta.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=44; ImageBase=0x7ffc22e10000; GuidSig=d28b6be6-17ca-2646-7...; Age=1; PDBFileName=ntmarta.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=162; ImageBase=0x7ffc22e10000; ImageSize=200,704; ImageChecksum=211,194; TimeDateStamp=0; DefaultBase=0x7ffc22e10000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=48; ImageBase=0x7ffc233c0000; ImageSize=192,512; ProcessID=0; TimeDateStamp=621,642,292; BuildTime=89/09/12 22:24:52.00...; OriginalFileName=sspicli.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=44; ImageBase=0x7ffc233c0000; GuidSig=823d5a41-e0d7-02a7-9...; Age=1; PDBFileName=sspicli.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=162; ImageBase=0x7ffc233c0000; ImageSize=192,512; ImageChecksum=235,306; TimeDateStamp=0; DefaultBase=0x7ffc233c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=48; ImageBase=0x7ffc233f0000; ImageSize=151,552; ProcessID=0; TimeDateStamp=-157,143,252; BuildTime=01/02/14 11:34:04.00...; OriginalFileName=userenv.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=44; ImageBase=0x7ffc233f0000; GuidSig=1a734def-8e54-a706-f...; Age=1; PDBFileName=userenv.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=162; ImageBase=0x7ffc233f0000; ImageSize=151,552; ImageChecksum=176,304; TimeDateStamp=0; DefaultBase=0x7ffc233f0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=44; ImageBase=0x7ffc234d0000; ImageSize=65,536; ProcessID=0; TimeDateStamp=-1,563,634,669; BuildTime=56/07/20 15:30:27.00...; OriginalFileName=umpdc.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=42; ImageBase=0x7ffc234d0000; GuidSig=1504cc55-3edb-4294-a...; Age=1; PDBFileName=UMPDC.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=158; ImageBase=0x7ffc234d0000; ImageSize=65,536; ImageChecksum=55,709; TimeDateStamp=0; DefaultBase=0x7ffc234d0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=50; ImageBase=0x7ffc234e0000; ImageSize=303,104; ProcessID=0; TimeDateStamp=-37,463,926; BuildTime=04/11/30 15:49:30.00...; OriginalFileName=POWRPROF.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=45; ImageBase=0x7ffc234e0000; GuidSig=bae22f43-6c95-a7d5-0...; Age=1; PDBFileName=powrprof.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=164; ImageBase=0x7ffc234e0000; ImageSize=303,104; ImageChecksum=321,827; TimeDateStamp=0; DefaultBase=0x7ffc234e0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=62; ImageBase=0x7ffc23530000; ImageSize=69,632; ProcessID=0; TimeDateStamp=96,400,242; BuildTime=73/01/20 17:50:42.00...; OriginalFileName=kernel.appcore.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=51; ImageBase=0x7ffc23530000; GuidSig=b44a2a63-8a5c-a8d8-1...; Age=1; PDBFileName=Kernel.Appcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=176; ImageBase=0x7ffc23530000; ImageSize=69,632; ImageChecksum=91,565; TimeDateStamp=0; DefaultBase=0x7ffc23530000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=48; ImageBase=0x7ffc23550000; ImageSize=126,976; ProcessID=0; TimeDateStamp=-87,365,952; BuildTime=03/05/03 02:09:04.00...; OriginalFileName=PROFAPI.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=44; ImageBase=0x7ffc23550000; GuidSig=d3e9e0b2-6dc3-e775-b...; Age=1; PDBFileName=profapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=162; ImageBase=0x7ffc23550000; ImageSize=126,976; ImageChecksum=153,678; TimeDateStamp=0; DefaultBase=0x7ffc23550000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=46; ImageBase=0x7ffc23570000; ImageSize=73,728; ProcessID=0; TimeDateStamp=-457,022,433; BuildTime=91/08/14 15:47:43.00...; OriginalFileName=msasn1.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=43; ImageBase=0x7ffc23570000; GuidSig=ff420efb-35b1-0aa7-6...; Age=1; PDBFileName=msasn1.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=160; ImageBase=0x7ffc23570000; ImageSize=73,728; ImageChecksum=79,097; TimeDateStamp=0; DefaultBase=0x7ffc23570000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=46; ImageBase=0x7ffc23590000; ImageSize=155,648; ProcessID=0; TimeDateStamp=-1,248,142,761; BuildTime=66/07/20 04:08:55.00...; OriginalFileName=bcrypt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=43; ImageBase=0x7ffc23590000; GuidSig=1a472182-0367-8386-d...; Age=1; PDBFileName=bcrypt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=160; ImageBase=0x7ffc23590000; ImageSize=155,648; ImageChecksum=157,312; TimeDateStamp=0; DefaultBase=0x7ffc23590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=50; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ProcessID=0; TimeDateStamp=1,555,946,369; BuildTime=19/04/22 15:19:29.00...; OriginalFileName=ucrtbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=45; ImageBase=0x7ffc23d90000; GuidSig=faceb612-020d-68fb-b...; Age=1; PDBFileName=ucrtbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=164; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ImageChecksum=1,052,117; TimeDateStamp=0; DefaultBase=0x7ffc23d90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=48; ImageBase=0x7ffc23e90000; ImageSize=94,208; ProcessID=0; TimeDateStamp=-1,525,668,879; BuildTime=57/10/03 01:33:37.00...; OriginalFileName=cryptsp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=44; ImageBase=0x7ffc23e90000; GuidSig=7618debe-ac0f-9998-7...; Age=1; PDBFileName=cryptsp.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=162; ImageBase=0x7ffc23e90000; ImageSize=94,208; ImageChecksum=133,544; TimeDateStamp=0; DefaultBase=0x7ffc23e90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=46; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ProcessID=0; TimeDateStamp=1,396,962,555; BuildTime=14/04/08 13:09:15.00...; OriginalFileName=Win32u.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=43; ImageBase=0x7ffc23eb0000; GuidSig=bc2e49ab-e46d-2e93-b...; Age=1; PDBFileName=win32u.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=160; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ImageChecksum=177,968; TimeDateStamp=0; DefaultBase=0x7ffc23eb0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=54; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ProcessID=0; TimeDateStamp=439,410,971; BuildTime=83/12/04 18:36:11.00...; OriginalFileName=Kernelbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=47; ImageBase=0x7ffc23ee0000; GuidSig=44c8ec9a-a0ea-4f98-d...; Age=1; PDBFileName=kernelbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=168; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ImageChecksum=2,793,344; TimeDateStamp=0; DefaultBase=0x7ffc23ee0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=44; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ProcessID=0; TimeDateStamp=1,868,443,751; BuildTime=29/03/17 12:09:11.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=46; ImageBase=0x7ffc24190000; GuidSig=e5a785df-0333-6a66-6...; Age=1; PDBFileName=gdi32full.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=166; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ImageChecksum=1,696,264; TimeDateStamp=0; DefaultBase=0x7ffc24190000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=66; ImageBase=0x7ffc24390000; ImageSize=528,384; ProcessID=0; TimeDateStamp=1,774,320,825; BuildTime=26/03/24 02:53:45.00...; OriginalFileName=bcryptprimitives.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=53; ImageBase=0x7ffc24390000; GuidSig=54a1b493-8222-f67e-4...; Age=1; PDBFileName=bcryptprimitives.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=180; ImageBase=0x7ffc24390000; ImageSize=528,384; ImageChecksum=562,796; TimeDateStamp=0; DefaultBase=0x7ffc24390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=52; ImageBase=0x7ffc24420000; ImageSize=647,168; ProcessID=0; TimeDateStamp=545,597,548; BuildTime=87/04/16 18:52:28.00...; OriginalFileName=msvcp_win.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=46; ImageBase=0x7ffc24420000; GuidSig=de65fef9-16bb-6b73-d...; Age=1; PDBFileName=msvcp_win.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=166; ImageBase=0x7ffc24420000; ImageSize=647,168; ImageChecksum=686,408; TimeDateStamp=0; DefaultBase=0x7ffc24420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=48; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ProcessID=0; TimeDateStamp=135,099,696; BuildTime=74/04/13 15:41:36.00...; OriginalFileName=CRYPT32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=44; ImageBase=0x7ffc244c0000; GuidSig=8c840cbc-1c63-bfb7-6...; Age=1; PDBFileName=crypt32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=162; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ImageChecksum=1,341,835; TimeDateStamp=0; DefaultBase=0x7ffc244c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=48; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ProcessID=0; TimeDateStamp=1,691,891,946; BuildTime=23/08/13 01:59:06.00...; OriginalFileName=COMBASE.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=44; ImageBase=0x7ffc246c0000; GuidSig=d15b0ee4-2a16-5244-2...; Age=1; PDBFileName=combase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=162; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ImageChecksum=3,387,881; TimeDateStamp=0; DefaultBase=0x7ffc246c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=50; ImageBase=0x7ffc24b30000; ImageSize=667,648; ProcessID=0; TimeDateStamp=-1,762,261,787; BuildTime=50/04/04 17:18:29.00...; OriginalFileName=advapi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=45; ImageBase=0x7ffc24b30000; GuidSig=549260e6-7474-8391-e...; Age=1; PDBFileName=advapi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=164; ImageBase=0x7ffc24b30000; ImageSize=667,648; ImageChecksum=662,904; TimeDateStamp=0; DefaultBase=0x7ffc24b30000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=50; ImageBase=0x7ffc24be0000; ImageSize=729,088; ProcessID=0; TimeDateStamp=775,814,378; BuildTime=94/08/02 07:59:38.00...; OriginalFileName=kernel32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=45; ImageBase=0x7ffc24be0000; GuidSig=47a44f0c-c47f-b6a1-f...; Age=1; PDBFileName=kernel32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=164; ImageBase=0x7ffc24be0000; ImageSize=729,088; ImageChecksum=723,980; TimeDateStamp=0; DefaultBase=0x7ffc24be0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=44; ImageBase=0x7ffc24d10000; ImageSize=188,416; ProcessID=0; TimeDateStamp=-1,667,059,575; BuildTime=53/04/10 14:22:01.00...; OriginalFileName=imm32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=42; ImageBase=0x7ffc24d10000; GuidSig=c11e81be-ed6a-db51-3...; Age=1; PDBFileName=imm32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=158; ImageBase=0x7ffc24d10000; ImageSize=188,416; ImageChecksum=216,565; TimeDateStamp=0; DefaultBase=0x7ffc24d10000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=44; ImageBase=0x7ffc24da0000; ImageSize=155,648; ProcessID=0; TimeDateStamp=-1,867,374,302; BuildTime=46/12/05 03:23:14.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=42; ImageBase=0x7ffc24da0000; GuidSig=209ad405-837d-061e-f...; Age=1; PDBFileName=gdi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=158; ImageBase=0x7ffc24da0000; ImageSize=155,648; ImageChecksum=194,403; TimeDateStamp=0; DefaultBase=0x7ffc24da0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=46; ImageBase=0x7ffc24eb0000; ImageSize=454,656; ProcessID=0; TimeDateStamp=252,347,079; BuildTime=77/12/30 16:24:39.00...; OriginalFileName=ws2_32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=43; ImageBase=0x7ffc24eb0000; GuidSig=94268932-d2c5-c3db-4...; Age=1; PDBFileName=ws2_32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=160; ImageBase=0x7ffc24eb0000; ImageSize=454,656; ImageChecksum=456,525; TimeDateStamp=0; DefaultBase=0x7ffc24eb0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=46; ImageBase=0x7ffc25390000; ImageSize=647,168; ProcessID=0; TimeDateStamp=-172,101,673; BuildTime=00/08/25 08:27:03.00...; OriginalFileName=msvcrt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=43; ImageBase=0x7ffc25390000; GuidSig=1fea8db6-b57f-5fbf-a...; Age=1; PDBFileName=msvcrt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=160; ImageBase=0x7ffc25390000; ImageSize=647,168; ImageChecksum=678,174; TimeDateStamp=0; DefaultBase=0x7ffc25390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=48; ImageBase=0x7ffc25590000; ImageSize=618,496; ProcessID=0; TimeDateStamp=-136,044,297; BuildTime=01/10/16 16:23:19.00...; OriginalFileName=sechost.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=44; ImageBase=0x7ffc25590000; GuidSig=0f733965-b12f-7923-b...; Age=1; PDBFileName=sechost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=162; ImageBase=0x7ffc25590000; ImageSize=618,496; ImageChecksum=662,974; TimeDateStamp=0; DefaultBase=0x7ffc25590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=46; ImageBase=0x7ffc256e0000; ImageSize=692,224; ProcessID=0; TimeDateStamp=1,221,584,444; BuildTime=08/09/16 17:00:44.00...; OriginalFileName=SHCORE.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=43; ImageBase=0x7ffc256e0000; GuidSig=3921dcf6-eafa-cc85-7...; Age=1; PDBFileName=shcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=160; ImageBase=0x7ffc256e0000; ImageSize=692,224; ImageChecksum=745,271; TimeDateStamp=0; DefaultBase=0x7ffc256e0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=50; ImageBase=0x7ffc25ea0000; ImageSize=802,816; ProcessID=0; TimeDateStamp=-1,108,332,853; BuildTime=70/12/24 08:14:03.00...; OriginalFileName=OLEAUT32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=45; ImageBase=0x7ffc25ea0000; GuidSig=2dfa946d-f7be-e09f-3...; Age=1; PDBFileName=oleaut32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=164; ImageBase=0x7ffc25ea0000; ImageSize=802,816; ImageChecksum=845,595; TimeDateStamp=0; DefaultBase=0x7ffc25ea0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=46; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ProcessID=0; TimeDateStamp=87,082,528; BuildTime=72/10/04 21:35:28.00...; OriginalFileName=rpcrt4.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=43; ImageBase=0x7ffc25f70000; GuidSig=a3028d6b-45da-0062-4...; Age=1; PDBFileName=rpcrt4.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=160; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ImageChecksum=1,199,090; TimeDateStamp=0; DefaultBase=0x7ffc25f70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=40; ImageBase=0x7ffc26410000; ImageSize=32,768; ProcessID=0; TimeDateStamp=1,693,425,343; BuildTime=23/08/30 19:55:43.00...; OriginalFileName=nsi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=40; ImageBase=0x7ffc26410000; GuidSig=7c67fb7d-8805-fe58-4...; Age=1; PDBFileName=nsi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=154; ImageBase=0x7ffc26410000; ImageSize=32,768; ImageChecksum=32,664; TimeDateStamp=0; DefaultBase=0x7ffc26410000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=46; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ProcessID=0; TimeDateStamp=-1,431,966,518; BuildTime=60/09/21 13:59:38.00...; OriginalFileName=user32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=43; ImageBase=0x7ffc26420000; GuidSig=bc4cc7cc-9a33-b8a6-6...; Age=1; PDBFileName=user32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=160; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ImageChecksum=1,700,392; TimeDateStamp=0; DefaultBase=0x7ffc26420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=44; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ProcessID=0; TimeDateStamp=-1,523,876,758; BuildTime=57/10/23 19:22:18.00...; OriginalFileName=ntdll.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=42; ImageBase=0x7ffc26600000; GuidSig=b54f3499-813e-bcf1-3...; Age=1; PDBFileName=ntdll.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1036; TID=-1; PName=winlogon; ProceNum=2; DataLen=158; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ImageChecksum=2,058,600; TimeDateStamp=0; DefaultBase=0x7ffc26600000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: Windows Kernel/Process/DCStart PID=1080; TID=-1; PName=fontdrvhost; ProceNum=2; DataLen=128; ProcessID=1,080; ParentID=1,036; ImageFileName=fontdrvhost.exe; PageDirectoryBase=0x102113a000; Flags=None; SessionID=1; ExitStatus=259; UniqueProcessKey=0xffffc50f60ecd080; CommandLine="fontdrvhost.exe"; PackageFullName=; ApplicationID=; 
EVENT 0.000: KernelTraceControl/ImageID PID=1080; TID=-1; PName=fontdrvhost; ProceNum=2; DataLen=56; ImageBase=0x7ff738b60000; ImageSize=839,680; ProcessID=0; TimeDateStamp=-832,071,347; BuildTime=79/09/25 19:32:29.00...; OriginalFileName=fontdrvhost.exe; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1080; TID=-1; PName=fontdrvhost; ProceNum=2; DataLen=48; ImageBase=0x7ff738b60000; GuidSig=40f9301e-e776-2d37-b...; Age=1; PDBFileName=fontdrvhost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1080; TID=-1; PName=fontdrvhost; ProceNum=2; DataLen=170; ImageBase=0x7ff738b60000; ImageSize=839,680; ImageChecksum=844,122; TimeDateStamp=0; DefaultBase=0x7ff738b60000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1080; TID=-1; PName=fontdrvhost; ProceNum=2; DataLen=50; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ProcessID=0; TimeDateStamp=1,555,946,369; BuildTime=19/04/22 15:19:29.00...; OriginalFileName=ucrtbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1080; TID=-1; PName=fontdrvhost; ProceNum=2; DataLen=45; ImageBase=0x7ffc23d90000; GuidSig=faceb612-020d-68fb-b...; Age=1; PDBFileName=ucrtbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1080; TID=-1; PName=fontdrvhost; ProceNum=2; DataLen=164; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ImageChecksum=1,052,117; TimeDateStamp=0; DefaultBase=0x7ffc23d90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1080; TID=-1; PName=fontdrvhost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ProcessID=0; TimeDateStamp=1,396,962,555; BuildTime=14/04/08 13:09:15.00...; OriginalFileName=Win32u.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1080; TID=-1; PName=fontdrvhost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23eb0000; GuidSig=bc2e49ab-e46d-2e93-b...; Age=1; PDBFileName=win32u.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1080; TID=-1; PName=fontdrvhost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ImageChecksum=177,968; TimeDateStamp=0; DefaultBase=0x7ffc23eb0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1080; TID=-1; PName=fontdrvhost; ProceNum=2; DataLen=54; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ProcessID=0; TimeDateStamp=439,410,971; BuildTime=83/12/04 18:36:11.00...; OriginalFileName=Kernelbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1080; TID=-1; PName=fontdrvhost; ProceNum=2; DataLen=47; ImageBase=0x7ffc23ee0000; GuidSig=44c8ec9a-a0ea-4f98-d...; Age=1; PDBFileName=kernelbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1080; TID=-1; PName=fontdrvhost; ProceNum=2; DataLen=168; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ImageChecksum=2,793,344; TimeDateStamp=0; DefaultBase=0x7ffc23ee0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1080; TID=-1; PName=fontdrvhost; ProceNum=2; DataLen=52; ImageBase=0x7ffc24420000; ImageSize=647,168; ProcessID=0; TimeDateStamp=545,597,548; BuildTime=87/04/16 18:52:28.00...; OriginalFileName=msvcp_win.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1080; TID=-1; PName=fontdrvhost; ProceNum=2; DataLen=46; ImageBase=0x7ffc24420000; GuidSig=de65fef9-16bb-6b73-d...; Age=1; PDBFileName=msvcp_win.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1080; TID=-1; PName=fontdrvhost; ProceNum=2; DataLen=166; ImageBase=0x7ffc24420000; ImageSize=647,168; ImageChecksum=686,408; TimeDateStamp=0; DefaultBase=0x7ffc24420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1080; TID=-1; PName=fontdrvhost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24be0000; ImageSize=729,088; ProcessID=0; TimeDateStamp=775,814,378; BuildTime=94/08/02 07:59:38.00...; OriginalFileName=kernel32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1080; TID=-1; PName=fontdrvhost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24be0000; GuidSig=47a44f0c-c47f-b6a1-f...; Age=1; PDBFileName=kernel32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1080; TID=-1; PName=fontdrvhost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24be0000; ImageSize=729,088; ImageChecksum=723,980; TimeDateStamp=0; DefaultBase=0x7ffc24be0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1080; TID=-1; PName=fontdrvhost; ProceNum=2; DataLen=44; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ProcessID=0; TimeDateStamp=-1,523,876,758; BuildTime=57/10/23 19:22:18.00...; OriginalFileName=ntdll.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1080; TID=-1; PName=fontdrvhost; ProceNum=2; DataLen=42; ImageBase=0x7ffc26600000; GuidSig=b54f3499-813e-bcf1-3...; Age=1; PDBFileName=ntdll.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1080; TID=-1; PName=fontdrvhost; ProceNum=2; DataLen=158; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ImageChecksum=2,058,600; TimeDateStamp=0; DefaultBase=0x7ffc26600000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: Windows Kernel/Process/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=168; ProcessID=1,128; ParentID=836; ImageFileName=svchost.exe; PageDirectoryBase=0x10237e3000; Flags=None; SessionID=0; ExitStatus=259; UniqueProcessKey=0xffffc50f60f25400; CommandLine=C:\Windows\system32\...; PackageFullName=; ApplicationID=; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ff6295b0000; ImageSize=65,536; ProcessID=0; TimeDateStamp=852,935,184; BuildTime=97/01/10 22:26:24.00...; OriginalFileName=svchost.exe; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ff6295b0000; GuidSig=ef7b3786-4e54-5d5e-c...; Age=1; PDBFileName=svchost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ff6295b0000; ImageSize=65,536; ImageChecksum=68,124; TimeDateStamp=0; DefaultBase=0x7ff6295b0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc03790000; ImageSize=323,584; ProcessID=0; TimeDateStamp=-1,046,143,486; BuildTime=72/12/13 03:03:30.00...; OriginalFileName=capauthz.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc03790000; GuidSig=f3e6040e-0f5a-e497-9...; Age=1; PDBFileName=capauthz.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc03790000; ImageSize=323,584; ImageChecksum=329,930; TimeDateStamp=0; DefaultBase=0x7ffc03790000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=52; ImageBase=0x7ffc069c0000; ImageSize=245,760; ProcessID=0; TimeDateStamp=1,961,330,995; BuildTime=32/02/25 14:09:55.00...; OriginalFileName=container.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc069c0000; GuidSig=f460c0f4-84d1-efa2-c...; Age=1; PDBFileName=container.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc069c0000; ImageSize=245,760; ImageChecksum=276,221; TimeDateStamp=0; DefaultBase=0x7ffc069c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc06a00000; ImageSize=684,032; ProcessID=0; TimeDateStamp=1,071,126,594; BuildTime=03/12/11 07:09:54.00...; OriginalFileName=daxexec.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc06a00000; GuidSig=18dc3241-0262-7150-c...; Age=1; PDBFileName=daxexec.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc06a00000; ImageSize=684,032; ImageChecksum=678,229; TimeDateStamp=0; DefaultBase=0x7ffc06a00000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=52; ImageBase=0x7ffc11c70000; ImageSize=40,960; ProcessID=0; TimeDateStamp=1,537,672,213; BuildTime=18/09/23 03:10:13.00...; OriginalFileName=filterLib.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc11c70000; GuidSig=15599307-8ba3-729e-a...; Age=1; PDBFileName=fltLib.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc11c70000; ImageSize=40,960; ImageChecksum=44,887; TimeDateStamp=0; DefaultBase=0x7ffc11c70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=52; ImageBase=0x7ffc196c0000; ImageSize=28,672; ProcessID=0; TimeDateStamp=-1,560,341,592; BuildTime=56/08/27 18:15:04.00...; OriginalFileName=wshhyperv.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc196c0000; GuidSig=05db701d-3e94-a9c9-5...; Age=1; PDBFileName=wshhyperv.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc196c0000; ImageSize=28,672; ImageChecksum=80,653; TimeDateStamp=0; DefaultBase=0x7ffc196c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc19840000; ImageSize=487,424; ProcessID=0; TimeDateStamp=2,075,638,905; BuildTime=35/10/10 14:21:45.00...; OriginalFileName=fwpuclnt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc19840000; GuidSig=f6f6d00e-0966-05bf-c...; Age=1; PDBFileName=fwpuclnt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc19840000; ImageSize=487,424; ImageChecksum=526,551; TimeDateStamp=0; DefaultBase=0x7ffc19840000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=54; ImageBase=0x7ffc1e970000; ImageSize=86,016; ProcessID=0; TimeDateStamp=525,713,861; BuildTime=86/08/29 15:37:41.00...; OriginalFileName=usermgrcli.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=47; ImageBase=0x7ffc1e970000; GuidSig=26f569a5-8783-27b0-0...; Age=1; PDBFileName=usermgrcli.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=168; ImageBase=0x7ffc1e970000; ImageSize=86,016; ImageChecksum=138,081; TimeDateStamp=0; DefaultBase=0x7ffc1e970000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc1f210000; ImageSize=77,824; ProcessID=0; TimeDateStamp=1,097,789,430; BuildTime=04/10/14 21:30:30.00...; OriginalFileName=wtsapi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc1f210000; GuidSig=2da85aef-00d2-fb45-8...; Age=1; PDBFileName=wtsapi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc1f210000; ImageSize=77,824; ImageChecksum=127,847; TimeDateStamp=0; DefaultBase=0x7ffc1f210000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=56; ImageBase=0x7ffc210e0000; ImageSize=77,824; ProcessID=0; TimeDateStamp=-538,337,510; BuildTime=89/01/15 12:16:26.00...; OriginalFileName=RpcRtRemote.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc210e0000; GuidSig=bff799a1-4214-db03-c...; Age=1; PDBFileName=RpcRtRemote.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=170; ImageBase=0x7ffc210e0000; ImageSize=77,824; ImageChecksum=119,214; TimeDateStamp=0; DefaultBase=0x7ffc210e0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc21100000; ImageSize=98,304; ProcessID=0; TimeDateStamp=295,534,382; BuildTime=79/05/14 12:53:02.00...; OriginalFileName=RpcEpMap.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc21100000; GuidSig=2d2a28f8-b1ed-e96e-9...; Age=1; PDBFileName=RpcEpMap.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc21100000; ImageSize=98,304; ImageChecksum=136,709; TimeDateStamp=0; DefaultBase=0x7ffc21100000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc21120000; ImageSize=1,290,240; ProcessID=0; TimeDateStamp=193,361,355; BuildTime=76/02/16 23:29:15.00...; OriginalFileName=rpcss.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc21120000; GuidSig=fafeca9d-6833-abf6-0...; Age=1; PDBFileName=rpcss.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc21120000; ImageSize=1,290,240; ImageChecksum=1,282,690; TimeDateStamp=0; DefaultBase=0x7ffc21120000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc21e20000; ImageSize=188,416; ProcessID=0; TimeDateStamp=157,235,662; BuildTime=74/12/25 20:34:22.00...; OriginalFileName=fwbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc21e20000; GuidSig=89b14238-fca7-5326-c...; Age=1; PDBFileName=fwbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc21e20000; ImageSize=188,416; ImageChecksum=220,140; TimeDateStamp=0; DefaultBase=0x7ffc21e20000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=56; ImageBase=0x7ffc21e80000; ImageSize=573,440; ProcessID=0; TimeDateStamp=775,848,894; BuildTime=94/08/02 17:34:54.00...; OriginalFileName=FirewallAPI.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc21e80000; GuidSig=f1e3fecf-4859-996c-0...; Age=1; PDBFileName=FirewallAPI.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=170; ImageBase=0x7ffc21e80000; ImageSize=573,440; ImageChecksum=603,289; TimeDateStamp=0; DefaultBase=0x7ffc21e80000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc21f70000; ImageSize=376,832; ProcessID=0; TimeDateStamp=43,988,838; BuildTime=71/05/25 03:07:18.00...; OriginalFileName=winsta.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc21f70000; GuidSig=b854bf05-e0a2-5b01-7...; Age=1; PDBFileName=winsta.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc21f70000; ImageSize=376,832; ImageChecksum=387,708; TimeDateStamp=0; DefaultBase=0x7ffc21f70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc22420000; ImageSize=237,568; ProcessID=0; TimeDateStamp=1,353,705,264; BuildTime=12/11/23 21:14:24.00...; OriginalFileName=iphlpapi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc22420000; GuidSig=a3177875-244a-46c8-b...; Age=1; PDBFileName=iphlpapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc22420000; ImageSize=237,568; ImageChecksum=252,735; TimeDateStamp=0; DefaultBase=0x7ffc22420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc22460000; ImageSize=827,392; ProcessID=0; TimeDateStamp=-1,912,355,972; BuildTime=45/07/02 12:28:44.00...; OriginalFileName=dnsapi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc22460000; GuidSig=77e3a024-129c-5dab-b...; Age=1; PDBFileName=dnsapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc22460000; ImageSize=827,392; ImageChecksum=850,901; TimeDateStamp=0; DefaultBase=0x7ffc22460000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc226c0000; ImageSize=421,888; ProcessID=0; TimeDateStamp=414,127,772; BuildTime=83/02/15 03:29:32.00...; OriginalFileName=mswsock.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc226c0000; GuidSig=96babb0d-8e64-884b-6...; Age=1; PDBFileName=mswsock.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc226c0000; ImageSize=421,888; ImageChecksum=420,926; TimeDateStamp=0; DefaultBase=0x7ffc226c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc22940000; ImageSize=167,936; ProcessID=0; TimeDateStamp=1,085,565,188; BuildTime=04/05/26 09:53:08.00...; OriginalFileName=wldp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=41; ImageBase=0x7ffc22940000; GuidSig=3d0180e1-0317-7a96-e...; Age=1; PDBFileName=WLDP.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=156; ImageBase=0x7ffc22940000; ImageSize=167,936; ImageChecksum=190,611; TimeDateStamp=0; DefaultBase=0x7ffc22940000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: Windows Kernel/PerfInfo/Sample PID=-1; TID=9984; PName=; ProceNum=2; DataLen=16; InstructionPointer=0xfffff8027ca2c34a; ProcessorNumber=2; Priority=9; ExecutingDPC=False; ExecutingISR=False; Rank=0; Count=1; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc233c0000; ImageSize=192,512; ProcessID=0; TimeDateStamp=621,642,292; BuildTime=89/09/12 22:24:52.00...; OriginalFileName=sspicli.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc233c0000; GuidSig=823d5a41-e0d7-02a7-9...; Age=1; PDBFileName=sspicli.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc233c0000; ImageSize=192,512; ImageChecksum=235,306; TimeDateStamp=0; DefaultBase=0x7ffc233c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc234d0000; ImageSize=65,536; ProcessID=0; TimeDateStamp=-1,563,634,669; BuildTime=56/07/20 15:30:27.00...; OriginalFileName=umpdc.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc234d0000; GuidSig=1504cc55-3edb-4294-a...; Age=1; PDBFileName=UMPDC.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc234d0000; ImageSize=65,536; ImageChecksum=55,709; TimeDateStamp=0; DefaultBase=0x7ffc234d0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc234e0000; ImageSize=303,104; ProcessID=0; TimeDateStamp=-37,463,926; BuildTime=04/11/30 15:49:30.00...; OriginalFileName=POWRPROF.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc234e0000; GuidSig=bae22f43-6c95-a7d5-0...; Age=1; PDBFileName=powrprof.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc234e0000; ImageSize=303,104; ImageChecksum=321,827; TimeDateStamp=0; DefaultBase=0x7ffc234e0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=62; ImageBase=0x7ffc23530000; ImageSize=69,632; ProcessID=0; TimeDateStamp=96,400,242; BuildTime=73/01/20 17:50:42.00...; OriginalFileName=kernel.appcore.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=51; ImageBase=0x7ffc23530000; GuidSig=b44a2a63-8a5c-a8d8-1...; Age=1; PDBFileName=Kernel.Appcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=176; ImageBase=0x7ffc23530000; ImageSize=69,632; ImageChecksum=91,565; TimeDateStamp=0; DefaultBase=0x7ffc23530000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc23550000; ImageSize=126,976; ProcessID=0; TimeDateStamp=-87,365,952; BuildTime=03/05/03 02:09:04.00...; OriginalFileName=PROFAPI.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc23550000; GuidSig=d3e9e0b2-6dc3-e775-b...; Age=1; PDBFileName=profapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc23550000; ImageSize=126,976; ImageChecksum=153,678; TimeDateStamp=0; DefaultBase=0x7ffc23550000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23570000; ImageSize=73,728; ProcessID=0; TimeDateStamp=-457,022,433; BuildTime=91/08/14 15:47:43.00...; OriginalFileName=msasn1.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23570000; GuidSig=ff420efb-35b1-0aa7-6...; Age=1; PDBFileName=msasn1.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23570000; ImageSize=73,728; ImageChecksum=79,097; TimeDateStamp=0; DefaultBase=0x7ffc23570000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23590000; ImageSize=155,648; ProcessID=0; TimeDateStamp=-1,248,142,761; BuildTime=66/07/20 04:08:55.00...; OriginalFileName=bcrypt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23590000; GuidSig=1a472182-0367-8386-d...; Age=1; PDBFileName=bcrypt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23590000; ImageSize=155,648; ImageChecksum=157,312; TimeDateStamp=0; DefaultBase=0x7ffc23590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=64; ImageBase=0x7ffc23610000; ImageSize=7,843,840; ProcessID=0; TimeDateStamp=-1,549,850,267; BuildTime=56/12/27 04:30:29.00...; OriginalFileName=Windows.Storage.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=52; ImageBase=0x7ffc23610000; GuidSig=d9102742-5b8c-0068-1...; Age=1; PDBFileName=Windows.Storage.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=178; ImageBase=0x7ffc23610000; ImageSize=7,843,840; ImageChecksum=7,937,261; TimeDateStamp=0; DefaultBase=0x7ffc23610000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ProcessID=0; TimeDateStamp=1,555,946,369; BuildTime=19/04/22 15:19:29.00...; OriginalFileName=ucrtbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc23d90000; GuidSig=faceb612-020d-68fb-b...; Age=1; PDBFileName=ucrtbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ImageChecksum=1,052,117; TimeDateStamp=0; DefaultBase=0x7ffc23d90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ProcessID=0; TimeDateStamp=1,396,962,555; BuildTime=14/04/08 13:09:15.00...; OriginalFileName=Win32u.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23eb0000; GuidSig=bc2e49ab-e46d-2e93-b...; Age=1; PDBFileName=win32u.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ImageChecksum=177,968; TimeDateStamp=0; DefaultBase=0x7ffc23eb0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=54; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ProcessID=0; TimeDateStamp=439,410,971; BuildTime=83/12/04 18:36:11.00...; OriginalFileName=Kernelbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=47; ImageBase=0x7ffc23ee0000; GuidSig=44c8ec9a-a0ea-4f98-d...; Age=1; PDBFileName=kernelbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=168; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ImageChecksum=2,793,344; TimeDateStamp=0; DefaultBase=0x7ffc23ee0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ProcessID=0; TimeDateStamp=1,868,443,751; BuildTime=29/03/17 12:09:11.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc24190000; GuidSig=e5a785df-0333-6a66-6...; Age=1; PDBFileName=gdi32full.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ImageChecksum=1,696,264; TimeDateStamp=0; DefaultBase=0x7ffc24190000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24330000; ImageSize=376,832; ProcessID=0; TimeDateStamp=1,670,486,148; BuildTime=22/12/08 07:55:48.00...; OriginalFileName=WINTRUST.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24330000; GuidSig=ef819cd6-e971-2b01-0...; Age=1; PDBFileName=wintrust.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24330000; ImageSize=376,832; ImageChecksum=380,837; TimeDateStamp=0; DefaultBase=0x7ffc24330000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=66; ImageBase=0x7ffc24390000; ImageSize=528,384; ProcessID=0; TimeDateStamp=1,774,320,825; BuildTime=26/03/24 02:53:45.00...; OriginalFileName=bcryptprimitives.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=53; ImageBase=0x7ffc24390000; GuidSig=54a1b493-8222-f67e-4...; Age=1; PDBFileName=bcryptprimitives.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=180; ImageBase=0x7ffc24390000; ImageSize=528,384; ImageChecksum=562,796; TimeDateStamp=0; DefaultBase=0x7ffc24390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=52; ImageBase=0x7ffc24420000; ImageSize=647,168; ProcessID=0; TimeDateStamp=545,597,548; BuildTime=87/04/16 18:52:28.00...; OriginalFileName=msvcp_win.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc24420000; GuidSig=de65fef9-16bb-6b73-d...; Age=1; PDBFileName=msvcp_win.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc24420000; ImageSize=647,168; ImageChecksum=686,408; TimeDateStamp=0; DefaultBase=0x7ffc24420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ProcessID=0; TimeDateStamp=135,099,696; BuildTime=74/04/13 15:41:36.00...; OriginalFileName=CRYPT32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc244c0000; GuidSig=8c840cbc-1c63-bfb7-6...; Age=1; PDBFileName=crypt32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ImageChecksum=1,341,835; TimeDateStamp=0; DefaultBase=0x7ffc244c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ProcessID=0; TimeDateStamp=1,691,891,946; BuildTime=23/08/13 01:59:06.00...; OriginalFileName=COMBASE.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc246c0000; GuidSig=d15b0ee4-2a16-5244-2...; Age=1; PDBFileName=combase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ImageChecksum=3,387,881; TimeDateStamp=0; DefaultBase=0x7ffc246c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24b30000; ImageSize=667,648; ProcessID=0; TimeDateStamp=-1,762,261,787; BuildTime=50/04/04 17:18:29.00...; OriginalFileName=advapi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24b30000; GuidSig=549260e6-7474-8391-e...; Age=1; PDBFileName=advapi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24b30000; ImageSize=667,648; ImageChecksum=662,904; TimeDateStamp=0; DefaultBase=0x7ffc24b30000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24be0000; ImageSize=729,088; ProcessID=0; TimeDateStamp=775,814,378; BuildTime=94/08/02 07:59:38.00...; OriginalFileName=kernel32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24be0000; GuidSig=47a44f0c-c47f-b6a1-f...; Age=1; PDBFileName=kernel32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24be0000; ImageSize=729,088; ImageChecksum=723,980; TimeDateStamp=0; DefaultBase=0x7ffc24be0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc24d40000; ImageSize=335,872; ProcessID=0; TimeDateStamp=-125,797,471; BuildTime=02/02/12 06:43:45.00...; OriginalFileName=SHLWAPI.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24d40000; GuidSig=8b7db15a-0b89-93df-4...; Age=1; PDBFileName=shlwapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc24d40000; ImageSize=335,872; ImageChecksum=385,032; TimeDateStamp=0; DefaultBase=0x7ffc24d40000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24da0000; ImageSize=155,648; ProcessID=0; TimeDateStamp=-1,867,374,302; BuildTime=46/12/05 03:23:14.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc24da0000; GuidSig=209ad405-837d-061e-f...; Age=1; PDBFileName=gdi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc24da0000; ImageSize=155,648; ImageChecksum=194,403; TimeDateStamp=0; DefaultBase=0x7ffc24da0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc24eb0000; ImageSize=454,656; ProcessID=0; TimeDateStamp=252,347,079; BuildTime=77/12/30 16:24:39.00...; OriginalFileName=ws2_32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc24eb0000; GuidSig=94268932-d2c5-c3db-4...; Age=1; PDBFileName=ws2_32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc24eb0000; ImageSize=454,656; ImageChecksum=456,525; TimeDateStamp=0; DefaultBase=0x7ffc24eb0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc25390000; ImageSize=647,168; ProcessID=0; TimeDateStamp=-172,101,673; BuildTime=00/08/25 08:27:03.00...; OriginalFileName=msvcrt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc25390000; GuidSig=1fea8db6-b57f-5fbf-a...; Age=1; PDBFileName=msvcrt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc25390000; ImageSize=647,168; ImageChecksum=678,174; TimeDateStamp=0; DefaultBase=0x7ffc25390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc25430000; ImageSize=1,400,832; ProcessID=0; TimeDateStamp=1,171,436,857; BuildTime=07/02/14 07:07:37.00...; OriginalFileName=OLE32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc25430000; GuidSig=ec385cee-495b-f162-5...; Age=1; PDBFileName=ole32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc25430000; ImageSize=1,400,832; ImageChecksum=1,434,873; TimeDateStamp=0; DefaultBase=0x7ffc25430000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc25590000; ImageSize=618,496; ProcessID=0; TimeDateStamp=-136,044,297; BuildTime=01/10/16 16:23:19.00...; OriginalFileName=sechost.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc25590000; GuidSig=0f733965-b12f-7923-b...; Age=1; PDBFileName=sechost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc25590000; ImageSize=618,496; ImageChecksum=662,974; TimeDateStamp=0; DefaultBase=0x7ffc25590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc25630000; ImageSize=663,552; ProcessID=0; TimeDateStamp=-1,794,760,561; BuildTime=49/03/24 13:52:15.00...; OriginalFileName=CLBCATQ.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc25630000; GuidSig=da759f99-b2bb-75c2-1...; Age=1; PDBFileName=CLBCatQ.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc25630000; ImageSize=663,552; ImageChecksum=684,075; TimeDateStamp=0; DefaultBase=0x7ffc25630000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc256e0000; ImageSize=692,224; ProcessID=0; TimeDateStamp=1,221,584,444; BuildTime=08/09/16 17:00:44.00...; OriginalFileName=SHCORE.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc256e0000; GuidSig=3921dcf6-eafa-cc85-7...; Age=1; PDBFileName=shcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc256e0000; ImageSize=692,224; ImageChecksum=745,271; TimeDateStamp=0; DefaultBase=0x7ffc256e0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc25ea0000; ImageSize=802,816; ProcessID=0; TimeDateStamp=-1,108,332,853; BuildTime=70/12/24 08:14:03.00...; OriginalFileName=OLEAUT32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc25ea0000; GuidSig=2dfa946d-f7be-e09f-3...; Age=1; PDBFileName=oleaut32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc25ea0000; ImageSize=802,816; ImageChecksum=845,595; TimeDateStamp=0; DefaultBase=0x7ffc25ea0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ProcessID=0; TimeDateStamp=87,082,528; BuildTime=72/10/04 21:35:28.00...; OriginalFileName=rpcrt4.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc25f70000; GuidSig=a3028d6b-45da-0062-4...; Age=1; PDBFileName=rpcrt4.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ImageChecksum=1,199,090; TimeDateStamp=0; DefaultBase=0x7ffc25f70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=40; ImageBase=0x7ffc26410000; ImageSize=32,768; ProcessID=0; TimeDateStamp=1,693,425,343; BuildTime=23/08/30 19:55:43.00...; OriginalFileName=nsi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=40; ImageBase=0x7ffc26410000; GuidSig=7c67fb7d-8805-fe58-4...; Age=1; PDBFileName=nsi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=154; ImageBase=0x7ffc26410000; ImageSize=32,768; ImageChecksum=32,664; TimeDateStamp=0; DefaultBase=0x7ffc26410000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ProcessID=0; TimeDateStamp=-1,431,966,518; BuildTime=60/09/21 13:59:38.00...; OriginalFileName=user32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc26420000; GuidSig=bc4cc7cc-9a33-b8a6-6...; Age=1; PDBFileName=user32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ImageChecksum=1,700,392; TimeDateStamp=0; DefaultBase=0x7ffc26420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ProcessID=0; TimeDateStamp=-1,523,876,758; BuildTime=57/10/23 19:22:18.00...; OriginalFileName=ntdll.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc26600000; GuidSig=b54f3499-813e-bcf1-3...; Age=1; PDBFileName=ntdll.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1128; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ImageChecksum=2,058,600; TimeDateStamp=0; DefaultBase=0x7ffc26600000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: Windows Kernel/Process/DCStart PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=192; ProcessID=1,176; ParentID=836; ImageFileName=svchost.exe; PageDirectoryBase=0x1021930000; Flags=None; SessionID=0; ExitStatus=259; UniqueProcessKey=0xffffc50f60f47380; CommandLine=C:\Windows\system32\...; PackageFullName=; ApplicationID=; 
EVENT 0.000: KernelTraceControl/ImageID PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ff6295b0000; ImageSize=65,536; ProcessID=0; TimeDateStamp=852,935,184; BuildTime=97/01/10 22:26:24.00...; OriginalFileName=svchost.exe; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ff6295b0000; GuidSig=ef7b3786-4e54-5d5e-c...; Age=1; PDBFileName=svchost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ff6295b0000; ImageSize=65,536; ImageChecksum=68,124; TimeDateStamp=0; DefaultBase=0x7ff6295b0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=84; ImageBase=0x7ffc12040000; ImageSize=1,265,664; ProcessID=0; TimeDateStamp=-1,902,823,923; BuildTime=45/10/20 20:16:13.00...; OriginalFileName=Windows.StateReposit...; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=62; ImageBase=0x7ffc12040000; GuidSig=48ef3ff1-69e6-4495-f...; Age=1; PDBFileName=Windows.StateReposit...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=198; ImageBase=0x7ffc12040000; ImageSize=1,265,664; ImageChecksum=1,295,312; TimeDateStamp=0; DefaultBase=0x7ffc12040000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=66; ImageBase=0x7ffc1a4d0000; ImageSize=356,352; ProcessID=0; TimeDateStamp=-1,757,445,782; BuildTime=50/05/30 11:05:14.00...; OriginalFileName=AppXAllUserStore.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=53; ImageBase=0x7ffc1a4d0000; GuidSig=8031daed-c327-d548-e...; Age=1; PDBFileName=AppxAllUserStore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=180; ImageBase=0x7ffc1a4d0000; ImageSize=356,352; ImageChecksum=367,814; TimeDateStamp=0; DefaultBase=0x7ffc1a4d0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc1e5b0000; ImageSize=65,536; ProcessID=0; TimeDateStamp=162,819,529; BuildTime=75/02/28 11:38:49.00...; OriginalFileName=lsmproxy.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc1e5b0000; GuidSig=89c329fd-d3aa-d2a5-0...; Age=1; PDBFileName=lsmproxy.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc1e5b0000; ImageSize=65,536; ImageChecksum=68,754; TimeDateStamp=0; DefaultBase=0x7ffc1e5b0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc20b70000; ImageSize=49,152; ProcessID=0; TimeDateStamp=1,713,249,400; BuildTime=24/04/16 06:36:40.00...; OriginalFileName=SysNtfy.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc20b70000; GuidSig=4a8e53c8-6df3-11e0-4...; Age=1; PDBFileName=sysntfy.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc20b70000; ImageSize=49,152; ImageChecksum=77,894; TimeDateStamp=0; DefaultBase=0x7ffc20b70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc20ed0000; ImageSize=184,320; ProcessID=0; TimeDateStamp=-387,540,599; BuildTime=93/10/26 20:18:17.00...; OriginalFileName=dwmapi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc20ed0000; GuidSig=0d061d68-1544-eff4-4...; Age=1; PDBFileName=dwmapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc20ed0000; ImageSize=184,320; ImageChecksum=211,409; TimeDateStamp=0; DefaultBase=0x7ffc20ed0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=40; ImageBase=0x7ffc20f30000; ImageSize=704,512; ProcessID=0; TimeDateStamp=-1,213,417,790; BuildTime=67/08/26 01:58:26.00...; OriginalFileName=lsm.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=40; ImageBase=0x7ffc20f30000; GuidSig=96ec0741-3d4c-7858-d...; Age=1; PDBFileName=lsm.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=154; ImageBase=0x7ffc20f30000; ImageSize=704,512; ImageChecksum=733,609; TimeDateStamp=0; DefaultBase=0x7ffc20f30000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc21b90000; ImageSize=131,072; ProcessID=0; TimeDateStamp=-1,139,896,690; BuildTime=69/12/24 00:30:06.00...; OriginalFileName=DXCore.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc21b90000; GuidSig=33bb03a6-a0d1-2ce8-8...; Age=1; PDBFileName=DXCore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc21b90000; ImageSize=131,072; ImageChecksum=173,498; TimeDateStamp=0; DefaultBase=0x7ffc21b90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc21bb0000; ImageSize=958,464; ProcessID=0; TimeDateStamp=1,511,252,964; BuildTime=17/11/21 08:29:24.00...; OriginalFileName=dxgi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=41; ImageBase=0x7ffc21bb0000; GuidSig=5e9cc76a-64eb-6cdf-7...; Age=1; PDBFileName=dxgi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=156; ImageBase=0x7ffc21bb0000; ImageSize=958,464; ImageChecksum=997,190; TimeDateStamp=0; DefaultBase=0x7ffc21bb0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc22940000; ImageSize=167,936; ProcessID=0; TimeDateStamp=1,085,565,188; BuildTime=04/05/26 09:53:08.00...; OriginalFileName=wldp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=41; ImageBase=0x7ffc22940000; GuidSig=3d0180e1-0317-7a96-e...; Age=1; PDBFileName=WLDP.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=156; ImageBase=0x7ffc22940000; ImageSize=167,936; ImageChecksum=190,611; TimeDateStamp=0; DefaultBase=0x7ffc22940000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=54; ImageBase=0x7ffc232d0000; ImageSize=172,032; ProcessID=0; TimeDateStamp=564,545,050; BuildTime=87/11/22 02:04:10.00...; OriginalFileName=devinfoset.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc232d0000; GuidSig=bf3fb10c-179d-a551-d...; Age=1; PDBFileName=devobj.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc232d0000; ImageSize=172,032; ImageChecksum=212,309; TimeDateStamp=0; DefaultBase=0x7ffc232d0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc233c0000; ImageSize=192,512; ProcessID=0; TimeDateStamp=621,642,292; BuildTime=89/09/12 22:24:52.00...; OriginalFileName=sspicli.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc233c0000; GuidSig=823d5a41-e0d7-02a7-9...; Age=1; PDBFileName=sspicli.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc233c0000; ImageSize=192,512; ImageChecksum=235,306; TimeDateStamp=0; DefaultBase=0x7ffc233c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc233f0000; ImageSize=151,552; ProcessID=0; TimeDateStamp=-157,143,252; BuildTime=01/02/14 11:34:04.00...; OriginalFileName=userenv.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc233f0000; GuidSig=1a734def-8e54-a706-f...; Age=1; PDBFileName=userenv.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc233f0000; ImageSize=151,552; ImageChecksum=176,304; TimeDateStamp=0; DefaultBase=0x7ffc233f0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=62; ImageBase=0x7ffc23530000; ImageSize=69,632; ProcessID=0; TimeDateStamp=96,400,242; BuildTime=73/01/20 17:50:42.00...; OriginalFileName=kernel.appcore.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=51; ImageBase=0x7ffc23530000; GuidSig=b44a2a63-8a5c-a8d8-1...; Age=1; PDBFileName=Kernel.Appcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=176; ImageBase=0x7ffc23530000; ImageSize=69,632; ImageChecksum=91,565; TimeDateStamp=0; DefaultBase=0x7ffc23530000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc23550000; ImageSize=126,976; ProcessID=0; TimeDateStamp=-87,365,952; BuildTime=03/05/03 02:09:04.00...; OriginalFileName=PROFAPI.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc23550000; GuidSig=d3e9e0b2-6dc3-e775-b...; Age=1; PDBFileName=profapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc23550000; ImageSize=126,976; ImageChecksum=153,678; TimeDateStamp=0; DefaultBase=0x7ffc23550000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23570000; ImageSize=73,728; ProcessID=0; TimeDateStamp=-457,022,433; BuildTime=91/08/14 15:47:43.00...; OriginalFileName=msasn1.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23570000; GuidSig=ff420efb-35b1-0aa7-6...; Age=1; PDBFileName=msasn1.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23570000; ImageSize=73,728; ImageChecksum=79,097; TimeDateStamp=0; DefaultBase=0x7ffc23570000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc235c0000; ImageSize=303,104; ProcessID=0; TimeDateStamp=-1,347,769,430; BuildTime=63/05/24 02:04:26.00...; OriginalFileName=CFGMGR32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc235c0000; GuidSig=c951ee8e-a9b3-8ebf-a...; Age=1; PDBFileName=cfgmgr32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc235c0000; ImageSize=303,104; ImageChecksum=322,106; TimeDateStamp=0; DefaultBase=0x7ffc235c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ProcessID=0; TimeDateStamp=1,555,946,369; BuildTime=19/04/22 15:19:29.00...; OriginalFileName=ucrtbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc23d90000; GuidSig=faceb612-020d-68fb-b...; Age=1; PDBFileName=ucrtbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ImageChecksum=1,052,117; TimeDateStamp=0; DefaultBase=0x7ffc23d90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ProcessID=0; TimeDateStamp=1,396,962,555; BuildTime=14/04/08 13:09:15.00...; OriginalFileName=Win32u.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23eb0000; GuidSig=bc2e49ab-e46d-2e93-b...; Age=1; PDBFileName=win32u.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ImageChecksum=177,968; TimeDateStamp=0; DefaultBase=0x7ffc23eb0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=54; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ProcessID=0; TimeDateStamp=439,410,971; BuildTime=83/12/04 18:36:11.00...; OriginalFileName=Kernelbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=47; ImageBase=0x7ffc23ee0000; GuidSig=44c8ec9a-a0ea-4f98-d...; Age=1; PDBFileName=kernelbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=168; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ImageChecksum=2,793,344; TimeDateStamp=0; DefaultBase=0x7ffc23ee0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ProcessID=0; TimeDateStamp=1,868,443,751; BuildTime=29/03/17 12:09:11.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc24190000; GuidSig=e5a785df-0333-6a66-6...; Age=1; PDBFileName=gdi32full.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ImageChecksum=1,696,264; TimeDateStamp=0; DefaultBase=0x7ffc24190000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24330000; ImageSize=376,832; ProcessID=0; TimeDateStamp=1,670,486,148; BuildTime=22/12/08 07:55:48.00...; OriginalFileName=WINTRUST.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24330000; GuidSig=ef819cd6-e971-2b01-0...; Age=1; PDBFileName=wintrust.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24330000; ImageSize=376,832; ImageChecksum=380,837; TimeDateStamp=0; DefaultBase=0x7ffc24330000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=66; ImageBase=0x7ffc24390000; ImageSize=528,384; ProcessID=0; TimeDateStamp=1,774,320,825; BuildTime=26/03/24 02:53:45.00...; OriginalFileName=bcryptprimitives.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=53; ImageBase=0x7ffc24390000; GuidSig=54a1b493-8222-f67e-4...; Age=1; PDBFileName=bcryptprimitives.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=180; ImageBase=0x7ffc24390000; ImageSize=528,384; ImageChecksum=562,796; TimeDateStamp=0; DefaultBase=0x7ffc24390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=52; ImageBase=0x7ffc24420000; ImageSize=647,168; ProcessID=0; TimeDateStamp=545,597,548; BuildTime=87/04/16 18:52:28.00...; OriginalFileName=msvcp_win.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc24420000; GuidSig=de65fef9-16bb-6b73-d...; Age=1; PDBFileName=msvcp_win.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc24420000; ImageSize=647,168; ImageChecksum=686,408; TimeDateStamp=0; DefaultBase=0x7ffc24420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ProcessID=0; TimeDateStamp=135,099,696; BuildTime=74/04/13 15:41:36.00...; OriginalFileName=CRYPT32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc244c0000; GuidSig=8c840cbc-1c63-bfb7-6...; Age=1; PDBFileName=crypt32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ImageChecksum=1,341,835; TimeDateStamp=0; DefaultBase=0x7ffc244c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ProcessID=0; TimeDateStamp=1,691,891,946; BuildTime=23/08/13 01:59:06.00...; OriginalFileName=COMBASE.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc246c0000; GuidSig=d15b0ee4-2a16-5244-2...; Age=1; PDBFileName=combase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ImageChecksum=3,387,881; TimeDateStamp=0; DefaultBase=0x7ffc246c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24b30000; ImageSize=667,648; ProcessID=0; TimeDateStamp=-1,762,261,787; BuildTime=50/04/04 17:18:29.00...; OriginalFileName=advapi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24b30000; GuidSig=549260e6-7474-8391-e...; Age=1; PDBFileName=advapi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24b30000; ImageSize=667,648; ImageChecksum=662,904; TimeDateStamp=0; DefaultBase=0x7ffc24b30000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24be0000; ImageSize=729,088; ProcessID=0; TimeDateStamp=775,814,378; BuildTime=94/08/02 07:59:38.00...; OriginalFileName=kernel32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24be0000; GuidSig=47a44f0c-c47f-b6a1-f...; Age=1; PDBFileName=kernel32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24be0000; ImageSize=729,088; ImageChecksum=723,980; TimeDateStamp=0; DefaultBase=0x7ffc24be0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24da0000; ImageSize=155,648; ProcessID=0; TimeDateStamp=-1,867,374,302; BuildTime=46/12/05 03:23:14.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc24da0000; GuidSig=209ad405-837d-061e-f...; Age=1; PDBFileName=gdi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc24da0000; ImageSize=155,648; ImageChecksum=194,403; TimeDateStamp=0; DefaultBase=0x7ffc24da0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc25390000; ImageSize=647,168; ProcessID=0; TimeDateStamp=-172,101,673; BuildTime=00/08/25 08:27:03.00...; OriginalFileName=msvcrt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc25390000; GuidSig=1fea8db6-b57f-5fbf-a...; Age=1; PDBFileName=msvcrt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc25390000; ImageSize=647,168; ImageChecksum=678,174; TimeDateStamp=0; DefaultBase=0x7ffc25390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc25590000; ImageSize=618,496; ProcessID=0; TimeDateStamp=-136,044,297; BuildTime=01/10/16 16:23:19.00...; OriginalFileName=sechost.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc25590000; GuidSig=0f733965-b12f-7923-b...; Age=1; PDBFileName=sechost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc25590000; ImageSize=618,496; ImageChecksum=662,974; TimeDateStamp=0; DefaultBase=0x7ffc25590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc25630000; ImageSize=663,552; ProcessID=0; TimeDateStamp=-1,794,760,561; BuildTime=49/03/24 13:52:15.00...; OriginalFileName=CLBCATQ.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc25630000; GuidSig=da759f99-b2bb-75c2-1...; Age=1; PDBFileName=CLBCatQ.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc25630000; ImageSize=663,552; ImageChecksum=684,075; TimeDateStamp=0; DefaultBase=0x7ffc25630000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc256e0000; ImageSize=692,224; ProcessID=0; TimeDateStamp=1,221,584,444; BuildTime=08/09/16 17:00:44.00...; OriginalFileName=SHCORE.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc256e0000; GuidSig=3921dcf6-eafa-cc85-7...; Age=1; PDBFileName=shcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc256e0000; ImageSize=692,224; ImageChecksum=745,271; TimeDateStamp=0; DefaultBase=0x7ffc256e0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc25ea0000; ImageSize=802,816; ProcessID=0; TimeDateStamp=-1,108,332,853; BuildTime=70/12/24 08:14:03.00...; OriginalFileName=OLEAUT32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc25ea0000; GuidSig=2dfa946d-f7be-e09f-3...; Age=1; PDBFileName=oleaut32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc25ea0000; ImageSize=802,816; ImageChecksum=845,595; TimeDateStamp=0; DefaultBase=0x7ffc25ea0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ProcessID=0; TimeDateStamp=87,082,528; BuildTime=72/10/04 21:35:28.00...; OriginalFileName=rpcrt4.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc25f70000; GuidSig=a3028d6b-45da-0062-4...; Age=1; PDBFileName=rpcrt4.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ImageChecksum=1,199,090; TimeDateStamp=0; DefaultBase=0x7ffc25f70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ProcessID=0; TimeDateStamp=-1,431,966,518; BuildTime=60/09/21 13:59:38.00...; OriginalFileName=user32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc26420000; GuidSig=bc4cc7cc-9a33-b8a6-6...; Age=1; PDBFileName=user32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ImageChecksum=1,700,392; TimeDateStamp=0; DefaultBase=0x7ffc26420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ProcessID=0; TimeDateStamp=-1,523,876,758; BuildTime=57/10/23 19:22:18.00...; OriginalFileName=ntdll.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc26600000; GuidSig=b54f3499-813e-bcf1-3...; Age=1; PDBFileName=ntdll.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1176; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ImageChecksum=2,058,600; TimeDateStamp=0; DefaultBase=0x7ffc26600000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: Windows Kernel/Process/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=104; ProcessID=1,244; ParentID=1,036; ImageFileName=dwm.exe; PageDirectoryBase=0x1023a15000; Flags=None; SessionID=1; ExitStatus=259; UniqueProcessKey=0xffffc50f60f8d080; CommandLine="dwm.exe"; PackageFullName=; ApplicationID=; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=40; ImageBase=0x7ff7ca7a0000; ImageSize=102,400; ProcessID=0; TimeDateStamp=1,684,584,697; BuildTime=23/05/20 12:11:37.00...; OriginalFileName=dwm.exe; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=40; ImageBase=0x7ff7ca7a0000; GuidSig=8710d1e9-ea84-1552-5...; Age=1; PDBFileName=dwm.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=154; ImageBase=0x7ff7ca7a0000; ImageSize=102,400; ImageChecksum=132,925; TimeDateStamp=0; DefaultBase=0x7ff7ca7a0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=52; ImageBase=0x7ffc09f00000; ImageSize=7,606,272; ProcessID=0; TimeDateStamp=-1,194,402,042; BuildTime=68/04/02 04:07:34.00...; OriginalFileName=D3D10Warp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=46; ImageBase=0x7ffc09f00000; GuidSig=d669f3b9-ced0-80f7-f...; Age=1; PDBFileName=d3d10warp.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=166; ImageBase=0x7ffc09f00000; ImageSize=7,606,272; ImageChecksum=7,622,718; TimeDateStamp=0; DefaultBase=0x7ffc09f00000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=54; ImageBase=0x7ffc0b6b0000; ImageSize=253,952; ProcessID=0; TimeDateStamp=1,294,250,535; BuildTime=11/01/05 18:02:15.00...; OriginalFileName=wuceffects.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=47; ImageBase=0x7ffc0b6b0000; GuidSig=6705375e-9cc7-a33d-6...; Age=1; PDBFileName=wuceffects.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=168; ImageBase=0x7ffc0b6b0000; ImageSize=253,952; ImageChecksum=284,053; TimeDateStamp=0; DefaultBase=0x7ffc0b6b0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=82; ImageBase=0x7ffc13860000; ImageSize=4,870,144; ProcessID=0; TimeDateStamp=-1,303,526,099; BuildTime=64/10/17 03:53:17.00...; OriginalFileName=Windows.UI.Xaml.Cont...; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=61; ImageBase=0x7ffc13860000; GuidSig=fa6c7294-f667-befa-f...; Age=1; PDBFileName=Windows.UI.Xaml.Cont...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=196; ImageBase=0x7ffc13860000; ImageSize=4,870,144; ImageChecksum=4,876,519; TimeDateStamp=0; DefaultBase=0x7ffc13860000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=48; ImageBase=0x7ffc13f70000; ImageSize=167,936; ProcessID=0; TimeDateStamp=-1,810,969,477; BuildTime=48/09/17 23:23:39.00...; OriginalFileName=cabinet.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=44; ImageBase=0x7ffc13f70000; GuidSig=fbd1eb24-5924-91e5-d...; Age=1; PDBFileName=cabinet.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=162; ImageBase=0x7ffc13f70000; ImageSize=167,936; ImageChecksum=165,152; TimeDateStamp=0; DefaultBase=0x7ffc13f70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=50; ImageBase=0x7ffc14be0000; ImageSize=2,777,088; ProcessID=0; TimeDateStamp=-247,417,097; BuildTime=98/04/05 15:29:59.00...; OriginalFileName=IeRtUtil.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=45; ImageBase=0x7ffc14be0000; GuidSig=529c3b2f-bc4b-e8e4-8...; Age=1; PDBFileName=iertutil.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=164; ImageBase=0x7ffc14be0000; ImageSize=2,777,088; ImageChecksum=2,821,706; TimeDateStamp=0; DefaultBase=0x7ffc14be0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=64; ImageBase=0x7ffc14f80000; ImageSize=17,813,504; ProcessID=0; TimeDateStamp=1,498,877,177; BuildTime=17/07/01 02:46:17.00...; OriginalFileName=Windows.UI.Xaml.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=52; ImageBase=0x7ffc14f80000; GuidSig=00c63e60-b882-10bd-a...; Age=1; PDBFileName=windows.ui.xaml.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=178; ImageBase=0x7ffc14f80000; ImageSize=17,813,504; ImageChecksum=17,847,957; TimeDateStamp=0; DefaultBase=0x7ffc14f80000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=44; ImageBase=0x7ffc160c0000; ImageSize=4,718,592; ProcessID=0; TimeDateStamp=1,509,118,319; BuildTime=17/10/27 15:31:59.00...; OriginalFileName=nvapi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=131; ImageBase=0x7ffc160c0000; GuidSig=77868537-6707-4f57-9...; Age=1; PDBFileName=C:\dvs\p4\build\sw\r...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=162; ImageBase=0x7ffc160c0000; ImageSize=4,718,592; ImageChecksum=4,592,788; TimeDateStamp=0; DefaultBase=0x7ffc160c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=54; ImageBase=0x7ffc168e0000; ImageSize=962,560; ProcessID=0; TimeDateStamp=1,509,120,150; BuildTime=17/10/27 16:02:30.00...; OriginalFileName=nvSCPAPI64.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=144; ImageBase=0x7ffc168e0000; GuidSig=350ce5e9-e57b-418f-b...; Age=1; PDBFileName=c:\dvs\p4\build\sw\r...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=232; ImageBase=0x7ffc168e0000; ImageSize=962,560; ImageChecksum=934,039; TimeDateStamp=0; DefaultBase=0x7ffc168e0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Program Files (x8...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=52; ImageBase=0x7ffc17070000; ImageSize=380,928; ProcessID=0; TimeDateStamp=-700,765,474; BuildTime=83/11/23 13:23:42.00...; OriginalFileName=BCP47Lang.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=47; ImageBase=0x7ffc17070000; GuidSig=5c831af5-a13f-c60f-5...; Age=1; PDBFileName=Bcp47Langs.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=168; ImageBase=0x7ffc17070000; ImageSize=380,928; ImageChecksum=414,724; TimeDateStamp=0; DefaultBase=0x7ffc17070000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=50; ImageBase=0x7ffc17140000; ImageSize=29,044,736; ProcessID=0; TimeDateStamp=1,509,120,436; BuildTime=17/10/27 16:07:16.00...; OriginalFileName=nvwgf2um.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=134; ImageBase=0x7ffc17140000; GuidSig=8338c4c2-2c85-42c3-a...; Age=1; PDBFileName=C:\dvs\p4\build\sw\r...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=308; ImageBase=0x7ffc17140000; ImageSize=29,044,736; ImageChecksum=29,011,692; TimeDateStamp=0; DefaultBase=0x7ffc17140000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=48; ImageBase=0x7ffc1a350000; ImageSize=958,464; ProcessID=0; TimeDateStamp=1,509,118,286; BuildTime=17/10/27 15:31:26.00...; OriginalFileName=nvldumd.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=130; ImageBase=0x7ffc1a350000; GuidSig=c7a21e7c-2b69-4edc-a...; Age=1; PDBFileName=C:\dvs\p4\build\sw\r...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=298; ImageBase=0x7ffc1a350000; ImageSize=958,464; ImageChecksum=979,845; TimeDateStamp=0; DefaultBase=0x7ffc1a350000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=66; ImageBase=0x7ffc1b6a0000; ImageSize=548,864; ProcessID=0; TimeDateStamp=-1,710,934,036; BuildTime=51/11/19 19:01:00.00...; OriginalFileName=Windows.Graphics.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=53; ImageBase=0x7ffc1b6a0000; GuidSig=5e1f9be3-14b8-53a2-e...; Age=1; PDBFileName=Windows.Graphics.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=180; ImageBase=0x7ffc1b6a0000; ImageSize=548,864; ImageChecksum=589,697; TimeDateStamp=0; DefaultBase=0x7ffc1b6a0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=54; ImageBase=0x7ffc1b730000; ImageSize=393,216; ProcessID=0; TimeDateStamp=289,651,529; BuildTime=79/03/07 10:45:29.00...; OriginalFileName=DispBroker.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=47; ImageBase=0x7ffc1b730000; GuidSig=134edf49-1a5b-5a43-4...; Age=1; PDBFileName=DispBroker.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=168; ImageBase=0x7ffc1b730000; ImageSize=393,216; ImageChecksum=395,424; TimeDateStamp=0; DefaultBase=0x7ffc1b730000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=50; ImageBase=0x7ffc1bc90000; ImageSize=655,360; ProcessID=0; TimeDateStamp=-765,789,457; BuildTime=81/10/31 23:10:39.00...; OriginalFileName=ActXPrxy.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=45; ImageBase=0x7ffc1bc90000; GuidSig=79615bf0-b4f4-5650-3...; Age=1; PDBFileName=ActXPrxy.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=164; ImageBase=0x7ffc1bc90000; ImageSize=655,360; ImageChecksum=637,890; TimeDateStamp=0; DefaultBase=0x7ffc1bc90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=84; ImageBase=0x7ffc1c5c0000; ImageSize=7,770,112; ProcessID=0; TimeDateStamp=-1,131,996,070; BuildTime=70/03/25 11:07:06.00...; OriginalFileName=OneCoreUAPCommonProx...; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=62; ImageBase=0x7ffc1c5c0000; GuidSig=94e428c9-8918-e01d-f...; Age=1; PDBFileName=OneCoreUAPCommonProx...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=198; ImageBase=0x7ffc1c5c0000; ImageSize=7,770,112; ImageChecksum=7,847,302; TimeDateStamp=0; DefaultBase=0x7ffc1c5c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=70; ImageBase=0x7ffc1ce80000; ImageSize=94,208; ProcessID=0; TimeDateStamp=-1,613,407,160; BuildTime=54/12/22 13:48:56.00...; OriginalFileName=ColorAdapterClient.d...; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=55; ImageBase=0x7ffc1ce80000; GuidSig=f998534b-2c32-ef63-c...; Age=1; PDBFileName=ColorAdapterClient.p...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=184; ImageBase=0x7ffc1ce80000; ImageSize=94,208; ImageChecksum=96,871; TimeDateStamp=0; DefaultBase=0x7ffc1ce80000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=44; ImageBase=0x7ffc1cec0000; ImageSize=712,704; ProcessID=0; TimeDateStamp=1,307,321,216; BuildTime=11/06/06 00:46:56.00...; OriginalFileName=MSCMS.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=42; ImageBase=0x7ffc1cec0000; GuidSig=a9f75e86-9cac-d677-8...; Age=1; PDBFileName=mscms.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=158; ImageBase=0x7ffc1cec0000; ImageSize=712,704; ImageChecksum=732,503; TimeDateStamp=0; DefaultBase=0x7ffc1cec0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=70; ImageBase=0x7ffc1d020000; ImageSize=413,696; ProcessID=0; TimeDateStamp=1,046,978,682; BuildTime=03/03/06 19:24:42.00...; OriginalFileName=DispBroker.Desktop.d...; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=55; ImageBase=0x7ffc1d020000; GuidSig=15ecc8ae-e362-4d43-b...; Age=1; PDBFileName=DispBroker.Desktop.p...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=184; ImageBase=0x7ffc1d020000; ImageSize=413,696; ImageChecksum=408,381; TimeDateStamp=0; DefaultBase=0x7ffc1d020000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=56; ImageBase=0x7ffc1d0e0000; ImageSize=290,816; ProcessID=0; TimeDateStamp=-1,035,193,730; BuildTime=73/04/18 20:39:26.00...; OriginalFileName=UIAnimation.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=48; ImageBase=0x7ffc1d0e0000; GuidSig=b75b4a21-1704-c92e-3...; Age=1; PDBFileName=UIAnimation.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=170; ImageBase=0x7ffc1d0e0000; ImageSize=290,816; ImageChecksum=290,244; TimeDateStamp=0; DefaultBase=0x7ffc1d0e0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=74; ImageBase=0x7ffc1d190000; ImageSize=843,776; ProcessID=0; TimeDateStamp=786,359,564; BuildTime=94/12/02 09:12:44.00...; OriginalFileName=Windows.Gaming.Input...; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=57; ImageBase=0x7ffc1d190000; GuidSig=d1fe82c6-a187-b002-b...; Age=1; PDBFileName=Windows.Gaming.Input...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=188; ImageBase=0x7ffc1d190000; ImageSize=843,776; ImageChecksum=824,228; TimeDateStamp=0; DefaultBase=0x7ffc1d190000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=60; ImageBase=0x7ffc1d8e0000; ImageSize=1,765,376; ProcessID=0; TimeDateStamp=506,932,473; BuildTime=86/01/24 06:34:33.00...; OriginalFileName=WindowsCodecs.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=50; ImageBase=0x7ffc1d8e0000; GuidSig=9b0795f1-68c8-840f-7...; Age=1; PDBFileName=WindowsCodecs.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=174; ImageBase=0x7ffc1d8e0000; ImageSize=1,765,376; ImageChecksum=1,768,159; TimeDateStamp=0; DefaultBase=0x7ffc1d8e0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=66; ImageBase=0x7ffc1ddc0000; ImageSize=3,313,664; ProcessID=0; TimeDateStamp=-1,954,220,771; BuildTime=44/03/04 23:22:05.00...; OriginalFileName=CoreUIComponents.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=53; ImageBase=0x7ffc1ddc0000; GuidSig=3264578f-8a0c-52c8-8...; Age=1; PDBFileName=CoreUIComponents.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=180; ImageBase=0x7ffc1ddc0000; ImageSize=3,313,664; ImageChecksum=3,363,347; TimeDateStamp=0; DefaultBase=0x7ffc1ddc0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=46; ImageBase=0x7ffc1e0f0000; ImageSize=413,696; ProcessID=0; TimeDateStamp=-1,881,841,972; BuildTime=46/06/20 16:35:24.00...; OriginalFileName=NINPUT.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=43; ImageBase=0x7ffc1e0f0000; GuidSig=5c3085be-a437-b6ab-6...; Age=1; PDBFileName=ninput.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=160; ImageBase=0x7ffc1e0f0000; ImageSize=413,696; ImageChecksum=457,977; TimeDateStamp=0; DefaultBase=0x7ffc1e0f0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=40; ImageBase=0x7ffc1e240000; ImageSize=2,060,288; ProcessID=0; TimeDateStamp=-498,246,784; BuildTime=90/04/24 12:35:12.00...; OriginalFileName=ISM.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=40; ImageBase=0x7ffc1e240000; GuidSig=8267f315-c6e9-a6f9-5...; Age=1; PDBFileName=ISM.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=154; ImageBase=0x7ffc1e240000; ImageSize=2,060,288; ImageChecksum=2,084,378; TimeDateStamp=0; DefaultBase=0x7ffc1e240000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=42; ImageBase=0x7ffc1e440000; ImageSize=40,960; ProcessID=0; TimeDateStamp=-109,314,334; BuildTime=02/08/22 01:22:42.00...; OriginalFileName=avrt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=41; ImageBase=0x7ffc1e440000; GuidSig=4f61c298-126e-a0a9-2...; Age=1; PDBFileName=avrt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=156; ImageBase=0x7ffc1e440000; ImageSize=40,960; ImageChecksum=52,178; TimeDateStamp=0; DefaultBase=0x7ffc1e440000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=50; ImageBase=0x7ffc1e450000; ImageSize=1,388,544; ProcessID=0; TimeDateStamp=-238,274,918; BuildTime=98/07/20 10:59:38.00...; OriginalFileName=WinTypes.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=45; ImageBase=0x7ffc1e450000; GuidSig=46ae6b82-4cf2-3a19-4...; Age=1; PDBFileName=WinTypes.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=164; ImageBase=0x7ffc1e450000; ImageSize=1,388,544; ImageChecksum=1,428,617; TimeDateStamp=0; DefaultBase=0x7ffc1e450000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=50; ImageBase=0x7ffc1ef90000; ImageSize=81,920; ProcessID=0; TimeDateStamp=-2,094,881,361; BuildTime=39/09/19 22:58:55.00...; OriginalFileName=DWMGhost.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=45; ImageBase=0x7ffc1ef90000; GuidSig=2cf2d450-384a-3929-3...; Age=1; PDBFileName=dwmghost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=164; ImageBase=0x7ffc1ef90000; ImageSize=81,920; ImageChecksum=118,298; TimeDateStamp=0; DefaultBase=0x7ffc1ef90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=48; ImageBase=0x7ffc1f0f0000; ImageSize=978,944; ProcessID=0; TimeDateStamp=2,097,505,968; BuildTime=36/06/19 16:32:48.00...; OriginalFileName=propsys.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=44; ImageBase=0x7ffc1f0f0000; GuidSig=f17d0756-2273-c8ff-e...; Age=1; PDBFileName=propsys.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=162; ImageBase=0x7ffc1f0f0000; ImageSize=978,944; ImageChecksum=990,621; TimeDateStamp=0; DefaultBase=0x7ffc1f0f0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=50; ImageBase=0x7ffc1f210000; ImageSize=77,824; ProcessID=0; TimeDateStamp=1,097,789,430; BuildTime=04/10/14 21:30:30.00...; OriginalFileName=wtsapi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=45; ImageBase=0x7ffc1f210000; GuidSig=2da85aef-00d2-fb45-8...; Age=1; PDBFileName=wtsapi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=164; ImageBase=0x7ffc1f210000; ImageSize=77,824; ImageChecksum=127,847; TimeDateStamp=0; DefaultBase=0x7ffc1f210000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=42; ImageBase=0x7ffc1f3c0000; ImageSize=6,029,312; ProcessID=0; TimeDateStamp=1,287,992,107; BuildTime=10/10/25 07:35:07.00...; OriginalFileName=d2d1.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=41; ImageBase=0x7ffc1f3c0000; GuidSig=9a136d37-c8aa-c3d1-5...; Age=1; PDBFileName=d2d1.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=156; ImageBase=0x7ffc1f3c0000; ImageSize=6,029,312; ImageChecksum=6,095,626; TimeDateStamp=0; DefaultBase=0x7ffc1f3c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=44; ImageBase=0x7ffc1f990000; ImageSize=2,469,888; ProcessID=0; TimeDateStamp=-443,116,862; BuildTime=92/01/22 14:27:14.00...; OriginalFileName=D3D11.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=42; ImageBase=0x7ffc1f990000; GuidSig=3ac51121-4469-cfce-1...; Age=1; PDBFileName=d3d11.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=158; ImageBase=0x7ffc1f990000; ImageSize=2,469,888; ImageChecksum=2,530,777; TimeDateStamp=0; DefaultBase=0x7ffc1f990000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=62; ImageBase=0x7ffc1fbf0000; ImageSize=4,530,176; ProcessID=0; TimeDateStamp=552,367,017; BuildTime=87/07/04 03:16:57.00...; OriginalFileName=d3dcompiler_47.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=51; ImageBase=0x7ffc1fbf0000; GuidSig=5d146547-bac5-7b81-8...; Age=1; PDBFileName=D3DCompiler_47.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=176; ImageBase=0x7ffc1fbf0000; ImageSize=4,530,176; ImageChecksum=4,523,144; TimeDateStamp=0; DefaultBase=0x7ffc1fbf0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=44; ImageBase=0x7ffc20050000; ImageSize=1,949,696; ProcessID=0; TimeDateStamp=-1,265,753,168; BuildTime=65/12/28 08:22:08.00...; OriginalFileName=dcomp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=42; ImageBase=0x7ffc20050000; GuidSig=6b1bdc7d-bd7f-c9c8-0...; Age=1; PDBFileName=dcomp.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=158; ImageBase=0x7ffc20050000; ImageSize=1,949,696; ImageChecksum=1,989,184; TimeDateStamp=0; DefaultBase=0x7ffc20050000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=48; ImageBase=0x7ffc20230000; ImageSize=3,588,096; ProcessID=0; TimeDateStamp=-1,178,041,426; BuildTime=68/10/08 12:44:30.00...; OriginalFileName=dwmcore.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=44; ImageBase=0x7ffc20230000; GuidSig=ca18b47a-64cc-676c-c...; Age=1; PDBFileName=dwmcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=162; ImageBase=0x7ffc20230000; ImageSize=3,588,096; ImageChecksum=3,612,858; TimeDateStamp=0; DefaultBase=0x7ffc20230000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=60; ImageBase=0x7ffc205a0000; ImageSize=868,352; ProcessID=0; TimeDateStamp=270,157,240; BuildTime=78/07/24 19:40:40.00...; OriginalFileName=CoreMessaging.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=50; ImageBase=0x7ffc205a0000; GuidSig=f77a6f37-b916-eb3a-b...; Age=1; PDBFileName=CoreMessaging.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=174; ImageBase=0x7ffc205a0000; ImageSize=868,352; ImageChecksum=871,099; TimeDateStamp=0; DefaultBase=0x7ffc205a0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=52; ImageBase=0x7ffc20680000; ImageSize=184,320; ProcessID=0; TimeDateStamp=-692,347,934; BuildTime=84/02/28 23:36:02.00...; OriginalFileName=WINMMbase.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=46; ImageBase=0x7ffc20680000; GuidSig=b19a643d-5ac2-3f36-2...; Age=1; PDBFileName=WINMMBASE.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=166; ImageBase=0x7ffc20680000; ImageSize=184,320; ImageChecksum=217,182; TimeDateStamp=0; DefaultBase=0x7ffc20680000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=44; ImageBase=0x7ffc206e0000; ImageSize=147,456; ProcessID=0; TimeDateStamp=-768,033,220; BuildTime=81/10/05 23:54:36.00...; OriginalFileName=WINMM.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=42; ImageBase=0x7ffc206e0000; GuidSig=6d145e3b-6417-f20c-4...; Age=1; PDBFileName=winmm.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=158; ImageBase=0x7ffc206e0000; ImageSize=147,456; ImageChecksum=140,341; TimeDateStamp=0; DefaultBase=0x7ffc206e0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=42; ImageBase=0x7ffc20710000; ImageSize=1,007,616; ProcessID=0; TimeDateStamp=1,835,561,560; BuildTime=28/03/01 22:12:40.00...; OriginalFileName=udwm.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=41; ImageBase=0x7ffc20710000; GuidSig=43ad0497-f8a3-15aa-0...; Age=1; PDBFileName=uDWM.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=156; ImageBase=0x7ffc20710000; ImageSize=1,007,616; ImageChecksum=1,022,099; TimeDateStamp=0; DefaultBase=0x7ffc20710000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=50; ImageBase=0x7ffc20810000; ImageSize=167,936; ProcessID=0; TimeDateStamp=1,721,734,825; BuildTime=24/07/23 11:40:25.00...; OriginalFileName=dwmredir.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=45; ImageBase=0x7ffc20810000; GuidSig=b195b82c-b86a-58b1-c...; Age=1; PDBFileName=dwmredir.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=164; ImageBase=0x7ffc20810000; ImageSize=167,936; ImageChecksum=162,824; TimeDateStamp=0; DefaultBase=0x7ffc20810000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=48; ImageBase=0x7ffc20960000; ImageSize=585,728; ProcessID=0; TimeDateStamp=-9,148,100; BuildTime=05/10/24 09:19:56.00...; OriginalFileName=Apphelp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=44; ImageBase=0x7ffc20960000; GuidSig=b37f976c-be76-5dae-9...; Age=1; PDBFileName=apphelp.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=162; ImageBase=0x7ffc20960000; ImageSize=585,728; ImageChecksum=594,685; TimeDateStamp=0; DefaultBase=0x7ffc20960000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=48; ImageBase=0x7ffc20ab0000; ImageSize=626,688; ProcessID=0; TimeDateStamp=-35,801,546; BuildTime=04/12/19 21:35:50.00...; OriginalFileName=UxTheme.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=44; ImageBase=0x7ffc20ab0000; GuidSig=46b4bea9-d4a7-aa5b-6...; Age=1; PDBFileName=UxTheme.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=162; ImageBase=0x7ffc20ab0000; ImageSize=626,688; ImageChecksum=614,047; TimeDateStamp=0; DefaultBase=0x7ffc20ab0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=64; ImageBase=0x7ffc20b80000; ImageSize=2,465,792; ProcessID=0; TimeDateStamp=1,123,054,026; BuildTime=05/08/03 07:27:06.00...; OriginalFileName=twinapi.appcore.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=52; ImageBase=0x7ffc20b80000; GuidSig=da642c52-541e-6baa-4...; Age=1; PDBFileName=twinapi.appcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=178; ImageBase=0x7ffc20b80000; ImageSize=2,465,792; ImageChecksum=2,536,066; TimeDateStamp=0; DefaultBase=0x7ffc20b80000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=46; ImageBase=0x7ffc20ed0000; ImageSize=184,320; ProcessID=0; TimeDateStamp=-387,540,599; BuildTime=93/10/26 20:18:17.00...; OriginalFileName=dwmapi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=43; ImageBase=0x7ffc20ed0000; GuidSig=0d061d68-1544-eff4-4...; Age=1; PDBFileName=dwmapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=160; ImageBase=0x7ffc20ed0000; ImageSize=184,320; ImageChecksum=211,409; TimeDateStamp=0; DefaultBase=0x7ffc20ed0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=50; ImageBase=0x7ffc20f00000; ImageSize=167,936; ProcessID=0; TimeDateStamp=-189,693,732; BuildTime=00/02/02 17:46:04.00...; OriginalFileName=rmclient.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=45; ImageBase=0x7ffc20f00000; GuidSig=d9b2eec0-1750-fc20-8...; Age=1; PDBFileName=RmClient.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=164; ImageBase=0x7ffc20f00000; ImageSize=167,936; ImageChecksum=187,354; TimeDateStamp=0; DefaultBase=0x7ffc20f00000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=48; ImageBase=0x7ffc21260000; ImageSize=40,960; ProcessID=0; TimeDateStamp=-1,837,403,674; BuildTime=47/11/17 00:33:42.00...; OriginalFileName=VERSION.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=44; ImageBase=0x7ffc21260000; GuidSig=fcf21b9c-bfda-c57b-3...; Age=1; PDBFileName=version.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=162; ImageBase=0x7ffc21260000; ImageSize=40,960; ImageChecksum=77,970; TimeDateStamp=0; DefaultBase=0x7ffc21260000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=48; ImageBase=0x7ffc21280000; ImageSize=217,088; ProcessID=0; TimeDateStamp=1,079,200,003; BuildTime=04/03/13 17:46:43.00...; OriginalFileName=XmlLite.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=44; ImageBase=0x7ffc21280000; GuidSig=d5ddfeb7-8925-62e6-d...; Age=1; PDBFileName=XmlLite.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=162; ImageBase=0x7ffc21280000; ImageSize=217,088; ImageChecksum=214,275; TimeDateStamp=0; DefaultBase=0x7ffc21280000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=40; ImageBase=0x7ffc21450000; ImageSize=57,344; ProcessID=0; TimeDateStamp=1,341,062,757; BuildTime=12/06/30 13:25:57.00...; OriginalFileName=hid.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=40; ImageBase=0x7ffc21450000; GuidSig=c56adcae-0493-03c4-1...; Age=1; PDBFileName=hid.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=154; ImageBase=0x7ffc21450000; ImageSize=57,344; ImageChecksum=74,973; TimeDateStamp=0; DefaultBase=0x7ffc21450000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=46; ImageBase=0x7ffc21b90000; ImageSize=131,072; ProcessID=0; TimeDateStamp=-1,139,896,690; BuildTime=69/12/24 00:30:06.00...; OriginalFileName=DXCore.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=43; ImageBase=0x7ffc21b90000; GuidSig=33bb03a6-a0d1-2ce8-8...; Age=1; PDBFileName=DXCore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=160; ImageBase=0x7ffc21b90000; ImageSize=131,072; ImageChecksum=173,498; TimeDateStamp=0; DefaultBase=0x7ffc21b90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=42; ImageBase=0x7ffc21bb0000; ImageSize=958,464; ProcessID=0; TimeDateStamp=1,511,252,964; BuildTime=17/11/21 08:29:24.00...; OriginalFileName=dxgi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=41; ImageBase=0x7ffc21bb0000; GuidSig=5e9cc76a-64eb-6cdf-7...; Age=1; PDBFileName=dxgi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=156; ImageBase=0x7ffc21bb0000; ImageSize=958,464; ImageChecksum=997,190; TimeDateStamp=0; DefaultBase=0x7ffc21bb0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=46; ImageBase=0x7ffc21f70000; ImageSize=376,832; ProcessID=0; TimeDateStamp=43,988,838; BuildTime=71/05/25 03:07:18.00...; OriginalFileName=winsta.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=43; ImageBase=0x7ffc21f70000; GuidSig=b854bf05-e0a2-5b01-7...; Age=1; PDBFileName=winsta.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=160; ImageBase=0x7ffc21f70000; ImageSize=376,832; ImageChecksum=387,708; TimeDateStamp=0; DefaultBase=0x7ffc21f70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=46; ImageBase=0x7ffc22280000; ImageSize=208,896; ProcessID=0; TimeDateStamp=-96,717,502; BuildTime=03/01/14 20:29:54.00...; OriginalFileName=rsaenh.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=43; ImageBase=0x7ffc22280000; GuidSig=97af5588-54c0-a219-f...; Age=1; PDBFileName=rsaenh.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=160; ImageBase=0x7ffc22280000; ImageSize=208,896; ImageChecksum=251,829; TimeDateStamp=0; DefaultBase=0x7ffc22280000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=52; ImageBase=0x7ffc22890000; ImageSize=49,152; ProcessID=0; TimeDateStamp=-17,821,274; BuildTime=05/07/16 00:07:02.00...; OriginalFileName=cryptbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=46; ImageBase=0x7ffc22890000; GuidSig=7588b6a3-bd73-2904-7...; Age=1; PDBFileName=cryptbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=166; ImageBase=0x7ffc22890000; ImageSize=49,152; ImageChecksum=64,645; TimeDateStamp=0; DefaultBase=0x7ffc22890000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=50; ImageBase=0x7ffc229b0000; ImageSize=2,641,920; ProcessID=0; TimeDateStamp=618,159,889; BuildTime=89/08/03 15:04:49.00...; OriginalFileName=COMCTL32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=45; ImageBase=0x7ffc229b0000; GuidSig=1c4f44cd-f82c-c59b-0...; Age=1; PDBFileName=comctl32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=344; ImageBase=0x7ffc229b0000; ImageSize=2,641,920; ImageChecksum=2,665,050; TimeDateStamp=0; DefaultBase=0x7ffc229b0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\WinSxS\am...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=48; ImageBase=0x7ffc22e10000; ImageSize=200,704; ProcessID=0; TimeDateStamp=-648,125,799; BuildTime=85/07/24 19:31:37.00...; OriginalFileName=ntmarta.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=44; ImageBase=0x7ffc22e10000; GuidSig=d28b6be6-17ca-2646-7...; Age=1; PDBFileName=ntmarta.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=162; ImageBase=0x7ffc22e10000; ImageSize=200,704; ImageChecksum=211,194; TimeDateStamp=0; DefaultBase=0x7ffc22e10000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=54; ImageBase=0x7ffc232d0000; ImageSize=172,032; ProcessID=0; TimeDateStamp=564,545,050; BuildTime=87/11/22 02:04:10.00...; OriginalFileName=devinfoset.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=43; ImageBase=0x7ffc232d0000; GuidSig=bf3fb10c-179d-a551-d...; Age=1; PDBFileName=devobj.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=160; ImageBase=0x7ffc232d0000; ImageSize=172,032; ImageChecksum=212,309; TimeDateStamp=0; DefaultBase=0x7ffc232d0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=48; ImageBase=0x7ffc233f0000; ImageSize=151,552; ProcessID=0; TimeDateStamp=-157,143,252; BuildTime=01/02/14 11:34:04.00...; OriginalFileName=userenv.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=44; ImageBase=0x7ffc233f0000; GuidSig=1a734def-8e54-a706-f...; Age=1; PDBFileName=userenv.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=162; ImageBase=0x7ffc233f0000; ImageSize=151,552; ImageChecksum=176,304; TimeDateStamp=0; DefaultBase=0x7ffc233f0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=44; ImageBase=0x7ffc234d0000; ImageSize=65,536; ProcessID=0; TimeDateStamp=-1,563,634,669; BuildTime=56/07/20 15:30:27.00...; OriginalFileName=umpdc.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=42; ImageBase=0x7ffc234d0000; GuidSig=1504cc55-3edb-4294-a...; Age=1; PDBFileName=UMPDC.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=158; ImageBase=0x7ffc234d0000; ImageSize=65,536; ImageChecksum=55,709; TimeDateStamp=0; DefaultBase=0x7ffc234d0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=50; ImageBase=0x7ffc234e0000; ImageSize=303,104; ProcessID=0; TimeDateStamp=-37,463,926; BuildTime=04/11/30 15:49:30.00...; OriginalFileName=POWRPROF.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=45; ImageBase=0x7ffc234e0000; GuidSig=bae22f43-6c95-a7d5-0...; Age=1; PDBFileName=powrprof.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=164; ImageBase=0x7ffc234e0000; ImageSize=303,104; ImageChecksum=321,827; TimeDateStamp=0; DefaultBase=0x7ffc234e0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=62; ImageBase=0x7ffc23530000; ImageSize=69,632; ProcessID=0; TimeDateStamp=96,400,242; BuildTime=73/01/20 17:50:42.00...; OriginalFileName=kernel.appcore.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=51; ImageBase=0x7ffc23530000; GuidSig=b44a2a63-8a5c-a8d8-1...; Age=1; PDBFileName=Kernel.Appcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=176; ImageBase=0x7ffc23530000; ImageSize=69,632; ImageChecksum=91,565; TimeDateStamp=0; DefaultBase=0x7ffc23530000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=48; ImageBase=0x7ffc23550000; ImageSize=126,976; ProcessID=0; TimeDateStamp=-87,365,952; BuildTime=03/05/03 02:09:04.00...; OriginalFileName=PROFAPI.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=44; ImageBase=0x7ffc23550000; GuidSig=d3e9e0b2-6dc3-e775-b...; Age=1; PDBFileName=profapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=162; ImageBase=0x7ffc23550000; ImageSize=126,976; ImageChecksum=153,678; TimeDateStamp=0; DefaultBase=0x7ffc23550000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=46; ImageBase=0x7ffc23570000; ImageSize=73,728; ProcessID=0; TimeDateStamp=-457,022,433; BuildTime=91/08/14 15:47:43.00...; OriginalFileName=msasn1.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=43; ImageBase=0x7ffc23570000; GuidSig=ff420efb-35b1-0aa7-6...; Age=1; PDBFileName=msasn1.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=160; ImageBase=0x7ffc23570000; ImageSize=73,728; ImageChecksum=79,097; TimeDateStamp=0; DefaultBase=0x7ffc23570000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=46; ImageBase=0x7ffc23590000; ImageSize=155,648; ProcessID=0; TimeDateStamp=-1,248,142,761; BuildTime=66/07/20 04:08:55.00...; OriginalFileName=bcrypt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=43; ImageBase=0x7ffc23590000; GuidSig=1a472182-0367-8386-d...; Age=1; PDBFileName=bcrypt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=160; ImageBase=0x7ffc23590000; ImageSize=155,648; ImageChecksum=157,312; TimeDateStamp=0; DefaultBase=0x7ffc23590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=50; ImageBase=0x7ffc235c0000; ImageSize=303,104; ProcessID=0; TimeDateStamp=-1,347,769,430; BuildTime=63/05/24 02:04:26.00...; OriginalFileName=CFGMGR32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=45; ImageBase=0x7ffc235c0000; GuidSig=c951ee8e-a9b3-8ebf-a...; Age=1; PDBFileName=cfgmgr32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=164; ImageBase=0x7ffc235c0000; ImageSize=303,104; ImageChecksum=322,106; TimeDateStamp=0; DefaultBase=0x7ffc235c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=64; ImageBase=0x7ffc23610000; ImageSize=7,843,840; ProcessID=0; TimeDateStamp=-1,549,850,267; BuildTime=56/12/27 04:30:29.00...; OriginalFileName=Windows.Storage.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=52; ImageBase=0x7ffc23610000; GuidSig=d9102742-5b8c-0068-1...; Age=1; PDBFileName=Windows.Storage.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=178; ImageBase=0x7ffc23610000; ImageSize=7,843,840; ImageChecksum=7,937,261; TimeDateStamp=0; DefaultBase=0x7ffc23610000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=50; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ProcessID=0; TimeDateStamp=1,555,946,369; BuildTime=19/04/22 15:19:29.00...; OriginalFileName=ucrtbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=45; ImageBase=0x7ffc23d90000; GuidSig=faceb612-020d-68fb-b...; Age=1; PDBFileName=ucrtbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=164; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ImageChecksum=1,052,117; TimeDateStamp=0; DefaultBase=0x7ffc23d90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=48; ImageBase=0x7ffc23e90000; ImageSize=94,208; ProcessID=0; TimeDateStamp=-1,525,668,879; BuildTime=57/10/03 01:33:37.00...; OriginalFileName=cryptsp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=44; ImageBase=0x7ffc23e90000; GuidSig=7618debe-ac0f-9998-7...; Age=1; PDBFileName=cryptsp.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=162; ImageBase=0x7ffc23e90000; ImageSize=94,208; ImageChecksum=133,544; TimeDateStamp=0; DefaultBase=0x7ffc23e90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=46; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ProcessID=0; TimeDateStamp=1,396,962,555; BuildTime=14/04/08 13:09:15.00...; OriginalFileName=Win32u.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=43; ImageBase=0x7ffc23eb0000; GuidSig=bc2e49ab-e46d-2e93-b...; Age=1; PDBFileName=win32u.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=160; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ImageChecksum=177,968; TimeDateStamp=0; DefaultBase=0x7ffc23eb0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=54; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ProcessID=0; TimeDateStamp=439,410,971; BuildTime=83/12/04 18:36:11.00...; OriginalFileName=Kernelbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=47; ImageBase=0x7ffc23ee0000; GuidSig=44c8ec9a-a0ea-4f98-d...; Age=1; PDBFileName=kernelbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=168; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ImageChecksum=2,793,344; TimeDateStamp=0; DefaultBase=0x7ffc23ee0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=44; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ProcessID=0; TimeDateStamp=1,868,443,751; BuildTime=29/03/17 12:09:11.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=46; ImageBase=0x7ffc24190000; GuidSig=e5a785df-0333-6a66-6...; Age=1; PDBFileName=gdi32full.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=166; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ImageChecksum=1,696,264; TimeDateStamp=0; DefaultBase=0x7ffc24190000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=50; ImageBase=0x7ffc24330000; ImageSize=376,832; ProcessID=0; TimeDateStamp=1,670,486,148; BuildTime=22/12/08 07:55:48.00...; OriginalFileName=WINTRUST.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=45; ImageBase=0x7ffc24330000; GuidSig=ef819cd6-e971-2b01-0...; Age=1; PDBFileName=wintrust.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=164; ImageBase=0x7ffc24330000; ImageSize=376,832; ImageChecksum=380,837; TimeDateStamp=0; DefaultBase=0x7ffc24330000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=66; ImageBase=0x7ffc24390000; ImageSize=528,384; ProcessID=0; TimeDateStamp=1,774,320,825; BuildTime=26/03/24 02:53:45.00...; OriginalFileName=bcryptprimitives.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=53; ImageBase=0x7ffc24390000; GuidSig=54a1b493-8222-f67e-4...; Age=1; PDBFileName=bcryptprimitives.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=180; ImageBase=0x7ffc24390000; ImageSize=528,384; ImageChecksum=562,796; TimeDateStamp=0; DefaultBase=0x7ffc24390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=52; ImageBase=0x7ffc24420000; ImageSize=647,168; ProcessID=0; TimeDateStamp=545,597,548; BuildTime=87/04/16 18:52:28.00...; OriginalFileName=msvcp_win.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=46; ImageBase=0x7ffc24420000; GuidSig=de65fef9-16bb-6b73-d...; Age=1; PDBFileName=msvcp_win.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=166; ImageBase=0x7ffc24420000; ImageSize=647,168; ImageChecksum=686,408; TimeDateStamp=0; DefaultBase=0x7ffc24420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=48; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ProcessID=0; TimeDateStamp=135,099,696; BuildTime=74/04/13 15:41:36.00...; OriginalFileName=CRYPT32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=44; ImageBase=0x7ffc244c0000; GuidSig=8c840cbc-1c63-bfb7-6...; Age=1; PDBFileName=crypt32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=162; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ImageChecksum=1,341,835; TimeDateStamp=0; DefaultBase=0x7ffc244c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=48; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ProcessID=0; TimeDateStamp=1,691,891,946; BuildTime=23/08/13 01:59:06.00...; OriginalFileName=COMBASE.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=44; ImageBase=0x7ffc246c0000; GuidSig=d15b0ee4-2a16-5244-2...; Age=1; PDBFileName=combase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=162; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ImageChecksum=3,387,881; TimeDateStamp=0; DefaultBase=0x7ffc246c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=50; ImageBase=0x7ffc24b30000; ImageSize=667,648; ProcessID=0; TimeDateStamp=-1,762,261,787; BuildTime=50/04/04 17:18:29.00...; OriginalFileName=advapi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=45; ImageBase=0x7ffc24b30000; GuidSig=549260e6-7474-8391-e...; Age=1; PDBFileName=advapi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=164; ImageBase=0x7ffc24b30000; ImageSize=667,648; ImageChecksum=662,904; TimeDateStamp=0; DefaultBase=0x7ffc24b30000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=50; ImageBase=0x7ffc24be0000; ImageSize=729,088; ProcessID=0; TimeDateStamp=775,814,378; BuildTime=94/08/02 07:59:38.00...; OriginalFileName=kernel32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=45; ImageBase=0x7ffc24be0000; GuidSig=47a44f0c-c47f-b6a1-f...; Age=1; PDBFileName=kernel32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=164; ImageBase=0x7ffc24be0000; ImageSize=729,088; ImageChecksum=723,980; TimeDateStamp=0; DefaultBase=0x7ffc24be0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=44; ImageBase=0x7ffc24d10000; ImageSize=188,416; ProcessID=0; TimeDateStamp=-1,667,059,575; BuildTime=53/04/10 14:22:01.00...; OriginalFileName=imm32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=42; ImageBase=0x7ffc24d10000; GuidSig=c11e81be-ed6a-db51-3...; Age=1; PDBFileName=imm32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=158; ImageBase=0x7ffc24d10000; ImageSize=188,416; ImageChecksum=216,565; TimeDateStamp=0; DefaultBase=0x7ffc24d10000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=48; ImageBase=0x7ffc24d40000; ImageSize=335,872; ProcessID=0; TimeDateStamp=-125,797,471; BuildTime=02/02/12 06:43:45.00...; OriginalFileName=SHLWAPI.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=44; ImageBase=0x7ffc24d40000; GuidSig=8b7db15a-0b89-93df-4...; Age=1; PDBFileName=shlwapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=162; ImageBase=0x7ffc24d40000; ImageSize=335,872; ImageChecksum=385,032; TimeDateStamp=0; DefaultBase=0x7ffc24d40000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=44; ImageBase=0x7ffc24da0000; ImageSize=155,648; ProcessID=0; TimeDateStamp=-1,867,374,302; BuildTime=46/12/05 03:23:14.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=42; ImageBase=0x7ffc24da0000; GuidSig=209ad405-837d-061e-f...; Age=1; PDBFileName=gdi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=158; ImageBase=0x7ffc24da0000; ImageSize=155,648; ImageChecksum=194,403; TimeDateStamp=0; DefaultBase=0x7ffc24da0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=50; ImageBase=0x7ffc24f20000; ImageSize=4,653,056; ProcessID=0; TimeDateStamp=-1,478,931,446; BuildTime=59/03/28 00:10:50.00...; OriginalFileName=SETUPAPI.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=45; ImageBase=0x7ffc24f20000; GuidSig=2afde28c-a886-98c2-7...; Age=1; PDBFileName=setupapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=164; ImageBase=0x7ffc24f20000; ImageSize=4,653,056; ImageChecksum=4,692,368; TimeDateStamp=0; DefaultBase=0x7ffc24f20000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=46; ImageBase=0x7ffc25390000; ImageSize=647,168; ProcessID=0; TimeDateStamp=-172,101,673; BuildTime=00/08/25 08:27:03.00...; OriginalFileName=msvcrt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=43; ImageBase=0x7ffc25390000; GuidSig=1fea8db6-b57f-5fbf-a...; Age=1; PDBFileName=msvcrt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=160; ImageBase=0x7ffc25390000; ImageSize=647,168; ImageChecksum=678,174; TimeDateStamp=0; DefaultBase=0x7ffc25390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=44; ImageBase=0x7ffc25430000; ImageSize=1,400,832; ProcessID=0; TimeDateStamp=1,171,436,857; BuildTime=07/02/14 07:07:37.00...; OriginalFileName=OLE32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=42; ImageBase=0x7ffc25430000; GuidSig=ec385cee-495b-f162-5...; Age=1; PDBFileName=ole32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=158; ImageBase=0x7ffc25430000; ImageSize=1,400,832; ImageChecksum=1,434,873; TimeDateStamp=0; DefaultBase=0x7ffc25430000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=48; ImageBase=0x7ffc25590000; ImageSize=618,496; ProcessID=0; TimeDateStamp=-136,044,297; BuildTime=01/10/16 16:23:19.00...; OriginalFileName=sechost.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=44; ImageBase=0x7ffc25590000; GuidSig=0f733965-b12f-7923-b...; Age=1; PDBFileName=sechost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=162; ImageBase=0x7ffc25590000; ImageSize=618,496; ImageChecksum=662,974; TimeDateStamp=0; DefaultBase=0x7ffc25590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=48; ImageBase=0x7ffc25630000; ImageSize=663,552; ProcessID=0; TimeDateStamp=-1,794,760,561; BuildTime=49/03/24 13:52:15.00...; OriginalFileName=CLBCATQ.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=44; ImageBase=0x7ffc25630000; GuidSig=da759f99-b2bb-75c2-1...; Age=1; PDBFileName=CLBCatQ.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=162; ImageBase=0x7ffc25630000; ImageSize=663,552; ImageChecksum=684,075; TimeDateStamp=0; DefaultBase=0x7ffc25630000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=46; ImageBase=0x7ffc256e0000; ImageSize=692,224; ProcessID=0; TimeDateStamp=1,221,584,444; BuildTime=08/09/16 17:00:44.00...; OriginalFileName=SHCORE.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=43; ImageBase=0x7ffc256e0000; GuidSig=3921dcf6-eafa-cc85-7...; Age=1; PDBFileName=shcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=160; ImageBase=0x7ffc256e0000; ImageSize=692,224; ImageChecksum=745,271; TimeDateStamp=0; DefaultBase=0x7ffc256e0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=48; ImageBase=0x7ffc257a0000; ImageSize=7,208,960; ProcessID=0; TimeDateStamp=-326,300,782; BuildTime=95/10/05 15:21:54.00...; OriginalFileName=SHELL32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=44; ImageBase=0x7ffc257a0000; GuidSig=7c75889e-b849-1987-a...; Age=1; PDBFileName=shell32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=162; ImageBase=0x7ffc257a0000; ImageSize=7,208,960; ImageChecksum=7,292,558; TimeDateStamp=0; DefaultBase=0x7ffc257a0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=50; ImageBase=0x7ffc25e80000; ImageSize=118,784; ProcessID=0; TimeDateStamp=331,349,049; BuildTime=80/07/02 01:24:09.00...; OriginalFileName=IMAGEHLP.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=45; ImageBase=0x7ffc25e80000; GuidSig=b100f2aa-7653-e1ab-3...; Age=1; PDBFileName=imagehlp.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=164; ImageBase=0x7ffc25e80000; ImageSize=118,784; ImageChecksum=163,995; TimeDateStamp=0; DefaultBase=0x7ffc25e80000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=50; ImageBase=0x7ffc25ea0000; ImageSize=802,816; ProcessID=0; TimeDateStamp=-1,108,332,853; BuildTime=70/12/24 08:14:03.00...; OriginalFileName=OLEAUT32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=45; ImageBase=0x7ffc25ea0000; GuidSig=2dfa946d-f7be-e09f-3...; Age=1; PDBFileName=oleaut32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=164; ImageBase=0x7ffc25ea0000; ImageSize=802,816; ImageChecksum=845,595; TimeDateStamp=0; DefaultBase=0x7ffc25ea0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=46; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ProcessID=0; TimeDateStamp=87,082,528; BuildTime=72/10/04 21:35:28.00...; OriginalFileName=rpcrt4.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=43; ImageBase=0x7ffc25f70000; GuidSig=a3028d6b-45da-0062-4...; Age=1; PDBFileName=rpcrt4.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=160; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ImageChecksum=1,199,090; TimeDateStamp=0; DefaultBase=0x7ffc25f70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=44; ImageBase=0x7ffc262c0000; ImageSize=32,768; ProcessID=0; TimeDateStamp=1,052,520,301; BuildTime=03/05/09 22:45:01.00...; OriginalFileName=PSAPI.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=42; ImageBase=0x7ffc262c0000; GuidSig=4d36e374-9edd-7d3d-e...; Age=1; PDBFileName=psapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=158; ImageBase=0x7ffc262c0000; ImageSize=32,768; ImageChecksum=53,623; TimeDateStamp=0; DefaultBase=0x7ffc262c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=46; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ProcessID=0; TimeDateStamp=-1,431,966,518; BuildTime=60/09/21 13:59:38.00...; OriginalFileName=user32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=43; ImageBase=0x7ffc26420000; GuidSig=bc4cc7cc-9a33-b8a6-6...; Age=1; PDBFileName=user32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=160; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ImageChecksum=1,700,392; TimeDateStamp=0; DefaultBase=0x7ffc26420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=44; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ProcessID=0; TimeDateStamp=-1,523,876,758; BuildTime=57/10/23 19:22:18.00...; OriginalFileName=ntdll.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=42; ImageBase=0x7ffc26600000; GuidSig=b54f3499-813e-bcf1-3...; Age=1; PDBFileName=ntdll.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1244; TID=-1; PName=dwm; ProceNum=2; DataLen=158; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ImageChecksum=2,058,600; TimeDateStamp=0; DefaultBase=0x7ffc26600000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: Windows Kernel/Process/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=2; DataLen=210; ProcessID=1,348; ParentID=836; ImageFileName=svchost.exe; PageDirectoryBase=0x10234b9000; Flags=None; SessionID=0; ExitStatus=259; UniqueProcessKey=0xffffc50f60fc8440; CommandLine=C:\Windows\System32\...; PackageFullName=; ApplicationID=; 
EVENT 0.000: Windows Kernel/PerfInfo/Sample PID=-1; TID=9984; PName=; ProceNum=2; DataLen=16; InstructionPointer=0xfffff8027cb40b62; ProcessorNumber=2; Priority=9; ExecutingDPC=False; ExecutingISR=False; Rank=0; Count=1; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=48; ImageBase=0x7ff6295b0000; ImageSize=65,536; ProcessID=0; TimeDateStamp=852,935,184; BuildTime=97/01/10 22:26:24.00...; OriginalFileName=svchost.exe; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=44; ImageBase=0x7ff6295b0000; GuidSig=ef7b3786-4e54-5d5e-c...; Age=1; PDBFileName=svchost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=162; ImageBase=0x7ff6295b0000; ImageSize=65,536; ImageChecksum=68,124; TimeDateStamp=0; DefaultBase=0x7ff6295b0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=40; ImageBase=0x7ffc1d170000; ImageSize=94,208; ProcessID=0; TimeDateStamp=795,216,183; BuildTime=95/03/14 21:23:03.00...; OriginalFileName=UMB.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=40; ImageBase=0x7ffc1d170000; GuidSig=bfb34133-9034-f2fb-7...; Age=1; PDBFileName=umb.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=154; ImageBase=0x7ffc1d170000; ImageSize=94,208; ImageChecksum=108,650; TimeDateStamp=0; DefaultBase=0x7ffc1d170000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=52; ImageBase=0x7ffc1d510000; ImageSize=65,536; ProcessID=0; TimeDateStamp=1,460,542,778; BuildTime=16/04/13 10:19:38.00...; OriginalFileName=websocket.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=46; ImageBase=0x7ffc1d510000; GuidSig=e7fc1059-eef9-0266-7...; Age=1; PDBFileName=websocket.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=166; ImageBase=0x7ffc1d510000; ImageSize=65,536; ImageChecksum=66,139; TimeDateStamp=0; DefaultBase=0x7ffc1d510000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=46; ImageBase=0x7ffc1d520000; ImageSize=69,632; ProcessID=0; TimeDateStamp=-956,693,950; BuildTime=75/10/14 10:09:06.00...; OriginalFileName=tlscsp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=43; ImageBase=0x7ffc1d520000; GuidSig=00f5f6ca-1c4c-d489-e...; Age=1; PDBFileName=tlscsp.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=160; ImageBase=0x7ffc1d520000; ImageSize=69,632; ImageChecksum=77,052; TimeDateStamp=0; DefaultBase=0x7ffc1d520000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=60; ImageBase=0x7ffc1d540000; ImageSize=1,843,200; ProcessID=0; TimeDateStamp=1,177,815,611; BuildTime=07/04/29 03:00:11.00...; OriginalFileName=rdpserverbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=50; ImageBase=0x7ffc1d540000; GuidSig=f9b390d2-f5d9-9e0b-8...; Age=1; PDBFileName=rdpserverbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=174; ImageBase=0x7ffc1d540000; ImageSize=1,843,200; ImageChecksum=1,849,305; TimeDateStamp=0; DefaultBase=0x7ffc1d540000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=48; ImageBase=0x7ffc1d710000; ImageSize=1,540,096; ProcessID=0; TimeDateStamp=1,399,504,257; BuildTime=14/05/07 23:10:57.00...; OriginalFileName=rdpbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=44; ImageBase=0x7ffc1d710000; GuidSig=30fb1abb-c32d-1da0-6...; Age=1; PDBFileName=rdpbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=162; ImageBase=0x7ffc1d710000; ImageSize=1,540,096; ImageChecksum=1,547,602; TimeDateStamp=0; DefaultBase=0x7ffc1d710000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=40; ImageBase=0x7ffc1d890000; ImageSize=294,912; ProcessID=0; TimeDateStamp=599,970,825; BuildTime=89/01/05 02:33:45.00...; OriginalFileName=PDH.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=40; ImageBase=0x7ffc1d890000; GuidSig=86e28f09-055f-cb75-b...; Age=1; PDBFileName=pdh.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=154; ImageBase=0x7ffc1d890000; ImageSize=294,912; ImageChecksum=301,328; TimeDateStamp=0; DefaultBase=0x7ffc1d890000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=46; ImageBase=0x7ffc1da90000; ImageSize=57,344; ProcessID=0; TimeDateStamp=1,300,071,905; BuildTime=11/03/14 03:05:05.00...; OriginalFileName=rfxvmt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=43; ImageBase=0x7ffc1da90000; GuidSig=6a28f4bf-2d0d-9660-d...; Age=1; PDBFileName=RfxVmt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=160; ImageBase=0x7ffc1da90000; ImageSize=57,344; ImageChecksum=105,121; TimeDateStamp=0; DefaultBase=0x7ffc1da90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=52; ImageBase=0x7ffc1dac0000; ImageSize=1,572,864; ProcessID=0; TimeDateStamp=-1,380,728,354; BuildTime=62/05/07 14:49:02.00...; OriginalFileName=RdpCoreTS.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=46; ImageBase=0x7ffc1dac0000; GuidSig=1e4fd884-32f5-f8b3-b...; Age=1; PDBFileName=RdpCoreTS.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=166; ImageBase=0x7ffc1dac0000; ImageSize=1,572,864; ImageChecksum=1,537,423; TimeDateStamp=0; DefaultBase=0x7ffc1dac0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=46; ImageBase=0x7ffc1dc40000; ImageSize=126,976; ProcessID=0; TimeDateStamp=559,492,093; BuildTime=87/09/24 14:28:13.00...; OriginalFileName=regapi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=43; ImageBase=0x7ffc1dc40000; GuidSig=3e633eb1-233e-1cf2-7...; Age=1; PDBFileName=regapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=160; ImageBase=0x7ffc1dc40000; ImageSize=126,976; ImageChecksum=114,389; TimeDateStamp=0; DefaultBase=0x7ffc1dc40000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=50; ImageBase=0x7ffc1e5b0000; ImageSize=65,536; ProcessID=0; TimeDateStamp=162,819,529; BuildTime=75/02/28 11:38:49.00...; OriginalFileName=lsmproxy.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=45; ImageBase=0x7ffc1e5b0000; GuidSig=89c329fd-d3aa-d2a5-0...; Age=1; PDBFileName=lsmproxy.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=164; ImageBase=0x7ffc1e5b0000; ImageSize=65,536; ImageChecksum=68,754; TimeDateStamp=0; DefaultBase=0x7ffc1e5b0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=48; ImageBase=0x7ffc1ed60000; ImageSize=1,093,632; ProcessID=0; TimeDateStamp=1,282,940,229; BuildTime=10/08/27 20:17:09.00...; OriginalFileName=termsrv.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=44; ImageBase=0x7ffc1ed60000; GuidSig=312f49c4-95a8-5fbf-b...; Age=1; PDBFileName=termsrv.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=162; ImageBase=0x7ffc1ed60000; ImageSize=1,093,632; ImageChecksum=1,119,758; TimeDateStamp=0; DefaultBase=0x7ffc1ed60000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=48; ImageBase=0x7ffc1f0f0000; ImageSize=978,944; ProcessID=0; TimeDateStamp=2,097,505,968; BuildTime=36/06/19 16:32:48.00...; OriginalFileName=propsys.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=44; ImageBase=0x7ffc1f0f0000; GuidSig=f17d0756-2273-c8ff-e...; Age=1; PDBFileName=propsys.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=162; ImageBase=0x7ffc1f0f0000; ImageSize=978,944; ImageChecksum=990,621; TimeDateStamp=0; DefaultBase=0x7ffc1f0f0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=44; ImageBase=0x7ffc1f990000; ImageSize=2,469,888; ProcessID=0; TimeDateStamp=-443,116,862; BuildTime=92/01/22 14:27:14.00...; OriginalFileName=D3D11.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=42; ImageBase=0x7ffc1f990000; GuidSig=3ac51121-4469-cfce-1...; Age=1; PDBFileName=d3d11.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=158; ImageBase=0x7ffc1f990000; ImageSize=2,469,888; ImageChecksum=2,530,777; TimeDateStamp=0; DefaultBase=0x7ffc1f990000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=50; ImageBase=0x7ffc20f00000; ImageSize=167,936; ProcessID=0; TimeDateStamp=-189,693,732; BuildTime=00/02/02 17:46:04.00...; OriginalFileName=rmclient.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=45; ImageBase=0x7ffc20f00000; GuidSig=d9b2eec0-1750-fc20-8...; Age=1; PDBFileName=RmClient.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=164; ImageBase=0x7ffc20f00000; ImageSize=167,936; ImageChecksum=187,354; TimeDateStamp=0; DefaultBase=0x7ffc20f00000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=58; ImageBase=0x7ffc214c0000; ImageSize=86,016; ProcessID=0; TimeDateStamp=1,872,893,629; BuildTime=29/05/08 00:13:49.00...; OriginalFileName=mskeyprotect.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=49; ImageBase=0x7ffc214c0000; GuidSig=4bae97e8-7589-2fd4-b...; Age=1; PDBFileName=mskeyprotect.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=172; ImageBase=0x7ffc214c0000; ImageSize=86,016; ImageChecksum=83,374; TimeDateStamp=0; DefaultBase=0x7ffc214c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=54; ImageBase=0x7ffc21570000; ImageSize=151,552; ProcessID=0; TimeDateStamp=226,275,606; BuildTime=77/03/03 22:20:06.00...; OriginalFileName=ncryptsslp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=47; ImageBase=0x7ffc21570000; GuidSig=3a6ec407-7dca-5b85-0...; Age=1; PDBFileName=ncryptsslp.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=168; ImageBase=0x7ffc21570000; ImageSize=151,552; ImageChecksum=198,289; TimeDateStamp=0; DefaultBase=0x7ffc21570000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=48; ImageBase=0x7ffc215a0000; ImageSize=49,152; ProcessID=0; TimeDateStamp=-197,101,473; BuildTime=99/11/09 00:03:43.00...; OriginalFileName=credssp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=44; ImageBase=0x7ffc215a0000; GuidSig=246e01dd-cfc2-874b-c...; Age=1; PDBFileName=credssp.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=162; ImageBase=0x7ffc215a0000; ImageSize=49,152; ImageChecksum=23,809; TimeDateStamp=0; DefaultBase=0x7ffc215a0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=46; ImageBase=0x7ffc21b90000; ImageSize=131,072; ProcessID=0; TimeDateStamp=-1,139,896,690; BuildTime=69/12/24 00:30:06.00...; OriginalFileName=DXCore.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=43; ImageBase=0x7ffc21b90000; GuidSig=33bb03a6-a0d1-2ce8-8...; Age=1; PDBFileName=DXCore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=160; ImageBase=0x7ffc21b90000; ImageSize=131,072; ImageChecksum=173,498; TimeDateStamp=0; DefaultBase=0x7ffc21b90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=42; ImageBase=0x7ffc21bb0000; ImageSize=958,464; ProcessID=0; TimeDateStamp=1,511,252,964; BuildTime=17/11/21 08:29:24.00...; OriginalFileName=dxgi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=41; ImageBase=0x7ffc21bb0000; GuidSig=5e9cc76a-64eb-6cdf-7...; Age=1; PDBFileName=dxgi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=156; ImageBase=0x7ffc21bb0000; ImageSize=958,464; ImageChecksum=997,190; TimeDateStamp=0; DefaultBase=0x7ffc21bb0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=46; ImageBase=0x7ffc21f70000; ImageSize=376,832; ProcessID=0; TimeDateStamp=43,988,838; BuildTime=71/05/25 03:07:18.00...; OriginalFileName=winsta.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=43; ImageBase=0x7ffc21f70000; GuidSig=b854bf05-e0a2-5b01-7...; Age=1; PDBFileName=winsta.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=160; ImageBase=0x7ffc21f70000; ImageSize=376,832; ImageChecksum=387,708; TimeDateStamp=0; DefaultBase=0x7ffc21f70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=44; ImageBase=0x7ffc22000000; ImageSize=303,104; ProcessID=0; TimeDateStamp=-1,775,967,220; BuildTime=49/10/28 02:14:36.00...; OriginalFileName=authz.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=42; ImageBase=0x7ffc22000000; GuidSig=f7ab524f-49bc-eb09-0...; Age=1; PDBFileName=authz.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=158; ImageBase=0x7ffc22000000; ImageSize=303,104; ImageChecksum=299,134; TimeDateStamp=0; DefaultBase=0x7ffc22000000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=50; ImageBase=0x7ffc221b0000; ImageSize=561,152; ProcessID=0; TimeDateStamp=78,261,937; BuildTime=72/06/24 19:25:37.00...; OriginalFileName=schannel.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=45; ImageBase=0x7ffc221b0000; GuidSig=6bdcdeba-3b92-d2d9-1...; Age=1; PDBFileName=schannel.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=164; ImageBase=0x7ffc221b0000; ImageSize=561,152; ImageChecksum=599,838; TimeDateStamp=0; DefaultBase=0x7ffc221b0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=44; ImageBase=0x7ffc222c0000; ImageSize=40,960; ProcessID=0; TimeDateStamp=-929,607,282; BuildTime=76/08/22 22:13:34.00...; OriginalFileName=dpapi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=42; ImageBase=0x7ffc222c0000; GuidSig=6f32740c-1701-84ad-b...; Age=1; PDBFileName=dpapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=158; ImageBase=0x7ffc222c0000; ImageSize=40,960; ImageChecksum=43,532; TimeDateStamp=0; DefaultBase=0x7ffc222c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=44; ImageBase=0x7ffc223f0000; ImageSize=172,032; ProcessID=0; TimeDateStamp=-303,628,398; BuildTime=96/06/24 01:14:58.00...; OriginalFileName=TSpkg.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=42; ImageBase=0x7ffc223f0000; GuidSig=1bbadf56-c87c-521d-0...; Age=1; PDBFileName=TSpkg.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=158; ImageBase=0x7ffc223f0000; ImageSize=172,032; ImageChecksum=205,183; TimeDateStamp=0; DefaultBase=0x7ffc223f0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=50; ImageBase=0x7ffc22420000; ImageSize=237,568; ProcessID=0; TimeDateStamp=1,353,705,264; BuildTime=12/11/23 21:14:24.00...; OriginalFileName=iphlpapi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=45; ImageBase=0x7ffc22420000; GuidSig=a3177875-244a-46c8-b...; Age=1; PDBFileName=iphlpapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=164; ImageBase=0x7ffc22420000; ImageSize=237,568; ImageChecksum=252,735; TimeDateStamp=0; DefaultBase=0x7ffc22420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=48; ImageBase=0x7ffc226c0000; ImageSize=421,888; ProcessID=0; TimeDateStamp=414,127,772; BuildTime=83/02/15 03:29:32.00...; OriginalFileName=mswsock.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=44; ImageBase=0x7ffc226c0000; GuidSig=96babb0d-8e64-884b-6...; Age=1; PDBFileName=mswsock.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=162; ImageBase=0x7ffc226c0000; ImageSize=421,888; ImageChecksum=420,926; TimeDateStamp=0; DefaultBase=0x7ffc226c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=52; ImageBase=0x7ffc22890000; ImageSize=49,152; ProcessID=0; TimeDateStamp=-17,821,274; BuildTime=05/07/16 00:07:02.00...; OriginalFileName=cryptbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=46; ImageBase=0x7ffc22890000; GuidSig=7588b6a3-bd73-2904-7...; Age=1; PDBFileName=cryptbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=166; ImageBase=0x7ffc22890000; ImageSize=49,152; ImageChecksum=64,645; TimeDateStamp=0; DefaultBase=0x7ffc22890000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=42; ImageBase=0x7ffc22940000; ImageSize=167,936; ProcessID=0; TimeDateStamp=1,085,565,188; BuildTime=04/05/26 09:53:08.00...; OriginalFileName=wldp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=41; ImageBase=0x7ffc22940000; GuidSig=3d0180e1-0317-7a96-e...; Age=1; PDBFileName=WLDP.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=156; ImageBase=0x7ffc22940000; ImageSize=167,936; ImageChecksum=190,611; TimeDateStamp=0; DefaultBase=0x7ffc22940000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=46; ImageBase=0x7ffc22970000; ImageSize=241,664; ProcessID=0; TimeDateStamp=-232,261,050; BuildTime=98/09/28 01:30:46.00...; OriginalFileName=ntasn1.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=43; ImageBase=0x7ffc22970000; GuidSig=6b406a9e-4f8b-5ac5-c...; Age=1; PDBFileName=ntasn1.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=160; ImageBase=0x7ffc22970000; ImageSize=241,664; ImageChecksum=243,110; TimeDateStamp=0; DefaultBase=0x7ffc22970000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=46; ImageBase=0x7ffc22c40000; ImageSize=155,648; ProcessID=0; TimeDateStamp=800,597,648; BuildTime=95/05/16 04:14:08.00...; OriginalFileName=ncrypt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=43; ImageBase=0x7ffc22c40000; GuidSig=d2e25da6-8b7d-b60f-0...; Age=1; PDBFileName=ncrypt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=160; ImageBase=0x7ffc22c40000; ImageSize=155,648; ImageChecksum=154,749; TimeDateStamp=0; DefaultBase=0x7ffc22c40000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=48; ImageBase=0x7ffc22e10000; ImageSize=200,704; ProcessID=0; TimeDateStamp=-648,125,799; BuildTime=85/07/24 19:31:37.00...; OriginalFileName=ntmarta.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=44; ImageBase=0x7ffc22e10000; GuidSig=d28b6be6-17ca-2646-7...; Age=1; PDBFileName=ntmarta.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=162; ImageBase=0x7ffc22e10000; ImageSize=200,704; ImageChecksum=211,194; TimeDateStamp=0; DefaultBase=0x7ffc22e10000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=54; ImageBase=0x7ffc232d0000; ImageSize=172,032; ProcessID=0; TimeDateStamp=564,545,050; BuildTime=87/11/22 02:04:10.00...; OriginalFileName=devinfoset.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=43; ImageBase=0x7ffc232d0000; GuidSig=bf3fb10c-179d-a551-d...; Age=1; PDBFileName=devobj.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=160; ImageBase=0x7ffc232d0000; ImageSize=172,032; ImageChecksum=212,309; TimeDateStamp=0; DefaultBase=0x7ffc232d0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=48; ImageBase=0x7ffc233c0000; ImageSize=192,512; ProcessID=0; TimeDateStamp=621,642,292; BuildTime=89/09/12 22:24:52.00...; OriginalFileName=sspicli.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=44; ImageBase=0x7ffc233c0000; GuidSig=823d5a41-e0d7-02a7-9...; Age=1; PDBFileName=sspicli.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=162; ImageBase=0x7ffc233c0000; ImageSize=192,512; ImageChecksum=235,306; TimeDateStamp=0; DefaultBase=0x7ffc233c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=48; ImageBase=0x7ffc233f0000; ImageSize=151,552; ProcessID=0; TimeDateStamp=-157,143,252; BuildTime=01/02/14 11:34:04.00...; OriginalFileName=userenv.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=44; ImageBase=0x7ffc233f0000; GuidSig=1a734def-8e54-a706-f...; Age=1; PDBFileName=userenv.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=162; ImageBase=0x7ffc233f0000; ImageSize=151,552; ImageChecksum=176,304; TimeDateStamp=0; DefaultBase=0x7ffc233f0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=44; ImageBase=0x7ffc234d0000; ImageSize=65,536; ProcessID=0; TimeDateStamp=-1,563,634,669; BuildTime=56/07/20 15:30:27.00...; OriginalFileName=umpdc.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=42; ImageBase=0x7ffc234d0000; GuidSig=1504cc55-3edb-4294-a...; Age=1; PDBFileName=UMPDC.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=158; ImageBase=0x7ffc234d0000; ImageSize=65,536; ImageChecksum=55,709; TimeDateStamp=0; DefaultBase=0x7ffc234d0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=62; ImageBase=0x7ffc23530000; ImageSize=69,632; ProcessID=0; TimeDateStamp=96,400,242; BuildTime=73/01/20 17:50:42.00...; OriginalFileName=kernel.appcore.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=51; ImageBase=0x7ffc23530000; GuidSig=b44a2a63-8a5c-a8d8-1...; Age=1; PDBFileName=Kernel.Appcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=176; ImageBase=0x7ffc23530000; ImageSize=69,632; ImageChecksum=91,565; TimeDateStamp=0; DefaultBase=0x7ffc23530000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=48; ImageBase=0x7ffc23550000; ImageSize=126,976; ProcessID=0; TimeDateStamp=-87,365,952; BuildTime=03/05/03 02:09:04.00...; OriginalFileName=PROFAPI.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=44; ImageBase=0x7ffc23550000; GuidSig=d3e9e0b2-6dc3-e775-b...; Age=1; PDBFileName=profapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=162; ImageBase=0x7ffc23550000; ImageSize=126,976; ImageChecksum=153,678; TimeDateStamp=0; DefaultBase=0x7ffc23550000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=46; ImageBase=0x7ffc23570000; ImageSize=73,728; ProcessID=0; TimeDateStamp=-457,022,433; BuildTime=91/08/14 15:47:43.00...; OriginalFileName=msasn1.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=43; ImageBase=0x7ffc23570000; GuidSig=ff420efb-35b1-0aa7-6...; Age=1; PDBFileName=msasn1.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=160; ImageBase=0x7ffc23570000; ImageSize=73,728; ImageChecksum=79,097; TimeDateStamp=0; DefaultBase=0x7ffc23570000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=46; ImageBase=0x7ffc23590000; ImageSize=155,648; ProcessID=0; TimeDateStamp=-1,248,142,761; BuildTime=66/07/20 04:08:55.00...; OriginalFileName=bcrypt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=43; ImageBase=0x7ffc23590000; GuidSig=1a472182-0367-8386-d...; Age=1; PDBFileName=bcrypt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=160; ImageBase=0x7ffc23590000; ImageSize=155,648; ImageChecksum=157,312; TimeDateStamp=0; DefaultBase=0x7ffc23590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=50; ImageBase=0x7ffc235c0000; ImageSize=303,104; ProcessID=0; TimeDateStamp=-1,347,769,430; BuildTime=63/05/24 02:04:26.00...; OriginalFileName=CFGMGR32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=45; ImageBase=0x7ffc235c0000; GuidSig=c951ee8e-a9b3-8ebf-a...; Age=1; PDBFileName=cfgmgr32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=164; ImageBase=0x7ffc235c0000; ImageSize=303,104; ImageChecksum=322,106; TimeDateStamp=0; DefaultBase=0x7ffc235c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=50; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ProcessID=0; TimeDateStamp=1,555,946,369; BuildTime=19/04/22 15:19:29.00...; OriginalFileName=ucrtbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=45; ImageBase=0x7ffc23d90000; GuidSig=faceb612-020d-68fb-b...; Age=1; PDBFileName=ucrtbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=164; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ImageChecksum=1,052,117; TimeDateStamp=0; DefaultBase=0x7ffc23d90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=48; ImageBase=0x7ffc23e90000; ImageSize=94,208; ProcessID=0; TimeDateStamp=-1,525,668,879; BuildTime=57/10/03 01:33:37.00...; OriginalFileName=cryptsp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=44; ImageBase=0x7ffc23e90000; GuidSig=7618debe-ac0f-9998-7...; Age=1; PDBFileName=cryptsp.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=162; ImageBase=0x7ffc23e90000; ImageSize=94,208; ImageChecksum=133,544; TimeDateStamp=0; DefaultBase=0x7ffc23e90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=46; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ProcessID=0; TimeDateStamp=1,396,962,555; BuildTime=14/04/08 13:09:15.00...; OriginalFileName=Win32u.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=43; ImageBase=0x7ffc23eb0000; GuidSig=bc2e49ab-e46d-2e93-b...; Age=1; PDBFileName=win32u.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=160; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ImageChecksum=177,968; TimeDateStamp=0; DefaultBase=0x7ffc23eb0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=54; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ProcessID=0; TimeDateStamp=439,410,971; BuildTime=83/12/04 18:36:11.00...; OriginalFileName=Kernelbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=47; ImageBase=0x7ffc23ee0000; GuidSig=44c8ec9a-a0ea-4f98-d...; Age=1; PDBFileName=kernelbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=168; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ImageChecksum=2,793,344; TimeDateStamp=0; DefaultBase=0x7ffc23ee0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=44; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ProcessID=0; TimeDateStamp=1,868,443,751; BuildTime=29/03/17 12:09:11.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=46; ImageBase=0x7ffc24190000; GuidSig=e5a785df-0333-6a66-6...; Age=1; PDBFileName=gdi32full.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=166; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ImageChecksum=1,696,264; TimeDateStamp=0; DefaultBase=0x7ffc24190000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=50; ImageBase=0x7ffc24330000; ImageSize=376,832; ProcessID=0; TimeDateStamp=1,670,486,148; BuildTime=22/12/08 07:55:48.00...; OriginalFileName=WINTRUST.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=45; ImageBase=0x7ffc24330000; GuidSig=ef819cd6-e971-2b01-0...; Age=1; PDBFileName=wintrust.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=164; ImageBase=0x7ffc24330000; ImageSize=376,832; ImageChecksum=380,837; TimeDateStamp=0; DefaultBase=0x7ffc24330000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=66; ImageBase=0x7ffc24390000; ImageSize=528,384; ProcessID=0; TimeDateStamp=1,774,320,825; BuildTime=26/03/24 02:53:45.00...; OriginalFileName=bcryptprimitives.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=53; ImageBase=0x7ffc24390000; GuidSig=54a1b493-8222-f67e-4...; Age=1; PDBFileName=bcryptprimitives.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=180; ImageBase=0x7ffc24390000; ImageSize=528,384; ImageChecksum=562,796; TimeDateStamp=0; DefaultBase=0x7ffc24390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=52; ImageBase=0x7ffc24420000; ImageSize=647,168; ProcessID=0; TimeDateStamp=545,597,548; BuildTime=87/04/16 18:52:28.00...; OriginalFileName=msvcp_win.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=46; ImageBase=0x7ffc24420000; GuidSig=de65fef9-16bb-6b73-d...; Age=1; PDBFileName=msvcp_win.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=166; ImageBase=0x7ffc24420000; ImageSize=647,168; ImageChecksum=686,408; TimeDateStamp=0; DefaultBase=0x7ffc24420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=48; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ProcessID=0; TimeDateStamp=135,099,696; BuildTime=74/04/13 15:41:36.00...; OriginalFileName=CRYPT32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=44; ImageBase=0x7ffc244c0000; GuidSig=8c840cbc-1c63-bfb7-6...; Age=1; PDBFileName=crypt32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=162; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ImageChecksum=1,341,835; TimeDateStamp=0; DefaultBase=0x7ffc244c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=48; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ProcessID=0; TimeDateStamp=1,691,891,946; BuildTime=23/08/13 01:59:06.00...; OriginalFileName=COMBASE.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=44; ImageBase=0x7ffc246c0000; GuidSig=d15b0ee4-2a16-5244-2...; Age=1; PDBFileName=combase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=162; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ImageChecksum=3,387,881; TimeDateStamp=0; DefaultBase=0x7ffc246c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=50; ImageBase=0x7ffc24b30000; ImageSize=667,648; ProcessID=0; TimeDateStamp=-1,762,261,787; BuildTime=50/04/04 17:18:29.00...; OriginalFileName=advapi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=45; ImageBase=0x7ffc24b30000; GuidSig=549260e6-7474-8391-e...; Age=1; PDBFileName=advapi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=164; ImageBase=0x7ffc24b30000; ImageSize=667,648; ImageChecksum=662,904; TimeDateStamp=0; DefaultBase=0x7ffc24b30000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=50; ImageBase=0x7ffc24be0000; ImageSize=729,088; ProcessID=0; TimeDateStamp=775,814,378; BuildTime=94/08/02 07:59:38.00...; OriginalFileName=kernel32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=45; ImageBase=0x7ffc24be0000; GuidSig=47a44f0c-c47f-b6a1-f...; Age=1; PDBFileName=kernel32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=164; ImageBase=0x7ffc24be0000; ImageSize=729,088; ImageChecksum=723,980; TimeDateStamp=0; DefaultBase=0x7ffc24be0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=44; ImageBase=0x7ffc24da0000; ImageSize=155,648; ProcessID=0; TimeDateStamp=-1,867,374,302; BuildTime=46/12/05 03:23:14.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=42; ImageBase=0x7ffc24da0000; GuidSig=209ad405-837d-061e-f...; Age=1; PDBFileName=gdi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=158; ImageBase=0x7ffc24da0000; ImageSize=155,648; ImageChecksum=194,403; TimeDateStamp=0; DefaultBase=0x7ffc24da0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=46; ImageBase=0x7ffc24eb0000; ImageSize=454,656; ProcessID=0; TimeDateStamp=252,347,079; BuildTime=77/12/30 16:24:39.00...; OriginalFileName=ws2_32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=43; ImageBase=0x7ffc24eb0000; GuidSig=94268932-d2c5-c3db-4...; Age=1; PDBFileName=ws2_32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=160; ImageBase=0x7ffc24eb0000; ImageSize=454,656; ImageChecksum=456,525; TimeDateStamp=0; DefaultBase=0x7ffc24eb0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=50; ImageBase=0x7ffc24f20000; ImageSize=4,653,056; ProcessID=0; TimeDateStamp=-1,478,931,446; BuildTime=59/03/28 00:10:50.00...; OriginalFileName=SETUPAPI.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=45; ImageBase=0x7ffc24f20000; GuidSig=2afde28c-a886-98c2-7...; Age=1; PDBFileName=setupapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=164; ImageBase=0x7ffc24f20000; ImageSize=4,653,056; ImageChecksum=4,692,368; TimeDateStamp=0; DefaultBase=0x7ffc24f20000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=46; ImageBase=0x7ffc25390000; ImageSize=647,168; ProcessID=0; TimeDateStamp=-172,101,673; BuildTime=00/08/25 08:27:03.00...; OriginalFileName=msvcrt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=43; ImageBase=0x7ffc25390000; GuidSig=1fea8db6-b57f-5fbf-a...; Age=1; PDBFileName=msvcrt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=160; ImageBase=0x7ffc25390000; ImageSize=647,168; ImageChecksum=678,174; TimeDateStamp=0; DefaultBase=0x7ffc25390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=48; ImageBase=0x7ffc25590000; ImageSize=618,496; ProcessID=0; TimeDateStamp=-136,044,297; BuildTime=01/10/16 16:23:19.00...; OriginalFileName=sechost.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=44; ImageBase=0x7ffc25590000; GuidSig=0f733965-b12f-7923-b...; Age=1; PDBFileName=sechost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=162; ImageBase=0x7ffc25590000; ImageSize=618,496; ImageChecksum=662,974; TimeDateStamp=0; DefaultBase=0x7ffc25590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=48; ImageBase=0x7ffc25630000; ImageSize=663,552; ProcessID=0; TimeDateStamp=-1,794,760,561; BuildTime=49/03/24 13:52:15.00...; OriginalFileName=CLBCATQ.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=44; ImageBase=0x7ffc25630000; GuidSig=da759f99-b2bb-75c2-1...; Age=1; PDBFileName=CLBCatQ.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=162; ImageBase=0x7ffc25630000; ImageSize=663,552; ImageChecksum=684,075; TimeDateStamp=0; DefaultBase=0x7ffc25630000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=46; ImageBase=0x7ffc256e0000; ImageSize=692,224; ProcessID=0; TimeDateStamp=1,221,584,444; BuildTime=08/09/16 17:00:44.00...; OriginalFileName=SHCORE.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=43; ImageBase=0x7ffc256e0000; GuidSig=3921dcf6-eafa-cc85-7...; Age=1; PDBFileName=shcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=160; ImageBase=0x7ffc256e0000; ImageSize=692,224; ImageChecksum=745,271; TimeDateStamp=0; DefaultBase=0x7ffc256e0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=50; ImageBase=0x7ffc25ea0000; ImageSize=802,816; ProcessID=0; TimeDateStamp=-1,108,332,853; BuildTime=70/12/24 08:14:03.00...; OriginalFileName=OLEAUT32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=45; ImageBase=0x7ffc25ea0000; GuidSig=2dfa946d-f7be-e09f-3...; Age=1; PDBFileName=oleaut32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=164; ImageBase=0x7ffc25ea0000; ImageSize=802,816; ImageChecksum=845,595; TimeDateStamp=0; DefaultBase=0x7ffc25ea0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=46; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ProcessID=0; TimeDateStamp=87,082,528; BuildTime=72/10/04 21:35:28.00...; OriginalFileName=rpcrt4.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=43; ImageBase=0x7ffc25f70000; GuidSig=a3028d6b-45da-0062-4...; Age=1; PDBFileName=rpcrt4.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=160; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ImageChecksum=1,199,090; TimeDateStamp=0; DefaultBase=0x7ffc25f70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=46; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ProcessID=0; TimeDateStamp=-1,431,966,518; BuildTime=60/09/21 13:59:38.00...; OriginalFileName=user32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=43; ImageBase=0x7ffc26420000; GuidSig=bc4cc7cc-9a33-b8a6-6...; Age=1; PDBFileName=user32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=160; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ImageChecksum=1,700,392; TimeDateStamp=0; DefaultBase=0x7ffc26420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=44; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ProcessID=0; TimeDateStamp=-1,523,876,758; BuildTime=57/10/23 19:22:18.00...; OriginalFileName=ntdll.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=42; ImageBase=0x7ffc26600000; GuidSig=b54f3499-813e-bcf1-3...; Age=1; PDBFileName=ntdll.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1348; TID=-1; PName=svchost; ProceNum=6; DataLen=158; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ImageChecksum=2,058,600; TimeDateStamp=0; DefaultBase=0x7ffc26600000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: Windows Kernel/Process/DCStart PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=240; ProcessID=1,384; ParentID=836; ImageFileName=svchost.exe; PageDirectoryBase=0x1023308000; Flags=None; SessionID=0; ExitStatus=259; UniqueProcessKey=0xffffc50f69016440; CommandLine=C:\Windows\system32\...; PackageFullName=; ApplicationID=; 
EVENT 0.000: KernelTraceControl/ImageID PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ff6295b0000; ImageSize=65,536; ProcessID=0; TimeDateStamp=852,935,184; BuildTime=97/01/10 22:26:24.00...; OriginalFileName=svchost.exe; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ff6295b0000; GuidSig=ef7b3786-4e54-5d5e-c...; Age=1; PDBFileName=svchost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ff6295b0000; ImageSize=65,536; ImageChecksum=68,124; TimeDateStamp=0; DefaultBase=0x7ff6295b0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc1e220000; ImageSize=86,016; ProcessID=0; TimeDateStamp=8,328,791; BuildTime=70/04/07 09:33:11.00...; OriginalFileName=wshbth.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc1e220000; GuidSig=32dd83fc-982c-6506-e...; Age=1; PDBFileName=wshbth.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc1e220000; ImageSize=86,016; ImageChecksum=104,802; TimeDateStamp=0; DefaultBase=0x7ffc1e220000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=52; ImageBase=0x7ffc1e990000; ImageSize=380,928; ProcessID=0; TimeDateStamp=1,812,948,918; BuildTime=27/06/14 04:55:18.00...; OriginalFileName=PhoneUtil.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc1e990000; GuidSig=40f6e49b-1b89-c719-1...; Age=1; PDBFileName=PhoneUtil.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc1e990000; ImageSize=380,928; ImageChecksum=390,541; TimeDateStamp=0; DefaultBase=0x7ffc1e990000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=80; ImageBase=0x7ffc1ea00000; ImageSize=81,920; ProcessID=0; TimeDateStamp=-1,459,344,608; BuildTime=59/11/09 16:58:08.00...; OriginalFileName=CommsPlatformHelperU...; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=63; ImageBase=0x7ffc1ea00000; GuidSig=eaed1bd8-1ed3-e64f-6...; Age=1; PDBFileName=UserDataPlatformHelp...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=200; ImageBase=0x7ffc1ea00000; ImageSize=81,920; ImageChecksum=71,885; TimeDateStamp=0; DefaultBase=0x7ffc1ea00000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=72; ImageBase=0x7ffc1ea20000; ImageSize=69,632; ProcessID=0; TimeDateStamp=-849,654,854; BuildTime=79/03/06 07:14:02.00...; OriginalFileName=CommsTypeHelperUtil....; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=59; ImageBase=0x7ffc1ea20000; GuidSig=45981fb6-782c-db1c-8...; Age=1; PDBFileName=UserDataTypeHelperUt...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=192; ImageBase=0x7ffc1ea20000; ImageSize=69,632; ImageChecksum=51,205; TimeDateStamp=0; DefaultBase=0x7ffc1ea20000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc1ea40000; ImageSize=466,944; ProcessID=0; TimeDateStamp=1,836,243,042; BuildTime=28/03/09 19:30:42.00...; OriginalFileName=PhoneOm.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc1ea40000; GuidSig=0e2f520a-ad45-a141-2...; Age=1; PDBFileName=PhoneOm.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc1ea40000; ImageSize=466,944; ImageChecksum=484,071; TimeDateStamp=0; DefaultBase=0x7ffc1ea40000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc1eb40000; ImageSize=987,136; ProcessID=0; TimeDateStamp=-319,839,029; BuildTime=95/12/19 10:17:47.00...; OriginalFileName=Pimstore.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc1eb40000; GuidSig=3eff4548-84a5-b7f2-b...; Age=1; PDBFileName=pimstore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc1eb40000; ImageSize=987,136; ImageChecksum=1,002,816; TimeDateStamp=0; DefaultBase=0x7ffc1eb40000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=68; ImageBase=0x7ffc1ec40000; ImageSize=192,512; ProcessID=0; TimeDateStamp=-1,799,983,472; BuildTime=49/01/23 03:03:44.00...; OriginalFileName=CallHistoryClient.dl...; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=54; ImageBase=0x7ffc1ec40000; GuidSig=3a894a1b-cec2-8d6f-6...; Age=1; PDBFileName=CallHistoryClient.pd...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=182; ImageBase=0x7ffc1ec40000; ImageSize=192,512; ImageChecksum=218,121; TimeDateStamp=0; DefaultBase=0x7ffc1ec40000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=58; ImageBase=0x7ffc1ec80000; ImageSize=61,440; ProcessID=0; TimeDateStamp=2,051,176,172; BuildTime=34/12/31 11:09:32.00...; OriginalFileName=BthTelemetry.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=49; ImageBase=0x7ffc1ec80000; GuidSig=124e105a-c61e-810d-a...; Age=1; PDBFileName=BthTelemetry.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=172; ImageBase=0x7ffc1ec80000; ImageSize=61,440; ImageChecksum=79,880; TimeDateStamp=0; DefaultBase=0x7ffc1ec80000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=56; ImageBase=0x7ffc1ee70000; ImageSize=1,085,440; ProcessID=0; TimeDateStamp=593,429,624; BuildTime=88/10/21 09:33:44.00...; OriginalFileName=BTAGService.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc1ee70000; GuidSig=3eb77e35-be86-ce85-3...; Age=1; PDBFileName=BTAGService.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=170; ImageBase=0x7ffc1ee70000; ImageSize=1,085,440; ImageChecksum=1,090,688; TimeDateStamp=0; DefaultBase=0x7ffc1ee70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc226c0000; ImageSize=421,888; ProcessID=0; TimeDateStamp=414,127,772; BuildTime=83/02/15 03:29:32.00...; OriginalFileName=mswsock.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc226c0000; GuidSig=96babb0d-8e64-884b-6...; Age=1; PDBFileName=mswsock.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc226c0000; ImageSize=421,888; ImageChecksum=420,926; TimeDateStamp=0; DefaultBase=0x7ffc226c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc22940000; ImageSize=167,936; ProcessID=0; TimeDateStamp=1,085,565,188; BuildTime=04/05/26 09:53:08.00...; OriginalFileName=wldp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=41; ImageBase=0x7ffc22940000; GuidSig=3d0180e1-0317-7a96-e...; Age=1; PDBFileName=WLDP.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=156; ImageBase=0x7ffc22940000; ImageSize=167,936; ImageChecksum=190,611; TimeDateStamp=0; DefaultBase=0x7ffc22940000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc22e10000; ImageSize=200,704; ProcessID=0; TimeDateStamp=-648,125,799; BuildTime=85/07/24 19:31:37.00...; OriginalFileName=ntmarta.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc22e10000; GuidSig=d28b6be6-17ca-2646-7...; Age=1; PDBFileName=ntmarta.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc22e10000; ImageSize=200,704; ImageChecksum=211,194; TimeDateStamp=0; DefaultBase=0x7ffc22e10000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=54; ImageBase=0x7ffc232d0000; ImageSize=172,032; ProcessID=0; TimeDateStamp=564,545,050; BuildTime=87/11/22 02:04:10.00...; OriginalFileName=devinfoset.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc232d0000; GuidSig=bf3fb10c-179d-a551-d...; Age=1; PDBFileName=devobj.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc232d0000; ImageSize=172,032; ImageChecksum=212,309; TimeDateStamp=0; DefaultBase=0x7ffc232d0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc234d0000; ImageSize=65,536; ProcessID=0; TimeDateStamp=-1,563,634,669; BuildTime=56/07/20 15:30:27.00...; OriginalFileName=umpdc.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc234d0000; GuidSig=1504cc55-3edb-4294-a...; Age=1; PDBFileName=UMPDC.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc234d0000; ImageSize=65,536; ImageChecksum=55,709; TimeDateStamp=0; DefaultBase=0x7ffc234d0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc234e0000; ImageSize=303,104; ProcessID=0; TimeDateStamp=-37,463,926; BuildTime=04/11/30 15:49:30.00...; OriginalFileName=POWRPROF.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc234e0000; GuidSig=bae22f43-6c95-a7d5-0...; Age=1; PDBFileName=powrprof.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc234e0000; ImageSize=303,104; ImageChecksum=321,827; TimeDateStamp=0; DefaultBase=0x7ffc234e0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=62; ImageBase=0x7ffc23530000; ImageSize=69,632; ProcessID=0; TimeDateStamp=96,400,242; BuildTime=73/01/20 17:50:42.00...; OriginalFileName=kernel.appcore.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=51; ImageBase=0x7ffc23530000; GuidSig=b44a2a63-8a5c-a8d8-1...; Age=1; PDBFileName=Kernel.Appcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=176; ImageBase=0x7ffc23530000; ImageSize=69,632; ImageChecksum=91,565; TimeDateStamp=0; DefaultBase=0x7ffc23530000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23570000; ImageSize=73,728; ProcessID=0; TimeDateStamp=-457,022,433; BuildTime=91/08/14 15:47:43.00...; OriginalFileName=msasn1.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23570000; GuidSig=ff420efb-35b1-0aa7-6...; Age=1; PDBFileName=msasn1.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23570000; ImageSize=73,728; ImageChecksum=79,097; TimeDateStamp=0; DefaultBase=0x7ffc23570000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23590000; ImageSize=155,648; ProcessID=0; TimeDateStamp=-1,248,142,761; BuildTime=66/07/20 04:08:55.00...; OriginalFileName=bcrypt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23590000; GuidSig=1a472182-0367-8386-d...; Age=1; PDBFileName=bcrypt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23590000; ImageSize=155,648; ImageChecksum=157,312; TimeDateStamp=0; DefaultBase=0x7ffc23590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc235c0000; ImageSize=303,104; ProcessID=0; TimeDateStamp=-1,347,769,430; BuildTime=63/05/24 02:04:26.00...; OriginalFileName=CFGMGR32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc235c0000; GuidSig=c951ee8e-a9b3-8ebf-a...; Age=1; PDBFileName=cfgmgr32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc235c0000; ImageSize=303,104; ImageChecksum=322,106; TimeDateStamp=0; DefaultBase=0x7ffc235c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ProcessID=0; TimeDateStamp=1,555,946,369; BuildTime=19/04/22 15:19:29.00...; OriginalFileName=ucrtbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc23d90000; GuidSig=faceb612-020d-68fb-b...; Age=1; PDBFileName=ucrtbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ImageChecksum=1,052,117; TimeDateStamp=0; DefaultBase=0x7ffc23d90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ProcessID=0; TimeDateStamp=1,396,962,555; BuildTime=14/04/08 13:09:15.00...; OriginalFileName=Win32u.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23eb0000; GuidSig=bc2e49ab-e46d-2e93-b...; Age=1; PDBFileName=win32u.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ImageChecksum=177,968; TimeDateStamp=0; DefaultBase=0x7ffc23eb0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=54; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ProcessID=0; TimeDateStamp=439,410,971; BuildTime=83/12/04 18:36:11.00...; OriginalFileName=Kernelbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=47; ImageBase=0x7ffc23ee0000; GuidSig=44c8ec9a-a0ea-4f98-d...; Age=1; PDBFileName=kernelbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=168; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ImageChecksum=2,793,344; TimeDateStamp=0; DefaultBase=0x7ffc23ee0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ProcessID=0; TimeDateStamp=1,868,443,751; BuildTime=29/03/17 12:09:11.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc24190000; GuidSig=e5a785df-0333-6a66-6...; Age=1; PDBFileName=gdi32full.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ImageChecksum=1,696,264; TimeDateStamp=0; DefaultBase=0x7ffc24190000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24330000; ImageSize=376,832; ProcessID=0; TimeDateStamp=1,670,486,148; BuildTime=22/12/08 07:55:48.00...; OriginalFileName=WINTRUST.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24330000; GuidSig=ef819cd6-e971-2b01-0...; Age=1; PDBFileName=wintrust.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24330000; ImageSize=376,832; ImageChecksum=380,837; TimeDateStamp=0; DefaultBase=0x7ffc24330000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=66; ImageBase=0x7ffc24390000; ImageSize=528,384; ProcessID=0; TimeDateStamp=1,774,320,825; BuildTime=26/03/24 02:53:45.00...; OriginalFileName=bcryptprimitives.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=53; ImageBase=0x7ffc24390000; GuidSig=54a1b493-8222-f67e-4...; Age=1; PDBFileName=bcryptprimitives.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=180; ImageBase=0x7ffc24390000; ImageSize=528,384; ImageChecksum=562,796; TimeDateStamp=0; DefaultBase=0x7ffc24390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=52; ImageBase=0x7ffc24420000; ImageSize=647,168; ProcessID=0; TimeDateStamp=545,597,548; BuildTime=87/04/16 18:52:28.00...; OriginalFileName=msvcp_win.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc24420000; GuidSig=de65fef9-16bb-6b73-d...; Age=1; PDBFileName=msvcp_win.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc24420000; ImageSize=647,168; ImageChecksum=686,408; TimeDateStamp=0; DefaultBase=0x7ffc24420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ProcessID=0; TimeDateStamp=135,099,696; BuildTime=74/04/13 15:41:36.00...; OriginalFileName=CRYPT32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc244c0000; GuidSig=8c840cbc-1c63-bfb7-6...; Age=1; PDBFileName=crypt32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ImageChecksum=1,341,835; TimeDateStamp=0; DefaultBase=0x7ffc244c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ProcessID=0; TimeDateStamp=1,691,891,946; BuildTime=23/08/13 01:59:06.00...; OriginalFileName=COMBASE.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc246c0000; GuidSig=d15b0ee4-2a16-5244-2...; Age=1; PDBFileName=combase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ImageChecksum=3,387,881; TimeDateStamp=0; DefaultBase=0x7ffc246c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24b30000; ImageSize=667,648; ProcessID=0; TimeDateStamp=-1,762,261,787; BuildTime=50/04/04 17:18:29.00...; OriginalFileName=advapi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24b30000; GuidSig=549260e6-7474-8391-e...; Age=1; PDBFileName=advapi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24b30000; ImageSize=667,648; ImageChecksum=662,904; TimeDateStamp=0; DefaultBase=0x7ffc24b30000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24be0000; ImageSize=729,088; ProcessID=0; TimeDateStamp=775,814,378; BuildTime=94/08/02 07:59:38.00...; OriginalFileName=kernel32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24be0000; GuidSig=47a44f0c-c47f-b6a1-f...; Age=1; PDBFileName=kernel32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24be0000; ImageSize=729,088; ImageChecksum=723,980; TimeDateStamp=0; DefaultBase=0x7ffc24be0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24da0000; ImageSize=155,648; ProcessID=0; TimeDateStamp=-1,867,374,302; BuildTime=46/12/05 03:23:14.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc24da0000; GuidSig=209ad405-837d-061e-f...; Age=1; PDBFileName=gdi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc24da0000; ImageSize=155,648; ImageChecksum=194,403; TimeDateStamp=0; DefaultBase=0x7ffc24da0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc24eb0000; ImageSize=454,656; ProcessID=0; TimeDateStamp=252,347,079; BuildTime=77/12/30 16:24:39.00...; OriginalFileName=ws2_32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc24eb0000; GuidSig=94268932-d2c5-c3db-4...; Age=1; PDBFileName=ws2_32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc24eb0000; ImageSize=454,656; ImageChecksum=456,525; TimeDateStamp=0; DefaultBase=0x7ffc24eb0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc25390000; ImageSize=647,168; ProcessID=0; TimeDateStamp=-172,101,673; BuildTime=00/08/25 08:27:03.00...; OriginalFileName=msvcrt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc25390000; GuidSig=1fea8db6-b57f-5fbf-a...; Age=1; PDBFileName=msvcrt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc25390000; ImageSize=647,168; ImageChecksum=678,174; TimeDateStamp=0; DefaultBase=0x7ffc25390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc25590000; ImageSize=618,496; ProcessID=0; TimeDateStamp=-136,044,297; BuildTime=01/10/16 16:23:19.00...; OriginalFileName=sechost.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc25590000; GuidSig=0f733965-b12f-7923-b...; Age=1; PDBFileName=sechost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc25590000; ImageSize=618,496; ImageChecksum=662,974; TimeDateStamp=0; DefaultBase=0x7ffc25590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc25630000; ImageSize=663,552; ProcessID=0; TimeDateStamp=-1,794,760,561; BuildTime=49/03/24 13:52:15.00...; OriginalFileName=CLBCATQ.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc25630000; GuidSig=da759f99-b2bb-75c2-1...; Age=1; PDBFileName=CLBCatQ.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc25630000; ImageSize=663,552; ImageChecksum=684,075; TimeDateStamp=0; DefaultBase=0x7ffc25630000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc256e0000; ImageSize=692,224; ProcessID=0; TimeDateStamp=1,221,584,444; BuildTime=08/09/16 17:00:44.00...; OriginalFileName=SHCORE.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc256e0000; GuidSig=3921dcf6-eafa-cc85-7...; Age=1; PDBFileName=shcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc256e0000; ImageSize=692,224; ImageChecksum=745,271; TimeDateStamp=0; DefaultBase=0x7ffc256e0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc25ea0000; ImageSize=802,816; ProcessID=0; TimeDateStamp=-1,108,332,853; BuildTime=70/12/24 08:14:03.00...; OriginalFileName=OLEAUT32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc25ea0000; GuidSig=2dfa946d-f7be-e09f-3...; Age=1; PDBFileName=oleaut32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc25ea0000; ImageSize=802,816; ImageChecksum=845,595; TimeDateStamp=0; DefaultBase=0x7ffc25ea0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ProcessID=0; TimeDateStamp=87,082,528; BuildTime=72/10/04 21:35:28.00...; OriginalFileName=rpcrt4.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc25f70000; GuidSig=a3028d6b-45da-0062-4...; Age=1; PDBFileName=rpcrt4.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ImageChecksum=1,199,090; TimeDateStamp=0; DefaultBase=0x7ffc25f70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ProcessID=0; TimeDateStamp=-1,431,966,518; BuildTime=60/09/21 13:59:38.00...; OriginalFileName=user32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc26420000; GuidSig=bc4cc7cc-9a33-b8a6-6...; Age=1; PDBFileName=user32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ImageChecksum=1,700,392; TimeDateStamp=0; DefaultBase=0x7ffc26420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ProcessID=0; TimeDateStamp=-1,523,876,758; BuildTime=57/10/23 19:22:18.00...; OriginalFileName=ntdll.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc26600000; GuidSig=b54f3499-813e-bcf1-3...; Age=1; PDBFileName=ntdll.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1384; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ImageChecksum=2,058,600; TimeDateStamp=0; DefaultBase=0x7ffc26600000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: Windows Kernel/Process/DCStart PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=238; ProcessID=1,392; ParentID=836; ImageFileName=svchost.exe; PageDirectoryBase=0x102368d000; Flags=None; SessionID=0; ExitStatus=259; UniqueProcessKey=0xffffc50f69018440; CommandLine=C:\Windows\System32\...; PackageFullName=; ApplicationID=; 
EVENT 0.000: KernelTraceControl/ImageID PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ff6295b0000; ImageSize=65,536; ProcessID=0; TimeDateStamp=852,935,184; BuildTime=97/01/10 22:26:24.00...; OriginalFileName=svchost.exe; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ff6295b0000; GuidSig=ef7b3786-4e54-5d5e-c...; Age=1; PDBFileName=svchost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ff6295b0000; ImageSize=65,536; ImageChecksum=68,124; TimeDateStamp=0; DefaultBase=0x7ff6295b0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffbf6f60000; ImageSize=106,496; ProcessID=0; TimeDateStamp=1,904,169,699; BuildTime=30/05/05 00:01:39.00...; OriginalFileName=pnrpnsp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffbf6f60000; GuidSig=bae4d79c-078d-4db3-7...; Age=1; PDBFileName=pnrpnsp.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffbf6f60000; ImageSize=106,496; ImageChecksum=88,577; TimeDateStamp=0; DefaultBase=0x7ffbf6f60000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffbf9ee0000; ImageSize=90,112; ProcessID=0; TimeDateStamp=-1,530,142,376; BuildTime=57/08/12 06:55:20.00...; OriginalFileName=napinsp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffbf9ee0000; GuidSig=ae9d4265-3592-19ee-4...; Age=1; PDBFileName=NapiNSP.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffbf9ee0000; ImageSize=90,112; ImageChecksum=73,693; TimeDateStamp=0; DefaultBase=0x7ffbf9ee0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc0a800000; ImageSize=57,344; ProcessID=0; TimeDateStamp=2,015,109,317; BuildTime=33/11/09 00:35:17.00...; OriginalFileName=winrnr.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc0a800000; GuidSig=3888bd6b-8cdc-f5e1-0...; Age=1; PDBFileName=winrnr.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc0a800000; ImageSize=57,344; ImageChecksum=73,575; TimeDateStamp=0; DefaultBase=0x7ffc0a800000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc14bd0000; ImageSize=40,960; ProcessID=0; TimeDateStamp=1,781,262,905; BuildTime=26/06/12 11:15:05.00...; OriginalFileName=rasadhlp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc14bd0000; GuidSig=0cce61bb-2297-d334-9...; Age=1; PDBFileName=rasadhlp.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc14bd0000; ImageSize=40,960; ImageChecksum=63,123; TimeDateStamp=0; DefaultBase=0x7ffc14bd0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc19840000; ImageSize=487,424; ProcessID=0; TimeDateStamp=2,075,638,905; BuildTime=35/10/10 14:21:45.00...; OriginalFileName=fwpuclnt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc19840000; GuidSig=f6f6d00e-0966-05bf-c...; Age=1; PDBFileName=fwpuclnt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc19840000; ImageSize=487,424; ImageChecksum=526,551; TimeDateStamp=0; DefaultBase=0x7ffc19840000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc1e220000; ImageSize=86,016; ProcessID=0; TimeDateStamp=8,328,791; BuildTime=70/04/07 09:33:11.00...; OriginalFileName=wshbth.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc1e220000; GuidSig=32dd83fc-982c-6506-e...; Age=1; PDBFileName=wshbth.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc1e220000; ImageSize=86,016; ImageChecksum=104,802; TimeDateStamp=0; DefaultBase=0x7ffc1e220000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc1ec70000; ImageSize=36,864; ProcessID=0; TimeDateStamp=509,992,685; BuildTime=86/02/28 16:38:05.00...; OriginalFileName=nrpsrv.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc1ec70000; GuidSig=8333842d-7e35-2ca0-9...; Age=1; PDBFileName=nrpsrv.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc1ec70000; ImageSize=36,864; ImageChecksum=30,953; TimeDateStamp=0; DefaultBase=0x7ffc1ec70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc1ecd0000; ImageSize=114,688; ProcessID=0; TimeDateStamp=-409,402,657; BuildTime=93/02/15 19:30:39.00...; OriginalFileName=nlaapi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc1ecd0000; GuidSig=a9fb50e6-055e-f24d-f...; Age=1; PDBFileName=nlaapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc1ecd0000; ImageSize=114,688; ImageChecksum=110,160; TimeDateStamp=0; DefaultBase=0x7ffc1ecd0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc1ef80000; ImageSize=49,152; ProcessID=0; TimeDateStamp=-1,284,303,539; BuildTime=65/05/27 15:29:17.00...; OriginalFileName=lmhsvc.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc1ef80000; GuidSig=68db07df-5a73-0d2a-f...; Age=1; PDBFileName=lmhsvc.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc1ef80000; ImageSize=49,152; ImageChecksum=67,049; TimeDateStamp=0; DefaultBase=0x7ffc1ef80000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc22420000; ImageSize=237,568; ProcessID=0; TimeDateStamp=1,353,705,264; BuildTime=12/11/23 21:14:24.00...; OriginalFileName=iphlpapi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc22420000; GuidSig=a3177875-244a-46c8-b...; Age=1; PDBFileName=iphlpapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc22420000; ImageSize=237,568; ImageChecksum=252,735; TimeDateStamp=0; DefaultBase=0x7ffc22420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc22460000; ImageSize=827,392; ProcessID=0; TimeDateStamp=-1,912,355,972; BuildTime=45/07/02 12:28:44.00...; OriginalFileName=dnsapi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc22460000; GuidSig=77e3a024-129c-5dab-b...; Age=1; PDBFileName=dnsapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc22460000; ImageSize=827,392; ImageChecksum=850,901; TimeDateStamp=0; DefaultBase=0x7ffc22460000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc226c0000; ImageSize=421,888; ProcessID=0; TimeDateStamp=414,127,772; BuildTime=83/02/15 03:29:32.00...; OriginalFileName=mswsock.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc226c0000; GuidSig=96babb0d-8e64-884b-6...; Age=1; PDBFileName=mswsock.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc226c0000; ImageSize=421,888; ImageChecksum=420,926; TimeDateStamp=0; DefaultBase=0x7ffc226c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc22940000; ImageSize=167,936; ProcessID=0; TimeDateStamp=1,085,565,188; BuildTime=04/05/26 09:53:08.00...; OriginalFileName=wldp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=41; ImageBase=0x7ffc22940000; GuidSig=3d0180e1-0317-7a96-e...; Age=1; PDBFileName=WLDP.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=156; ImageBase=0x7ffc22940000; ImageSize=167,936; ImageChecksum=190,611; TimeDateStamp=0; DefaultBase=0x7ffc22940000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=54; ImageBase=0x7ffc232d0000; ImageSize=172,032; ProcessID=0; TimeDateStamp=564,545,050; BuildTime=87/11/22 02:04:10.00...; OriginalFileName=devinfoset.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc232d0000; GuidSig=bf3fb10c-179d-a551-d...; Age=1; PDBFileName=devobj.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc232d0000; ImageSize=172,032; ImageChecksum=212,309; TimeDateStamp=0; DefaultBase=0x7ffc232d0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=62; ImageBase=0x7ffc23530000; ImageSize=69,632; ProcessID=0; TimeDateStamp=96,400,242; BuildTime=73/01/20 17:50:42.00...; OriginalFileName=kernel.appcore.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=51; ImageBase=0x7ffc23530000; GuidSig=b44a2a63-8a5c-a8d8-1...; Age=1; PDBFileName=Kernel.Appcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=176; ImageBase=0x7ffc23530000; ImageSize=69,632; ImageChecksum=91,565; TimeDateStamp=0; DefaultBase=0x7ffc23530000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23570000; ImageSize=73,728; ProcessID=0; TimeDateStamp=-457,022,433; BuildTime=91/08/14 15:47:43.00...; OriginalFileName=msasn1.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23570000; GuidSig=ff420efb-35b1-0aa7-6...; Age=1; PDBFileName=msasn1.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23570000; ImageSize=73,728; ImageChecksum=79,097; TimeDateStamp=0; DefaultBase=0x7ffc23570000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23590000; ImageSize=155,648; ProcessID=0; TimeDateStamp=-1,248,142,761; BuildTime=66/07/20 04:08:55.00...; OriginalFileName=bcrypt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23590000; GuidSig=1a472182-0367-8386-d...; Age=1; PDBFileName=bcrypt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23590000; ImageSize=155,648; ImageChecksum=157,312; TimeDateStamp=0; DefaultBase=0x7ffc23590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc235c0000; ImageSize=303,104; ProcessID=0; TimeDateStamp=-1,347,769,430; BuildTime=63/05/24 02:04:26.00...; OriginalFileName=CFGMGR32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc235c0000; GuidSig=c951ee8e-a9b3-8ebf-a...; Age=1; PDBFileName=cfgmgr32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc235c0000; ImageSize=303,104; ImageChecksum=322,106; TimeDateStamp=0; DefaultBase=0x7ffc235c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ProcessID=0; TimeDateStamp=1,555,946,369; BuildTime=19/04/22 15:19:29.00...; OriginalFileName=ucrtbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc23d90000; GuidSig=faceb612-020d-68fb-b...; Age=1; PDBFileName=ucrtbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ImageChecksum=1,052,117; TimeDateStamp=0; DefaultBase=0x7ffc23d90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ProcessID=0; TimeDateStamp=1,396,962,555; BuildTime=14/04/08 13:09:15.00...; OriginalFileName=Win32u.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23eb0000; GuidSig=bc2e49ab-e46d-2e93-b...; Age=1; PDBFileName=win32u.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ImageChecksum=177,968; TimeDateStamp=0; DefaultBase=0x7ffc23eb0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=54; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ProcessID=0; TimeDateStamp=439,410,971; BuildTime=83/12/04 18:36:11.00...; OriginalFileName=Kernelbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=47; ImageBase=0x7ffc23ee0000; GuidSig=44c8ec9a-a0ea-4f98-d...; Age=1; PDBFileName=kernelbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=168; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ImageChecksum=2,793,344; TimeDateStamp=0; DefaultBase=0x7ffc23ee0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ProcessID=0; TimeDateStamp=1,868,443,751; BuildTime=29/03/17 12:09:11.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc24190000; GuidSig=e5a785df-0333-6a66-6...; Age=1; PDBFileName=gdi32full.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ImageChecksum=1,696,264; TimeDateStamp=0; DefaultBase=0x7ffc24190000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24330000; ImageSize=376,832; ProcessID=0; TimeDateStamp=1,670,486,148; BuildTime=22/12/08 07:55:48.00...; OriginalFileName=WINTRUST.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24330000; GuidSig=ef819cd6-e971-2b01-0...; Age=1; PDBFileName=wintrust.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24330000; ImageSize=376,832; ImageChecksum=380,837; TimeDateStamp=0; DefaultBase=0x7ffc24330000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=66; ImageBase=0x7ffc24390000; ImageSize=528,384; ProcessID=0; TimeDateStamp=1,774,320,825; BuildTime=26/03/24 02:53:45.00...; OriginalFileName=bcryptprimitives.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=53; ImageBase=0x7ffc24390000; GuidSig=54a1b493-8222-f67e-4...; Age=1; PDBFileName=bcryptprimitives.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=180; ImageBase=0x7ffc24390000; ImageSize=528,384; ImageChecksum=562,796; TimeDateStamp=0; DefaultBase=0x7ffc24390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=52; ImageBase=0x7ffc24420000; ImageSize=647,168; ProcessID=0; TimeDateStamp=545,597,548; BuildTime=87/04/16 18:52:28.00...; OriginalFileName=msvcp_win.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc24420000; GuidSig=de65fef9-16bb-6b73-d...; Age=1; PDBFileName=msvcp_win.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc24420000; ImageSize=647,168; ImageChecksum=686,408; TimeDateStamp=0; DefaultBase=0x7ffc24420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ProcessID=0; TimeDateStamp=135,099,696; BuildTime=74/04/13 15:41:36.00...; OriginalFileName=CRYPT32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc244c0000; GuidSig=8c840cbc-1c63-bfb7-6...; Age=1; PDBFileName=crypt32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ImageChecksum=1,341,835; TimeDateStamp=0; DefaultBase=0x7ffc244c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ProcessID=0; TimeDateStamp=1,691,891,946; BuildTime=23/08/13 01:59:06.00...; OriginalFileName=COMBASE.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc246c0000; GuidSig=d15b0ee4-2a16-5244-2...; Age=1; PDBFileName=combase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ImageChecksum=3,387,881; TimeDateStamp=0; DefaultBase=0x7ffc246c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24be0000; ImageSize=729,088; ProcessID=0; TimeDateStamp=775,814,378; BuildTime=94/08/02 07:59:38.00...; OriginalFileName=kernel32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24be0000; GuidSig=47a44f0c-c47f-b6a1-f...; Age=1; PDBFileName=kernel32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24be0000; ImageSize=729,088; ImageChecksum=723,980; TimeDateStamp=0; DefaultBase=0x7ffc24be0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24da0000; ImageSize=155,648; ProcessID=0; TimeDateStamp=-1,867,374,302; BuildTime=46/12/05 03:23:14.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc24da0000; GuidSig=209ad405-837d-061e-f...; Age=1; PDBFileName=gdi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc24da0000; ImageSize=155,648; ImageChecksum=194,403; TimeDateStamp=0; DefaultBase=0x7ffc24da0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc24eb0000; ImageSize=454,656; ProcessID=0; TimeDateStamp=252,347,079; BuildTime=77/12/30 16:24:39.00...; OriginalFileName=ws2_32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc24eb0000; GuidSig=94268932-d2c5-c3db-4...; Age=1; PDBFileName=ws2_32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc24eb0000; ImageSize=454,656; ImageChecksum=456,525; TimeDateStamp=0; DefaultBase=0x7ffc24eb0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc25390000; ImageSize=647,168; ProcessID=0; TimeDateStamp=-172,101,673; BuildTime=00/08/25 08:27:03.00...; OriginalFileName=msvcrt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc25390000; GuidSig=1fea8db6-b57f-5fbf-a...; Age=1; PDBFileName=msvcrt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc25390000; ImageSize=647,168; ImageChecksum=678,174; TimeDateStamp=0; DefaultBase=0x7ffc25390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc25590000; ImageSize=618,496; ProcessID=0; TimeDateStamp=-136,044,297; BuildTime=01/10/16 16:23:19.00...; OriginalFileName=sechost.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc25590000; GuidSig=0f733965-b12f-7923-b...; Age=1; PDBFileName=sechost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc25590000; ImageSize=618,496; ImageChecksum=662,974; TimeDateStamp=0; DefaultBase=0x7ffc25590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ProcessID=0; TimeDateStamp=87,082,528; BuildTime=72/10/04 21:35:28.00...; OriginalFileName=rpcrt4.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc25f70000; GuidSig=a3028d6b-45da-0062-4...; Age=1; PDBFileName=rpcrt4.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ImageChecksum=1,199,090; TimeDateStamp=0; DefaultBase=0x7ffc25f70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=40; ImageBase=0x7ffc26410000; ImageSize=32,768; ProcessID=0; TimeDateStamp=1,693,425,343; BuildTime=23/08/30 19:55:43.00...; OriginalFileName=nsi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=40; ImageBase=0x7ffc26410000; GuidSig=7c67fb7d-8805-fe58-4...; Age=1; PDBFileName=nsi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=154; ImageBase=0x7ffc26410000; ImageSize=32,768; ImageChecksum=32,664; TimeDateStamp=0; DefaultBase=0x7ffc26410000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ProcessID=0; TimeDateStamp=-1,431,966,518; BuildTime=60/09/21 13:59:38.00...; OriginalFileName=user32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc26420000; GuidSig=bc4cc7cc-9a33-b8a6-6...; Age=1; PDBFileName=user32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ImageChecksum=1,700,392; TimeDateStamp=0; DefaultBase=0x7ffc26420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ProcessID=0; TimeDateStamp=-1,523,876,758; BuildTime=57/10/23 19:22:18.00...; OriginalFileName=ntdll.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc26600000; GuidSig=b54f3499-813e-bcf1-3...; Age=1; PDBFileName=ntdll.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1392; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ImageChecksum=2,058,600; TimeDateStamp=0; DefaultBase=0x7ffc26600000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: Windows Kernel/Process/DCStart PID=1408; TID=-1; PName=svchost; ProceNum=4; DataLen=212; ProcessID=1,408; ParentID=836; ImageFileName=svchost.exe; PageDirectoryBase=0x1025a9a000; Flags=None; SessionID=0; ExitStatus=259; UniqueProcessKey=0xffffc50f6901d440; CommandLine=C:\Windows\system32\...; PackageFullName=; ApplicationID=; 
EVENT 0.000: KernelTraceControl/ImageID PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ff6295b0000; ImageSize=65,536; ProcessID=0; TimeDateStamp=852,935,184; BuildTime=97/01/10 22:26:24.00...; OriginalFileName=svchost.exe; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ff6295b0000; GuidSig=ef7b3786-4e54-5d5e-c...; Age=1; PDBFileName=svchost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ff6295b0000; ImageSize=65,536; ImageChecksum=68,124; TimeDateStamp=0; DefaultBase=0x7ff6295b0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=84; ImageBase=0x7ffc1c5c0000; ImageSize=7,770,112; ProcessID=0; TimeDateStamp=-1,131,996,070; BuildTime=70/03/25 11:07:06.00...; OriginalFileName=OneCoreUAPCommonProx...; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=62; ImageBase=0x7ffc1c5c0000; GuidSig=94e428c9-8918-e01d-f...; Age=1; PDBFileName=OneCoreUAPCommonProx...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=198; ImageBase=0x7ffc1c5c0000; ImageSize=7,770,112; ImageChecksum=7,847,302; TimeDateStamp=0; DefaultBase=0x7ffc1c5c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=58; ImageBase=0x7ffc1ec80000; ImageSize=61,440; ProcessID=0; TimeDateStamp=2,051,176,172; BuildTime=34/12/31 11:09:32.00...; OriginalFileName=BthTelemetry.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=49; ImageBase=0x7ffc1ec80000; GuidSig=124e105a-c61e-810d-a...; Age=1; PDBFileName=BthTelemetry.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=172; ImageBase=0x7ffc1ec80000; ImageSize=61,440; ImageChecksum=79,880; TimeDateStamp=0; DefaultBase=0x7ffc1ec80000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=56; ImageBase=0x7ffc1ecf0000; ImageSize=401,408; ProcessID=0; TimeDateStamp=1,095,761,024; BuildTime=04/09/21 10:03:44.00...; OriginalFileName=bthavctpsvc.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc1ecf0000; GuidSig=2176551f-e996-8470-1...; Age=1; PDBFileName=BthAvctpSvc.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=170; ImageBase=0x7ffc1ecf0000; ImageSize=401,408; ImageChecksum=439,374; TimeDateStamp=0; DefaultBase=0x7ffc1ecf0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc1f0f0000; ImageSize=978,944; ProcessID=0; TimeDateStamp=2,097,505,968; BuildTime=36/06/19 16:32:48.00...; OriginalFileName=propsys.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc1f0f0000; GuidSig=f17d0756-2273-c8ff-e...; Age=1; PDBFileName=propsys.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc1f0f0000; ImageSize=978,944; ImageChecksum=990,621; TimeDateStamp=0; DefaultBase=0x7ffc1f0f0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc22940000; ImageSize=167,936; ProcessID=0; TimeDateStamp=1,085,565,188; BuildTime=04/05/26 09:53:08.00...; OriginalFileName=wldp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=41; ImageBase=0x7ffc22940000; GuidSig=3d0180e1-0317-7a96-e...; Age=1; PDBFileName=WLDP.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=156; ImageBase=0x7ffc22940000; ImageSize=167,936; ImageChecksum=190,611; TimeDateStamp=0; DefaultBase=0x7ffc22940000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc234d0000; ImageSize=65,536; ProcessID=0; TimeDateStamp=-1,563,634,669; BuildTime=56/07/20 15:30:27.00...; OriginalFileName=umpdc.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc234d0000; GuidSig=1504cc55-3edb-4294-a...; Age=1; PDBFileName=UMPDC.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc234d0000; ImageSize=65,536; ImageChecksum=55,709; TimeDateStamp=0; DefaultBase=0x7ffc234d0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc234e0000; ImageSize=303,104; ProcessID=0; TimeDateStamp=-37,463,926; BuildTime=04/11/30 15:49:30.00...; OriginalFileName=POWRPROF.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc234e0000; GuidSig=bae22f43-6c95-a7d5-0...; Age=1; PDBFileName=powrprof.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc234e0000; ImageSize=303,104; ImageChecksum=321,827; TimeDateStamp=0; DefaultBase=0x7ffc234e0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=62; ImageBase=0x7ffc23530000; ImageSize=69,632; ProcessID=0; TimeDateStamp=96,400,242; BuildTime=73/01/20 17:50:42.00...; OriginalFileName=kernel.appcore.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=51; ImageBase=0x7ffc23530000; GuidSig=b44a2a63-8a5c-a8d8-1...; Age=1; PDBFileName=Kernel.Appcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=176; ImageBase=0x7ffc23530000; ImageSize=69,632; ImageChecksum=91,565; TimeDateStamp=0; DefaultBase=0x7ffc23530000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23570000; ImageSize=73,728; ProcessID=0; TimeDateStamp=-457,022,433; BuildTime=91/08/14 15:47:43.00...; OriginalFileName=msasn1.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23570000; GuidSig=ff420efb-35b1-0aa7-6...; Age=1; PDBFileName=msasn1.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23570000; ImageSize=73,728; ImageChecksum=79,097; TimeDateStamp=0; DefaultBase=0x7ffc23570000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23590000; ImageSize=155,648; ProcessID=0; TimeDateStamp=-1,248,142,761; BuildTime=66/07/20 04:08:55.00...; OriginalFileName=bcrypt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23590000; GuidSig=1a472182-0367-8386-d...; Age=1; PDBFileName=bcrypt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23590000; ImageSize=155,648; ImageChecksum=157,312; TimeDateStamp=0; DefaultBase=0x7ffc23590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc235c0000; ImageSize=303,104; ProcessID=0; TimeDateStamp=-1,347,769,430; BuildTime=63/05/24 02:04:26.00...; OriginalFileName=CFGMGR32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc235c0000; GuidSig=c951ee8e-a9b3-8ebf-a...; Age=1; PDBFileName=cfgmgr32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc235c0000; ImageSize=303,104; ImageChecksum=322,106; TimeDateStamp=0; DefaultBase=0x7ffc235c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ProcessID=0; TimeDateStamp=1,555,946,369; BuildTime=19/04/22 15:19:29.00...; OriginalFileName=ucrtbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc23d90000; GuidSig=faceb612-020d-68fb-b...; Age=1; PDBFileName=ucrtbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ImageChecksum=1,052,117; TimeDateStamp=0; DefaultBase=0x7ffc23d90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ProcessID=0; TimeDateStamp=1,396,962,555; BuildTime=14/04/08 13:09:15.00...; OriginalFileName=Win32u.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23eb0000; GuidSig=bc2e49ab-e46d-2e93-b...; Age=1; PDBFileName=win32u.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ImageChecksum=177,968; TimeDateStamp=0; DefaultBase=0x7ffc23eb0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=54; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ProcessID=0; TimeDateStamp=439,410,971; BuildTime=83/12/04 18:36:11.00...; OriginalFileName=Kernelbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=47; ImageBase=0x7ffc23ee0000; GuidSig=44c8ec9a-a0ea-4f98-d...; Age=1; PDBFileName=kernelbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=168; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ImageChecksum=2,793,344; TimeDateStamp=0; DefaultBase=0x7ffc23ee0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ProcessID=0; TimeDateStamp=1,868,443,751; BuildTime=29/03/17 12:09:11.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc24190000; GuidSig=e5a785df-0333-6a66-6...; Age=1; PDBFileName=gdi32full.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ImageChecksum=1,696,264; TimeDateStamp=0; DefaultBase=0x7ffc24190000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24330000; ImageSize=376,832; ProcessID=0; TimeDateStamp=1,670,486,148; BuildTime=22/12/08 07:55:48.00...; OriginalFileName=WINTRUST.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24330000; GuidSig=ef819cd6-e971-2b01-0...; Age=1; PDBFileName=wintrust.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24330000; ImageSize=376,832; ImageChecksum=380,837; TimeDateStamp=0; DefaultBase=0x7ffc24330000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=66; ImageBase=0x7ffc24390000; ImageSize=528,384; ProcessID=0; TimeDateStamp=1,774,320,825; BuildTime=26/03/24 02:53:45.00...; OriginalFileName=bcryptprimitives.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=53; ImageBase=0x7ffc24390000; GuidSig=54a1b493-8222-f67e-4...; Age=1; PDBFileName=bcryptprimitives.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=180; ImageBase=0x7ffc24390000; ImageSize=528,384; ImageChecksum=562,796; TimeDateStamp=0; DefaultBase=0x7ffc24390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=52; ImageBase=0x7ffc24420000; ImageSize=647,168; ProcessID=0; TimeDateStamp=545,597,548; BuildTime=87/04/16 18:52:28.00...; OriginalFileName=msvcp_win.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc24420000; GuidSig=de65fef9-16bb-6b73-d...; Age=1; PDBFileName=msvcp_win.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc24420000; ImageSize=647,168; ImageChecksum=686,408; TimeDateStamp=0; DefaultBase=0x7ffc24420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ProcessID=0; TimeDateStamp=135,099,696; BuildTime=74/04/13 15:41:36.00...; OriginalFileName=CRYPT32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc244c0000; GuidSig=8c840cbc-1c63-bfb7-6...; Age=1; PDBFileName=crypt32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ImageChecksum=1,341,835; TimeDateStamp=0; DefaultBase=0x7ffc244c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ProcessID=0; TimeDateStamp=1,691,891,946; BuildTime=23/08/13 01:59:06.00...; OriginalFileName=COMBASE.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc246c0000; GuidSig=d15b0ee4-2a16-5244-2...; Age=1; PDBFileName=combase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ImageChecksum=3,387,881; TimeDateStamp=0; DefaultBase=0x7ffc246c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24be0000; ImageSize=729,088; ProcessID=0; TimeDateStamp=775,814,378; BuildTime=94/08/02 07:59:38.00...; OriginalFileName=kernel32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24be0000; GuidSig=47a44f0c-c47f-b6a1-f...; Age=1; PDBFileName=kernel32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24be0000; ImageSize=729,088; ImageChecksum=723,980; TimeDateStamp=0; DefaultBase=0x7ffc24be0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24da0000; ImageSize=155,648; ProcessID=0; TimeDateStamp=-1,867,374,302; BuildTime=46/12/05 03:23:14.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc24da0000; GuidSig=209ad405-837d-061e-f...; Age=1; PDBFileName=gdi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc24da0000; ImageSize=155,648; ImageChecksum=194,403; TimeDateStamp=0; DefaultBase=0x7ffc24da0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc25390000; ImageSize=647,168; ProcessID=0; TimeDateStamp=-172,101,673; BuildTime=00/08/25 08:27:03.00...; OriginalFileName=msvcrt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc25390000; GuidSig=1fea8db6-b57f-5fbf-a...; Age=1; PDBFileName=msvcrt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc25390000; ImageSize=647,168; ImageChecksum=678,174; TimeDateStamp=0; DefaultBase=0x7ffc25390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc25590000; ImageSize=618,496; ProcessID=0; TimeDateStamp=-136,044,297; BuildTime=01/10/16 16:23:19.00...; OriginalFileName=sechost.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc25590000; GuidSig=0f733965-b12f-7923-b...; Age=1; PDBFileName=sechost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc25590000; ImageSize=618,496; ImageChecksum=662,974; TimeDateStamp=0; DefaultBase=0x7ffc25590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc25630000; ImageSize=663,552; ProcessID=0; TimeDateStamp=-1,794,760,561; BuildTime=49/03/24 13:52:15.00...; OriginalFileName=CLBCATQ.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc25630000; GuidSig=da759f99-b2bb-75c2-1...; Age=1; PDBFileName=CLBCatQ.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc25630000; ImageSize=663,552; ImageChecksum=684,075; TimeDateStamp=0; DefaultBase=0x7ffc25630000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc256e0000; ImageSize=692,224; ProcessID=0; TimeDateStamp=1,221,584,444; BuildTime=08/09/16 17:00:44.00...; OriginalFileName=SHCORE.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc256e0000; GuidSig=3921dcf6-eafa-cc85-7...; Age=1; PDBFileName=shcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc256e0000; ImageSize=692,224; ImageChecksum=745,271; TimeDateStamp=0; DefaultBase=0x7ffc256e0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc25ea0000; ImageSize=802,816; ProcessID=0; TimeDateStamp=-1,108,332,853; BuildTime=70/12/24 08:14:03.00...; OriginalFileName=OLEAUT32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc25ea0000; GuidSig=2dfa946d-f7be-e09f-3...; Age=1; PDBFileName=oleaut32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc25ea0000; ImageSize=802,816; ImageChecksum=845,595; TimeDateStamp=0; DefaultBase=0x7ffc25ea0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ProcessID=0; TimeDateStamp=87,082,528; BuildTime=72/10/04 21:35:28.00...; OriginalFileName=rpcrt4.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc25f70000; GuidSig=a3028d6b-45da-0062-4...; Age=1; PDBFileName=rpcrt4.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ImageChecksum=1,199,090; TimeDateStamp=0; DefaultBase=0x7ffc25f70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ProcessID=0; TimeDateStamp=-1,431,966,518; BuildTime=60/09/21 13:59:38.00...; OriginalFileName=user32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc26420000; GuidSig=bc4cc7cc-9a33-b8a6-6...; Age=1; PDBFileName=user32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ImageChecksum=1,700,392; TimeDateStamp=0; DefaultBase=0x7ffc26420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ProcessID=0; TimeDateStamp=-1,523,876,758; BuildTime=57/10/23 19:22:18.00...; OriginalFileName=ntdll.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc26600000; GuidSig=b54f3499-813e-bcf1-3...; Age=1; PDBFileName=ntdll.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1408; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ImageChecksum=2,058,600; TimeDateStamp=0; DefaultBase=0x7ffc26600000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: Windows Kernel/Process/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=204; ProcessID=1,416; ParentID=836; ImageFileName=svchost.exe; PageDirectoryBase=0x102599d000; Flags=None; SessionID=0; ExitStatus=259; UniqueProcessKey=0xffffc50f69020400; CommandLine=C:\Windows\system32\...; PackageFullName=; ApplicationID=; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ff6295b0000; ImageSize=65,536; ProcessID=0; TimeDateStamp=852,935,184; BuildTime=97/01/10 22:26:24.00...; OriginalFileName=svchost.exe; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ff6295b0000; GuidSig=ef7b3786-4e54-5d5e-c...; Age=1; PDBFileName=svchost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ff6295b0000; ImageSize=65,536; ImageChecksum=68,124; TimeDateStamp=0; DefaultBase=0x7ff6295b0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=86; ImageBase=0x7ffc1cf70000; ImageSize=663,552; ProcessID=0; TimeDateStamp=221,491,317; BuildTime=77/01/07 13:21:57.00...; OriginalFileName=Windows.Internal.Blu...; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=63; ImageBase=0x7ffc1cf70000; GuidSig=9531295e-0bcc-0c8c-6...; Age=1; PDBFileName=Windows.Internal.Blu...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=200; ImageBase=0x7ffc1cf70000; ImageSize=663,552; ImageChecksum=675,030; TimeDateStamp=0; DefaultBase=0x7ffc1cf70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=38; ImageBase=0x7ffc1d0d0000; ImageSize=49,152; ProcessID=0; TimeDateStamp=271,701,914; BuildTime=78/08/11 16:45:14.00...; OriginalFileName=bi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=39; ImageBase=0x7ffc1d0d0000; GuidSig=750b35ae-26a8-fa1a-d...; Age=1; PDBFileName=bi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=152; ImageBase=0x7ffc1d0d0000; ImageSize=49,152; ImageChecksum=46,380; TimeDateStamp=0; DefaultBase=0x7ffc1d0d0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=84; ImageBase=0x7ffc1d2f0000; ImageSize=290,816; ProcessID=0; TimeDateStamp=1,841,046,419; BuildTime=28/05/04 09:46:59.00...; OriginalFileName=Microsoft.Bluetooth....; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=62; ImageBase=0x7ffc1d2f0000; GuidSig=502e6c0e-ee12-46c8-9...; Age=1; PDBFileName=Microsoft.Bluetooth....; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=198; ImageBase=0x7ffc1d2f0000; ImageSize=290,816; ImageChecksum=310,146; TimeDateStamp=0; DefaultBase=0x7ffc1d2f0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc1e450000; ImageSize=1,388,544; ProcessID=0; TimeDateStamp=-238,274,918; BuildTime=98/07/20 10:59:38.00...; OriginalFileName=WinTypes.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc1e450000; GuidSig=46ae6b82-4cf2-3a19-4...; Age=1; PDBFileName=WinTypes.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc1e450000; ImageSize=1,388,544; ImageChecksum=1,428,617; TimeDateStamp=0; DefaultBase=0x7ffc1e450000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=88; ImageBase=0x7ffc1e5c0000; ImageSize=3,837,952; ProcessID=0; TimeDateStamp=68,073,833; BuildTime=72/02/27 21:23:53.00...; OriginalFileName=Microsoft.Bluetooth....; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=64; ImageBase=0x7ffc1e5c0000; GuidSig=22432435-dd04-b0c3-1...; Age=1; PDBFileName=Microsoft.Bluetooth....; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=202; ImageBase=0x7ffc1e5c0000; ImageSize=3,837,952; ImageChecksum=3,862,157; TimeDateStamp=0; DefaultBase=0x7ffc1e5c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=54; ImageBase=0x7ffc1e970000; ImageSize=86,016; ProcessID=0; TimeDateStamp=525,713,861; BuildTime=86/08/29 15:37:41.00...; OriginalFileName=usermgrcli.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=47; ImageBase=0x7ffc1e970000; GuidSig=26f569a5-8783-27b0-0...; Age=1; PDBFileName=usermgrcli.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=168; ImageBase=0x7ffc1e970000; ImageSize=86,016; ImageChecksum=138,081; TimeDateStamp=0; DefaultBase=0x7ffc1e970000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=60; ImageBase=0x7ffc1eac0000; ImageSize=524,288; ProcessID=0; TimeDateStamp=970,085,465; BuildTime=00/09/27 20:11:05.00...; OriginalFileName=PolicyManager.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc1eac0000; GuidSig=263d8dd8-e39f-0946-0...; Age=1; PDBFileName=policymanager.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=174; ImageBase=0x7ffc1eac0000; ImageSize=524,288; ImageChecksum=516,279; TimeDateStamp=0; DefaultBase=0x7ffc1eac0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=58; ImageBase=0x7ffc1ec80000; ImageSize=61,440; ProcessID=0; TimeDateStamp=2,051,176,172; BuildTime=34/12/31 11:09:32.00...; OriginalFileName=BthTelemetry.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=49; ImageBase=0x7ffc1ec80000; GuidSig=124e105a-c61e-810d-a...; Age=1; PDBFileName=BthTelemetry.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=172; ImageBase=0x7ffc1ec80000; ImageSize=61,440; ImageChecksum=79,880; TimeDateStamp=0; DefaultBase=0x7ffc1ec80000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc1ec90000; ImageSize=241,664; ProcessID=0; TimeDateStamp=800,931,714; BuildTime=95/05/20 01:01:54.00...; OriginalFileName=BTHSERV.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc1ec90000; GuidSig=8e6ce101-4485-dcfc-d...; Age=1; PDBFileName=bthserv.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc1ec90000; ImageSize=241,664; ImageChecksum=233,935; TimeDateStamp=0; DefaultBase=0x7ffc1ec90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=58; ImageBase=0x7ffc1f260000; ImageSize=565,248; ProcessID=0; TimeDateStamp=-2,109,210,886; BuildTime=39/04/07 02:33:30.00...; OriginalFileName=msvcp110_win.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=49; ImageBase=0x7ffc1f260000; GuidSig=8b3306f1-7c4d-d8b8-0...; Age=1; PDBFileName=msvcp110_win.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=172; ImageBase=0x7ffc1f260000; ImageSize=565,248; ImageChecksum=591,592; TimeDateStamp=0; DefaultBase=0x7ffc1f260000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=52; ImageBase=0x7ffc20910000; ImageSize=266,240; ProcessID=0; TimeDateStamp=972,189,211; BuildTime=00/10/22 04:33:31.00...; OriginalFileName=BrokerLib.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc20910000; GuidSig=f423664f-cf3d-9472-1...; Age=1; PDBFileName=BrokerLib.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc20910000; ImageSize=266,240; ImageChecksum=287,821; TimeDateStamp=0; DefaultBase=0x7ffc20910000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=64; ImageBase=0x7ffc20b80000; ImageSize=2,465,792; ProcessID=0; TimeDateStamp=1,123,054,026; BuildTime=05/08/03 07:27:06.00...; OriginalFileName=twinapi.appcore.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=52; ImageBase=0x7ffc20b80000; GuidSig=da642c52-541e-6baa-4...; Age=1; PDBFileName=twinapi.appcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=178; ImageBase=0x7ffc20b80000; ImageSize=2,465,792; ImageChecksum=2,536,066; TimeDateStamp=0; DefaultBase=0x7ffc20b80000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc20f00000; ImageSize=167,936; ProcessID=0; TimeDateStamp=-189,693,732; BuildTime=00/02/02 17:46:04.00...; OriginalFileName=rmclient.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc20f00000; GuidSig=d9b2eec0-1750-fc20-8...; Age=1; PDBFileName=RmClient.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc20f00000; ImageSize=167,936; ImageChecksum=187,354; TimeDateStamp=0; DefaultBase=0x7ffc20f00000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc22000000; ImageSize=303,104; ProcessID=0; TimeDateStamp=-1,775,967,220; BuildTime=49/10/28 02:14:36.00...; OriginalFileName=authz.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc22000000; GuidSig=f7ab524f-49bc-eb09-0...; Age=1; PDBFileName=authz.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc22000000; ImageSize=303,104; ImageChecksum=299,134; TimeDateStamp=0; DefaultBase=0x7ffc22000000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=54; ImageBase=0x7ffc22630000; ImageSize=53,248; ProcessID=0; TimeDateStamp=-1,481,996,771; BuildTime=59/02/20 12:42:05.00...; OriginalFileName=NtlmShared.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=47; ImageBase=0x7ffc22630000; GuidSig=6b0ef484-881c-773a-b...; Age=1; PDBFileName=NtlmShared.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=168; ImageBase=0x7ffc22630000; ImageSize=53,248; ImageChecksum=68,032; TimeDateStamp=0; DefaultBase=0x7ffc22630000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc22640000; ImageSize=487,424; ProcessID=0; TimeDateStamp=-1,940,114,644; BuildTime=44/08/15 05:44:12.00...; OriginalFileName=MSV1_0.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc22640000; GuidSig=b1bdce7a-f083-1cac-f...; Age=1; PDBFileName=msv1_0.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc22640000; ImageSize=487,424; ImageChecksum=528,525; TimeDateStamp=0; DefaultBase=0x7ffc22640000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc22730000; ImageSize=86,016; ProcessID=0; TimeDateStamp=-975,283,468; BuildTime=75/03/13 06:23:48.00...; OriginalFileName=cryptdll.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc22730000; GuidSig=b09167fe-56a9-ede0-2...; Age=1; PDBFileName=cryptdll.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc22730000; ImageSize=86,016; ImageChecksum=71,894; TimeDateStamp=0; DefaultBase=0x7ffc22730000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc22940000; ImageSize=167,936; ProcessID=0; TimeDateStamp=1,085,565,188; BuildTime=04/05/26 09:53:08.00...; OriginalFileName=wldp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=41; ImageBase=0x7ffc22940000; GuidSig=3d0180e1-0317-7a96-e...; Age=1; PDBFileName=WLDP.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=156; ImageBase=0x7ffc22940000; ImageSize=167,936; ImageChecksum=190,611; TimeDateStamp=0; DefaultBase=0x7ffc22940000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=54; ImageBase=0x7ffc232d0000; ImageSize=172,032; ProcessID=0; TimeDateStamp=564,545,050; BuildTime=87/11/22 02:04:10.00...; OriginalFileName=devinfoset.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc232d0000; GuidSig=bf3fb10c-179d-a551-d...; Age=1; PDBFileName=devobj.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc232d0000; ImageSize=172,032; ImageChecksum=212,309; TimeDateStamp=0; DefaultBase=0x7ffc232d0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc233c0000; ImageSize=192,512; ProcessID=0; TimeDateStamp=621,642,292; BuildTime=89/09/12 22:24:52.00...; OriginalFileName=sspicli.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc233c0000; GuidSig=823d5a41-e0d7-02a7-9...; Age=1; PDBFileName=sspicli.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc233c0000; ImageSize=192,512; ImageChecksum=235,306; TimeDateStamp=0; DefaultBase=0x7ffc233c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=62; ImageBase=0x7ffc23530000; ImageSize=69,632; ProcessID=0; TimeDateStamp=96,400,242; BuildTime=73/01/20 17:50:42.00...; OriginalFileName=kernel.appcore.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=51; ImageBase=0x7ffc23530000; GuidSig=b44a2a63-8a5c-a8d8-1...; Age=1; PDBFileName=Kernel.Appcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=176; ImageBase=0x7ffc23530000; ImageSize=69,632; ImageChecksum=91,565; TimeDateStamp=0; DefaultBase=0x7ffc23530000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23570000; ImageSize=73,728; ProcessID=0; TimeDateStamp=-457,022,433; BuildTime=91/08/14 15:47:43.00...; OriginalFileName=msasn1.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23570000; GuidSig=ff420efb-35b1-0aa7-6...; Age=1; PDBFileName=msasn1.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23570000; ImageSize=73,728; ImageChecksum=79,097; TimeDateStamp=0; DefaultBase=0x7ffc23570000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23590000; ImageSize=155,648; ProcessID=0; TimeDateStamp=-1,248,142,761; BuildTime=66/07/20 04:08:55.00...; OriginalFileName=bcrypt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23590000; GuidSig=1a472182-0367-8386-d...; Age=1; PDBFileName=bcrypt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23590000; ImageSize=155,648; ImageChecksum=157,312; TimeDateStamp=0; DefaultBase=0x7ffc23590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc235c0000; ImageSize=303,104; ProcessID=0; TimeDateStamp=-1,347,769,430; BuildTime=63/05/24 02:04:26.00...; OriginalFileName=CFGMGR32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc235c0000; GuidSig=c951ee8e-a9b3-8ebf-a...; Age=1; PDBFileName=cfgmgr32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc235c0000; ImageSize=303,104; ImageChecksum=322,106; TimeDateStamp=0; DefaultBase=0x7ffc235c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ProcessID=0; TimeDateStamp=1,555,946,369; BuildTime=19/04/22 15:19:29.00...; OriginalFileName=ucrtbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc23d90000; GuidSig=faceb612-020d-68fb-b...; Age=1; PDBFileName=ucrtbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ImageChecksum=1,052,117; TimeDateStamp=0; DefaultBase=0x7ffc23d90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ProcessID=0; TimeDateStamp=1,396,962,555; BuildTime=14/04/08 13:09:15.00...; OriginalFileName=Win32u.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23eb0000; GuidSig=bc2e49ab-e46d-2e93-b...; Age=1; PDBFileName=win32u.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ImageChecksum=177,968; TimeDateStamp=0; DefaultBase=0x7ffc23eb0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=54; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ProcessID=0; TimeDateStamp=439,410,971; BuildTime=83/12/04 18:36:11.00...; OriginalFileName=Kernelbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=47; ImageBase=0x7ffc23ee0000; GuidSig=44c8ec9a-a0ea-4f98-d...; Age=1; PDBFileName=kernelbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=168; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ImageChecksum=2,793,344; TimeDateStamp=0; DefaultBase=0x7ffc23ee0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ProcessID=0; TimeDateStamp=1,868,443,751; BuildTime=29/03/17 12:09:11.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc24190000; GuidSig=e5a785df-0333-6a66-6...; Age=1; PDBFileName=gdi32full.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ImageChecksum=1,696,264; TimeDateStamp=0; DefaultBase=0x7ffc24190000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24330000; ImageSize=376,832; ProcessID=0; TimeDateStamp=1,670,486,148; BuildTime=22/12/08 07:55:48.00...; OriginalFileName=WINTRUST.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24330000; GuidSig=ef819cd6-e971-2b01-0...; Age=1; PDBFileName=wintrust.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24330000; ImageSize=376,832; ImageChecksum=380,837; TimeDateStamp=0; DefaultBase=0x7ffc24330000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=66; ImageBase=0x7ffc24390000; ImageSize=528,384; ProcessID=0; TimeDateStamp=1,774,320,825; BuildTime=26/03/24 02:53:45.00...; OriginalFileName=bcryptprimitives.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=53; ImageBase=0x7ffc24390000; GuidSig=54a1b493-8222-f67e-4...; Age=1; PDBFileName=bcryptprimitives.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=180; ImageBase=0x7ffc24390000; ImageSize=528,384; ImageChecksum=562,796; TimeDateStamp=0; DefaultBase=0x7ffc24390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=52; ImageBase=0x7ffc24420000; ImageSize=647,168; ProcessID=0; TimeDateStamp=545,597,548; BuildTime=87/04/16 18:52:28.00...; OriginalFileName=msvcp_win.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc24420000; GuidSig=de65fef9-16bb-6b73-d...; Age=1; PDBFileName=msvcp_win.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc24420000; ImageSize=647,168; ImageChecksum=686,408; TimeDateStamp=0; DefaultBase=0x7ffc24420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ProcessID=0; TimeDateStamp=135,099,696; BuildTime=74/04/13 15:41:36.00...; OriginalFileName=CRYPT32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc244c0000; GuidSig=8c840cbc-1c63-bfb7-6...; Age=1; PDBFileName=crypt32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ImageChecksum=1,341,835; TimeDateStamp=0; DefaultBase=0x7ffc244c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ProcessID=0; TimeDateStamp=1,691,891,946; BuildTime=23/08/13 01:59:06.00...; OriginalFileName=COMBASE.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc246c0000; GuidSig=d15b0ee4-2a16-5244-2...; Age=1; PDBFileName=combase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ImageChecksum=3,387,881; TimeDateStamp=0; DefaultBase=0x7ffc246c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24b30000; ImageSize=667,648; ProcessID=0; TimeDateStamp=-1,762,261,787; BuildTime=50/04/04 17:18:29.00...; OriginalFileName=advapi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24b30000; GuidSig=549260e6-7474-8391-e...; Age=1; PDBFileName=advapi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24b30000; ImageSize=667,648; ImageChecksum=662,904; TimeDateStamp=0; DefaultBase=0x7ffc24b30000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24be0000; ImageSize=729,088; ProcessID=0; TimeDateStamp=775,814,378; BuildTime=94/08/02 07:59:38.00...; OriginalFileName=kernel32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24be0000; GuidSig=47a44f0c-c47f-b6a1-f...; Age=1; PDBFileName=kernel32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24be0000; ImageSize=729,088; ImageChecksum=723,980; TimeDateStamp=0; DefaultBase=0x7ffc24be0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: Windows Kernel/PerfInfo/Sample PID=-1; TID=9984; PName=; ProceNum=2; DataLen=16; InstructionPointer=0xfffff8027ca67778; ProcessorNumber=2; Priority=9; ExecutingDPC=False; ExecutingISR=False; Rank=0; Count=1; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24da0000; ImageSize=155,648; ProcessID=0; TimeDateStamp=-1,867,374,302; BuildTime=46/12/05 03:23:14.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc24da0000; GuidSig=209ad405-837d-061e-f...; Age=1; PDBFileName=gdi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc24da0000; ImageSize=155,648; ImageChecksum=194,403; TimeDateStamp=0; DefaultBase=0x7ffc24da0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24dd0000; ImageSize=483,328; ProcessID=0; TimeDateStamp=2,094,009,598; BuildTime=36/05/10 05:19:58.00...; OriginalFileName=COML2.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc24dd0000; GuidSig=1b7a443a-a66f-075a-5...; Age=1; PDBFileName=coml2.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc24dd0000; ImageSize=483,328; ImageChecksum=521,990; TimeDateStamp=0; DefaultBase=0x7ffc24dd0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc25390000; ImageSize=647,168; ProcessID=0; TimeDateStamp=-172,101,673; BuildTime=00/08/25 08:27:03.00...; OriginalFileName=msvcrt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc25390000; GuidSig=1fea8db6-b57f-5fbf-a...; Age=1; PDBFileName=msvcrt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc25390000; ImageSize=647,168; ImageChecksum=678,174; TimeDateStamp=0; DefaultBase=0x7ffc25390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc25430000; ImageSize=1,400,832; ProcessID=0; TimeDateStamp=1,171,436,857; BuildTime=07/02/14 07:07:37.00...; OriginalFileName=OLE32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc25430000; GuidSig=ec385cee-495b-f162-5...; Age=1; PDBFileName=ole32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc25430000; ImageSize=1,400,832; ImageChecksum=1,434,873; TimeDateStamp=0; DefaultBase=0x7ffc25430000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc25590000; ImageSize=618,496; ProcessID=0; TimeDateStamp=-136,044,297; BuildTime=01/10/16 16:23:19.00...; OriginalFileName=sechost.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc25590000; GuidSig=0f733965-b12f-7923-b...; Age=1; PDBFileName=sechost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc25590000; ImageSize=618,496; ImageChecksum=662,974; TimeDateStamp=0; DefaultBase=0x7ffc25590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc25630000; ImageSize=663,552; ProcessID=0; TimeDateStamp=-1,794,760,561; BuildTime=49/03/24 13:52:15.00...; OriginalFileName=CLBCATQ.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc25630000; GuidSig=da759f99-b2bb-75c2-1...; Age=1; PDBFileName=CLBCatQ.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc25630000; ImageSize=663,552; ImageChecksum=684,075; TimeDateStamp=0; DefaultBase=0x7ffc25630000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc256e0000; ImageSize=692,224; ProcessID=0; TimeDateStamp=1,221,584,444; BuildTime=08/09/16 17:00:44.00...; OriginalFileName=SHCORE.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc256e0000; GuidSig=3921dcf6-eafa-cc85-7...; Age=1; PDBFileName=shcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc256e0000; ImageSize=692,224; ImageChecksum=745,271; TimeDateStamp=0; DefaultBase=0x7ffc256e0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc25ea0000; ImageSize=802,816; ProcessID=0; TimeDateStamp=-1,108,332,853; BuildTime=70/12/24 08:14:03.00...; OriginalFileName=OLEAUT32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc25ea0000; GuidSig=2dfa946d-f7be-e09f-3...; Age=1; PDBFileName=oleaut32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc25ea0000; ImageSize=802,816; ImageChecksum=845,595; TimeDateStamp=0; DefaultBase=0x7ffc25ea0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ProcessID=0; TimeDateStamp=87,082,528; BuildTime=72/10/04 21:35:28.00...; OriginalFileName=rpcrt4.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc25f70000; GuidSig=a3028d6b-45da-0062-4...; Age=1; PDBFileName=rpcrt4.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ImageChecksum=1,199,090; TimeDateStamp=0; DefaultBase=0x7ffc25f70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ProcessID=0; TimeDateStamp=-1,431,966,518; BuildTime=60/09/21 13:59:38.00...; OriginalFileName=user32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc26420000; GuidSig=bc4cc7cc-9a33-b8a6-6...; Age=1; PDBFileName=user32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ImageChecksum=1,700,392; TimeDateStamp=0; DefaultBase=0x7ffc26420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ProcessID=0; TimeDateStamp=-1,523,876,758; BuildTime=57/10/23 19:22:18.00...; OriginalFileName=ntdll.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc26600000; GuidSig=b54f3499-813e-bcf1-3...; Age=1; PDBFileName=ntdll.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1416; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ImageChecksum=2,058,600; TimeDateStamp=0; DefaultBase=0x7ffc26600000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: Windows Kernel/Process/DCStart PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=200; ProcessID=1,548; ParentID=836; ImageFileName=svchost.exe; PageDirectoryBase=0x1024144000; Flags=None; SessionID=0; ExitStatus=259; UniqueProcessKey=0xffffc50f69094400; CommandLine=C:\Windows\system32\...; PackageFullName=; ApplicationID=; 
EVENT 0.000: KernelTraceControl/ImageID PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ff6295b0000; ImageSize=65,536; ProcessID=0; TimeDateStamp=852,935,184; BuildTime=97/01/10 22:26:24.00...; OriginalFileName=svchost.exe; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ff6295b0000; GuidSig=ef7b3786-4e54-5d5e-c...; Age=1; PDBFileName=svchost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ff6295b0000; ImageSize=65,536; ImageChecksum=68,124; TimeDateStamp=0; DefaultBase=0x7ff6295b0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=60; ImageBase=0x7ffc205a0000; ImageSize=868,352; ProcessID=0; TimeDateStamp=270,157,240; BuildTime=78/07/24 19:40:40.00...; OriginalFileName=CoreMessaging.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc205a0000; GuidSig=f77a6f37-b916-eb3a-b...; Age=1; PDBFileName=CoreMessaging.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=174; ImageBase=0x7ffc205a0000; ImageSize=868,352; ImageChecksum=871,099; TimeDateStamp=0; DefaultBase=0x7ffc205a0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc22940000; ImageSize=167,936; ProcessID=0; TimeDateStamp=1,085,565,188; BuildTime=04/05/26 09:53:08.00...; OriginalFileName=wldp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=41; ImageBase=0x7ffc22940000; GuidSig=3d0180e1-0317-7a96-e...; Age=1; PDBFileName=WLDP.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=156; ImageBase=0x7ffc22940000; ImageSize=167,936; ImageChecksum=190,611; TimeDateStamp=0; DefaultBase=0x7ffc22940000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=62; ImageBase=0x7ffc23530000; ImageSize=69,632; ProcessID=0; TimeDateStamp=96,400,242; BuildTime=73/01/20 17:50:42.00...; OriginalFileName=kernel.appcore.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=51; ImageBase=0x7ffc23530000; GuidSig=b44a2a63-8a5c-a8d8-1...; Age=1; PDBFileName=Kernel.Appcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=176; ImageBase=0x7ffc23530000; ImageSize=69,632; ImageChecksum=91,565; TimeDateStamp=0; DefaultBase=0x7ffc23530000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23570000; ImageSize=73,728; ProcessID=0; TimeDateStamp=-457,022,433; BuildTime=91/08/14 15:47:43.00...; OriginalFileName=msasn1.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23570000; GuidSig=ff420efb-35b1-0aa7-6...; Age=1; PDBFileName=msasn1.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23570000; ImageSize=73,728; ImageChecksum=79,097; TimeDateStamp=0; DefaultBase=0x7ffc23570000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ProcessID=0; TimeDateStamp=1,555,946,369; BuildTime=19/04/22 15:19:29.00...; OriginalFileName=ucrtbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc23d90000; GuidSig=faceb612-020d-68fb-b...; Age=1; PDBFileName=ucrtbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ImageChecksum=1,052,117; TimeDateStamp=0; DefaultBase=0x7ffc23d90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ProcessID=0; TimeDateStamp=1,396,962,555; BuildTime=14/04/08 13:09:15.00...; OriginalFileName=Win32u.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23eb0000; GuidSig=bc2e49ab-e46d-2e93-b...; Age=1; PDBFileName=win32u.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ImageChecksum=177,968; TimeDateStamp=0; DefaultBase=0x7ffc23eb0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=54; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ProcessID=0; TimeDateStamp=439,410,971; BuildTime=83/12/04 18:36:11.00...; OriginalFileName=Kernelbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=47; ImageBase=0x7ffc23ee0000; GuidSig=44c8ec9a-a0ea-4f98-d...; Age=1; PDBFileName=kernelbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=168; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ImageChecksum=2,793,344; TimeDateStamp=0; DefaultBase=0x7ffc23ee0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ProcessID=0; TimeDateStamp=1,868,443,751; BuildTime=29/03/17 12:09:11.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc24190000; GuidSig=e5a785df-0333-6a66-6...; Age=1; PDBFileName=gdi32full.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ImageChecksum=1,696,264; TimeDateStamp=0; DefaultBase=0x7ffc24190000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24330000; ImageSize=376,832; ProcessID=0; TimeDateStamp=1,670,486,148; BuildTime=22/12/08 07:55:48.00...; OriginalFileName=WINTRUST.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24330000; GuidSig=ef819cd6-e971-2b01-0...; Age=1; PDBFileName=wintrust.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24330000; ImageSize=376,832; ImageChecksum=380,837; TimeDateStamp=0; DefaultBase=0x7ffc24330000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=66; ImageBase=0x7ffc24390000; ImageSize=528,384; ProcessID=0; TimeDateStamp=1,774,320,825; BuildTime=26/03/24 02:53:45.00...; OriginalFileName=bcryptprimitives.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=53; ImageBase=0x7ffc24390000; GuidSig=54a1b493-8222-f67e-4...; Age=1; PDBFileName=bcryptprimitives.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=180; ImageBase=0x7ffc24390000; ImageSize=528,384; ImageChecksum=562,796; TimeDateStamp=0; DefaultBase=0x7ffc24390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=52; ImageBase=0x7ffc24420000; ImageSize=647,168; ProcessID=0; TimeDateStamp=545,597,548; BuildTime=87/04/16 18:52:28.00...; OriginalFileName=msvcp_win.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc24420000; GuidSig=de65fef9-16bb-6b73-d...; Age=1; PDBFileName=msvcp_win.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc24420000; ImageSize=647,168; ImageChecksum=686,408; TimeDateStamp=0; DefaultBase=0x7ffc24420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ProcessID=0; TimeDateStamp=135,099,696; BuildTime=74/04/13 15:41:36.00...; OriginalFileName=CRYPT32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc244c0000; GuidSig=8c840cbc-1c63-bfb7-6...; Age=1; PDBFileName=crypt32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ImageChecksum=1,341,835; TimeDateStamp=0; DefaultBase=0x7ffc244c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ProcessID=0; TimeDateStamp=1,691,891,946; BuildTime=23/08/13 01:59:06.00...; OriginalFileName=COMBASE.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc246c0000; GuidSig=d15b0ee4-2a16-5244-2...; Age=1; PDBFileName=combase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ImageChecksum=3,387,881; TimeDateStamp=0; DefaultBase=0x7ffc246c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24be0000; ImageSize=729,088; ProcessID=0; TimeDateStamp=775,814,378; BuildTime=94/08/02 07:59:38.00...; OriginalFileName=kernel32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24be0000; GuidSig=47a44f0c-c47f-b6a1-f...; Age=1; PDBFileName=kernel32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24be0000; ImageSize=729,088; ImageChecksum=723,980; TimeDateStamp=0; DefaultBase=0x7ffc24be0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24da0000; ImageSize=155,648; ProcessID=0; TimeDateStamp=-1,867,374,302; BuildTime=46/12/05 03:23:14.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc24da0000; GuidSig=209ad405-837d-061e-f...; Age=1; PDBFileName=gdi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc24da0000; ImageSize=155,648; ImageChecksum=194,403; TimeDateStamp=0; DefaultBase=0x7ffc24da0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc25390000; ImageSize=647,168; ProcessID=0; TimeDateStamp=-172,101,673; BuildTime=00/08/25 08:27:03.00...; OriginalFileName=msvcrt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc25390000; GuidSig=1fea8db6-b57f-5fbf-a...; Age=1; PDBFileName=msvcrt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc25390000; ImageSize=647,168; ImageChecksum=678,174; TimeDateStamp=0; DefaultBase=0x7ffc25390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc25590000; ImageSize=618,496; ProcessID=0; TimeDateStamp=-136,044,297; BuildTime=01/10/16 16:23:19.00...; OriginalFileName=sechost.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc25590000; GuidSig=0f733965-b12f-7923-b...; Age=1; PDBFileName=sechost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc25590000; ImageSize=618,496; ImageChecksum=662,974; TimeDateStamp=0; DefaultBase=0x7ffc25590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ProcessID=0; TimeDateStamp=87,082,528; BuildTime=72/10/04 21:35:28.00...; OriginalFileName=rpcrt4.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc25f70000; GuidSig=a3028d6b-45da-0062-4...; Age=1; PDBFileName=rpcrt4.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ImageChecksum=1,199,090; TimeDateStamp=0; DefaultBase=0x7ffc25f70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ProcessID=0; TimeDateStamp=-1,431,966,518; BuildTime=60/09/21 13:59:38.00...; OriginalFileName=user32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc26420000; GuidSig=bc4cc7cc-9a33-b8a6-6...; Age=1; PDBFileName=user32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ImageChecksum=1,700,392; TimeDateStamp=0; DefaultBase=0x7ffc26420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ProcessID=0; TimeDateStamp=-1,523,876,758; BuildTime=57/10/23 19:22:18.00...; OriginalFileName=ntdll.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc26600000; GuidSig=b54f3499-813e-bcf1-3...; Age=1; PDBFileName=ntdll.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1548; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ImageChecksum=2,058,600; TimeDateStamp=0; DefaultBase=0x7ffc26600000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: Windows Kernel/Process/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=196; ProcessID=1,664; ParentID=836; ImageFileName=svchost.exe; PageDirectoryBase=0x1024a43000; Flags=None; SessionID=0; ExitStatus=259; UniqueProcessKey=0xffffc50f690c9380; CommandLine=C:\Windows\system32\...; PackageFullName=; ApplicationID=; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ff6295b0000; ImageSize=65,536; ProcessID=0; TimeDateStamp=852,935,184; BuildTime=97/01/10 22:26:24.00...; OriginalFileName=svchost.exe; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ff6295b0000; GuidSig=ef7b3786-4e54-5d5e-c...; Age=1; PDBFileName=svchost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ff6295b0000; ImageSize=65,536; ImageChecksum=68,124; TimeDateStamp=0; DefaultBase=0x7ff6295b0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc1b790000; ImageSize=389,120; ProcessID=0; TimeDateStamp=2,036,898,759; BuildTime=34/07/19 05:12:39.00...; OriginalFileName=wevtapi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc1b790000; GuidSig=fe24c9ce-9500-e622-0...; Age=1; PDBFileName=wevtapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc1b790000; ImageSize=389,120; ImageChecksum=404,506; TimeDateStamp=0; DefaultBase=0x7ffc1b790000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=64; ImageBase=0x7ffc1cd90000; ImageSize=184,320; ProcessID=0; TimeDateStamp=2,108,502,310; BuildTime=36/10/24 23:05:10.00...; OriginalFileName=WPTaskScheduler.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=52; ImageBase=0x7ffc1cd90000; GuidSig=ead7e63f-1a0e-2f0f-2...; Age=1; PDBFileName=WPTaskScheduler.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=178; ImageBase=0x7ffc1cd90000; ImageSize=184,320; ImageChecksum=227,213; TimeDateStamp=0; DefaultBase=0x7ffc1cd90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=66; ImageBase=0x7ffc1ceb0000; ImageSize=57,344; ProcessID=0; TimeDateStamp=1,342,672,271; BuildTime=12/07/19 04:31:11.00...; OriginalFileName=TimeBrokerClient.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=53; ImageBase=0x7ffc1ceb0000; GuidSig=e9d3fa9c-ac35-4498-b...; Age=1; PDBFileName=TimeBrokerClient.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=180; ImageBase=0x7ffc1ceb0000; ImageSize=57,344; ImageChecksum=63,302; TimeDateStamp=0; DefaultBase=0x7ffc1ceb0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=84; ImageBase=0x7ffc1d130000; ImageSize=45,056; ProcessID=0; TimeDateStamp=-1,984,426,357; BuildTime=43/03/21 08:55:39.00...; OriginalFileName=CSystemEventsBrokerC...; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=62; ImageBase=0x7ffc1d130000; GuidSig=6e0a1e6a-bb1d-4dec-6...; Age=1; PDBFileName=CSystemEventsBrokerC...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=198; ImageBase=0x7ffc1d130000; ImageSize=45,056; ImageChecksum=64,139; TimeDateStamp=0; DefaultBase=0x7ffc1d130000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc1d370000; ImageSize=499,712; ProcessID=0; TimeDateStamp=265,754,238; BuildTime=78/06/03 20:37:18.00...; OriginalFileName=taskcomp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc1d370000; GuidSig=b04deb27-db01-2b6e-8...; Age=1; PDBFileName=taskcomp.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc1d370000; ImageSize=499,712; ImageChecksum=515,508; TimeDateStamp=0; DefaultBase=0x7ffc1d370000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc1daa0000; ImageSize=69,632; ProcessID=0; TimeDateStamp=1,060,290,298; BuildTime=03/08/07 21:04:58.00...; OriginalFileName=wmiclnt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc1daa0000; GuidSig=0d5a053a-cc97-a8a2-d...; Age=1; PDBFileName=wmiclnt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc1daa0000; ImageSize=69,632; ImageChecksum=100,370; TimeDateStamp=0; DefaultBase=0x7ffc1daa0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc1dc60000; ImageSize=290,816; ProcessID=0; TimeDateStamp=-341,338,975; BuildTime=95/04/14 14:05:21.00...; OriginalFileName=ubpm.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=41; ImageBase=0x7ffc1dc60000; GuidSig=33bdebad-745b-87ce-4...; Age=1; PDBFileName=ubpm.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=156; ImageBase=0x7ffc1dc60000; ImageSize=290,816; ImageChecksum=316,418; TimeDateStamp=0; DefaultBase=0x7ffc1dc60000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc1dce0000; ImageSize=880,640; ProcessID=0; TimeDateStamp=2,109,053,104; BuildTime=36/10/31 08:05:04.00...; OriginalFileName=schedsvc.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc1dce0000; GuidSig=3a0b18ca-1303-ed99-c...; Age=1; PDBFileName=SchedSvc.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc1dce0000; ImageSize=880,640; ImageChecksum=888,885; TimeDateStamp=0; DefaultBase=0x7ffc1dce0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=54; ImageBase=0x7ffc1e970000; ImageSize=86,016; ProcessID=0; TimeDateStamp=525,713,861; BuildTime=86/08/29 15:37:41.00...; OriginalFileName=usermgrcli.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=47; ImageBase=0x7ffc1e970000; GuidSig=26f569a5-8783-27b0-0...; Age=1; PDBFileName=usermgrcli.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=168; ImageBase=0x7ffc1e970000; ImageSize=86,016; ImageChecksum=138,081; TimeDateStamp=0; DefaultBase=0x7ffc1e970000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc1f0f0000; ImageSize=978,944; ProcessID=0; TimeDateStamp=2,097,505,968; BuildTime=36/06/19 16:32:48.00...; OriginalFileName=propsys.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc1f0f0000; GuidSig=f17d0756-2273-c8ff-e...; Age=1; PDBFileName=propsys.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc1f0f0000; ImageSize=978,944; ImageChecksum=990,621; TimeDateStamp=0; DefaultBase=0x7ffc1f0f0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc1f210000; ImageSize=77,824; ProcessID=0; TimeDateStamp=1,097,789,430; BuildTime=04/10/14 21:30:30.00...; OriginalFileName=wtsapi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc1f210000; GuidSig=2da85aef-00d2-fb45-8...; Age=1; PDBFileName=wtsapi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc1f210000; ImageSize=77,824; ImageChecksum=127,847; TimeDateStamp=0; DefaultBase=0x7ffc1f210000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc1f980000; ImageSize=32,768; ProcessID=0; TimeDateStamp=-236,881,493; BuildTime=98/08/05 14:03:23.00...; OriginalFileName=dabapi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc1f980000; GuidSig=5020c7dc-a979-6518-5...; Age=1; PDBFileName=dabapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc1f980000; ImageSize=32,768; ImageChecksum=65,064; TimeDateStamp=0; DefaultBase=0x7ffc1f980000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc20960000; ImageSize=585,728; ProcessID=0; TimeDateStamp=-9,148,100; BuildTime=05/10/24 09:19:56.00...; OriginalFileName=Apphelp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc20960000; GuidSig=b37f976c-be76-5dae-9...; Age=1; PDBFileName=apphelp.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc20960000; ImageSize=585,728; ImageChecksum=594,685; TimeDateStamp=0; DefaultBase=0x7ffc20960000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc20f00000; ImageSize=167,936; ProcessID=0; TimeDateStamp=-189,693,732; BuildTime=00/02/02 17:46:04.00...; OriginalFileName=rmclient.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc20f00000; GuidSig=d9b2eec0-1750-fc20-8...; Age=1; PDBFileName=RmClient.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc20f00000; ImageSize=167,936; ImageChecksum=187,354; TimeDateStamp=0; DefaultBase=0x7ffc20f00000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc21280000; ImageSize=217,088; ProcessID=0; TimeDateStamp=1,079,200,003; BuildTime=04/03/13 17:46:43.00...; OriginalFileName=XmlLite.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc21280000; GuidSig=d5ddfeb7-8925-62e6-d...; Age=1; PDBFileName=XmlLite.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc21280000; ImageSize=217,088; ImageChecksum=214,275; TimeDateStamp=0; DefaultBase=0x7ffc21280000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc21f40000; ImageSize=180,224; ProcessID=0; TimeDateStamp=-909,532,674; BuildTime=77/04/12 06:30:22.00...; OriginalFileName=NETJOIN.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc21f40000; GuidSig=71b08a81-de07-43d2-1...; Age=1; PDBFileName=netjoin.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc21f40000; ImageSize=180,224; ImageChecksum=221,332; TimeDateStamp=0; DefaultBase=0x7ffc21f40000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc21f70000; ImageSize=376,832; ProcessID=0; TimeDateStamp=43,988,838; BuildTime=71/05/25 03:07:18.00...; OriginalFileName=winsta.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc21f70000; GuidSig=b854bf05-e0a2-5b01-7...; Age=1; PDBFileName=winsta.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc21f70000; ImageSize=376,832; ImageChecksum=387,708; TimeDateStamp=0; DefaultBase=0x7ffc21f70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc22000000; ImageSize=303,104; ProcessID=0; TimeDateStamp=-1,775,967,220; BuildTime=49/10/28 02:14:36.00...; OriginalFileName=authz.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc22000000; GuidSig=f7ab524f-49bc-eb09-0...; Age=1; PDBFileName=authz.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc22000000; ImageSize=303,104; ImageChecksum=299,134; TimeDateStamp=0; DefaultBase=0x7ffc22000000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc22530000; ImageSize=49,152; ProcessID=0; TimeDateStamp=2,074,299,887; BuildTime=35/09/25 02:24:47.00...; OriginalFileName=NETUTILS.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc22530000; GuidSig=5c5ce532-d78d-35ad-c...; Age=1; PDBFileName=netutils.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc22530000; ImageSize=49,152; ImageChecksum=85,437; TimeDateStamp=0; DefaultBase=0x7ffc22530000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc226c0000; ImageSize=421,888; ProcessID=0; TimeDateStamp=414,127,772; BuildTime=83/02/15 03:29:32.00...; OriginalFileName=mswsock.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc226c0000; GuidSig=96babb0d-8e64-884b-6...; Age=1; PDBFileName=mswsock.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc226c0000; ImageSize=421,888; ImageChecksum=420,926; TimeDateStamp=0; DefaultBase=0x7ffc226c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=52; ImageBase=0x7ffc22890000; ImageSize=49,152; ProcessID=0; TimeDateStamp=-17,821,274; BuildTime=05/07/16 00:07:02.00...; OriginalFileName=cryptbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc22890000; GuidSig=7588b6a3-bd73-2904-7...; Age=1; PDBFileName=cryptbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc22890000; ImageSize=49,152; ImageChecksum=64,645; TimeDateStamp=0; DefaultBase=0x7ffc22890000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc228d0000; ImageSize=172,032; ProcessID=0; TimeDateStamp=1,912,110,850; BuildTime=30/08/04 21:54:10.00...; OriginalFileName=JOINUTIL.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc228d0000; GuidSig=17b706f9-2002-cb30-2...; Age=1; PDBFileName=joinutil.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc228d0000; ImageSize=172,032; ImageChecksum=168,713; TimeDateStamp=0; DefaultBase=0x7ffc228d0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc22920000; ImageSize=94,208; ProcessID=0; TimeDateStamp=327,216,314; BuildTime=80/05/15 05:25:14.00...; OriginalFileName=WKSCLI.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc22920000; GuidSig=7ea191fe-cb13-d326-8...; Age=1; PDBFileName=wkscli.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc22920000; ImageSize=94,208; ImageChecksum=120,976; TimeDateStamp=0; DefaultBase=0x7ffc22920000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc22940000; ImageSize=167,936; ProcessID=0; TimeDateStamp=1,085,565,188; BuildTime=04/05/26 09:53:08.00...; OriginalFileName=wldp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=41; ImageBase=0x7ffc22940000; GuidSig=3d0180e1-0317-7a96-e...; Age=1; PDBFileName=WLDP.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=156; ImageBase=0x7ffc22940000; ImageSize=167,936; ImageChecksum=190,611; TimeDateStamp=0; DefaultBase=0x7ffc22940000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc22e10000; ImageSize=200,704; ProcessID=0; TimeDateStamp=-648,125,799; BuildTime=85/07/24 19:31:37.00...; OriginalFileName=ntmarta.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc22e10000; GuidSig=d28b6be6-17ca-2646-7...; Age=1; PDBFileName=ntmarta.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc22e10000; ImageSize=200,704; ImageChecksum=211,194; TimeDateStamp=0; DefaultBase=0x7ffc22e10000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=66; ImageBase=0x7ffc23300000; ImageSize=98,304; ProcessID=0; TimeDateStamp=-297,978,839; BuildTime=96/08/28 10:34:17.00...; OriginalFileName=EventAggregation.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=53; ImageBase=0x7ffc23300000; GuidSig=09f09e24-5676-0e17-9...; Age=1; PDBFileName=EventAggregation.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=180; ImageBase=0x7ffc23300000; ImageSize=98,304; ImageChecksum=114,278; TimeDateStamp=0; DefaultBase=0x7ffc23300000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc233c0000; ImageSize=192,512; ProcessID=0; TimeDateStamp=621,642,292; BuildTime=89/09/12 22:24:52.00...; OriginalFileName=sspicli.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc233c0000; GuidSig=823d5a41-e0d7-02a7-9...; Age=1; PDBFileName=sspicli.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc233c0000; ImageSize=192,512; ImageChecksum=235,306; TimeDateStamp=0; DefaultBase=0x7ffc233c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc234d0000; ImageSize=65,536; ProcessID=0; TimeDateStamp=-1,563,634,669; BuildTime=56/07/20 15:30:27.00...; OriginalFileName=umpdc.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc234d0000; GuidSig=1504cc55-3edb-4294-a...; Age=1; PDBFileName=UMPDC.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc234d0000; ImageSize=65,536; ImageChecksum=55,709; TimeDateStamp=0; DefaultBase=0x7ffc234d0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc234e0000; ImageSize=303,104; ProcessID=0; TimeDateStamp=-37,463,926; BuildTime=04/11/30 15:49:30.00...; OriginalFileName=POWRPROF.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc234e0000; GuidSig=bae22f43-6c95-a7d5-0...; Age=1; PDBFileName=powrprof.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc234e0000; ImageSize=303,104; ImageChecksum=321,827; TimeDateStamp=0; DefaultBase=0x7ffc234e0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=62; ImageBase=0x7ffc23530000; ImageSize=69,632; ProcessID=0; TimeDateStamp=96,400,242; BuildTime=73/01/20 17:50:42.00...; OriginalFileName=kernel.appcore.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=51; ImageBase=0x7ffc23530000; GuidSig=b44a2a63-8a5c-a8d8-1...; Age=1; PDBFileName=Kernel.Appcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=176; ImageBase=0x7ffc23530000; ImageSize=69,632; ImageChecksum=91,565; TimeDateStamp=0; DefaultBase=0x7ffc23530000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc23550000; ImageSize=126,976; ProcessID=0; TimeDateStamp=-87,365,952; BuildTime=03/05/03 02:09:04.00...; OriginalFileName=PROFAPI.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc23550000; GuidSig=d3e9e0b2-6dc3-e775-b...; Age=1; PDBFileName=profapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc23550000; ImageSize=126,976; ImageChecksum=153,678; TimeDateStamp=0; DefaultBase=0x7ffc23550000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23570000; ImageSize=73,728; ProcessID=0; TimeDateStamp=-457,022,433; BuildTime=91/08/14 15:47:43.00...; OriginalFileName=msasn1.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23570000; GuidSig=ff420efb-35b1-0aa7-6...; Age=1; PDBFileName=msasn1.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23570000; ImageSize=73,728; ImageChecksum=79,097; TimeDateStamp=0; DefaultBase=0x7ffc23570000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23590000; ImageSize=155,648; ProcessID=0; TimeDateStamp=-1,248,142,761; BuildTime=66/07/20 04:08:55.00...; OriginalFileName=bcrypt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23590000; GuidSig=1a472182-0367-8386-d...; Age=1; PDBFileName=bcrypt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23590000; ImageSize=155,648; ImageChecksum=157,312; TimeDateStamp=0; DefaultBase=0x7ffc23590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc235c0000; ImageSize=303,104; ProcessID=0; TimeDateStamp=-1,347,769,430; BuildTime=63/05/24 02:04:26.00...; OriginalFileName=CFGMGR32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc235c0000; GuidSig=c951ee8e-a9b3-8ebf-a...; Age=1; PDBFileName=cfgmgr32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc235c0000; ImageSize=303,104; ImageChecksum=322,106; TimeDateStamp=0; DefaultBase=0x7ffc235c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=64; ImageBase=0x7ffc23610000; ImageSize=7,843,840; ProcessID=0; TimeDateStamp=-1,549,850,267; BuildTime=56/12/27 04:30:29.00...; OriginalFileName=Windows.Storage.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=52; ImageBase=0x7ffc23610000; GuidSig=d9102742-5b8c-0068-1...; Age=1; PDBFileName=Windows.Storage.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=178; ImageBase=0x7ffc23610000; ImageSize=7,843,840; ImageChecksum=7,937,261; TimeDateStamp=0; DefaultBase=0x7ffc23610000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ProcessID=0; TimeDateStamp=1,555,946,369; BuildTime=19/04/22 15:19:29.00...; OriginalFileName=ucrtbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc23d90000; GuidSig=faceb612-020d-68fb-b...; Age=1; PDBFileName=ucrtbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ImageChecksum=1,052,117; TimeDateStamp=0; DefaultBase=0x7ffc23d90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc23e90000; ImageSize=94,208; ProcessID=0; TimeDateStamp=-1,525,668,879; BuildTime=57/10/03 01:33:37.00...; OriginalFileName=cryptsp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc23e90000; GuidSig=7618debe-ac0f-9998-7...; Age=1; PDBFileName=cryptsp.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc23e90000; ImageSize=94,208; ImageChecksum=133,544; TimeDateStamp=0; DefaultBase=0x7ffc23e90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ProcessID=0; TimeDateStamp=1,396,962,555; BuildTime=14/04/08 13:09:15.00...; OriginalFileName=Win32u.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23eb0000; GuidSig=bc2e49ab-e46d-2e93-b...; Age=1; PDBFileName=win32u.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ImageChecksum=177,968; TimeDateStamp=0; DefaultBase=0x7ffc23eb0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=54; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ProcessID=0; TimeDateStamp=439,410,971; BuildTime=83/12/04 18:36:11.00...; OriginalFileName=Kernelbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=47; ImageBase=0x7ffc23ee0000; GuidSig=44c8ec9a-a0ea-4f98-d...; Age=1; PDBFileName=kernelbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=168; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ImageChecksum=2,793,344; TimeDateStamp=0; DefaultBase=0x7ffc23ee0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ProcessID=0; TimeDateStamp=1,868,443,751; BuildTime=29/03/17 12:09:11.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc24190000; GuidSig=e5a785df-0333-6a66-6...; Age=1; PDBFileName=gdi32full.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ImageChecksum=1,696,264; TimeDateStamp=0; DefaultBase=0x7ffc24190000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24330000; ImageSize=376,832; ProcessID=0; TimeDateStamp=1,670,486,148; BuildTime=22/12/08 07:55:48.00...; OriginalFileName=WINTRUST.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24330000; GuidSig=ef819cd6-e971-2b01-0...; Age=1; PDBFileName=wintrust.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24330000; ImageSize=376,832; ImageChecksum=380,837; TimeDateStamp=0; DefaultBase=0x7ffc24330000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=66; ImageBase=0x7ffc24390000; ImageSize=528,384; ProcessID=0; TimeDateStamp=1,774,320,825; BuildTime=26/03/24 02:53:45.00...; OriginalFileName=bcryptprimitives.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=53; ImageBase=0x7ffc24390000; GuidSig=54a1b493-8222-f67e-4...; Age=1; PDBFileName=bcryptprimitives.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=180; ImageBase=0x7ffc24390000; ImageSize=528,384; ImageChecksum=562,796; TimeDateStamp=0; DefaultBase=0x7ffc24390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=52; ImageBase=0x7ffc24420000; ImageSize=647,168; ProcessID=0; TimeDateStamp=545,597,548; BuildTime=87/04/16 18:52:28.00...; OriginalFileName=msvcp_win.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc24420000; GuidSig=de65fef9-16bb-6b73-d...; Age=1; PDBFileName=msvcp_win.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc24420000; ImageSize=647,168; ImageChecksum=686,408; TimeDateStamp=0; DefaultBase=0x7ffc24420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ProcessID=0; TimeDateStamp=135,099,696; BuildTime=74/04/13 15:41:36.00...; OriginalFileName=CRYPT32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc244c0000; GuidSig=8c840cbc-1c63-bfb7-6...; Age=1; PDBFileName=crypt32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ImageChecksum=1,341,835; TimeDateStamp=0; DefaultBase=0x7ffc244c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ProcessID=0; TimeDateStamp=1,691,891,946; BuildTime=23/08/13 01:59:06.00...; OriginalFileName=COMBASE.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc246c0000; GuidSig=d15b0ee4-2a16-5244-2...; Age=1; PDBFileName=combase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ImageChecksum=3,387,881; TimeDateStamp=0; DefaultBase=0x7ffc246c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24b30000; ImageSize=667,648; ProcessID=0; TimeDateStamp=-1,762,261,787; BuildTime=50/04/04 17:18:29.00...; OriginalFileName=advapi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24b30000; GuidSig=549260e6-7474-8391-e...; Age=1; PDBFileName=advapi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24b30000; ImageSize=667,648; ImageChecksum=662,904; TimeDateStamp=0; DefaultBase=0x7ffc24b30000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24be0000; ImageSize=729,088; ProcessID=0; TimeDateStamp=775,814,378; BuildTime=94/08/02 07:59:38.00...; OriginalFileName=kernel32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24be0000; GuidSig=47a44f0c-c47f-b6a1-f...; Age=1; PDBFileName=kernel32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24be0000; ImageSize=729,088; ImageChecksum=723,980; TimeDateStamp=0; DefaultBase=0x7ffc24be0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc24d40000; ImageSize=335,872; ProcessID=0; TimeDateStamp=-125,797,471; BuildTime=02/02/12 06:43:45.00...; OriginalFileName=SHLWAPI.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24d40000; GuidSig=8b7db15a-0b89-93df-4...; Age=1; PDBFileName=shlwapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc24d40000; ImageSize=335,872; ImageChecksum=385,032; TimeDateStamp=0; DefaultBase=0x7ffc24d40000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24da0000; ImageSize=155,648; ProcessID=0; TimeDateStamp=-1,867,374,302; BuildTime=46/12/05 03:23:14.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc24da0000; GuidSig=209ad405-837d-061e-f...; Age=1; PDBFileName=gdi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc24da0000; ImageSize=155,648; ImageChecksum=194,403; TimeDateStamp=0; DefaultBase=0x7ffc24da0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc24eb0000; ImageSize=454,656; ProcessID=0; TimeDateStamp=252,347,079; BuildTime=77/12/30 16:24:39.00...; OriginalFileName=ws2_32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc24eb0000; GuidSig=94268932-d2c5-c3db-4...; Age=1; PDBFileName=ws2_32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc24eb0000; ImageSize=454,656; ImageChecksum=456,525; TimeDateStamp=0; DefaultBase=0x7ffc24eb0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc25390000; ImageSize=647,168; ProcessID=0; TimeDateStamp=-172,101,673; BuildTime=00/08/25 08:27:03.00...; OriginalFileName=msvcrt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc25390000; GuidSig=1fea8db6-b57f-5fbf-a...; Age=1; PDBFileName=msvcrt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc25390000; ImageSize=647,168; ImageChecksum=678,174; TimeDateStamp=0; DefaultBase=0x7ffc25390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc25590000; ImageSize=618,496; ProcessID=0; TimeDateStamp=-136,044,297; BuildTime=01/10/16 16:23:19.00...; OriginalFileName=sechost.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc25590000; GuidSig=0f733965-b12f-7923-b...; Age=1; PDBFileName=sechost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc25590000; ImageSize=618,496; ImageChecksum=662,974; TimeDateStamp=0; DefaultBase=0x7ffc25590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc25630000; ImageSize=663,552; ProcessID=0; TimeDateStamp=-1,794,760,561; BuildTime=49/03/24 13:52:15.00...; OriginalFileName=CLBCATQ.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc25630000; GuidSig=da759f99-b2bb-75c2-1...; Age=1; PDBFileName=CLBCatQ.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc25630000; ImageSize=663,552; ImageChecksum=684,075; TimeDateStamp=0; DefaultBase=0x7ffc25630000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc256e0000; ImageSize=692,224; ProcessID=0; TimeDateStamp=1,221,584,444; BuildTime=08/09/16 17:00:44.00...; OriginalFileName=SHCORE.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc256e0000; GuidSig=3921dcf6-eafa-cc85-7...; Age=1; PDBFileName=shcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc256e0000; ImageSize=692,224; ImageChecksum=745,271; TimeDateStamp=0; DefaultBase=0x7ffc256e0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc257a0000; ImageSize=7,208,960; ProcessID=0; TimeDateStamp=-326,300,782; BuildTime=95/10/05 15:21:54.00...; OriginalFileName=SHELL32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc257a0000; GuidSig=7c75889e-b849-1987-a...; Age=1; PDBFileName=shell32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc257a0000; ImageSize=7,208,960; ImageChecksum=7,292,558; TimeDateStamp=0; DefaultBase=0x7ffc257a0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc25ea0000; ImageSize=802,816; ProcessID=0; TimeDateStamp=-1,108,332,853; BuildTime=70/12/24 08:14:03.00...; OriginalFileName=OLEAUT32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc25ea0000; GuidSig=2dfa946d-f7be-e09f-3...; Age=1; PDBFileName=oleaut32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc25ea0000; ImageSize=802,816; ImageChecksum=845,595; TimeDateStamp=0; DefaultBase=0x7ffc25ea0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ProcessID=0; TimeDateStamp=87,082,528; BuildTime=72/10/04 21:35:28.00...; OriginalFileName=rpcrt4.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc25f70000; GuidSig=a3028d6b-45da-0062-4...; Age=1; PDBFileName=rpcrt4.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ImageChecksum=1,199,090; TimeDateStamp=0; DefaultBase=0x7ffc25f70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ProcessID=0; TimeDateStamp=-1,431,966,518; BuildTime=60/09/21 13:59:38.00...; OriginalFileName=user32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc26420000; GuidSig=bc4cc7cc-9a33-b8a6-6...; Age=1; PDBFileName=user32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ImageChecksum=1,700,392; TimeDateStamp=0; DefaultBase=0x7ffc26420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ProcessID=0; TimeDateStamp=-1,523,876,758; BuildTime=57/10/23 19:22:18.00...; OriginalFileName=ntdll.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc26600000; GuidSig=b54f3499-813e-bcf1-3...; Age=1; PDBFileName=ntdll.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1664; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ImageChecksum=2,058,600; TimeDateStamp=0; DefaultBase=0x7ffc26600000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: Windows Kernel/Process/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=242; ProcessID=1,728; ParentID=836; ImageFileName=svchost.exe; PageDirectoryBase=0x1b5ef3000; Flags=None; SessionID=0; ExitStatus=259; UniqueProcessKey=0xffffc50f690ec3c0; CommandLine=C:\Windows\System32\...; PackageFullName=; ApplicationID=; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ff6295b0000; ImageSize=65,536; ProcessID=0; TimeDateStamp=852,935,184; BuildTime=97/01/10 22:26:24.00...; OriginalFileName=svchost.exe; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ff6295b0000; GuidSig=ef7b3786-4e54-5d5e-c...; Age=1; PDBFileName=svchost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ff6295b0000; ImageSize=65,536; ImageChecksum=68,124; TimeDateStamp=0; DefaultBase=0x7ff6295b0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=78; ImageBase=0x7ffc04970000; ImageSize=495,616; ProcessID=0; TimeDateStamp=-1,815,447,834; BuildTime=48/07/28 03:24:22.00...; OriginalFileName=OneCoreCommonProxySt...; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=59; ImageBase=0x7ffc04970000; GuidSig=b02b2453-78f9-7203-5...; Age=1; PDBFileName=OneCoreCommonProxySt...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=192; ImageBase=0x7ffc04970000; ImageSize=495,616; ImageChecksum=520,411; TimeDateStamp=0; DefaultBase=0x7ffc04970000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=62; ImageBase=0x7ffc07230000; ImageSize=102,400; ProcessID=0; TimeDateStamp=637,029,004; BuildTime=90/03/10 00:30:04.00...; OriginalFileName=ExecModelProxy.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=51; ImageBase=0x7ffc07230000; GuidSig=00678d31-3115-de94-0...; Age=1; PDBFileName=ExecModelProxy.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=176; ImageBase=0x7ffc07230000; ImageSize=102,400; ImageChecksum=123,213; TimeDateStamp=0; DefaultBase=0x7ffc07230000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=66; ImageBase=0x7ffc12b40000; ImageSize=81,920; ProcessID=0; TimeDateStamp=1,354,870,190; BuildTime=12/12/07 08:49:50.00...; OriginalFileName=WlanRadioManager.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=53; ImageBase=0x7ffc12b40000; GuidSig=8e8d606f-0044-d57b-e...; Age=1; PDBFileName=WlanRadioManager.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=180; ImageBase=0x7ffc12b40000; ImageSize=81,920; ImageChecksum=105,154; TimeDateStamp=0; DefaultBase=0x7ffc12b40000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc16080000; ImageSize=65,536; ProcessID=0; TimeDateStamp=-1,950,322,743; BuildTime=44/04/19 02:09:13.00...; OriginalFileName=npfproxy.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc16080000; GuidSig=cafaab8a-51a0-538e-6...; Age=1; PDBFileName=npmproxy.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc16080000; ImageSize=65,536; ImageChecksum=60,620; TimeDateStamp=0; DefaultBase=0x7ffc16080000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc170d0000; ImageSize=430,080; ProcessID=0; TimeDateStamp=-46,343,289; BuildTime=04/08/19 21:20:07.00...; OriginalFileName=wlanapi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc170d0000; GuidSig=d006f6bd-7e00-c90e-b...; Age=1; PDBFileName=wlanapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc170d0000; ImageSize=430,080; ImageChecksum=458,645; TimeDateStamp=0; DefaultBase=0x7ffc170d0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=66; ImageBase=0x7ffc1ceb0000; ImageSize=57,344; ProcessID=0; TimeDateStamp=1,342,672,271; BuildTime=12/07/19 04:31:11.00...; OriginalFileName=TimeBrokerClient.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=53; ImageBase=0x7ffc1ceb0000; GuidSig=e9d3fa9c-ac35-4498-b...; Age=1; PDBFileName=TimeBrokerClient.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=180; ImageBase=0x7ffc1ceb0000; ImageSize=57,344; ImageChecksum=63,302; TimeDateStamp=0; DefaultBase=0x7ffc1ceb0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc1d090000; ImageSize=253,952; ProcessID=0; TimeDateStamp=-578,718,165; BuildTime=87/10/06 03:25:31.00...; OriginalFileName=netprofm.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc1d090000; GuidSig=038a2b9a-2880-0573-3...; Age=1; PDBFileName=netprofm.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc1d090000; ImageSize=253,952; ImageChecksum=247,073; TimeDateStamp=0; DefaultBase=0x7ffc1d090000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=38; ImageBase=0x7ffc1d0d0000; ImageSize=49,152; ProcessID=0; TimeDateStamp=271,701,914; BuildTime=78/08/11 16:45:14.00...; OriginalFileName=bi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=39; ImageBase=0x7ffc1d0d0000; GuidSig=750b35ae-26a8-fa1a-d...; Age=1; PDBFileName=bi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=152; ImageBase=0x7ffc1d0d0000; ImageSize=49,152; ImageChecksum=46,380; TimeDateStamp=0; DefaultBase=0x7ffc1d0d0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc1d140000; ImageSize=36,864; ProcessID=0; TimeDateStamp=-2,113,047,163; BuildTime=39/02/21 16:55:33.00...; OriginalFileName=httpprxc.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc1d140000; GuidSig=6559c72a-0f9e-0373-7...; Age=1; PDBFileName=httpprxc.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc1d140000; ImageSize=36,864; ImageChecksum=66,600; TimeDateStamp=0; DefaultBase=0x7ffc1d140000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=60; ImageBase=0x7ffc1d150000; ImageSize=126,976; ProcessID=0; TimeDateStamp=-859,297,804; BuildTime=78/11/14 16:38:12.00...; OriginalFileName=BTHRADIOMEDIA.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc1d150000; GuidSig=1f3f4858-6b9d-5d17-4...; Age=1; PDBFileName=BthRadioMedia.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=174; ImageBase=0x7ffc1d150000; ImageSize=126,976; ImageChecksum=162,279; TimeDateStamp=0; DefaultBase=0x7ffc1d150000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=78; ImageBase=0x7ffc1d2b0000; ImageSize=237,568; ProcessID=0; TimeDateStamp=-225,161,935; BuildTime=98/12/19 05:29:21.00...; OriginalFileName=Windows.Devices.Radi...; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=59; ImageBase=0x7ffc1d2b0000; GuidSig=6e58a5bf-b5de-8be0-2...; Age=1; PDBFileName=Windows.Devices.Radi...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=192; ImageBase=0x7ffc1d2b0000; ImageSize=237,568; ImageChecksum=280,483; TimeDateStamp=0; DefaultBase=0x7ffc1d2b0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=82; ImageBase=0x7ffc1d3f0000; ImageSize=53,248; ProcessID=0; TimeDateStamp=1,383,191,948; BuildTime=13/10/31 03:59:08.00...; OriginalFileName=SystemEventsBrokerCl...; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=61; ImageBase=0x7ffc1d3f0000; GuidSig=2b4bcd92-836a-1e1c-0...; Age=1; PDBFileName=SystemEventsBrokerCl...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=196; ImageBase=0x7ffc1d3f0000; ImageSize=53,248; ImageChecksum=54,008; TimeDateStamp=0; DefaultBase=0x7ffc1d3f0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=54; ImageBase=0x7ffc1d4b0000; ImageSize=393,216; ProcessID=0; TimeDateStamp=787,726,522; BuildTime=94/12/18 04:55:22.00...; OriginalFileName=ncbservice.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=47; ImageBase=0x7ffc1d4b0000; GuidSig=1132b93a-fbe3-b570-c...; Age=1; PDBFileName=ncbservice.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=168; ImageBase=0x7ffc1d4b0000; ImageSize=393,216; ImageChecksum=403,800; TimeDateStamp=0; DefaultBase=0x7ffc1d4b0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=54; ImageBase=0x7ffc1e970000; ImageSize=86,016; ProcessID=0; TimeDateStamp=525,713,861; BuildTime=86/08/29 15:37:41.00...; OriginalFileName=usermgrcli.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=47; ImageBase=0x7ffc1e970000; GuidSig=26f569a5-8783-27b0-0...; Age=1; PDBFileName=usermgrcli.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=168; ImageBase=0x7ffc1e970000; ImageSize=86,016; ImageChecksum=138,081; TimeDateStamp=0; DefaultBase=0x7ffc1e970000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=52; ImageBase=0x7ffc20910000; ImageSize=266,240; ProcessID=0; TimeDateStamp=972,189,211; BuildTime=00/10/22 04:33:31.00...; OriginalFileName=BrokerLib.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc20910000; GuidSig=f423664f-cf3d-9472-1...; Age=1; PDBFileName=BrokerLib.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc20910000; ImageSize=266,240; ImageChecksum=287,821; TimeDateStamp=0; DefaultBase=0x7ffc20910000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=64; ImageBase=0x7ffc20b80000; ImageSize=2,465,792; ProcessID=0; TimeDateStamp=1,123,054,026; BuildTime=05/08/03 07:27:06.00...; OriginalFileName=twinapi.appcore.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=52; ImageBase=0x7ffc20b80000; GuidSig=da642c52-541e-6baa-4...; Age=1; PDBFileName=twinapi.appcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=178; ImageBase=0x7ffc20b80000; ImageSize=2,465,792; ImageChecksum=2,536,066; TimeDateStamp=0; DefaultBase=0x7ffc20b80000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc20f00000; ImageSize=167,936; ProcessID=0; TimeDateStamp=-189,693,732; BuildTime=00/02/02 17:46:04.00...; OriginalFileName=rmclient.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc20f00000; GuidSig=d9b2eec0-1750-fc20-8...; Age=1; PDBFileName=RmClient.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc20f00000; ImageSize=167,936; ImageChecksum=187,354; TimeDateStamp=0; DefaultBase=0x7ffc20f00000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc22420000; ImageSize=237,568; ProcessID=0; TimeDateStamp=1,353,705,264; BuildTime=12/11/23 21:14:24.00...; OriginalFileName=iphlpapi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc22420000; GuidSig=a3177875-244a-46c8-b...; Age=1; PDBFileName=iphlpapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc22420000; ImageSize=237,568; ImageChecksum=252,735; TimeDateStamp=0; DefaultBase=0x7ffc22420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc226c0000; ImageSize=421,888; ProcessID=0; TimeDateStamp=414,127,772; BuildTime=83/02/15 03:29:32.00...; OriginalFileName=mswsock.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc226c0000; GuidSig=96babb0d-8e64-884b-6...; Age=1; PDBFileName=mswsock.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc226c0000; ImageSize=421,888; ImageChecksum=420,926; TimeDateStamp=0; DefaultBase=0x7ffc226c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc22940000; ImageSize=167,936; ProcessID=0; TimeDateStamp=1,085,565,188; BuildTime=04/05/26 09:53:08.00...; OriginalFileName=wldp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=41; ImageBase=0x7ffc22940000; GuidSig=3d0180e1-0317-7a96-e...; Age=1; PDBFileName=WLDP.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=156; ImageBase=0x7ffc22940000; ImageSize=167,936; ImageChecksum=190,611; TimeDateStamp=0; DefaultBase=0x7ffc22940000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=54; ImageBase=0x7ffc232d0000; ImageSize=172,032; ProcessID=0; TimeDateStamp=564,545,050; BuildTime=87/11/22 02:04:10.00...; OriginalFileName=devinfoset.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc232d0000; GuidSig=bf3fb10c-179d-a551-d...; Age=1; PDBFileName=devobj.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc232d0000; ImageSize=172,032; ImageChecksum=212,309; TimeDateStamp=0; DefaultBase=0x7ffc232d0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=66; ImageBase=0x7ffc23300000; ImageSize=98,304; ProcessID=0; TimeDateStamp=-297,978,839; BuildTime=96/08/28 10:34:17.00...; OriginalFileName=EventAggregation.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=53; ImageBase=0x7ffc23300000; GuidSig=09f09e24-5676-0e17-9...; Age=1; PDBFileName=EventAggregation.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=180; ImageBase=0x7ffc23300000; ImageSize=98,304; ImageChecksum=114,278; TimeDateStamp=0; DefaultBase=0x7ffc23300000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc233c0000; ImageSize=192,512; ProcessID=0; TimeDateStamp=621,642,292; BuildTime=89/09/12 22:24:52.00...; OriginalFileName=sspicli.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc233c0000; GuidSig=823d5a41-e0d7-02a7-9...; Age=1; PDBFileName=sspicli.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc233c0000; ImageSize=192,512; ImageChecksum=235,306; TimeDateStamp=0; DefaultBase=0x7ffc233c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc234d0000; ImageSize=65,536; ProcessID=0; TimeDateStamp=-1,563,634,669; BuildTime=56/07/20 15:30:27.00...; OriginalFileName=umpdc.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc234d0000; GuidSig=1504cc55-3edb-4294-a...; Age=1; PDBFileName=UMPDC.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc234d0000; ImageSize=65,536; ImageChecksum=55,709; TimeDateStamp=0; DefaultBase=0x7ffc234d0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc234e0000; ImageSize=303,104; ProcessID=0; TimeDateStamp=-37,463,926; BuildTime=04/11/30 15:49:30.00...; OriginalFileName=POWRPROF.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc234e0000; GuidSig=bae22f43-6c95-a7d5-0...; Age=1; PDBFileName=powrprof.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc234e0000; ImageSize=303,104; ImageChecksum=321,827; TimeDateStamp=0; DefaultBase=0x7ffc234e0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=62; ImageBase=0x7ffc23530000; ImageSize=69,632; ProcessID=0; TimeDateStamp=96,400,242; BuildTime=73/01/20 17:50:42.00...; OriginalFileName=kernel.appcore.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=51; ImageBase=0x7ffc23530000; GuidSig=b44a2a63-8a5c-a8d8-1...; Age=1; PDBFileName=Kernel.Appcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=176; ImageBase=0x7ffc23530000; ImageSize=69,632; ImageChecksum=91,565; TimeDateStamp=0; DefaultBase=0x7ffc23530000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc23550000; ImageSize=126,976; ProcessID=0; TimeDateStamp=-87,365,952; BuildTime=03/05/03 02:09:04.00...; OriginalFileName=PROFAPI.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc23550000; GuidSig=d3e9e0b2-6dc3-e775-b...; Age=1; PDBFileName=profapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc23550000; ImageSize=126,976; ImageChecksum=153,678; TimeDateStamp=0; DefaultBase=0x7ffc23550000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23570000; ImageSize=73,728; ProcessID=0; TimeDateStamp=-457,022,433; BuildTime=91/08/14 15:47:43.00...; OriginalFileName=msasn1.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23570000; GuidSig=ff420efb-35b1-0aa7-6...; Age=1; PDBFileName=msasn1.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23570000; ImageSize=73,728; ImageChecksum=79,097; TimeDateStamp=0; DefaultBase=0x7ffc23570000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23590000; ImageSize=155,648; ProcessID=0; TimeDateStamp=-1,248,142,761; BuildTime=66/07/20 04:08:55.00...; OriginalFileName=bcrypt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23590000; GuidSig=1a472182-0367-8386-d...; Age=1; PDBFileName=bcrypt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23590000; ImageSize=155,648; ImageChecksum=157,312; TimeDateStamp=0; DefaultBase=0x7ffc23590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc235c0000; ImageSize=303,104; ProcessID=0; TimeDateStamp=-1,347,769,430; BuildTime=63/05/24 02:04:26.00...; OriginalFileName=CFGMGR32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc235c0000; GuidSig=c951ee8e-a9b3-8ebf-a...; Age=1; PDBFileName=cfgmgr32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc235c0000; ImageSize=303,104; ImageChecksum=322,106; TimeDateStamp=0; DefaultBase=0x7ffc235c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ProcessID=0; TimeDateStamp=1,555,946,369; BuildTime=19/04/22 15:19:29.00...; OriginalFileName=ucrtbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc23d90000; GuidSig=faceb612-020d-68fb-b...; Age=1; PDBFileName=ucrtbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ImageChecksum=1,052,117; TimeDateStamp=0; DefaultBase=0x7ffc23d90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ProcessID=0; TimeDateStamp=1,396,962,555; BuildTime=14/04/08 13:09:15.00...; OriginalFileName=Win32u.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23eb0000; GuidSig=bc2e49ab-e46d-2e93-b...; Age=1; PDBFileName=win32u.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ImageChecksum=177,968; TimeDateStamp=0; DefaultBase=0x7ffc23eb0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=54; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ProcessID=0; TimeDateStamp=439,410,971; BuildTime=83/12/04 18:36:11.00...; OriginalFileName=Kernelbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=47; ImageBase=0x7ffc23ee0000; GuidSig=44c8ec9a-a0ea-4f98-d...; Age=1; PDBFileName=kernelbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=168; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ImageChecksum=2,793,344; TimeDateStamp=0; DefaultBase=0x7ffc23ee0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ProcessID=0; TimeDateStamp=1,868,443,751; BuildTime=29/03/17 12:09:11.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc24190000; GuidSig=e5a785df-0333-6a66-6...; Age=1; PDBFileName=gdi32full.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ImageChecksum=1,696,264; TimeDateStamp=0; DefaultBase=0x7ffc24190000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24330000; ImageSize=376,832; ProcessID=0; TimeDateStamp=1,670,486,148; BuildTime=22/12/08 07:55:48.00...; OriginalFileName=WINTRUST.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24330000; GuidSig=ef819cd6-e971-2b01-0...; Age=1; PDBFileName=wintrust.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24330000; ImageSize=376,832; ImageChecksum=380,837; TimeDateStamp=0; DefaultBase=0x7ffc24330000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=66; ImageBase=0x7ffc24390000; ImageSize=528,384; ProcessID=0; TimeDateStamp=1,774,320,825; BuildTime=26/03/24 02:53:45.00...; OriginalFileName=bcryptprimitives.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=53; ImageBase=0x7ffc24390000; GuidSig=54a1b493-8222-f67e-4...; Age=1; PDBFileName=bcryptprimitives.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=180; ImageBase=0x7ffc24390000; ImageSize=528,384; ImageChecksum=562,796; TimeDateStamp=0; DefaultBase=0x7ffc24390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=52; ImageBase=0x7ffc24420000; ImageSize=647,168; ProcessID=0; TimeDateStamp=545,597,548; BuildTime=87/04/16 18:52:28.00...; OriginalFileName=msvcp_win.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc24420000; GuidSig=de65fef9-16bb-6b73-d...; Age=1; PDBFileName=msvcp_win.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc24420000; ImageSize=647,168; ImageChecksum=686,408; TimeDateStamp=0; DefaultBase=0x7ffc24420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ProcessID=0; TimeDateStamp=135,099,696; BuildTime=74/04/13 15:41:36.00...; OriginalFileName=CRYPT32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc244c0000; GuidSig=8c840cbc-1c63-bfb7-6...; Age=1; PDBFileName=crypt32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ImageChecksum=1,341,835; TimeDateStamp=0; DefaultBase=0x7ffc244c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ProcessID=0; TimeDateStamp=1,691,891,946; BuildTime=23/08/13 01:59:06.00...; OriginalFileName=COMBASE.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc246c0000; GuidSig=d15b0ee4-2a16-5244-2...; Age=1; PDBFileName=combase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ImageChecksum=3,387,881; TimeDateStamp=0; DefaultBase=0x7ffc246c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24b30000; ImageSize=667,648; ProcessID=0; TimeDateStamp=-1,762,261,787; BuildTime=50/04/04 17:18:29.00...; OriginalFileName=advapi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24b30000; GuidSig=549260e6-7474-8391-e...; Age=1; PDBFileName=advapi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24b30000; ImageSize=667,648; ImageChecksum=662,904; TimeDateStamp=0; DefaultBase=0x7ffc24b30000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24be0000; ImageSize=729,088; ProcessID=0; TimeDateStamp=775,814,378; BuildTime=94/08/02 07:59:38.00...; OriginalFileName=kernel32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24be0000; GuidSig=47a44f0c-c47f-b6a1-f...; Age=1; PDBFileName=kernel32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24be0000; ImageSize=729,088; ImageChecksum=723,980; TimeDateStamp=0; DefaultBase=0x7ffc24be0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24da0000; ImageSize=155,648; ProcessID=0; TimeDateStamp=-1,867,374,302; BuildTime=46/12/05 03:23:14.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc24da0000; GuidSig=209ad405-837d-061e-f...; Age=1; PDBFileName=gdi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc24da0000; ImageSize=155,648; ImageChecksum=194,403; TimeDateStamp=0; DefaultBase=0x7ffc24da0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24dd0000; ImageSize=483,328; ProcessID=0; TimeDateStamp=2,094,009,598; BuildTime=36/05/10 05:19:58.00...; OriginalFileName=COML2.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc24dd0000; GuidSig=1b7a443a-a66f-075a-5...; Age=1; PDBFileName=coml2.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc24dd0000; ImageSize=483,328; ImageChecksum=521,990; TimeDateStamp=0; DefaultBase=0x7ffc24dd0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc24eb0000; ImageSize=454,656; ProcessID=0; TimeDateStamp=252,347,079; BuildTime=77/12/30 16:24:39.00...; OriginalFileName=ws2_32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc24eb0000; GuidSig=94268932-d2c5-c3db-4...; Age=1; PDBFileName=ws2_32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc24eb0000; ImageSize=454,656; ImageChecksum=456,525; TimeDateStamp=0; DefaultBase=0x7ffc24eb0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc25390000; ImageSize=647,168; ProcessID=0; TimeDateStamp=-172,101,673; BuildTime=00/08/25 08:27:03.00...; OriginalFileName=msvcrt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc25390000; GuidSig=1fea8db6-b57f-5fbf-a...; Age=1; PDBFileName=msvcrt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc25390000; ImageSize=647,168; ImageChecksum=678,174; TimeDateStamp=0; DefaultBase=0x7ffc25390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc25430000; ImageSize=1,400,832; ProcessID=0; TimeDateStamp=1,171,436,857; BuildTime=07/02/14 07:07:37.00...; OriginalFileName=OLE32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc25430000; GuidSig=ec385cee-495b-f162-5...; Age=1; PDBFileName=ole32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc25430000; ImageSize=1,400,832; ImageChecksum=1,434,873; TimeDateStamp=0; DefaultBase=0x7ffc25430000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc25590000; ImageSize=618,496; ProcessID=0; TimeDateStamp=-136,044,297; BuildTime=01/10/16 16:23:19.00...; OriginalFileName=sechost.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc25590000; GuidSig=0f733965-b12f-7923-b...; Age=1; PDBFileName=sechost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc25590000; ImageSize=618,496; ImageChecksum=662,974; TimeDateStamp=0; DefaultBase=0x7ffc25590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc25630000; ImageSize=663,552; ProcessID=0; TimeDateStamp=-1,794,760,561; BuildTime=49/03/24 13:52:15.00...; OriginalFileName=CLBCATQ.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc25630000; GuidSig=da759f99-b2bb-75c2-1...; Age=1; PDBFileName=CLBCatQ.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc25630000; ImageSize=663,552; ImageChecksum=684,075; TimeDateStamp=0; DefaultBase=0x7ffc25630000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc256e0000; ImageSize=692,224; ProcessID=0; TimeDateStamp=1,221,584,444; BuildTime=08/09/16 17:00:44.00...; OriginalFileName=SHCORE.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc256e0000; GuidSig=3921dcf6-eafa-cc85-7...; Age=1; PDBFileName=shcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc256e0000; ImageSize=692,224; ImageChecksum=745,271; TimeDateStamp=0; DefaultBase=0x7ffc256e0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc25ea0000; ImageSize=802,816; ProcessID=0; TimeDateStamp=-1,108,332,853; BuildTime=70/12/24 08:14:03.00...; OriginalFileName=OLEAUT32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc25ea0000; GuidSig=2dfa946d-f7be-e09f-3...; Age=1; PDBFileName=oleaut32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc25ea0000; ImageSize=802,816; ImageChecksum=845,595; TimeDateStamp=0; DefaultBase=0x7ffc25ea0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ProcessID=0; TimeDateStamp=87,082,528; BuildTime=72/10/04 21:35:28.00...; OriginalFileName=rpcrt4.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc25f70000; GuidSig=a3028d6b-45da-0062-4...; Age=1; PDBFileName=rpcrt4.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ImageChecksum=1,199,090; TimeDateStamp=0; DefaultBase=0x7ffc25f70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=40; ImageBase=0x7ffc26410000; ImageSize=32,768; ProcessID=0; TimeDateStamp=1,693,425,343; BuildTime=23/08/30 19:55:43.00...; OriginalFileName=nsi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=40; ImageBase=0x7ffc26410000; GuidSig=7c67fb7d-8805-fe58-4...; Age=1; PDBFileName=nsi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=154; ImageBase=0x7ffc26410000; ImageSize=32,768; ImageChecksum=32,664; TimeDateStamp=0; DefaultBase=0x7ffc26410000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ProcessID=0; TimeDateStamp=-1,431,966,518; BuildTime=60/09/21 13:59:38.00...; OriginalFileName=user32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc26420000; GuidSig=bc4cc7cc-9a33-b8a6-6...; Age=1; PDBFileName=user32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ImageChecksum=1,700,392; TimeDateStamp=0; DefaultBase=0x7ffc26420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ProcessID=0; TimeDateStamp=-1,523,876,758; BuildTime=57/10/23 19:22:18.00...; OriginalFileName=ntdll.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc26600000; GuidSig=b54f3499-813e-bcf1-3...; Age=1; PDBFileName=ntdll.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1728; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ImageChecksum=2,058,600; TimeDateStamp=0; DefaultBase=0x7ffc26600000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: Windows Kernel/Process/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=194; ProcessID=1,736; ParentID=836; ImageFileName=svchost.exe; PageDirectoryBase=0x102505d000; Flags=None; SessionID=0; ExitStatus=259; UniqueProcessKey=0xffffc50f690ef3c0; CommandLine=C:\Windows\system32\...; PackageFullName=; ApplicationID=; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ff6295b0000; ImageSize=65,536; ProcessID=0; TimeDateStamp=852,935,184; BuildTime=97/01/10 22:26:24.00...; OriginalFileName=svchost.exe; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ff6295b0000; GuidSig=ef7b3786-4e54-5d5e-c...; Age=1; PDBFileName=svchost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ff6295b0000; ImageSize=65,536; ImageChecksum=68,124; TimeDateStamp=0; DefaultBase=0x7ff6295b0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc0c4f0000; ImageSize=172,032; ProcessID=0; TimeDateStamp=1,473,711,439; BuildTime=16/09/12 20:17:19.00...; OriginalFileName=IdStore.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc0c4f0000; GuidSig=a85b0c1c-5e13-23ef-a...; Age=1; PDBFileName=IdStore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc0c4f0000; ImageSize=172,032; ImageChecksum=183,174; TimeDateStamp=0; DefaultBase=0x7ffc0c4f0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=56; ImageBase=0x7ffc11cf0000; ImageSize=483,328; ProcessID=0; TimeDateStamp=-1,764,305,694; BuildTime=50/03/12 01:33:22.00...; OriginalFileName=SettingSync.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc11cf0000; GuidSig=3be94fe3-c8a6-a072-5...; Age=1; PDBFileName=SettingSync.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=170; ImageBase=0x7ffc11cf0000; ImageSize=483,328; ImageChecksum=471,240; TimeDateStamp=0; DefaultBase=0x7ffc11cf0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=70; ImageBase=0x7ffc11d70000; ImageSize=2,207,744; ProcessID=0; TimeDateStamp=1,725,840,572; BuildTime=24/09/09 00:09:32.00...; OriginalFileName=Windows.CloudStore.d...; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=55; ImageBase=0x7ffc11d70000; GuidSig=9f2bb5d4-cbc4-54dc-2...; Age=1; PDBFileName=Windows.CloudStore.p...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=184; ImageBase=0x7ffc11d70000; ImageSize=2,207,744; ImageChecksum=2,137,896; TimeDateStamp=0; DefaultBase=0x7ffc11d70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc14830000; ImageSize=1,916,928; ProcessID=0; TimeDateStamp=-1,400,863,692; BuildTime=61/09/16 13:40:04.00...; OriginalFileName=UrlMon.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc14830000; GuidSig=ea55cfae-6229-51bf-f...; Age=1; PDBFileName=urlmon.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc14830000; ImageSize=1,916,928; ImageChecksum=1,864,520; TimeDateStamp=0; DefaultBase=0x7ffc14830000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc14be0000; ImageSize=2,777,088; ProcessID=0; TimeDateStamp=-247,417,097; BuildTime=98/04/05 15:29:59.00...; OriginalFileName=IeRtUtil.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc14be0000; GuidSig=529c3b2f-bc4b-e8e4-8...; Age=1; PDBFileName=iertutil.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc14be0000; ImageSize=2,777,088; ImageChecksum=2,821,706; TimeDateStamp=0; DefaultBase=0x7ffc14be0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=60; ImageBase=0x7ffc1a7e0000; ImageSize=94,208; ProcessID=0; TimeDateStamp=1,596,646,532; BuildTime=20/08/05 16:55:32.00...; OriginalFileName=shacctprofile.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc1a7e0000; GuidSig=679f7145-3709-d1ab-b...; Age=1; PDBFileName=shacctprofile.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=174; ImageBase=0x7ffc1a7e0000; ImageSize=94,208; ImageChecksum=97,786; TimeDateStamp=0; DefaultBase=0x7ffc1a7e0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc1b790000; ImageSize=389,120; ProcessID=0; TimeDateStamp=2,036,898,759; BuildTime=34/07/19 05:12:39.00...; OriginalFileName=wevtapi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc1b790000; GuidSig=fe24c9ce-9500-e622-0...; Age=1; PDBFileName=wevtapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc1b790000; ImageSize=389,120; ImageChecksum=404,506; TimeDateStamp=0; DefaultBase=0x7ffc1b790000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc1d260000; ImageSize=270,336; ProcessID=0; TimeDateStamp=-397,220,398; BuildTime=93/07/06 19:28:18.00...; OriginalFileName=LOGONCLI.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc1d260000; GuidSig=a44b87ca-253c-1d9b-f...; Age=1; PDBFileName=logoncli.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc1d260000; ImageSize=270,336; ImageChecksum=297,692; TimeDateStamp=0; DefaultBase=0x7ffc1d260000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=54; ImageBase=0x7ffc1d340000; ImageSize=180,224; ProcessID=0; TimeDateStamp=167,163,382; BuildTime=75/04/19 18:16:22.00...; OriginalFileName=ProfSvcExt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=47; ImageBase=0x7ffc1d340000; GuidSig=b6cc447f-f8b6-7e97-5...; Age=1; PDBFileName=profsvcext.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=168; ImageBase=0x7ffc1d340000; ImageSize=180,224; ImageChecksum=188,933; TimeDateStamp=0; DefaultBase=0x7ffc1d340000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc1d430000; ImageSize=507,904; ProcessID=0; TimeDateStamp=-1,097,245,541; BuildTime=71/05/01 16:02:35.00...; OriginalFileName=ProfSvc.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc1d430000; GuidSig=0bd869ed-73d8-0d6c-4...; Age=1; PDBFileName=profsvc.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc1d430000; ImageSize=507,904; ImageChecksum=518,405; TimeDateStamp=0; DefaultBase=0x7ffc1d430000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=66; ImageBase=0x7ffc1ddc0000; ImageSize=3,313,664; ProcessID=0; TimeDateStamp=-1,954,220,771; BuildTime=44/03/04 23:22:05.00...; OriginalFileName=CoreUIComponents.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=53; ImageBase=0x7ffc1ddc0000; GuidSig=3264578f-8a0c-52c8-8...; Age=1; PDBFileName=CoreUIComponents.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=180; ImageBase=0x7ffc1ddc0000; ImageSize=3,313,664; ImageChecksum=3,363,347; TimeDateStamp=0; DefaultBase=0x7ffc1ddc0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc1e450000; ImageSize=1,388,544; ProcessID=0; TimeDateStamp=-238,274,918; BuildTime=98/07/20 10:59:38.00...; OriginalFileName=WinTypes.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc1e450000; GuidSig=46ae6b82-4cf2-3a19-4...; Age=1; PDBFileName=WinTypes.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc1e450000; ImageSize=1,388,544; ImageChecksum=1,428,617; TimeDateStamp=0; DefaultBase=0x7ffc1e450000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc1f1e0000; ImageSize=143,360; ProcessID=0; TimeDateStamp=734,606,851; BuildTime=93/04/12 09:27:31.00...; OriginalFileName=SAMLib.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc1f1e0000; GuidSig=14a63def-d32d-737d-b...; Age=1; PDBFileName=samlib.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc1f1e0000; ImageSize=143,360; ImageChecksum=143,005; TimeDateStamp=0; DefaultBase=0x7ffc1f1e0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=60; ImageBase=0x7ffc205a0000; ImageSize=868,352; ProcessID=0; TimeDateStamp=270,157,240; BuildTime=78/07/24 19:40:40.00...; OriginalFileName=CoreMessaging.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc205a0000; GuidSig=f77a6f37-b916-eb3a-b...; Age=1; PDBFileName=CoreMessaging.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=174; ImageBase=0x7ffc205a0000; ImageSize=868,352; ImageChecksum=871,099; TimeDateStamp=0; DefaultBase=0x7ffc205a0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc20b70000; ImageSize=49,152; ProcessID=0; TimeDateStamp=1,713,249,400; BuildTime=24/04/16 06:36:40.00...; OriginalFileName=SysNtfy.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc20b70000; GuidSig=4a8e53c8-6df3-11e0-4...; Age=1; PDBFileName=sysntfy.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc20b70000; ImageSize=49,152; ImageChecksum=77,894; TimeDateStamp=0; DefaultBase=0x7ffc20b70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc21ad0000; ImageSize=139,264; ProcessID=0; TimeDateStamp=-1,174,313,774; BuildTime=68/11/20 16:12:02.00...; OriginalFileName=gpapi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc21ad0000; GuidSig=75a8e246-9e74-629f-3...; Age=1; PDBFileName=gpapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc21ad0000; ImageSize=139,264; ImageChecksum=174,936; TimeDateStamp=0; DefaultBase=0x7ffc21ad0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc21d90000; ImageSize=155,648; ProcessID=0; TimeDateStamp=1,815,732,627; BuildTime=27/07/16 10:10:27.00...; OriginalFileName=sppc.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=41; ImageBase=0x7ffc21d90000; GuidSig=03b44fc2-c1f9-f76c-5...; Age=1; PDBFileName=sppc.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=156; ImageBase=0x7ffc21d90000; ImageSize=155,648; ImageChecksum=197,421; TimeDateStamp=0; DefaultBase=0x7ffc21d90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=40; ImageBase=0x7ffc21dc0000; ImageSize=159,744; ProcessID=0; TimeDateStamp=-1,388,064,996; BuildTime=62/02/11 16:51:40.00...; OriginalFileName=slc.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=40; ImageBase=0x7ffc21dc0000; GuidSig=fc19fd5c-ba36-4b57-9...; Age=1; PDBFileName=SLC.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=154; ImageBase=0x7ffc21dc0000; ImageSize=159,744; ImageChecksum=164,577; TimeDateStamp=0; DefaultBase=0x7ffc21dc0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc22530000; ImageSize=49,152; ProcessID=0; TimeDateStamp=2,074,299,887; BuildTime=35/09/25 02:24:47.00...; OriginalFileName=NETUTILS.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc22530000; GuidSig=5c5ce532-d78d-35ad-c...; Age=1; PDBFileName=netutils.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc22530000; ImageSize=49,152; ImageChecksum=85,437; TimeDateStamp=0; DefaultBase=0x7ffc22530000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=52; ImageBase=0x7ffc22890000; ImageSize=49,152; ProcessID=0; TimeDateStamp=-17,821,274; BuildTime=05/07/16 00:07:02.00...; OriginalFileName=cryptbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc22890000; GuidSig=7588b6a3-bd73-2904-7...; Age=1; PDBFileName=cryptbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc22890000; ImageSize=49,152; ImageChecksum=64,645; TimeDateStamp=0; DefaultBase=0x7ffc22890000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc22920000; ImageSize=94,208; ProcessID=0; TimeDateStamp=327,216,314; BuildTime=80/05/15 05:25:14.00...; OriginalFileName=WKSCLI.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc22920000; GuidSig=7ea191fe-cb13-d326-8...; Age=1; PDBFileName=wkscli.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc22920000; ImageSize=94,208; ImageChecksum=120,976; TimeDateStamp=0; DefaultBase=0x7ffc22920000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc22940000; ImageSize=167,936; ProcessID=0; TimeDateStamp=1,085,565,188; BuildTime=04/05/26 09:53:08.00...; OriginalFileName=wldp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=41; ImageBase=0x7ffc22940000; GuidSig=3d0180e1-0317-7a96-e...; Age=1; PDBFileName=WLDP.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=156; ImageBase=0x7ffc22940000; ImageSize=167,936; ImageChecksum=190,611; TimeDateStamp=0; DefaultBase=0x7ffc22940000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc22e10000; ImageSize=200,704; ProcessID=0; TimeDateStamp=-648,125,799; BuildTime=85/07/24 19:31:37.00...; OriginalFileName=ntmarta.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc22e10000; GuidSig=d28b6be6-17ca-2646-7...; Age=1; PDBFileName=ntmarta.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc22e10000; ImageSize=200,704; ImageChecksum=211,194; TimeDateStamp=0; DefaultBase=0x7ffc22e10000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc233c0000; ImageSize=192,512; ProcessID=0; TimeDateStamp=621,642,292; BuildTime=89/09/12 22:24:52.00...; OriginalFileName=sspicli.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc233c0000; GuidSig=823d5a41-e0d7-02a7-9...; Age=1; PDBFileName=sspicli.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc233c0000; ImageSize=192,512; ImageChecksum=235,306; TimeDateStamp=0; DefaultBase=0x7ffc233c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc233f0000; ImageSize=151,552; ProcessID=0; TimeDateStamp=-157,143,252; BuildTime=01/02/14 11:34:04.00...; OriginalFileName=userenv.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc233f0000; GuidSig=1a734def-8e54-a706-f...; Age=1; PDBFileName=userenv.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc233f0000; ImageSize=151,552; ImageChecksum=176,304; TimeDateStamp=0; DefaultBase=0x7ffc233f0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc234d0000; ImageSize=65,536; ProcessID=0; TimeDateStamp=-1,563,634,669; BuildTime=56/07/20 15:30:27.00...; OriginalFileName=umpdc.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc234d0000; GuidSig=1504cc55-3edb-4294-a...; Age=1; PDBFileName=UMPDC.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc234d0000; ImageSize=65,536; ImageChecksum=55,709; TimeDateStamp=0; DefaultBase=0x7ffc234d0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc234e0000; ImageSize=303,104; ProcessID=0; TimeDateStamp=-37,463,926; BuildTime=04/11/30 15:49:30.00...; OriginalFileName=POWRPROF.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc234e0000; GuidSig=bae22f43-6c95-a7d5-0...; Age=1; PDBFileName=powrprof.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc234e0000; ImageSize=303,104; ImageChecksum=321,827; TimeDateStamp=0; DefaultBase=0x7ffc234e0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=62; ImageBase=0x7ffc23530000; ImageSize=69,632; ProcessID=0; TimeDateStamp=96,400,242; BuildTime=73/01/20 17:50:42.00...; OriginalFileName=kernel.appcore.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=51; ImageBase=0x7ffc23530000; GuidSig=b44a2a63-8a5c-a8d8-1...; Age=1; PDBFileName=Kernel.Appcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=176; ImageBase=0x7ffc23530000; ImageSize=69,632; ImageChecksum=91,565; TimeDateStamp=0; DefaultBase=0x7ffc23530000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc23550000; ImageSize=126,976; ProcessID=0; TimeDateStamp=-87,365,952; BuildTime=03/05/03 02:09:04.00...; OriginalFileName=PROFAPI.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc23550000; GuidSig=d3e9e0b2-6dc3-e775-b...; Age=1; PDBFileName=profapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc23550000; ImageSize=126,976; ImageChecksum=153,678; TimeDateStamp=0; DefaultBase=0x7ffc23550000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23570000; ImageSize=73,728; ProcessID=0; TimeDateStamp=-457,022,433; BuildTime=91/08/14 15:47:43.00...; OriginalFileName=msasn1.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23570000; GuidSig=ff420efb-35b1-0aa7-6...; Age=1; PDBFileName=msasn1.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23570000; ImageSize=73,728; ImageChecksum=79,097; TimeDateStamp=0; DefaultBase=0x7ffc23570000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23590000; ImageSize=155,648; ProcessID=0; TimeDateStamp=-1,248,142,761; BuildTime=66/07/20 04:08:55.00...; OriginalFileName=bcrypt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23590000; GuidSig=1a472182-0367-8386-d...; Age=1; PDBFileName=bcrypt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23590000; ImageSize=155,648; ImageChecksum=157,312; TimeDateStamp=0; DefaultBase=0x7ffc23590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: Windows Kernel/PerfInfo/Sample PID=-1; TID=9984; PName=; ProceNum=2; DataLen=16; InstructionPointer=0xfffff8027ca9b34f; ProcessorNumber=2; Priority=9; ExecutingDPC=False; ExecutingISR=False; Rank=0; Count=1; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc235c0000; ImageSize=303,104; ProcessID=0; TimeDateStamp=-1,347,769,430; BuildTime=63/05/24 02:04:26.00...; OriginalFileName=CFGMGR32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc235c0000; GuidSig=c951ee8e-a9b3-8ebf-a...; Age=1; PDBFileName=cfgmgr32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc235c0000; ImageSize=303,104; ImageChecksum=322,106; TimeDateStamp=0; DefaultBase=0x7ffc235c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=64; ImageBase=0x7ffc23610000; ImageSize=7,843,840; ProcessID=0; TimeDateStamp=-1,549,850,267; BuildTime=56/12/27 04:30:29.00...; OriginalFileName=Windows.Storage.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=52; ImageBase=0x7ffc23610000; GuidSig=d9102742-5b8c-0068-1...; Age=1; PDBFileName=Windows.Storage.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=178; ImageBase=0x7ffc23610000; ImageSize=7,843,840; ImageChecksum=7,937,261; TimeDateStamp=0; DefaultBase=0x7ffc23610000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ProcessID=0; TimeDateStamp=1,555,946,369; BuildTime=19/04/22 15:19:29.00...; OriginalFileName=ucrtbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc23d90000; GuidSig=faceb612-020d-68fb-b...; Age=1; PDBFileName=ucrtbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ImageChecksum=1,052,117; TimeDateStamp=0; DefaultBase=0x7ffc23d90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc23e90000; ImageSize=94,208; ProcessID=0; TimeDateStamp=-1,525,668,879; BuildTime=57/10/03 01:33:37.00...; OriginalFileName=cryptsp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc23e90000; GuidSig=7618debe-ac0f-9998-7...; Age=1; PDBFileName=cryptsp.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc23e90000; ImageSize=94,208; ImageChecksum=133,544; TimeDateStamp=0; DefaultBase=0x7ffc23e90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ProcessID=0; TimeDateStamp=1,396,962,555; BuildTime=14/04/08 13:09:15.00...; OriginalFileName=Win32u.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23eb0000; GuidSig=bc2e49ab-e46d-2e93-b...; Age=1; PDBFileName=win32u.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ImageChecksum=177,968; TimeDateStamp=0; DefaultBase=0x7ffc23eb0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=54; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ProcessID=0; TimeDateStamp=439,410,971; BuildTime=83/12/04 18:36:11.00...; OriginalFileName=Kernelbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=47; ImageBase=0x7ffc23ee0000; GuidSig=44c8ec9a-a0ea-4f98-d...; Age=1; PDBFileName=kernelbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=168; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ImageChecksum=2,793,344; TimeDateStamp=0; DefaultBase=0x7ffc23ee0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ProcessID=0; TimeDateStamp=1,868,443,751; BuildTime=29/03/17 12:09:11.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc24190000; GuidSig=e5a785df-0333-6a66-6...; Age=1; PDBFileName=gdi32full.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ImageChecksum=1,696,264; TimeDateStamp=0; DefaultBase=0x7ffc24190000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24330000; ImageSize=376,832; ProcessID=0; TimeDateStamp=1,670,486,148; BuildTime=22/12/08 07:55:48.00...; OriginalFileName=WINTRUST.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24330000; GuidSig=ef819cd6-e971-2b01-0...; Age=1; PDBFileName=wintrust.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24330000; ImageSize=376,832; ImageChecksum=380,837; TimeDateStamp=0; DefaultBase=0x7ffc24330000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=66; ImageBase=0x7ffc24390000; ImageSize=528,384; ProcessID=0; TimeDateStamp=1,774,320,825; BuildTime=26/03/24 02:53:45.00...; OriginalFileName=bcryptprimitives.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=53; ImageBase=0x7ffc24390000; GuidSig=54a1b493-8222-f67e-4...; Age=1; PDBFileName=bcryptprimitives.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=180; ImageBase=0x7ffc24390000; ImageSize=528,384; ImageChecksum=562,796; TimeDateStamp=0; DefaultBase=0x7ffc24390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=52; ImageBase=0x7ffc24420000; ImageSize=647,168; ProcessID=0; TimeDateStamp=545,597,548; BuildTime=87/04/16 18:52:28.00...; OriginalFileName=msvcp_win.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc24420000; GuidSig=de65fef9-16bb-6b73-d...; Age=1; PDBFileName=msvcp_win.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc24420000; ImageSize=647,168; ImageChecksum=686,408; TimeDateStamp=0; DefaultBase=0x7ffc24420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ProcessID=0; TimeDateStamp=135,099,696; BuildTime=74/04/13 15:41:36.00...; OriginalFileName=CRYPT32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc244c0000; GuidSig=8c840cbc-1c63-bfb7-6...; Age=1; PDBFileName=crypt32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ImageChecksum=1,341,835; TimeDateStamp=0; DefaultBase=0x7ffc244c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ProcessID=0; TimeDateStamp=1,691,891,946; BuildTime=23/08/13 01:59:06.00...; OriginalFileName=COMBASE.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc246c0000; GuidSig=d15b0ee4-2a16-5244-2...; Age=1; PDBFileName=combase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ImageChecksum=3,387,881; TimeDateStamp=0; DefaultBase=0x7ffc246c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24b30000; ImageSize=667,648; ProcessID=0; TimeDateStamp=-1,762,261,787; BuildTime=50/04/04 17:18:29.00...; OriginalFileName=advapi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24b30000; GuidSig=549260e6-7474-8391-e...; Age=1; PDBFileName=advapi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24b30000; ImageSize=667,648; ImageChecksum=662,904; TimeDateStamp=0; DefaultBase=0x7ffc24b30000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24be0000; ImageSize=729,088; ProcessID=0; TimeDateStamp=775,814,378; BuildTime=94/08/02 07:59:38.00...; OriginalFileName=kernel32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24be0000; GuidSig=47a44f0c-c47f-b6a1-f...; Age=1; PDBFileName=kernel32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24be0000; ImageSize=729,088; ImageChecksum=723,980; TimeDateStamp=0; DefaultBase=0x7ffc24be0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc24ca0000; ImageSize=425,984; ProcessID=0; TimeDateStamp=402,771,166; BuildTime=82/10/06 16:52:46.00...; OriginalFileName=WLDAP32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24ca0000; GuidSig=abfb3f82-2347-e7de-9...; Age=1; PDBFileName=wldap32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc24ca0000; ImageSize=425,984; ImageChecksum=436,918; TimeDateStamp=0; DefaultBase=0x7ffc24ca0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc24d40000; ImageSize=335,872; ProcessID=0; TimeDateStamp=-125,797,471; BuildTime=02/02/12 06:43:45.00...; OriginalFileName=SHLWAPI.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24d40000; GuidSig=8b7db15a-0b89-93df-4...; Age=1; PDBFileName=shlwapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc24d40000; ImageSize=335,872; ImageChecksum=385,032; TimeDateStamp=0; DefaultBase=0x7ffc24d40000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24da0000; ImageSize=155,648; ProcessID=0; TimeDateStamp=-1,867,374,302; BuildTime=46/12/05 03:23:14.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc24da0000; GuidSig=209ad405-837d-061e-f...; Age=1; PDBFileName=gdi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc24da0000; ImageSize=155,648; ImageChecksum=194,403; TimeDateStamp=0; DefaultBase=0x7ffc24da0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc25390000; ImageSize=647,168; ProcessID=0; TimeDateStamp=-172,101,673; BuildTime=00/08/25 08:27:03.00...; OriginalFileName=msvcrt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc25390000; GuidSig=1fea8db6-b57f-5fbf-a...; Age=1; PDBFileName=msvcrt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc25390000; ImageSize=647,168; ImageChecksum=678,174; TimeDateStamp=0; DefaultBase=0x7ffc25390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc25590000; ImageSize=618,496; ProcessID=0; TimeDateStamp=-136,044,297; BuildTime=01/10/16 16:23:19.00...; OriginalFileName=sechost.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc25590000; GuidSig=0f733965-b12f-7923-b...; Age=1; PDBFileName=sechost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc25590000; ImageSize=618,496; ImageChecksum=662,974; TimeDateStamp=0; DefaultBase=0x7ffc25590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc25630000; ImageSize=663,552; ProcessID=0; TimeDateStamp=-1,794,760,561; BuildTime=49/03/24 13:52:15.00...; OriginalFileName=CLBCATQ.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc25630000; GuidSig=da759f99-b2bb-75c2-1...; Age=1; PDBFileName=CLBCatQ.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc25630000; ImageSize=663,552; ImageChecksum=684,075; TimeDateStamp=0; DefaultBase=0x7ffc25630000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc256e0000; ImageSize=692,224; ProcessID=0; TimeDateStamp=1,221,584,444; BuildTime=08/09/16 17:00:44.00...; OriginalFileName=SHCORE.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc256e0000; GuidSig=3921dcf6-eafa-cc85-7...; Age=1; PDBFileName=shcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc256e0000; ImageSize=692,224; ImageChecksum=745,271; TimeDateStamp=0; DefaultBase=0x7ffc256e0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc257a0000; ImageSize=7,208,960; ProcessID=0; TimeDateStamp=-326,300,782; BuildTime=95/10/05 15:21:54.00...; OriginalFileName=SHELL32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc257a0000; GuidSig=7c75889e-b849-1987-a...; Age=1; PDBFileName=shell32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc257a0000; ImageSize=7,208,960; ImageChecksum=7,292,558; TimeDateStamp=0; DefaultBase=0x7ffc257a0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc25ea0000; ImageSize=802,816; ProcessID=0; TimeDateStamp=-1,108,332,853; BuildTime=70/12/24 08:14:03.00...; OriginalFileName=OLEAUT32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc25ea0000; GuidSig=2dfa946d-f7be-e09f-3...; Age=1; PDBFileName=oleaut32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc25ea0000; ImageSize=802,816; ImageChecksum=845,595; TimeDateStamp=0; DefaultBase=0x7ffc25ea0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ProcessID=0; TimeDateStamp=87,082,528; BuildTime=72/10/04 21:35:28.00...; OriginalFileName=rpcrt4.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc25f70000; GuidSig=a3028d6b-45da-0062-4...; Age=1; PDBFileName=rpcrt4.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ImageChecksum=1,199,090; TimeDateStamp=0; DefaultBase=0x7ffc25f70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ProcessID=0; TimeDateStamp=-1,431,966,518; BuildTime=60/09/21 13:59:38.00...; OriginalFileName=user32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc26420000; GuidSig=bc4cc7cc-9a33-b8a6-6...; Age=1; PDBFileName=user32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ImageChecksum=1,700,392; TimeDateStamp=0; DefaultBase=0x7ffc26420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ProcessID=0; TimeDateStamp=-1,523,876,758; BuildTime=57/10/23 19:22:18.00...; OriginalFileName=ntdll.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc26600000; GuidSig=b54f3499-813e-bcf1-3...; Age=1; PDBFileName=ntdll.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1736; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ImageChecksum=2,058,600; TimeDateStamp=0; DefaultBase=0x7ffc26600000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: Windows Kernel/Process/DCStart PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=250; ProcessID=1,744; ParentID=836; ImageFileName=svchost.exe; PageDirectoryBase=0xf0a25a000; Flags=None; SessionID=0; ExitStatus=259; UniqueProcessKey=0xffffc50f69115440; CommandLine=C:\Windows\system32\...; PackageFullName=; ApplicationID=; 
EVENT 0.000: KernelTraceControl/ImageID PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ff6295b0000; ImageSize=65,536; ProcessID=0; TimeDateStamp=852,935,184; BuildTime=97/01/10 22:26:24.00...; OriginalFileName=svchost.exe; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ff6295b0000; GuidSig=ef7b3786-4e54-5d5e-c...; Age=1; PDBFileName=svchost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ff6295b0000; ImageSize=65,536; ImageChecksum=68,124; TimeDateStamp=0; DefaultBase=0x7ff6295b0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=78; ImageBase=0x7ffc04970000; ImageSize=495,616; ProcessID=0; TimeDateStamp=-1,815,447,834; BuildTime=48/07/28 03:24:22.00...; OriginalFileName=OneCoreCommonProxySt...; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=59; ImageBase=0x7ffc04970000; GuidSig=b02b2453-78f9-7203-5...; Age=1; PDBFileName=OneCoreCommonProxySt...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=192; ImageBase=0x7ffc04970000; ImageSize=495,616; ImageChecksum=520,411; TimeDateStamp=0; DefaultBase=0x7ffc04970000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=62; ImageBase=0x7ffc07230000; ImageSize=102,400; ProcessID=0; TimeDateStamp=637,029,004; BuildTime=90/03/10 00:30:04.00...; OriginalFileName=ExecModelProxy.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=51; ImageBase=0x7ffc07230000; GuidSig=00678d31-3115-de94-0...; Age=1; PDBFileName=ExecModelProxy.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=176; ImageBase=0x7ffc07230000; ImageSize=102,400; ImageChecksum=123,213; TimeDateStamp=0; DefaultBase=0x7ffc07230000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=84; ImageBase=0x7ffc1c5c0000; ImageSize=7,770,112; ProcessID=0; TimeDateStamp=-1,131,996,070; BuildTime=70/03/25 11:07:06.00...; OriginalFileName=OneCoreUAPCommonProx...; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=62; ImageBase=0x7ffc1c5c0000; GuidSig=94e428c9-8918-e01d-f...; Age=1; PDBFileName=OneCoreUAPCommonProx...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=198; ImageBase=0x7ffc1c5c0000; ImageSize=7,770,112; ImageChecksum=7,847,302; TimeDateStamp=0; DefaultBase=0x7ffc1c5c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=38; ImageBase=0x7ffc1d0d0000; ImageSize=49,152; ProcessID=0; TimeDateStamp=271,701,914; BuildTime=78/08/11 16:45:14.00...; OriginalFileName=bi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=39; ImageBase=0x7ffc1d0d0000; GuidSig=750b35ae-26a8-fa1a-d...; Age=1; PDBFileName=bi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=152; ImageBase=0x7ffc1d0d0000; ImageSize=49,152; ImageChecksum=46,380; TimeDateStamp=0; DefaultBase=0x7ffc1d0d0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=66; ImageBase=0x7ffc1d400000; ImageSize=188,416; ProcessID=0; TimeDateStamp=-1,119,078,320; BuildTime=70/08/21 23:22:56.00...; OriginalFileName=TimeBrokerServer.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=53; ImageBase=0x7ffc1d400000; GuidSig=71a55708-8685-67f2-7...; Age=1; PDBFileName=TimeBrokerServer.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=180; ImageBase=0x7ffc1d400000; ImageSize=188,416; ImageChecksum=226,473; TimeDateStamp=0; DefaultBase=0x7ffc1d400000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=54; ImageBase=0x7ffc1e970000; ImageSize=86,016; ProcessID=0; TimeDateStamp=525,713,861; BuildTime=86/08/29 15:37:41.00...; OriginalFileName=usermgrcli.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=47; ImageBase=0x7ffc1e970000; GuidSig=26f569a5-8783-27b0-0...; Age=1; PDBFileName=usermgrcli.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=168; ImageBase=0x7ffc1e970000; ImageSize=86,016; ImageChecksum=138,081; TimeDateStamp=0; DefaultBase=0x7ffc1e970000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=52; ImageBase=0x7ffc20910000; ImageSize=266,240; ProcessID=0; TimeDateStamp=972,189,211; BuildTime=00/10/22 04:33:31.00...; OriginalFileName=BrokerLib.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc20910000; GuidSig=f423664f-cf3d-9472-1...; Age=1; PDBFileName=BrokerLib.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc20910000; ImageSize=266,240; ImageChecksum=287,821; TimeDateStamp=0; DefaultBase=0x7ffc20910000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=64; ImageBase=0x7ffc20b80000; ImageSize=2,465,792; ProcessID=0; TimeDateStamp=1,123,054,026; BuildTime=05/08/03 07:27:06.00...; OriginalFileName=twinapi.appcore.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=52; ImageBase=0x7ffc20b80000; GuidSig=da642c52-541e-6baa-4...; Age=1; PDBFileName=twinapi.appcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=178; ImageBase=0x7ffc20b80000; ImageSize=2,465,792; ImageChecksum=2,536,066; TimeDateStamp=0; DefaultBase=0x7ffc20b80000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc20f00000; ImageSize=167,936; ProcessID=0; TimeDateStamp=-189,693,732; BuildTime=00/02/02 17:46:04.00...; OriginalFileName=rmclient.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc20f00000; GuidSig=d9b2eec0-1750-fc20-8...; Age=1; PDBFileName=RmClient.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc20f00000; ImageSize=167,936; ImageChecksum=187,354; TimeDateStamp=0; DefaultBase=0x7ffc20f00000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc22940000; ImageSize=167,936; ProcessID=0; TimeDateStamp=1,085,565,188; BuildTime=04/05/26 09:53:08.00...; OriginalFileName=wldp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=41; ImageBase=0x7ffc22940000; GuidSig=3d0180e1-0317-7a96-e...; Age=1; PDBFileName=WLDP.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=156; ImageBase=0x7ffc22940000; ImageSize=167,936; ImageChecksum=190,611; TimeDateStamp=0; DefaultBase=0x7ffc22940000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc234d0000; ImageSize=65,536; ProcessID=0; TimeDateStamp=-1,563,634,669; BuildTime=56/07/20 15:30:27.00...; OriginalFileName=umpdc.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc234d0000; GuidSig=1504cc55-3edb-4294-a...; Age=1; PDBFileName=UMPDC.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc234d0000; ImageSize=65,536; ImageChecksum=55,709; TimeDateStamp=0; DefaultBase=0x7ffc234d0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc234e0000; ImageSize=303,104; ProcessID=0; TimeDateStamp=-37,463,926; BuildTime=04/11/30 15:49:30.00...; OriginalFileName=POWRPROF.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc234e0000; GuidSig=bae22f43-6c95-a7d5-0...; Age=1; PDBFileName=powrprof.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc234e0000; ImageSize=303,104; ImageChecksum=321,827; TimeDateStamp=0; DefaultBase=0x7ffc234e0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=62; ImageBase=0x7ffc23530000; ImageSize=69,632; ProcessID=0; TimeDateStamp=96,400,242; BuildTime=73/01/20 17:50:42.00...; OriginalFileName=kernel.appcore.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=51; ImageBase=0x7ffc23530000; GuidSig=b44a2a63-8a5c-a8d8-1...; Age=1; PDBFileName=Kernel.Appcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=176; ImageBase=0x7ffc23530000; ImageSize=69,632; ImageChecksum=91,565; TimeDateStamp=0; DefaultBase=0x7ffc23530000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23570000; ImageSize=73,728; ProcessID=0; TimeDateStamp=-457,022,433; BuildTime=91/08/14 15:47:43.00...; OriginalFileName=msasn1.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23570000; GuidSig=ff420efb-35b1-0aa7-6...; Age=1; PDBFileName=msasn1.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23570000; ImageSize=73,728; ImageChecksum=79,097; TimeDateStamp=0; DefaultBase=0x7ffc23570000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ProcessID=0; TimeDateStamp=1,555,946,369; BuildTime=19/04/22 15:19:29.00...; OriginalFileName=ucrtbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc23d90000; GuidSig=faceb612-020d-68fb-b...; Age=1; PDBFileName=ucrtbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ImageChecksum=1,052,117; TimeDateStamp=0; DefaultBase=0x7ffc23d90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ProcessID=0; TimeDateStamp=1,396,962,555; BuildTime=14/04/08 13:09:15.00...; OriginalFileName=Win32u.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23eb0000; GuidSig=bc2e49ab-e46d-2e93-b...; Age=1; PDBFileName=win32u.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ImageChecksum=177,968; TimeDateStamp=0; DefaultBase=0x7ffc23eb0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=54; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ProcessID=0; TimeDateStamp=439,410,971; BuildTime=83/12/04 18:36:11.00...; OriginalFileName=Kernelbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=47; ImageBase=0x7ffc23ee0000; GuidSig=44c8ec9a-a0ea-4f98-d...; Age=1; PDBFileName=kernelbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=168; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ImageChecksum=2,793,344; TimeDateStamp=0; DefaultBase=0x7ffc23ee0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ProcessID=0; TimeDateStamp=1,868,443,751; BuildTime=29/03/17 12:09:11.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc24190000; GuidSig=e5a785df-0333-6a66-6...; Age=1; PDBFileName=gdi32full.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ImageChecksum=1,696,264; TimeDateStamp=0; DefaultBase=0x7ffc24190000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24330000; ImageSize=376,832; ProcessID=0; TimeDateStamp=1,670,486,148; BuildTime=22/12/08 07:55:48.00...; OriginalFileName=WINTRUST.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24330000; GuidSig=ef819cd6-e971-2b01-0...; Age=1; PDBFileName=wintrust.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24330000; ImageSize=376,832; ImageChecksum=380,837; TimeDateStamp=0; DefaultBase=0x7ffc24330000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=66; ImageBase=0x7ffc24390000; ImageSize=528,384; ProcessID=0; TimeDateStamp=1,774,320,825; BuildTime=26/03/24 02:53:45.00...; OriginalFileName=bcryptprimitives.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=53; ImageBase=0x7ffc24390000; GuidSig=54a1b493-8222-f67e-4...; Age=1; PDBFileName=bcryptprimitives.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=180; ImageBase=0x7ffc24390000; ImageSize=528,384; ImageChecksum=562,796; TimeDateStamp=0; DefaultBase=0x7ffc24390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=52; ImageBase=0x7ffc24420000; ImageSize=647,168; ProcessID=0; TimeDateStamp=545,597,548; BuildTime=87/04/16 18:52:28.00...; OriginalFileName=msvcp_win.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc24420000; GuidSig=de65fef9-16bb-6b73-d...; Age=1; PDBFileName=msvcp_win.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc24420000; ImageSize=647,168; ImageChecksum=686,408; TimeDateStamp=0; DefaultBase=0x7ffc24420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ProcessID=0; TimeDateStamp=135,099,696; BuildTime=74/04/13 15:41:36.00...; OriginalFileName=CRYPT32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc244c0000; GuidSig=8c840cbc-1c63-bfb7-6...; Age=1; PDBFileName=crypt32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ImageChecksum=1,341,835; TimeDateStamp=0; DefaultBase=0x7ffc244c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ProcessID=0; TimeDateStamp=1,691,891,946; BuildTime=23/08/13 01:59:06.00...; OriginalFileName=COMBASE.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc246c0000; GuidSig=d15b0ee4-2a16-5244-2...; Age=1; PDBFileName=combase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ImageChecksum=3,387,881; TimeDateStamp=0; DefaultBase=0x7ffc246c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24b30000; ImageSize=667,648; ProcessID=0; TimeDateStamp=-1,762,261,787; BuildTime=50/04/04 17:18:29.00...; OriginalFileName=advapi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24b30000; GuidSig=549260e6-7474-8391-e...; Age=1; PDBFileName=advapi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24b30000; ImageSize=667,648; ImageChecksum=662,904; TimeDateStamp=0; DefaultBase=0x7ffc24b30000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24be0000; ImageSize=729,088; ProcessID=0; TimeDateStamp=775,814,378; BuildTime=94/08/02 07:59:38.00...; OriginalFileName=kernel32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24be0000; GuidSig=47a44f0c-c47f-b6a1-f...; Age=1; PDBFileName=kernel32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24be0000; ImageSize=729,088; ImageChecksum=723,980; TimeDateStamp=0; DefaultBase=0x7ffc24be0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24da0000; ImageSize=155,648; ProcessID=0; TimeDateStamp=-1,867,374,302; BuildTime=46/12/05 03:23:14.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc24da0000; GuidSig=209ad405-837d-061e-f...; Age=1; PDBFileName=gdi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc24da0000; ImageSize=155,648; ImageChecksum=194,403; TimeDateStamp=0; DefaultBase=0x7ffc24da0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24dd0000; ImageSize=483,328; ProcessID=0; TimeDateStamp=2,094,009,598; BuildTime=36/05/10 05:19:58.00...; OriginalFileName=COML2.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc24dd0000; GuidSig=1b7a443a-a66f-075a-5...; Age=1; PDBFileName=coml2.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc24dd0000; ImageSize=483,328; ImageChecksum=521,990; TimeDateStamp=0; DefaultBase=0x7ffc24dd0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc25390000; ImageSize=647,168; ProcessID=0; TimeDateStamp=-172,101,673; BuildTime=00/08/25 08:27:03.00...; OriginalFileName=msvcrt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc25390000; GuidSig=1fea8db6-b57f-5fbf-a...; Age=1; PDBFileName=msvcrt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc25390000; ImageSize=647,168; ImageChecksum=678,174; TimeDateStamp=0; DefaultBase=0x7ffc25390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc25430000; ImageSize=1,400,832; ProcessID=0; TimeDateStamp=1,171,436,857; BuildTime=07/02/14 07:07:37.00...; OriginalFileName=OLE32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc25430000; GuidSig=ec385cee-495b-f162-5...; Age=1; PDBFileName=ole32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc25430000; ImageSize=1,400,832; ImageChecksum=1,434,873; TimeDateStamp=0; DefaultBase=0x7ffc25430000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc25590000; ImageSize=618,496; ProcessID=0; TimeDateStamp=-136,044,297; BuildTime=01/10/16 16:23:19.00...; OriginalFileName=sechost.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc25590000; GuidSig=0f733965-b12f-7923-b...; Age=1; PDBFileName=sechost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc25590000; ImageSize=618,496; ImageChecksum=662,974; TimeDateStamp=0; DefaultBase=0x7ffc25590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc25630000; ImageSize=663,552; ProcessID=0; TimeDateStamp=-1,794,760,561; BuildTime=49/03/24 13:52:15.00...; OriginalFileName=CLBCATQ.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc25630000; GuidSig=da759f99-b2bb-75c2-1...; Age=1; PDBFileName=CLBCatQ.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc25630000; ImageSize=663,552; ImageChecksum=684,075; TimeDateStamp=0; DefaultBase=0x7ffc25630000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc256e0000; ImageSize=692,224; ProcessID=0; TimeDateStamp=1,221,584,444; BuildTime=08/09/16 17:00:44.00...; OriginalFileName=SHCORE.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc256e0000; GuidSig=3921dcf6-eafa-cc85-7...; Age=1; PDBFileName=shcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc256e0000; ImageSize=692,224; ImageChecksum=745,271; TimeDateStamp=0; DefaultBase=0x7ffc256e0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ProcessID=0; TimeDateStamp=87,082,528; BuildTime=72/10/04 21:35:28.00...; OriginalFileName=rpcrt4.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc25f70000; GuidSig=a3028d6b-45da-0062-4...; Age=1; PDBFileName=rpcrt4.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ImageChecksum=1,199,090; TimeDateStamp=0; DefaultBase=0x7ffc25f70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ProcessID=0; TimeDateStamp=-1,431,966,518; BuildTime=60/09/21 13:59:38.00...; OriginalFileName=user32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc26420000; GuidSig=bc4cc7cc-9a33-b8a6-6...; Age=1; PDBFileName=user32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ImageChecksum=1,700,392; TimeDateStamp=0; DefaultBase=0x7ffc26420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ProcessID=0; TimeDateStamp=-1,523,876,758; BuildTime=57/10/23 19:22:18.00...; OriginalFileName=ntdll.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc26600000; GuidSig=b54f3499-813e-bcf1-3...; Age=1; PDBFileName=ntdll.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1744; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ImageChecksum=2,058,600; TimeDateStamp=0; DefaultBase=0x7ffc26600000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: Windows Kernel/Process/DCStart PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=236; ProcessID=1,856; ParentID=836; ImageFileName=svchost.exe; PageDirectoryBase=0x10260cb000; Flags=None; SessionID=0; ExitStatus=259; UniqueProcessKey=0xffffc50f6914c3c0; CommandLine=C:\Windows\system32\...; PackageFullName=; ApplicationID=; 
EVENT 0.000: KernelTraceControl/ImageID PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=48; ImageBase=0x7ff6295b0000; ImageSize=65,536; ProcessID=0; TimeDateStamp=852,935,184; BuildTime=97/01/10 22:26:24.00...; OriginalFileName=svchost.exe; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=44; ImageBase=0x7ff6295b0000; GuidSig=ef7b3786-4e54-5d5e-c...; Age=1; PDBFileName=svchost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=162; ImageBase=0x7ff6295b0000; ImageSize=65,536; ImageChecksum=68,124; TimeDateStamp=0; DefaultBase=0x7ff6295b0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=48; ImageBase=0x7ffc1cea0000; ImageSize=57,344; ProcessID=0; TimeDateStamp=-1,674,517,373; BuildTime=53/01/14 06:45:23.00...; OriginalFileName=HIDSERV.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=44; ImageBase=0x7ffc1cea0000; GuidSig=02b8493b-74e2-61e6-1...; Age=1; PDBFileName=hidserv.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=162; ImageBase=0x7ffc1cea0000; ImageSize=57,344; ImageChecksum=36,140; TimeDateStamp=0; DefaultBase=0x7ffc1cea0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=40; ImageBase=0x7ffc21450000; ImageSize=57,344; ProcessID=0; TimeDateStamp=1,341,062,757; BuildTime=12/06/30 13:25:57.00...; OriginalFileName=hid.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=40; ImageBase=0x7ffc21450000; GuidSig=c56adcae-0493-03c4-1...; Age=1; PDBFileName=hid.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=154; ImageBase=0x7ffc21450000; ImageSize=57,344; ImageChecksum=74,973; TimeDateStamp=0; DefaultBase=0x7ffc21450000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=46; ImageBase=0x7ffc21f70000; ImageSize=376,832; ProcessID=0; TimeDateStamp=43,988,838; BuildTime=71/05/25 03:07:18.00...; OriginalFileName=winsta.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=43; ImageBase=0x7ffc21f70000; GuidSig=b854bf05-e0a2-5b01-7...; Age=1; PDBFileName=winsta.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=160; ImageBase=0x7ffc21f70000; ImageSize=376,832; ImageChecksum=387,708; TimeDateStamp=0; DefaultBase=0x7ffc21f70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=42; ImageBase=0x7ffc22940000; ImageSize=167,936; ProcessID=0; TimeDateStamp=1,085,565,188; BuildTime=04/05/26 09:53:08.00...; OriginalFileName=wldp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=41; ImageBase=0x7ffc22940000; GuidSig=3d0180e1-0317-7a96-e...; Age=1; PDBFileName=WLDP.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=156; ImageBase=0x7ffc22940000; ImageSize=167,936; ImageChecksum=190,611; TimeDateStamp=0; DefaultBase=0x7ffc22940000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=54; ImageBase=0x7ffc232d0000; ImageSize=172,032; ProcessID=0; TimeDateStamp=564,545,050; BuildTime=87/11/22 02:04:10.00...; OriginalFileName=devinfoset.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=43; ImageBase=0x7ffc232d0000; GuidSig=bf3fb10c-179d-a551-d...; Age=1; PDBFileName=devobj.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=160; ImageBase=0x7ffc232d0000; ImageSize=172,032; ImageChecksum=212,309; TimeDateStamp=0; DefaultBase=0x7ffc232d0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=62; ImageBase=0x7ffc23530000; ImageSize=69,632; ProcessID=0; TimeDateStamp=96,400,242; BuildTime=73/01/20 17:50:42.00...; OriginalFileName=kernel.appcore.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=51; ImageBase=0x7ffc23530000; GuidSig=b44a2a63-8a5c-a8d8-1...; Age=1; PDBFileName=Kernel.Appcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=176; ImageBase=0x7ffc23530000; ImageSize=69,632; ImageChecksum=91,565; TimeDateStamp=0; DefaultBase=0x7ffc23530000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=46; ImageBase=0x7ffc23570000; ImageSize=73,728; ProcessID=0; TimeDateStamp=-457,022,433; BuildTime=91/08/14 15:47:43.00...; OriginalFileName=msasn1.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=43; ImageBase=0x7ffc23570000; GuidSig=ff420efb-35b1-0aa7-6...; Age=1; PDBFileName=msasn1.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=160; ImageBase=0x7ffc23570000; ImageSize=73,728; ImageChecksum=79,097; TimeDateStamp=0; DefaultBase=0x7ffc23570000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=46; ImageBase=0x7ffc23590000; ImageSize=155,648; ProcessID=0; TimeDateStamp=-1,248,142,761; BuildTime=66/07/20 04:08:55.00...; OriginalFileName=bcrypt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=43; ImageBase=0x7ffc23590000; GuidSig=1a472182-0367-8386-d...; Age=1; PDBFileName=bcrypt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=160; ImageBase=0x7ffc23590000; ImageSize=155,648; ImageChecksum=157,312; TimeDateStamp=0; DefaultBase=0x7ffc23590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=50; ImageBase=0x7ffc235c0000; ImageSize=303,104; ProcessID=0; TimeDateStamp=-1,347,769,430; BuildTime=63/05/24 02:04:26.00...; OriginalFileName=CFGMGR32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=45; ImageBase=0x7ffc235c0000; GuidSig=c951ee8e-a9b3-8ebf-a...; Age=1; PDBFileName=cfgmgr32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=164; ImageBase=0x7ffc235c0000; ImageSize=303,104; ImageChecksum=322,106; TimeDateStamp=0; DefaultBase=0x7ffc235c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=50; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ProcessID=0; TimeDateStamp=1,555,946,369; BuildTime=19/04/22 15:19:29.00...; OriginalFileName=ucrtbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=45; ImageBase=0x7ffc23d90000; GuidSig=faceb612-020d-68fb-b...; Age=1; PDBFileName=ucrtbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=164; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ImageChecksum=1,052,117; TimeDateStamp=0; DefaultBase=0x7ffc23d90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=46; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ProcessID=0; TimeDateStamp=1,396,962,555; BuildTime=14/04/08 13:09:15.00...; OriginalFileName=Win32u.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=43; ImageBase=0x7ffc23eb0000; GuidSig=bc2e49ab-e46d-2e93-b...; Age=1; PDBFileName=win32u.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=160; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ImageChecksum=177,968; TimeDateStamp=0; DefaultBase=0x7ffc23eb0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=54; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ProcessID=0; TimeDateStamp=439,410,971; BuildTime=83/12/04 18:36:11.00...; OriginalFileName=Kernelbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=47; ImageBase=0x7ffc23ee0000; GuidSig=44c8ec9a-a0ea-4f98-d...; Age=1; PDBFileName=kernelbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=168; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ImageChecksum=2,793,344; TimeDateStamp=0; DefaultBase=0x7ffc23ee0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=44; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ProcessID=0; TimeDateStamp=1,868,443,751; BuildTime=29/03/17 12:09:11.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=46; ImageBase=0x7ffc24190000; GuidSig=e5a785df-0333-6a66-6...; Age=1; PDBFileName=gdi32full.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=166; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ImageChecksum=1,696,264; TimeDateStamp=0; DefaultBase=0x7ffc24190000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=50; ImageBase=0x7ffc24330000; ImageSize=376,832; ProcessID=0; TimeDateStamp=1,670,486,148; BuildTime=22/12/08 07:55:48.00...; OriginalFileName=WINTRUST.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=45; ImageBase=0x7ffc24330000; GuidSig=ef819cd6-e971-2b01-0...; Age=1; PDBFileName=wintrust.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=164; ImageBase=0x7ffc24330000; ImageSize=376,832; ImageChecksum=380,837; TimeDateStamp=0; DefaultBase=0x7ffc24330000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=66; ImageBase=0x7ffc24390000; ImageSize=528,384; ProcessID=0; TimeDateStamp=1,774,320,825; BuildTime=26/03/24 02:53:45.00...; OriginalFileName=bcryptprimitives.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=53; ImageBase=0x7ffc24390000; GuidSig=54a1b493-8222-f67e-4...; Age=1; PDBFileName=bcryptprimitives.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=180; ImageBase=0x7ffc24390000; ImageSize=528,384; ImageChecksum=562,796; TimeDateStamp=0; DefaultBase=0x7ffc24390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=52; ImageBase=0x7ffc24420000; ImageSize=647,168; ProcessID=0; TimeDateStamp=545,597,548; BuildTime=87/04/16 18:52:28.00...; OriginalFileName=msvcp_win.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=46; ImageBase=0x7ffc24420000; GuidSig=de65fef9-16bb-6b73-d...; Age=1; PDBFileName=msvcp_win.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=166; ImageBase=0x7ffc24420000; ImageSize=647,168; ImageChecksum=686,408; TimeDateStamp=0; DefaultBase=0x7ffc24420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=48; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ProcessID=0; TimeDateStamp=135,099,696; BuildTime=74/04/13 15:41:36.00...; OriginalFileName=CRYPT32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=44; ImageBase=0x7ffc244c0000; GuidSig=8c840cbc-1c63-bfb7-6...; Age=1; PDBFileName=crypt32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=162; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ImageChecksum=1,341,835; TimeDateStamp=0; DefaultBase=0x7ffc244c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=48; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ProcessID=0; TimeDateStamp=1,691,891,946; BuildTime=23/08/13 01:59:06.00...; OriginalFileName=COMBASE.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=44; ImageBase=0x7ffc246c0000; GuidSig=d15b0ee4-2a16-5244-2...; Age=1; PDBFileName=combase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=162; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ImageChecksum=3,387,881; TimeDateStamp=0; DefaultBase=0x7ffc246c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=50; ImageBase=0x7ffc24be0000; ImageSize=729,088; ProcessID=0; TimeDateStamp=775,814,378; BuildTime=94/08/02 07:59:38.00...; OriginalFileName=kernel32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=45; ImageBase=0x7ffc24be0000; GuidSig=47a44f0c-c47f-b6a1-f...; Age=1; PDBFileName=kernel32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=164; ImageBase=0x7ffc24be0000; ImageSize=729,088; ImageChecksum=723,980; TimeDateStamp=0; DefaultBase=0x7ffc24be0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=44; ImageBase=0x7ffc24da0000; ImageSize=155,648; ProcessID=0; TimeDateStamp=-1,867,374,302; BuildTime=46/12/05 03:23:14.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=42; ImageBase=0x7ffc24da0000; GuidSig=209ad405-837d-061e-f...; Age=1; PDBFileName=gdi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=158; ImageBase=0x7ffc24da0000; ImageSize=155,648; ImageChecksum=194,403; TimeDateStamp=0; DefaultBase=0x7ffc24da0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=50; ImageBase=0x7ffc24f20000; ImageSize=4,653,056; ProcessID=0; TimeDateStamp=-1,478,931,446; BuildTime=59/03/28 00:10:50.00...; OriginalFileName=SETUPAPI.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=45; ImageBase=0x7ffc24f20000; GuidSig=2afde28c-a886-98c2-7...; Age=1; PDBFileName=setupapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=164; ImageBase=0x7ffc24f20000; ImageSize=4,653,056; ImageChecksum=4,692,368; TimeDateStamp=0; DefaultBase=0x7ffc24f20000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=46; ImageBase=0x7ffc25390000; ImageSize=647,168; ProcessID=0; TimeDateStamp=-172,101,673; BuildTime=00/08/25 08:27:03.00...; OriginalFileName=msvcrt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=43; ImageBase=0x7ffc25390000; GuidSig=1fea8db6-b57f-5fbf-a...; Age=1; PDBFileName=msvcrt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=160; ImageBase=0x7ffc25390000; ImageSize=647,168; ImageChecksum=678,174; TimeDateStamp=0; DefaultBase=0x7ffc25390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=48; ImageBase=0x7ffc25590000; ImageSize=618,496; ProcessID=0; TimeDateStamp=-136,044,297; BuildTime=01/10/16 16:23:19.00...; OriginalFileName=sechost.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=44; ImageBase=0x7ffc25590000; GuidSig=0f733965-b12f-7923-b...; Age=1; PDBFileName=sechost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=162; ImageBase=0x7ffc25590000; ImageSize=618,496; ImageChecksum=662,974; TimeDateStamp=0; DefaultBase=0x7ffc25590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=46; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ProcessID=0; TimeDateStamp=87,082,528; BuildTime=72/10/04 21:35:28.00...; OriginalFileName=rpcrt4.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=43; ImageBase=0x7ffc25f70000; GuidSig=a3028d6b-45da-0062-4...; Age=1; PDBFileName=rpcrt4.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=160; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ImageChecksum=1,199,090; TimeDateStamp=0; DefaultBase=0x7ffc25f70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=46; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ProcessID=0; TimeDateStamp=-1,431,966,518; BuildTime=60/09/21 13:59:38.00...; OriginalFileName=user32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=43; ImageBase=0x7ffc26420000; GuidSig=bc4cc7cc-9a33-b8a6-6...; Age=1; PDBFileName=user32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=160; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ImageChecksum=1,700,392; TimeDateStamp=0; DefaultBase=0x7ffc26420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=44; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ProcessID=0; TimeDateStamp=-1,523,876,758; BuildTime=57/10/23 19:22:18.00...; OriginalFileName=ntdll.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=42; ImageBase=0x7ffc26600000; GuidSig=b54f3499-813e-bcf1-3...; Age=1; PDBFileName=ntdll.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1856; TID=-1; PName=svchost; ProceNum=4; DataLen=158; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ImageChecksum=2,058,600; TimeDateStamp=0; DefaultBase=0x7ffc26600000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: Windows Kernel/Process/DCStart PID=1944; TID=-1; PName=svchost; ProceNum=4; DataLen=202; ProcessID=1,944; ParentID=836; ImageFileName=svchost.exe; PageDirectoryBase=0x1024494000; Flags=None; SessionID=0; ExitStatus=259; UniqueProcessKey=0xffffc50f691b63c0; CommandLine=C:\Windows\system32\...; PackageFullName=; ApplicationID=; 
EVENT 0.000: Windows Kernel/PerfInfo/Sample PID=2684; TID=2728; PName=MemCompression; ProceNum=10; DataLen=16; InstructionPointer=0xfffff8027cb599d0; ProcessorNumber=10; Priority=12; ExecutingDPC=False; ExecutingISR=False; Rank=0; Count=1; 
EVENT 0.000: KernelTraceControl/ImageID PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ff6295b0000; ImageSize=65,536; ProcessID=0; TimeDateStamp=852,935,184; BuildTime=97/01/10 22:26:24.00...; OriginalFileName=svchost.exe; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ff6295b0000; GuidSig=ef7b3786-4e54-5d5e-c...; Age=1; PDBFileName=svchost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ff6295b0000; ImageSize=65,536; ImageChecksum=68,124; TimeDateStamp=0; DefaultBase=0x7ff6295b0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=58; ImageBase=0x7ffc1b7f0000; ImageSize=319,488; ProcessID=0; TimeDateStamp=-360,106,301; BuildTime=94/09/09 08:56:35.00...; OriginalFileName=usermgrproxy.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=49; ImageBase=0x7ffc1b7f0000; GuidSig=a2cd2089-b706-90fc-4...; Age=1; PDBFileName=UserMgrProxy.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=172; ImageBase=0x7ffc1b7f0000; ImageSize=319,488; ImageChecksum=348,328; TimeDateStamp=0; DefaultBase=0x7ffc1b7f0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=74; ImageBase=0x7ffc1b8e0000; ImageSize=716,800; ProcessID=0; TimeDateStamp=650,958,935; BuildTime=90/08/18 05:55:35.00...; OriginalFileName=StateRepository.Core...; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=57; ImageBase=0x7ffc1b8e0000; GuidSig=62f6c847-10ac-67e1-e...; Age=1; PDBFileName=staterepository.core...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=188; ImageBase=0x7ffc1b8e0000; ImageSize=716,800; ImageChecksum=767,375; TimeDateStamp=0; DefaultBase=0x7ffc1b8e0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=74; ImageBase=0x7ffc1b9b0000; ImageSize=913,408; ProcessID=0; TimeDateStamp=-1,341,668,806; BuildTime=63/08/02 16:41:30.00...; OriginalFileName=AppXDeploymentClient...; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=57; ImageBase=0x7ffc1b9b0000; GuidSig=6d73f5ef-f6c1-955c-f...; Age=1; PDBFileName=AppXDeploymentClient...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=188; ImageBase=0x7ffc1b9b0000; ImageSize=913,408; ImageChecksum=936,248; TimeDateStamp=0; DefaultBase=0x7ffc1b9b0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc1bdd0000; ImageSize=98,304; ProcessID=0; TimeDateStamp=1,680,099,600; BuildTime=23/03/29 14:20:00.00...; OriginalFileName=SAMCLI.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc1bdd0000; GuidSig=e1f6ec3d-d01d-5faa-0...; Age=1; PDBFileName=samcli.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc1bdd0000; ImageSize=98,304; ImageChecksum=108,383; TimeDateStamp=0; DefaultBase=0x7ffc1bdd0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc1c3f0000; ImageSize=1,306,624; ProcessID=0; TimeDateStamp=197,987,431; BuildTime=76/04/10 12:30:31.00...; OriginalFileName=usermgr.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc1c3f0000; GuidSig=45e87ee1-8854-e56d-4...; Age=1; PDBFileName=usermgr.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc1c3f0000; ImageSize=1,306,624; ImageChecksum=1,344,094; TimeDateStamp=0; DefaultBase=0x7ffc1c3f0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc1d260000; ImageSize=270,336; ProcessID=0; TimeDateStamp=-397,220,398; BuildTime=93/07/06 19:28:18.00...; OriginalFileName=LOGONCLI.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc1d260000; GuidSig=a44b87ca-253c-1d9b-f...; Age=1; PDBFileName=logoncli.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc1d260000; ImageSize=270,336; ImageChecksum=297,692; TimeDateStamp=0; DefaultBase=0x7ffc1d260000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc1e450000; ImageSize=1,388,544; ProcessID=0; TimeDateStamp=-238,274,918; BuildTime=98/07/20 10:59:38.00...; OriginalFileName=WinTypes.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc1e450000; GuidSig=46ae6b82-4cf2-3a19-4...; Age=1; PDBFileName=WinTypes.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc1e450000; ImageSize=1,388,544; ImageChecksum=1,428,617; TimeDateStamp=0; DefaultBase=0x7ffc1e450000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc1f1e0000; ImageSize=143,360; ProcessID=0; TimeDateStamp=734,606,851; BuildTime=93/04/12 09:27:31.00...; OriginalFileName=SAMLib.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc1f1e0000; GuidSig=14a63def-d32d-737d-b...; Age=1; PDBFileName=samlib.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc1f1e0000; ImageSize=143,360; ImageChecksum=143,005; TimeDateStamp=0; DefaultBase=0x7ffc1f1e0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc1f210000; ImageSize=77,824; ProcessID=0; TimeDateStamp=1,097,789,430; BuildTime=04/10/14 21:30:30.00...; OriginalFileName=wtsapi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc1f210000; GuidSig=2da85aef-00d2-fb45-8...; Age=1; PDBFileName=wtsapi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc1f210000; ImageSize=77,824; ImageChecksum=127,847; TimeDateStamp=0; DefaultBase=0x7ffc1f210000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc21f70000; ImageSize=376,832; ProcessID=0; TimeDateStamp=43,988,838; BuildTime=71/05/25 03:07:18.00...; OriginalFileName=winsta.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc21f70000; GuidSig=b854bf05-e0a2-5b01-7...; Age=1; PDBFileName=winsta.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc21f70000; ImageSize=376,832; ImageChecksum=387,708; TimeDateStamp=0; DefaultBase=0x7ffc21f70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc22940000; ImageSize=167,936; ProcessID=0; TimeDateStamp=1,085,565,188; BuildTime=04/05/26 09:53:08.00...; OriginalFileName=wldp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=41; ImageBase=0x7ffc22940000; GuidSig=3d0180e1-0317-7a96-e...; Age=1; PDBFileName=WLDP.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=156; ImageBase=0x7ffc22940000; ImageSize=167,936; ImageChecksum=190,611; TimeDateStamp=0; DefaultBase=0x7ffc22940000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc22e10000; ImageSize=200,704; ProcessID=0; TimeDateStamp=-648,125,799; BuildTime=85/07/24 19:31:37.00...; OriginalFileName=ntmarta.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc22e10000; GuidSig=d28b6be6-17ca-2646-7...; Age=1; PDBFileName=ntmarta.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc22e10000; ImageSize=200,704; ImageChecksum=211,194; TimeDateStamp=0; DefaultBase=0x7ffc22e10000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc233c0000; ImageSize=192,512; ProcessID=0; TimeDateStamp=621,642,292; BuildTime=89/09/12 22:24:52.00...; OriginalFileName=sspicli.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc233c0000; GuidSig=823d5a41-e0d7-02a7-9...; Age=1; PDBFileName=sspicli.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc233c0000; ImageSize=192,512; ImageChecksum=235,306; TimeDateStamp=0; DefaultBase=0x7ffc233c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc233f0000; ImageSize=151,552; ProcessID=0; TimeDateStamp=-157,143,252; BuildTime=01/02/14 11:34:04.00...; OriginalFileName=userenv.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc233f0000; GuidSig=1a734def-8e54-a706-f...; Age=1; PDBFileName=userenv.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc233f0000; ImageSize=151,552; ImageChecksum=176,304; TimeDateStamp=0; DefaultBase=0x7ffc233f0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=62; ImageBase=0x7ffc23530000; ImageSize=69,632; ProcessID=0; TimeDateStamp=96,400,242; BuildTime=73/01/20 17:50:42.00...; OriginalFileName=kernel.appcore.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=51; ImageBase=0x7ffc23530000; GuidSig=b44a2a63-8a5c-a8d8-1...; Age=1; PDBFileName=Kernel.Appcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=176; ImageBase=0x7ffc23530000; ImageSize=69,632; ImageChecksum=91,565; TimeDateStamp=0; DefaultBase=0x7ffc23530000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc23550000; ImageSize=126,976; ProcessID=0; TimeDateStamp=-87,365,952; BuildTime=03/05/03 02:09:04.00...; OriginalFileName=PROFAPI.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc23550000; GuidSig=d3e9e0b2-6dc3-e775-b...; Age=1; PDBFileName=profapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc23550000; ImageSize=126,976; ImageChecksum=153,678; TimeDateStamp=0; DefaultBase=0x7ffc23550000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23570000; ImageSize=73,728; ProcessID=0; TimeDateStamp=-457,022,433; BuildTime=91/08/14 15:47:43.00...; OriginalFileName=msasn1.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23570000; GuidSig=ff420efb-35b1-0aa7-6...; Age=1; PDBFileName=msasn1.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23570000; ImageSize=73,728; ImageChecksum=79,097; TimeDateStamp=0; DefaultBase=0x7ffc23570000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23590000; ImageSize=155,648; ProcessID=0; TimeDateStamp=-1,248,142,761; BuildTime=66/07/20 04:08:55.00...; OriginalFileName=bcrypt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23590000; GuidSig=1a472182-0367-8386-d...; Age=1; PDBFileName=bcrypt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23590000; ImageSize=155,648; ImageChecksum=157,312; TimeDateStamp=0; DefaultBase=0x7ffc23590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ProcessID=0; TimeDateStamp=1,555,946,369; BuildTime=19/04/22 15:19:29.00...; OriginalFileName=ucrtbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc23d90000; GuidSig=faceb612-020d-68fb-b...; Age=1; PDBFileName=ucrtbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ImageChecksum=1,052,117; TimeDateStamp=0; DefaultBase=0x7ffc23d90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ProcessID=0; TimeDateStamp=1,396,962,555; BuildTime=14/04/08 13:09:15.00...; OriginalFileName=Win32u.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23eb0000; GuidSig=bc2e49ab-e46d-2e93-b...; Age=1; PDBFileName=win32u.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ImageChecksum=177,968; TimeDateStamp=0; DefaultBase=0x7ffc23eb0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=54; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ProcessID=0; TimeDateStamp=439,410,971; BuildTime=83/12/04 18:36:11.00...; OriginalFileName=Kernelbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=47; ImageBase=0x7ffc23ee0000; GuidSig=44c8ec9a-a0ea-4f98-d...; Age=1; PDBFileName=kernelbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=168; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ImageChecksum=2,793,344; TimeDateStamp=0; DefaultBase=0x7ffc23ee0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ProcessID=0; TimeDateStamp=1,868,443,751; BuildTime=29/03/17 12:09:11.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc24190000; GuidSig=e5a785df-0333-6a66-6...; Age=1; PDBFileName=gdi32full.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ImageChecksum=1,696,264; TimeDateStamp=0; DefaultBase=0x7ffc24190000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24330000; ImageSize=376,832; ProcessID=0; TimeDateStamp=1,670,486,148; BuildTime=22/12/08 07:55:48.00...; OriginalFileName=WINTRUST.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24330000; GuidSig=ef819cd6-e971-2b01-0...; Age=1; PDBFileName=wintrust.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24330000; ImageSize=376,832; ImageChecksum=380,837; TimeDateStamp=0; DefaultBase=0x7ffc24330000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=66; ImageBase=0x7ffc24390000; ImageSize=528,384; ProcessID=0; TimeDateStamp=1,774,320,825; BuildTime=26/03/24 02:53:45.00...; OriginalFileName=bcryptprimitives.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=53; ImageBase=0x7ffc24390000; GuidSig=54a1b493-8222-f67e-4...; Age=1; PDBFileName=bcryptprimitives.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=180; ImageBase=0x7ffc24390000; ImageSize=528,384; ImageChecksum=562,796; TimeDateStamp=0; DefaultBase=0x7ffc24390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=52; ImageBase=0x7ffc24420000; ImageSize=647,168; ProcessID=0; TimeDateStamp=545,597,548; BuildTime=87/04/16 18:52:28.00...; OriginalFileName=msvcp_win.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc24420000; GuidSig=de65fef9-16bb-6b73-d...; Age=1; PDBFileName=msvcp_win.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc24420000; ImageSize=647,168; ImageChecksum=686,408; TimeDateStamp=0; DefaultBase=0x7ffc24420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ProcessID=0; TimeDateStamp=135,099,696; BuildTime=74/04/13 15:41:36.00...; OriginalFileName=CRYPT32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc244c0000; GuidSig=8c840cbc-1c63-bfb7-6...; Age=1; PDBFileName=crypt32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ImageChecksum=1,341,835; TimeDateStamp=0; DefaultBase=0x7ffc244c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ProcessID=0; TimeDateStamp=1,691,891,946; BuildTime=23/08/13 01:59:06.00...; OriginalFileName=COMBASE.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc246c0000; GuidSig=d15b0ee4-2a16-5244-2...; Age=1; PDBFileName=combase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ImageChecksum=3,387,881; TimeDateStamp=0; DefaultBase=0x7ffc246c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24b30000; ImageSize=667,648; ProcessID=0; TimeDateStamp=-1,762,261,787; BuildTime=50/04/04 17:18:29.00...; OriginalFileName=advapi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24b30000; GuidSig=549260e6-7474-8391-e...; Age=1; PDBFileName=advapi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24b30000; ImageSize=667,648; ImageChecksum=662,904; TimeDateStamp=0; DefaultBase=0x7ffc24b30000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24be0000; ImageSize=729,088; ProcessID=0; TimeDateStamp=775,814,378; BuildTime=94/08/02 07:59:38.00...; OriginalFileName=kernel32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24be0000; GuidSig=47a44f0c-c47f-b6a1-f...; Age=1; PDBFileName=kernel32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24be0000; ImageSize=729,088; ImageChecksum=723,980; TimeDateStamp=0; DefaultBase=0x7ffc24be0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc24ca0000; ImageSize=425,984; ProcessID=0; TimeDateStamp=402,771,166; BuildTime=82/10/06 16:52:46.00...; OriginalFileName=WLDAP32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24ca0000; GuidSig=abfb3f82-2347-e7de-9...; Age=1; PDBFileName=wldap32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc24ca0000; ImageSize=425,984; ImageChecksum=436,918; TimeDateStamp=0; DefaultBase=0x7ffc24ca0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24da0000; ImageSize=155,648; ProcessID=0; TimeDateStamp=-1,867,374,302; BuildTime=46/12/05 03:23:14.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc24da0000; GuidSig=209ad405-837d-061e-f...; Age=1; PDBFileName=gdi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc24da0000; ImageSize=155,648; ImageChecksum=194,403; TimeDateStamp=0; DefaultBase=0x7ffc24da0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc25390000; ImageSize=647,168; ProcessID=0; TimeDateStamp=-172,101,673; BuildTime=00/08/25 08:27:03.00...; OriginalFileName=msvcrt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc25390000; GuidSig=1fea8db6-b57f-5fbf-a...; Age=1; PDBFileName=msvcrt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc25390000; ImageSize=647,168; ImageChecksum=678,174; TimeDateStamp=0; DefaultBase=0x7ffc25390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc25590000; ImageSize=618,496; ProcessID=0; TimeDateStamp=-136,044,297; BuildTime=01/10/16 16:23:19.00...; OriginalFileName=sechost.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc25590000; GuidSig=0f733965-b12f-7923-b...; Age=1; PDBFileName=sechost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc25590000; ImageSize=618,496; ImageChecksum=662,974; TimeDateStamp=0; DefaultBase=0x7ffc25590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc25630000; ImageSize=663,552; ProcessID=0; TimeDateStamp=-1,794,760,561; BuildTime=49/03/24 13:52:15.00...; OriginalFileName=CLBCATQ.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc25630000; GuidSig=da759f99-b2bb-75c2-1...; Age=1; PDBFileName=CLBCatQ.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc25630000; ImageSize=663,552; ImageChecksum=684,075; TimeDateStamp=0; DefaultBase=0x7ffc25630000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc256e0000; ImageSize=692,224; ProcessID=0; TimeDateStamp=1,221,584,444; BuildTime=08/09/16 17:00:44.00...; OriginalFileName=SHCORE.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc256e0000; GuidSig=3921dcf6-eafa-cc85-7...; Age=1; PDBFileName=shcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc256e0000; ImageSize=692,224; ImageChecksum=745,271; TimeDateStamp=0; DefaultBase=0x7ffc256e0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc25ea0000; ImageSize=802,816; ProcessID=0; TimeDateStamp=-1,108,332,853; BuildTime=70/12/24 08:14:03.00...; OriginalFileName=OLEAUT32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc25ea0000; GuidSig=2dfa946d-f7be-e09f-3...; Age=1; PDBFileName=oleaut32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc25ea0000; ImageSize=802,816; ImageChecksum=845,595; TimeDateStamp=0; DefaultBase=0x7ffc25ea0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ProcessID=0; TimeDateStamp=87,082,528; BuildTime=72/10/04 21:35:28.00...; OriginalFileName=rpcrt4.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc25f70000; GuidSig=a3028d6b-45da-0062-4...; Age=1; PDBFileName=rpcrt4.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ImageChecksum=1,199,090; TimeDateStamp=0; DefaultBase=0x7ffc25f70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ProcessID=0; TimeDateStamp=-1,431,966,518; BuildTime=60/09/21 13:59:38.00...; OriginalFileName=user32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc26420000; GuidSig=bc4cc7cc-9a33-b8a6-6...; Age=1; PDBFileName=user32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ImageChecksum=1,700,392; TimeDateStamp=0; DefaultBase=0x7ffc26420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ProcessID=0; TimeDateStamp=-1,523,876,758; BuildTime=57/10/23 19:22:18.00...; OriginalFileName=ntdll.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc26600000; GuidSig=b54f3499-813e-bcf1-3...; Age=1; PDBFileName=ntdll.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=1944; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ImageChecksum=2,058,600; TimeDateStamp=0; DefaultBase=0x7ffc26600000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: Windows Kernel/Process/DCStart PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=240; ProcessID=2,016; ParentID=836; ImageFileName=svchost.exe; PageDirectoryBase=0x1026bd9000; Flags=None; SessionID=0; ExitStatus=259; UniqueProcessKey=0xffffc50f691e1440; CommandLine=C:\Windows\System32\...; PackageFullName=; ApplicationID=; 
EVENT 0.000: KernelTraceControl/ImageID PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ff6295b0000; ImageSize=65,536; ProcessID=0; TimeDateStamp=852,935,184; BuildTime=97/01/10 22:26:24.00...; OriginalFileName=svchost.exe; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ff6295b0000; GuidSig=ef7b3786-4e54-5d5e-c...; Age=1; PDBFileName=svchost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ff6295b0000; ImageSize=65,536; ImageChecksum=68,124; TimeDateStamp=0; DefaultBase=0x7ff6295b0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc1be10000; ImageSize=1,949,696; ProcessID=0; TimeDateStamp=177,109,342; BuildTime=75/08/12 21:02:22.00...; OriginalFileName=wevtsvc.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc1be10000; GuidSig=3c755956-2871-7019-e...; Age=1; PDBFileName=wevtsvc.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc1be10000; ImageSize=1,949,696; ImageChecksum=1,964,960; TimeDateStamp=0; DefaultBase=0x7ffc1be10000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=60; ImageBase=0x7ffc1eac0000; ImageSize=524,288; ProcessID=0; TimeDateStamp=970,085,465; BuildTime=00/09/27 20:11:05.00...; OriginalFileName=PolicyManager.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc1eac0000; GuidSig=263d8dd8-e39f-0946-0...; Age=1; PDBFileName=policymanager.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=174; ImageBase=0x7ffc1eac0000; ImageSize=524,288; ImageChecksum=516,279; TimeDateStamp=0; DefaultBase=0x7ffc1eac0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=58; ImageBase=0x7ffc1f260000; ImageSize=565,248; ProcessID=0; TimeDateStamp=-2,109,210,886; BuildTime=39/04/07 02:33:30.00...; OriginalFileName=msvcp110_win.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=49; ImageBase=0x7ffc1f260000; GuidSig=8b3306f1-7c4d-d8b8-0...; Age=1; PDBFileName=msvcp110_win.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=172; ImageBase=0x7ffc1f260000; ImageSize=565,248; ImageChecksum=591,592; TimeDateStamp=0; DefaultBase=0x7ffc1f260000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc21ad0000; ImageSize=139,264; ProcessID=0; TimeDateStamp=-1,174,313,774; BuildTime=68/11/20 16:12:02.00...; OriginalFileName=gpapi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc21ad0000; GuidSig=75a8e246-9e74-629f-3...; Age=1; PDBFileName=gpapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc21ad0000; ImageSize=139,264; ImageChecksum=174,936; TimeDateStamp=0; DefaultBase=0x7ffc21ad0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc226c0000; ImageSize=421,888; ProcessID=0; TimeDateStamp=414,127,772; BuildTime=83/02/15 03:29:32.00...; OriginalFileName=mswsock.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc226c0000; GuidSig=96babb0d-8e64-884b-6...; Age=1; PDBFileName=mswsock.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc226c0000; ImageSize=421,888; ImageChecksum=420,926; TimeDateStamp=0; DefaultBase=0x7ffc226c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc22940000; ImageSize=167,936; ProcessID=0; TimeDateStamp=1,085,565,188; BuildTime=04/05/26 09:53:08.00...; OriginalFileName=wldp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=41; ImageBase=0x7ffc22940000; GuidSig=3d0180e1-0317-7a96-e...; Age=1; PDBFileName=WLDP.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=156; ImageBase=0x7ffc22940000; ImageSize=167,936; ImageChecksum=190,611; TimeDateStamp=0; DefaultBase=0x7ffc22940000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc233c0000; ImageSize=192,512; ProcessID=0; TimeDateStamp=621,642,292; BuildTime=89/09/12 22:24:52.00...; OriginalFileName=sspicli.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc233c0000; GuidSig=823d5a41-e0d7-02a7-9...; Age=1; PDBFileName=sspicli.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc233c0000; ImageSize=192,512; ImageChecksum=235,306; TimeDateStamp=0; DefaultBase=0x7ffc233c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc233f0000; ImageSize=151,552; ProcessID=0; TimeDateStamp=-157,143,252; BuildTime=01/02/14 11:34:04.00...; OriginalFileName=userenv.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc233f0000; GuidSig=1a734def-8e54-a706-f...; Age=1; PDBFileName=userenv.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc233f0000; ImageSize=151,552; ImageChecksum=176,304; TimeDateStamp=0; DefaultBase=0x7ffc233f0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc234d0000; ImageSize=65,536; ProcessID=0; TimeDateStamp=-1,563,634,669; BuildTime=56/07/20 15:30:27.00...; OriginalFileName=umpdc.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc234d0000; GuidSig=1504cc55-3edb-4294-a...; Age=1; PDBFileName=UMPDC.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc234d0000; ImageSize=65,536; ImageChecksum=55,709; TimeDateStamp=0; DefaultBase=0x7ffc234d0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc234e0000; ImageSize=303,104; ProcessID=0; TimeDateStamp=-37,463,926; BuildTime=04/11/30 15:49:30.00...; OriginalFileName=POWRPROF.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc234e0000; GuidSig=bae22f43-6c95-a7d5-0...; Age=1; PDBFileName=powrprof.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc234e0000; ImageSize=303,104; ImageChecksum=321,827; TimeDateStamp=0; DefaultBase=0x7ffc234e0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=62; ImageBase=0x7ffc23530000; ImageSize=69,632; ProcessID=0; TimeDateStamp=96,400,242; BuildTime=73/01/20 17:50:42.00...; OriginalFileName=kernel.appcore.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=51; ImageBase=0x7ffc23530000; GuidSig=b44a2a63-8a5c-a8d8-1...; Age=1; PDBFileName=Kernel.Appcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=176; ImageBase=0x7ffc23530000; ImageSize=69,632; ImageChecksum=91,565; TimeDateStamp=0; DefaultBase=0x7ffc23530000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc23550000; ImageSize=126,976; ProcessID=0; TimeDateStamp=-87,365,952; BuildTime=03/05/03 02:09:04.00...; OriginalFileName=PROFAPI.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc23550000; GuidSig=d3e9e0b2-6dc3-e775-b...; Age=1; PDBFileName=profapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc23550000; ImageSize=126,976; ImageChecksum=153,678; TimeDateStamp=0; DefaultBase=0x7ffc23550000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23570000; ImageSize=73,728; ProcessID=0; TimeDateStamp=-457,022,433; BuildTime=91/08/14 15:47:43.00...; OriginalFileName=msasn1.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23570000; GuidSig=ff420efb-35b1-0aa7-6...; Age=1; PDBFileName=msasn1.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23570000; ImageSize=73,728; ImageChecksum=79,097; TimeDateStamp=0; DefaultBase=0x7ffc23570000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23590000; ImageSize=155,648; ProcessID=0; TimeDateStamp=-1,248,142,761; BuildTime=66/07/20 04:08:55.00...; OriginalFileName=bcrypt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23590000; GuidSig=1a472182-0367-8386-d...; Age=1; PDBFileName=bcrypt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23590000; ImageSize=155,648; ImageChecksum=157,312; TimeDateStamp=0; DefaultBase=0x7ffc23590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ProcessID=0; TimeDateStamp=1,555,946,369; BuildTime=19/04/22 15:19:29.00...; OriginalFileName=ucrtbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc23d90000; GuidSig=faceb612-020d-68fb-b...; Age=1; PDBFileName=ucrtbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ImageChecksum=1,052,117; TimeDateStamp=0; DefaultBase=0x7ffc23d90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ProcessID=0; TimeDateStamp=1,396,962,555; BuildTime=14/04/08 13:09:15.00...; OriginalFileName=Win32u.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23eb0000; GuidSig=bc2e49ab-e46d-2e93-b...; Age=1; PDBFileName=win32u.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ImageChecksum=177,968; TimeDateStamp=0; DefaultBase=0x7ffc23eb0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=54; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ProcessID=0; TimeDateStamp=439,410,971; BuildTime=83/12/04 18:36:11.00...; OriginalFileName=Kernelbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=47; ImageBase=0x7ffc23ee0000; GuidSig=44c8ec9a-a0ea-4f98-d...; Age=1; PDBFileName=kernelbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=168; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ImageChecksum=2,793,344; TimeDateStamp=0; DefaultBase=0x7ffc23ee0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ProcessID=0; TimeDateStamp=1,868,443,751; BuildTime=29/03/17 12:09:11.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc24190000; GuidSig=e5a785df-0333-6a66-6...; Age=1; PDBFileName=gdi32full.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ImageChecksum=1,696,264; TimeDateStamp=0; DefaultBase=0x7ffc24190000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24330000; ImageSize=376,832; ProcessID=0; TimeDateStamp=1,670,486,148; BuildTime=22/12/08 07:55:48.00...; OriginalFileName=WINTRUST.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24330000; GuidSig=ef819cd6-e971-2b01-0...; Age=1; PDBFileName=wintrust.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24330000; ImageSize=376,832; ImageChecksum=380,837; TimeDateStamp=0; DefaultBase=0x7ffc24330000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=66; ImageBase=0x7ffc24390000; ImageSize=528,384; ProcessID=0; TimeDateStamp=1,774,320,825; BuildTime=26/03/24 02:53:45.00...; OriginalFileName=bcryptprimitives.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=53; ImageBase=0x7ffc24390000; GuidSig=54a1b493-8222-f67e-4...; Age=1; PDBFileName=bcryptprimitives.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=180; ImageBase=0x7ffc24390000; ImageSize=528,384; ImageChecksum=562,796; TimeDateStamp=0; DefaultBase=0x7ffc24390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=52; ImageBase=0x7ffc24420000; ImageSize=647,168; ProcessID=0; TimeDateStamp=545,597,548; BuildTime=87/04/16 18:52:28.00...; OriginalFileName=msvcp_win.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc24420000; GuidSig=de65fef9-16bb-6b73-d...; Age=1; PDBFileName=msvcp_win.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc24420000; ImageSize=647,168; ImageChecksum=686,408; TimeDateStamp=0; DefaultBase=0x7ffc24420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ProcessID=0; TimeDateStamp=135,099,696; BuildTime=74/04/13 15:41:36.00...; OriginalFileName=CRYPT32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc244c0000; GuidSig=8c840cbc-1c63-bfb7-6...; Age=1; PDBFileName=crypt32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ImageChecksum=1,341,835; TimeDateStamp=0; DefaultBase=0x7ffc244c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ProcessID=0; TimeDateStamp=1,691,891,946; BuildTime=23/08/13 01:59:06.00...; OriginalFileName=COMBASE.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc246c0000; GuidSig=d15b0ee4-2a16-5244-2...; Age=1; PDBFileName=combase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ImageChecksum=3,387,881; TimeDateStamp=0; DefaultBase=0x7ffc246c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24b30000; ImageSize=667,648; ProcessID=0; TimeDateStamp=-1,762,261,787; BuildTime=50/04/04 17:18:29.00...; OriginalFileName=advapi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24b30000; GuidSig=549260e6-7474-8391-e...; Age=1; PDBFileName=advapi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24b30000; ImageSize=667,648; ImageChecksum=662,904; TimeDateStamp=0; DefaultBase=0x7ffc24b30000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24be0000; ImageSize=729,088; ProcessID=0; TimeDateStamp=775,814,378; BuildTime=94/08/02 07:59:38.00...; OriginalFileName=kernel32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24be0000; GuidSig=47a44f0c-c47f-b6a1-f...; Age=1; PDBFileName=kernel32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24be0000; ImageSize=729,088; ImageChecksum=723,980; TimeDateStamp=0; DefaultBase=0x7ffc24be0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24da0000; ImageSize=155,648; ProcessID=0; TimeDateStamp=-1,867,374,302; BuildTime=46/12/05 03:23:14.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc24da0000; GuidSig=209ad405-837d-061e-f...; Age=1; PDBFileName=gdi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc24da0000; ImageSize=155,648; ImageChecksum=194,403; TimeDateStamp=0; DefaultBase=0x7ffc24da0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc24eb0000; ImageSize=454,656; ProcessID=0; TimeDateStamp=252,347,079; BuildTime=77/12/30 16:24:39.00...; OriginalFileName=ws2_32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc24eb0000; GuidSig=94268932-d2c5-c3db-4...; Age=1; PDBFileName=ws2_32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc24eb0000; ImageSize=454,656; ImageChecksum=456,525; TimeDateStamp=0; DefaultBase=0x7ffc24eb0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc25390000; ImageSize=647,168; ProcessID=0; TimeDateStamp=-172,101,673; BuildTime=00/08/25 08:27:03.00...; OriginalFileName=msvcrt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc25390000; GuidSig=1fea8db6-b57f-5fbf-a...; Age=1; PDBFileName=msvcrt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc25390000; ImageSize=647,168; ImageChecksum=678,174; TimeDateStamp=0; DefaultBase=0x7ffc25390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc25590000; ImageSize=618,496; ProcessID=0; TimeDateStamp=-136,044,297; BuildTime=01/10/16 16:23:19.00...; OriginalFileName=sechost.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc25590000; GuidSig=0f733965-b12f-7923-b...; Age=1; PDBFileName=sechost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc25590000; ImageSize=618,496; ImageChecksum=662,974; TimeDateStamp=0; DefaultBase=0x7ffc25590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc256e0000; ImageSize=692,224; ProcessID=0; TimeDateStamp=1,221,584,444; BuildTime=08/09/16 17:00:44.00...; OriginalFileName=SHCORE.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc256e0000; GuidSig=3921dcf6-eafa-cc85-7...; Age=1; PDBFileName=shcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc256e0000; ImageSize=692,224; ImageChecksum=745,271; TimeDateStamp=0; DefaultBase=0x7ffc256e0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc25ea0000; ImageSize=802,816; ProcessID=0; TimeDateStamp=-1,108,332,853; BuildTime=70/12/24 08:14:03.00...; OriginalFileName=OLEAUT32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc25ea0000; GuidSig=2dfa946d-f7be-e09f-3...; Age=1; PDBFileName=oleaut32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc25ea0000; ImageSize=802,816; ImageChecksum=845,595; TimeDateStamp=0; DefaultBase=0x7ffc25ea0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ProcessID=0; TimeDateStamp=87,082,528; BuildTime=72/10/04 21:35:28.00...; OriginalFileName=rpcrt4.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc25f70000; GuidSig=a3028d6b-45da-0062-4...; Age=1; PDBFileName=rpcrt4.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ImageChecksum=1,199,090; TimeDateStamp=0; DefaultBase=0x7ffc25f70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ProcessID=0; TimeDateStamp=-1,431,966,518; BuildTime=60/09/21 13:59:38.00...; OriginalFileName=user32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc26420000; GuidSig=bc4cc7cc-9a33-b8a6-6...; Age=1; PDBFileName=user32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ImageChecksum=1,700,392; TimeDateStamp=0; DefaultBase=0x7ffc26420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ProcessID=0; TimeDateStamp=-1,523,876,758; BuildTime=57/10/23 19:22:18.00...; OriginalFileName=ntdll.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc26600000; GuidSig=b54f3499-813e-bcf1-3...; Age=1; PDBFileName=ntdll.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2016; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ImageChecksum=2,058,600; TimeDateStamp=0; DefaultBase=0x7ffc26600000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: Windows Kernel/Process/DCStart PID=2040; TID=-1; PName=svchost; ProceNum=4; DataLen=230; ProcessID=2,040; ParentID=836; ImageFileName=svchost.exe; PageDirectoryBase=0x1024c3b000; Flags=None; SessionID=0; ExitStatus=259; UniqueProcessKey=0xffffc50f691e5440; CommandLine=C:\Windows\system32\...; PackageFullName=; ApplicationID=; 
EVENT 0.000: KernelTraceControl/ImageID PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ff6295b0000; ImageSize=65,536; ProcessID=0; TimeDateStamp=852,935,184; BuildTime=97/01/10 22:26:24.00...; OriginalFileName=svchost.exe; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ff6295b0000; GuidSig=ef7b3786-4e54-5d5e-c...; Age=1; PDBFileName=svchost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ff6295b0000; ImageSize=65,536; ImageChecksum=68,124; TimeDateStamp=0; DefaultBase=0x7ff6295b0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc1bc90000; ImageSize=655,360; ProcessID=0; TimeDateStamp=-765,789,457; BuildTime=81/10/31 23:10:39.00...; OriginalFileName=ActXPrxy.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc1bc90000; GuidSig=79615bf0-b4f4-5650-3...; Age=1; PDBFileName=ActXPrxy.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc1bc90000; ImageSize=655,360; ImageChecksum=637,890; TimeDateStamp=0; DefaultBase=0x7ffc1bc90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=70; ImageBase=0x7ffc1ce80000; ImageSize=94,208; ProcessID=0; TimeDateStamp=-1,613,407,160; BuildTime=54/12/22 13:48:56.00...; OriginalFileName=ColorAdapterClient.d...; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=55; ImageBase=0x7ffc1ce80000; GuidSig=f998534b-2c32-ef63-c...; Age=1; PDBFileName=ColorAdapterClient.p...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=184; ImageBase=0x7ffc1ce80000; ImageSize=94,208; ImageChecksum=96,871; TimeDateStamp=0; DefaultBase=0x7ffc1ce80000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc1cec0000; ImageSize=712,704; ProcessID=0; TimeDateStamp=1,307,321,216; BuildTime=11/06/06 00:46:56.00...; OriginalFileName=MSCMS.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc1cec0000; GuidSig=a9f75e86-9cac-d677-8...; Age=1; PDBFileName=mscms.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc1cec0000; ImageSize=712,704; ImageChecksum=732,503; TimeDateStamp=0; DefaultBase=0x7ffc1cec0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=70; ImageBase=0x7ffc1d020000; ImageSize=413,696; ProcessID=0; TimeDateStamp=1,046,978,682; BuildTime=03/03/06 19:24:42.00...; OriginalFileName=DispBroker.Desktop.d...; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=55; ImageBase=0x7ffc1d020000; GuidSig=15ecc8ae-e362-4d43-b...; Age=1; PDBFileName=DispBroker.Desktop.p...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=184; ImageBase=0x7ffc1d020000; ImageSize=413,696; ImageChecksum=408,381; TimeDateStamp=0; DefaultBase=0x7ffc1d020000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc22940000; ImageSize=167,936; ProcessID=0; TimeDateStamp=1,085,565,188; BuildTime=04/05/26 09:53:08.00...; OriginalFileName=wldp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=41; ImageBase=0x7ffc22940000; GuidSig=3d0180e1-0317-7a96-e...; Age=1; PDBFileName=WLDP.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=156; ImageBase=0x7ffc22940000; ImageSize=167,936; ImageChecksum=190,611; TimeDateStamp=0; DefaultBase=0x7ffc22940000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc233f0000; ImageSize=151,552; ProcessID=0; TimeDateStamp=-157,143,252; BuildTime=01/02/14 11:34:04.00...; OriginalFileName=userenv.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc233f0000; GuidSig=1a734def-8e54-a706-f...; Age=1; PDBFileName=userenv.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc233f0000; ImageSize=151,552; ImageChecksum=176,304; TimeDateStamp=0; DefaultBase=0x7ffc233f0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=62; ImageBase=0x7ffc23530000; ImageSize=69,632; ProcessID=0; TimeDateStamp=96,400,242; BuildTime=73/01/20 17:50:42.00...; OriginalFileName=kernel.appcore.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=51; ImageBase=0x7ffc23530000; GuidSig=b44a2a63-8a5c-a8d8-1...; Age=1; PDBFileName=Kernel.Appcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=176; ImageBase=0x7ffc23530000; ImageSize=69,632; ImageChecksum=91,565; TimeDateStamp=0; DefaultBase=0x7ffc23530000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc23550000; ImageSize=126,976; ProcessID=0; TimeDateStamp=-87,365,952; BuildTime=03/05/03 02:09:04.00...; OriginalFileName=PROFAPI.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc23550000; GuidSig=d3e9e0b2-6dc3-e775-b...; Age=1; PDBFileName=profapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc23550000; ImageSize=126,976; ImageChecksum=153,678; TimeDateStamp=0; DefaultBase=0x7ffc23550000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23570000; ImageSize=73,728; ProcessID=0; TimeDateStamp=-457,022,433; BuildTime=91/08/14 15:47:43.00...; OriginalFileName=msasn1.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23570000; GuidSig=ff420efb-35b1-0aa7-6...; Age=1; PDBFileName=msasn1.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23570000; ImageSize=73,728; ImageChecksum=79,097; TimeDateStamp=0; DefaultBase=0x7ffc23570000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc235c0000; ImageSize=303,104; ProcessID=0; TimeDateStamp=-1,347,769,430; BuildTime=63/05/24 02:04:26.00...; OriginalFileName=CFGMGR32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc235c0000; GuidSig=c951ee8e-a9b3-8ebf-a...; Age=1; PDBFileName=cfgmgr32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc235c0000; ImageSize=303,104; ImageChecksum=322,106; TimeDateStamp=0; DefaultBase=0x7ffc235c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ProcessID=0; TimeDateStamp=1,555,946,369; BuildTime=19/04/22 15:19:29.00...; OriginalFileName=ucrtbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc23d90000; GuidSig=faceb612-020d-68fb-b...; Age=1; PDBFileName=ucrtbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ImageChecksum=1,052,117; TimeDateStamp=0; DefaultBase=0x7ffc23d90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ProcessID=0; TimeDateStamp=1,396,962,555; BuildTime=14/04/08 13:09:15.00...; OriginalFileName=Win32u.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23eb0000; GuidSig=bc2e49ab-e46d-2e93-b...; Age=1; PDBFileName=win32u.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ImageChecksum=177,968; TimeDateStamp=0; DefaultBase=0x7ffc23eb0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=54; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ProcessID=0; TimeDateStamp=439,410,971; BuildTime=83/12/04 18:36:11.00...; OriginalFileName=Kernelbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=47; ImageBase=0x7ffc23ee0000; GuidSig=44c8ec9a-a0ea-4f98-d...; Age=1; PDBFileName=kernelbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=168; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ImageChecksum=2,793,344; TimeDateStamp=0; DefaultBase=0x7ffc23ee0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ProcessID=0; TimeDateStamp=1,868,443,751; BuildTime=29/03/17 12:09:11.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc24190000; GuidSig=e5a785df-0333-6a66-6...; Age=1; PDBFileName=gdi32full.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ImageChecksum=1,696,264; TimeDateStamp=0; DefaultBase=0x7ffc24190000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24330000; ImageSize=376,832; ProcessID=0; TimeDateStamp=1,670,486,148; BuildTime=22/12/08 07:55:48.00...; OriginalFileName=WINTRUST.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24330000; GuidSig=ef819cd6-e971-2b01-0...; Age=1; PDBFileName=wintrust.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24330000; ImageSize=376,832; ImageChecksum=380,837; TimeDateStamp=0; DefaultBase=0x7ffc24330000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=66; ImageBase=0x7ffc24390000; ImageSize=528,384; ProcessID=0; TimeDateStamp=1,774,320,825; BuildTime=26/03/24 02:53:45.00...; OriginalFileName=bcryptprimitives.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=53; ImageBase=0x7ffc24390000; GuidSig=54a1b493-8222-f67e-4...; Age=1; PDBFileName=bcryptprimitives.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=180; ImageBase=0x7ffc24390000; ImageSize=528,384; ImageChecksum=562,796; TimeDateStamp=0; DefaultBase=0x7ffc24390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=52; ImageBase=0x7ffc24420000; ImageSize=647,168; ProcessID=0; TimeDateStamp=545,597,548; BuildTime=87/04/16 18:52:28.00...; OriginalFileName=msvcp_win.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc24420000; GuidSig=de65fef9-16bb-6b73-d...; Age=1; PDBFileName=msvcp_win.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc24420000; ImageSize=647,168; ImageChecksum=686,408; TimeDateStamp=0; DefaultBase=0x7ffc24420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ProcessID=0; TimeDateStamp=135,099,696; BuildTime=74/04/13 15:41:36.00...; OriginalFileName=CRYPT32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc244c0000; GuidSig=8c840cbc-1c63-bfb7-6...; Age=1; PDBFileName=crypt32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ImageChecksum=1,341,835; TimeDateStamp=0; DefaultBase=0x7ffc244c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ProcessID=0; TimeDateStamp=1,691,891,946; BuildTime=23/08/13 01:59:06.00...; OriginalFileName=COMBASE.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc246c0000; GuidSig=d15b0ee4-2a16-5244-2...; Age=1; PDBFileName=combase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ImageChecksum=3,387,881; TimeDateStamp=0; DefaultBase=0x7ffc246c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24be0000; ImageSize=729,088; ProcessID=0; TimeDateStamp=775,814,378; BuildTime=94/08/02 07:59:38.00...; OriginalFileName=kernel32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24be0000; GuidSig=47a44f0c-c47f-b6a1-f...; Age=1; PDBFileName=kernel32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24be0000; ImageSize=729,088; ImageChecksum=723,980; TimeDateStamp=0; DefaultBase=0x7ffc24be0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24da0000; ImageSize=155,648; ProcessID=0; TimeDateStamp=-1,867,374,302; BuildTime=46/12/05 03:23:14.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc24da0000; GuidSig=209ad405-837d-061e-f...; Age=1; PDBFileName=gdi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc24da0000; ImageSize=155,648; ImageChecksum=194,403; TimeDateStamp=0; DefaultBase=0x7ffc24da0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc25390000; ImageSize=647,168; ProcessID=0; TimeDateStamp=-172,101,673; BuildTime=00/08/25 08:27:03.00...; OriginalFileName=msvcrt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc25390000; GuidSig=1fea8db6-b57f-5fbf-a...; Age=1; PDBFileName=msvcrt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc25390000; ImageSize=647,168; ImageChecksum=678,174; TimeDateStamp=0; DefaultBase=0x7ffc25390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc25590000; ImageSize=618,496; ProcessID=0; TimeDateStamp=-136,044,297; BuildTime=01/10/16 16:23:19.00...; OriginalFileName=sechost.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc25590000; GuidSig=0f733965-b12f-7923-b...; Age=1; PDBFileName=sechost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc25590000; ImageSize=618,496; ImageChecksum=662,974; TimeDateStamp=0; DefaultBase=0x7ffc25590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc25630000; ImageSize=663,552; ProcessID=0; TimeDateStamp=-1,794,760,561; BuildTime=49/03/24 13:52:15.00...; OriginalFileName=CLBCATQ.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc25630000; GuidSig=da759f99-b2bb-75c2-1...; Age=1; PDBFileName=CLBCatQ.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc25630000; ImageSize=663,552; ImageChecksum=684,075; TimeDateStamp=0; DefaultBase=0x7ffc25630000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc25ea0000; ImageSize=802,816; ProcessID=0; TimeDateStamp=-1,108,332,853; BuildTime=70/12/24 08:14:03.00...; OriginalFileName=OLEAUT32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc25ea0000; GuidSig=2dfa946d-f7be-e09f-3...; Age=1; PDBFileName=oleaut32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc25ea0000; ImageSize=802,816; ImageChecksum=845,595; TimeDateStamp=0; DefaultBase=0x7ffc25ea0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ProcessID=0; TimeDateStamp=87,082,528; BuildTime=72/10/04 21:35:28.00...; OriginalFileName=rpcrt4.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc25f70000; GuidSig=a3028d6b-45da-0062-4...; Age=1; PDBFileName=rpcrt4.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ImageChecksum=1,199,090; TimeDateStamp=0; DefaultBase=0x7ffc25f70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ProcessID=0; TimeDateStamp=-1,431,966,518; BuildTime=60/09/21 13:59:38.00...; OriginalFileName=user32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc26420000; GuidSig=bc4cc7cc-9a33-b8a6-6...; Age=1; PDBFileName=user32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ImageChecksum=1,700,392; TimeDateStamp=0; DefaultBase=0x7ffc26420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ProcessID=0; TimeDateStamp=-1,523,876,758; BuildTime=57/10/23 19:22:18.00...; OriginalFileName=ntdll.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc26600000; GuidSig=b54f3499-813e-bcf1-3...; Age=1; PDBFileName=ntdll.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2040; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ImageChecksum=2,058,600; TimeDateStamp=0; DefaultBase=0x7ffc26600000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: Windows Kernel/Process/DCStart PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=246; ProcessID=2,100; ParentID=836; ImageFileName=svchost.exe; PageDirectoryBase=0x10279a8000; Flags=None; SessionID=0; ExitStatus=259; UniqueProcessKey=0xffffc50f69215080; CommandLine=C:\Windows\System32\...; PackageFullName=; ApplicationID=; 
EVENT 0.000: KernelTraceControl/ImageID PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ff6295b0000; ImageSize=65,536; ProcessID=0; TimeDateStamp=852,935,184; BuildTime=97/01/10 22:26:24.00...; OriginalFileName=svchost.exe; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ff6295b0000; GuidSig=ef7b3786-4e54-5d5e-c...; Age=1; PDBFileName=svchost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ff6295b0000; ImageSize=65,536; ImageChecksum=68,124; TimeDateStamp=0; DefaultBase=0x7ff6295b0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc1b870000; ImageSize=446,464; ProcessID=0; TimeDateStamp=-89,134,859; BuildTime=03/04/12 14:47:17.00...; OriginalFileName=umrdp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc1b870000; GuidSig=c55d50e6-f6a8-07f3-7...; Age=1; PDBFileName=umrdp.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc1b870000; ImageSize=446,464; ImageChecksum=436,356; TimeDateStamp=0; DefaultBase=0x7ffc1b870000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=40; ImageBase=0x7ffc1d170000; ImageSize=94,208; ProcessID=0; TimeDateStamp=795,216,183; BuildTime=95/03/14 21:23:03.00...; OriginalFileName=UMB.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=40; ImageBase=0x7ffc1d170000; GuidSig=bfb34133-9034-f2fb-7...; Age=1; PDBFileName=umb.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=154; ImageBase=0x7ffc1d170000; ImageSize=94,208; ImageChecksum=108,650; TimeDateStamp=0; DefaultBase=0x7ffc1d170000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc1f0f0000; ImageSize=978,944; ProcessID=0; TimeDateStamp=2,097,505,968; BuildTime=36/06/19 16:32:48.00...; OriginalFileName=propsys.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc1f0f0000; GuidSig=f17d0756-2273-c8ff-e...; Age=1; PDBFileName=propsys.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc1f0f0000; ImageSize=978,944; ImageChecksum=990,621; TimeDateStamp=0; DefaultBase=0x7ffc1f0f0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc21f70000; ImageSize=376,832; ProcessID=0; TimeDateStamp=43,988,838; BuildTime=71/05/25 03:07:18.00...; OriginalFileName=winsta.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc21f70000; GuidSig=b854bf05-e0a2-5b01-7...; Age=1; PDBFileName=winsta.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc21f70000; ImageSize=376,832; ImageChecksum=387,708; TimeDateStamp=0; DefaultBase=0x7ffc21f70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc22940000; ImageSize=167,936; ProcessID=0; TimeDateStamp=1,085,565,188; BuildTime=04/05/26 09:53:08.00...; OriginalFileName=wldp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=41; ImageBase=0x7ffc22940000; GuidSig=3d0180e1-0317-7a96-e...; Age=1; PDBFileName=WLDP.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=156; ImageBase=0x7ffc22940000; ImageSize=167,936; ImageChecksum=190,611; TimeDateStamp=0; DefaultBase=0x7ffc22940000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=54; ImageBase=0x7ffc232d0000; ImageSize=172,032; ProcessID=0; TimeDateStamp=564,545,050; BuildTime=87/11/22 02:04:10.00...; OriginalFileName=devinfoset.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc232d0000; GuidSig=bf3fb10c-179d-a551-d...; Age=1; PDBFileName=devobj.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc232d0000; ImageSize=172,032; ImageChecksum=212,309; TimeDateStamp=0; DefaultBase=0x7ffc232d0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=62; ImageBase=0x7ffc23530000; ImageSize=69,632; ProcessID=0; TimeDateStamp=96,400,242; BuildTime=73/01/20 17:50:42.00...; OriginalFileName=kernel.appcore.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=51; ImageBase=0x7ffc23530000; GuidSig=b44a2a63-8a5c-a8d8-1...; Age=1; PDBFileName=Kernel.Appcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=176; ImageBase=0x7ffc23530000; ImageSize=69,632; ImageChecksum=91,565; TimeDateStamp=0; DefaultBase=0x7ffc23530000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23570000; ImageSize=73,728; ProcessID=0; TimeDateStamp=-457,022,433; BuildTime=91/08/14 15:47:43.00...; OriginalFileName=msasn1.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23570000; GuidSig=ff420efb-35b1-0aa7-6...; Age=1; PDBFileName=msasn1.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23570000; ImageSize=73,728; ImageChecksum=79,097; TimeDateStamp=0; DefaultBase=0x7ffc23570000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23590000; ImageSize=155,648; ProcessID=0; TimeDateStamp=-1,248,142,761; BuildTime=66/07/20 04:08:55.00...; OriginalFileName=bcrypt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23590000; GuidSig=1a472182-0367-8386-d...; Age=1; PDBFileName=bcrypt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23590000; ImageSize=155,648; ImageChecksum=157,312; TimeDateStamp=0; DefaultBase=0x7ffc23590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc235c0000; ImageSize=303,104; ProcessID=0; TimeDateStamp=-1,347,769,430; BuildTime=63/05/24 02:04:26.00...; OriginalFileName=CFGMGR32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc235c0000; GuidSig=c951ee8e-a9b3-8ebf-a...; Age=1; PDBFileName=cfgmgr32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc235c0000; ImageSize=303,104; ImageChecksum=322,106; TimeDateStamp=0; DefaultBase=0x7ffc235c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ProcessID=0; TimeDateStamp=1,555,946,369; BuildTime=19/04/22 15:19:29.00...; OriginalFileName=ucrtbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc23d90000; GuidSig=faceb612-020d-68fb-b...; Age=1; PDBFileName=ucrtbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ImageChecksum=1,052,117; TimeDateStamp=0; DefaultBase=0x7ffc23d90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ProcessID=0; TimeDateStamp=1,396,962,555; BuildTime=14/04/08 13:09:15.00...; OriginalFileName=Win32u.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23eb0000; GuidSig=bc2e49ab-e46d-2e93-b...; Age=1; PDBFileName=win32u.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ImageChecksum=177,968; TimeDateStamp=0; DefaultBase=0x7ffc23eb0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=54; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ProcessID=0; TimeDateStamp=439,410,971; BuildTime=83/12/04 18:36:11.00...; OriginalFileName=Kernelbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=47; ImageBase=0x7ffc23ee0000; GuidSig=44c8ec9a-a0ea-4f98-d...; Age=1; PDBFileName=kernelbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=168; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ImageChecksum=2,793,344; TimeDateStamp=0; DefaultBase=0x7ffc23ee0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ProcessID=0; TimeDateStamp=1,868,443,751; BuildTime=29/03/17 12:09:11.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc24190000; GuidSig=e5a785df-0333-6a66-6...; Age=1; PDBFileName=gdi32full.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ImageChecksum=1,696,264; TimeDateStamp=0; DefaultBase=0x7ffc24190000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24330000; ImageSize=376,832; ProcessID=0; TimeDateStamp=1,670,486,148; BuildTime=22/12/08 07:55:48.00...; OriginalFileName=WINTRUST.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24330000; GuidSig=ef819cd6-e971-2b01-0...; Age=1; PDBFileName=wintrust.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24330000; ImageSize=376,832; ImageChecksum=380,837; TimeDateStamp=0; DefaultBase=0x7ffc24330000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=66; ImageBase=0x7ffc24390000; ImageSize=528,384; ProcessID=0; TimeDateStamp=1,774,320,825; BuildTime=26/03/24 02:53:45.00...; OriginalFileName=bcryptprimitives.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=53; ImageBase=0x7ffc24390000; GuidSig=54a1b493-8222-f67e-4...; Age=1; PDBFileName=bcryptprimitives.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=180; ImageBase=0x7ffc24390000; ImageSize=528,384; ImageChecksum=562,796; TimeDateStamp=0; DefaultBase=0x7ffc24390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=52; ImageBase=0x7ffc24420000; ImageSize=647,168; ProcessID=0; TimeDateStamp=545,597,548; BuildTime=87/04/16 18:52:28.00...; OriginalFileName=msvcp_win.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc24420000; GuidSig=de65fef9-16bb-6b73-d...; Age=1; PDBFileName=msvcp_win.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc24420000; ImageSize=647,168; ImageChecksum=686,408; TimeDateStamp=0; DefaultBase=0x7ffc24420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: Windows Kernel/PerfInfo/Sample PID=-1; TID=9984; PName=; ProceNum=2; DataLen=16; InstructionPointer=0xfffff8027ca2f199; ProcessorNumber=2; Priority=9; ExecutingDPC=False; ExecutingISR=False; Rank=0; Count=1; 
EVENT 0.000: KernelTraceControl/ImageID PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ProcessID=0; TimeDateStamp=135,099,696; BuildTime=74/04/13 15:41:36.00...; OriginalFileName=CRYPT32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc244c0000; GuidSig=8c840cbc-1c63-bfb7-6...; Age=1; PDBFileName=crypt32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ImageChecksum=1,341,835; TimeDateStamp=0; DefaultBase=0x7ffc244c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ProcessID=0; TimeDateStamp=1,691,891,946; BuildTime=23/08/13 01:59:06.00...; OriginalFileName=COMBASE.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc246c0000; GuidSig=d15b0ee4-2a16-5244-2...; Age=1; PDBFileName=combase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ImageChecksum=3,387,881; TimeDateStamp=0; DefaultBase=0x7ffc246c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24b30000; ImageSize=667,648; ProcessID=0; TimeDateStamp=-1,762,261,787; BuildTime=50/04/04 17:18:29.00...; OriginalFileName=advapi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24b30000; GuidSig=549260e6-7474-8391-e...; Age=1; PDBFileName=advapi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24b30000; ImageSize=667,648; ImageChecksum=662,904; TimeDateStamp=0; DefaultBase=0x7ffc24b30000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24be0000; ImageSize=729,088; ProcessID=0; TimeDateStamp=775,814,378; BuildTime=94/08/02 07:59:38.00...; OriginalFileName=kernel32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24be0000; GuidSig=47a44f0c-c47f-b6a1-f...; Age=1; PDBFileName=kernel32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24be0000; ImageSize=729,088; ImageChecksum=723,980; TimeDateStamp=0; DefaultBase=0x7ffc24be0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc24d40000; ImageSize=335,872; ProcessID=0; TimeDateStamp=-125,797,471; BuildTime=02/02/12 06:43:45.00...; OriginalFileName=SHLWAPI.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24d40000; GuidSig=8b7db15a-0b89-93df-4...; Age=1; PDBFileName=shlwapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc24d40000; ImageSize=335,872; ImageChecksum=385,032; TimeDateStamp=0; DefaultBase=0x7ffc24d40000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24da0000; ImageSize=155,648; ProcessID=0; TimeDateStamp=-1,867,374,302; BuildTime=46/12/05 03:23:14.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc24da0000; GuidSig=209ad405-837d-061e-f...; Age=1; PDBFileName=gdi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc24da0000; ImageSize=155,648; ImageChecksum=194,403; TimeDateStamp=0; DefaultBase=0x7ffc24da0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24f20000; ImageSize=4,653,056; ProcessID=0; TimeDateStamp=-1,478,931,446; BuildTime=59/03/28 00:10:50.00...; OriginalFileName=SETUPAPI.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24f20000; GuidSig=2afde28c-a886-98c2-7...; Age=1; PDBFileName=setupapi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24f20000; ImageSize=4,653,056; ImageChecksum=4,692,368; TimeDateStamp=0; DefaultBase=0x7ffc24f20000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc25390000; ImageSize=647,168; ProcessID=0; TimeDateStamp=-172,101,673; BuildTime=00/08/25 08:27:03.00...; OriginalFileName=msvcrt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc25390000; GuidSig=1fea8db6-b57f-5fbf-a...; Age=1; PDBFileName=msvcrt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc25390000; ImageSize=647,168; ImageChecksum=678,174; TimeDateStamp=0; DefaultBase=0x7ffc25390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc25590000; ImageSize=618,496; ProcessID=0; TimeDateStamp=-136,044,297; BuildTime=01/10/16 16:23:19.00...; OriginalFileName=sechost.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc25590000; GuidSig=0f733965-b12f-7923-b...; Age=1; PDBFileName=sechost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc25590000; ImageSize=618,496; ImageChecksum=662,974; TimeDateStamp=0; DefaultBase=0x7ffc25590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc25630000; ImageSize=663,552; ProcessID=0; TimeDateStamp=-1,794,760,561; BuildTime=49/03/24 13:52:15.00...; OriginalFileName=CLBCATQ.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc25630000; GuidSig=da759f99-b2bb-75c2-1...; Age=1; PDBFileName=CLBCatQ.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc25630000; ImageSize=663,552; ImageChecksum=684,075; TimeDateStamp=0; DefaultBase=0x7ffc25630000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc256e0000; ImageSize=692,224; ProcessID=0; TimeDateStamp=1,221,584,444; BuildTime=08/09/16 17:00:44.00...; OriginalFileName=SHCORE.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc256e0000; GuidSig=3921dcf6-eafa-cc85-7...; Age=1; PDBFileName=shcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc256e0000; ImageSize=692,224; ImageChecksum=745,271; TimeDateStamp=0; DefaultBase=0x7ffc256e0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc25ea0000; ImageSize=802,816; ProcessID=0; TimeDateStamp=-1,108,332,853; BuildTime=70/12/24 08:14:03.00...; OriginalFileName=OLEAUT32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc25ea0000; GuidSig=2dfa946d-f7be-e09f-3...; Age=1; PDBFileName=oleaut32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc25ea0000; ImageSize=802,816; ImageChecksum=845,595; TimeDateStamp=0; DefaultBase=0x7ffc25ea0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ProcessID=0; TimeDateStamp=87,082,528; BuildTime=72/10/04 21:35:28.00...; OriginalFileName=rpcrt4.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc25f70000; GuidSig=a3028d6b-45da-0062-4...; Age=1; PDBFileName=rpcrt4.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ImageChecksum=1,199,090; TimeDateStamp=0; DefaultBase=0x7ffc25f70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ProcessID=0; TimeDateStamp=-1,431,966,518; BuildTime=60/09/21 13:59:38.00...; OriginalFileName=user32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc26420000; GuidSig=bc4cc7cc-9a33-b8a6-6...; Age=1; PDBFileName=user32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ImageChecksum=1,700,392; TimeDateStamp=0; DefaultBase=0x7ffc26420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ProcessID=0; TimeDateStamp=-1,523,876,758; BuildTime=57/10/23 19:22:18.00...; OriginalFileName=ntdll.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc26600000; GuidSig=b54f3499-813e-bcf1-3...; Age=1; PDBFileName=ntdll.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2100; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ImageChecksum=2,058,600; TimeDateStamp=0; DefaultBase=0x7ffc26600000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: Windows Kernel/Process/DCStart PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=196; ProcessID=2,312; ParentID=836; ImageFileName=svchost.exe; PageDirectoryBase=0x1028633000; Flags=None; SessionID=0; ExitStatus=259; UniqueProcessKey=0xffffc50f69294400; CommandLine=C:\Windows\system32\...; PackageFullName=; ApplicationID=; 
EVENT 0.000: KernelTraceControl/ImageID PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ff6295b0000; ImageSize=65,536; ProcessID=0; TimeDateStamp=852,935,184; BuildTime=97/01/10 22:26:24.00...; OriginalFileName=svchost.exe; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ff6295b0000; GuidSig=ef7b3786-4e54-5d5e-c...; Age=1; PDBFileName=svchost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ff6295b0000; ImageSize=65,536; ImageChecksum=68,124; TimeDateStamp=0; DefaultBase=0x7ff6295b0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc1b690000; ImageSize=53,248; ProcessID=0; TimeDateStamp=-720,406,558; BuildTime=83/04/10 05:32:18.00...; OriginalFileName=nsisvc.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc1b690000; GuidSig=f72e1a5b-3b60-2b74-9...; Age=1; PDBFileName=nsisvc.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc1b690000; ImageSize=53,248; ImageChecksum=54,691; TimeDateStamp=0; DefaultBase=0x7ffc1b690000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc22940000; ImageSize=167,936; ProcessID=0; TimeDateStamp=1,085,565,188; BuildTime=04/05/26 09:53:08.00...; OriginalFileName=wldp.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=41; ImageBase=0x7ffc22940000; GuidSig=3d0180e1-0317-7a96-e...; Age=1; PDBFileName=WLDP.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=156; ImageBase=0x7ffc22940000; ImageSize=167,936; ImageChecksum=190,611; TimeDateStamp=0; DefaultBase=0x7ffc22940000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=62; ImageBase=0x7ffc23530000; ImageSize=69,632; ProcessID=0; TimeDateStamp=96,400,242; BuildTime=73/01/20 17:50:42.00...; OriginalFileName=kernel.appcore.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=51; ImageBase=0x7ffc23530000; GuidSig=b44a2a63-8a5c-a8d8-1...; Age=1; PDBFileName=Kernel.Appcore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=176; ImageBase=0x7ffc23530000; ImageSize=69,632; ImageChecksum=91,565; TimeDateStamp=0; DefaultBase=0x7ffc23530000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23570000; ImageSize=73,728; ProcessID=0; TimeDateStamp=-457,022,433; BuildTime=91/08/14 15:47:43.00...; OriginalFileName=msasn1.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23570000; GuidSig=ff420efb-35b1-0aa7-6...; Age=1; PDBFileName=msasn1.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23570000; ImageSize=73,728; ImageChecksum=79,097; TimeDateStamp=0; DefaultBase=0x7ffc23570000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ProcessID=0; TimeDateStamp=1,555,946,369; BuildTime=19/04/22 15:19:29.00...; OriginalFileName=ucrtbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc23d90000; GuidSig=faceb612-020d-68fb-b...; Age=1; PDBFileName=ucrtbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc23d90000; ImageSize=1,024,000; ImageChecksum=1,052,117; TimeDateStamp=0; DefaultBase=0x7ffc23d90000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ProcessID=0; TimeDateStamp=1,396,962,555; BuildTime=14/04/08 13:09:15.00...; OriginalFileName=Win32u.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc23eb0000; GuidSig=bc2e49ab-e46d-2e93-b...; Age=1; PDBFileName=win32u.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc23eb0000; ImageSize=135,168; ImageChecksum=177,968; TimeDateStamp=0; DefaultBase=0x7ffc23eb0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=54; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ProcessID=0; TimeDateStamp=439,410,971; BuildTime=83/12/04 18:36:11.00...; OriginalFileName=Kernelbase.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=47; ImageBase=0x7ffc23ee0000; GuidSig=44c8ec9a-a0ea-4f98-d...; Age=1; PDBFileName=kernelbase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=168; ImageBase=0x7ffc23ee0000; ImageSize=2,760,704; ImageChecksum=2,793,344; TimeDateStamp=0; DefaultBase=0x7ffc23ee0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ProcessID=0; TimeDateStamp=1,868,443,751; BuildTime=29/03/17 12:09:11.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc24190000; GuidSig=e5a785df-0333-6a66-6...; Age=1; PDBFileName=gdi32full.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc24190000; ImageSize=1,654,784; ImageChecksum=1,696,264; TimeDateStamp=0; DefaultBase=0x7ffc24190000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24330000; ImageSize=376,832; ProcessID=0; TimeDateStamp=1,670,486,148; BuildTime=22/12/08 07:55:48.00...; OriginalFileName=WINTRUST.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24330000; GuidSig=ef819cd6-e971-2b01-0...; Age=1; PDBFileName=wintrust.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24330000; ImageSize=376,832; ImageChecksum=380,837; TimeDateStamp=0; DefaultBase=0x7ffc24330000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=66; ImageBase=0x7ffc24390000; ImageSize=528,384; ProcessID=0; TimeDateStamp=1,774,320,825; BuildTime=26/03/24 02:53:45.00...; OriginalFileName=bcryptprimitives.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=53; ImageBase=0x7ffc24390000; GuidSig=54a1b493-8222-f67e-4...; Age=1; PDBFileName=bcryptprimitives.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=180; ImageBase=0x7ffc24390000; ImageSize=528,384; ImageChecksum=562,796; TimeDateStamp=0; DefaultBase=0x7ffc24390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=52; ImageBase=0x7ffc24420000; ImageSize=647,168; ProcessID=0; TimeDateStamp=545,597,548; BuildTime=87/04/16 18:52:28.00...; OriginalFileName=msvcp_win.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc24420000; GuidSig=de65fef9-16bb-6b73-d...; Age=1; PDBFileName=msvcp_win.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=166; ImageBase=0x7ffc24420000; ImageSize=647,168; ImageChecksum=686,408; TimeDateStamp=0; DefaultBase=0x7ffc24420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ProcessID=0; TimeDateStamp=135,099,696; BuildTime=74/04/13 15:41:36.00...; OriginalFileName=CRYPT32.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc244c0000; GuidSig=8c840cbc-1c63-bfb7-6...; Age=1; PDBFileName=crypt32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc244c0000; ImageSize=1,347,584; ImageChecksum=1,341,835; TimeDateStamp=0; DefaultBase=0x7ffc244c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ProcessID=0; TimeDateStamp=1,691,891,946; BuildTime=23/08/13 01:59:06.00...; OriginalFileName=COMBASE.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc246c0000; GuidSig=d15b0ee4-2a16-5244-2...; Age=1; PDBFileName=combase.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc246c0000; ImageSize=3,366,912; ImageChecksum=3,387,881; TimeDateStamp=0; DefaultBase=0x7ffc246c0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=50; ImageBase=0x7ffc24be0000; ImageSize=729,088; ProcessID=0; TimeDateStamp=775,814,378; BuildTime=94/08/02 07:59:38.00...; OriginalFileName=kernel32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=45; ImageBase=0x7ffc24be0000; GuidSig=47a44f0c-c47f-b6a1-f...; Age=1; PDBFileName=kernel32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=164; ImageBase=0x7ffc24be0000; ImageSize=729,088; ImageChecksum=723,980; TimeDateStamp=0; DefaultBase=0x7ffc24be0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc24da0000; ImageSize=155,648; ProcessID=0; TimeDateStamp=-1,867,374,302; BuildTime=46/12/05 03:23:14.00...; OriginalFileName=gdi32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc24da0000; GuidSig=209ad405-837d-061e-f...; Age=1; PDBFileName=gdi32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc24da0000; ImageSize=155,648; ImageChecksum=194,403; TimeDateStamp=0; DefaultBase=0x7ffc24da0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc25390000; ImageSize=647,168; ProcessID=0; TimeDateStamp=-172,101,673; BuildTime=00/08/25 08:27:03.00...; OriginalFileName=msvcrt.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc25390000; GuidSig=1fea8db6-b57f-5fbf-a...; Age=1; PDBFileName=msvcrt.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc25390000; ImageSize=647,168; ImageChecksum=678,174; TimeDateStamp=0; DefaultBase=0x7ffc25390000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=48; ImageBase=0x7ffc25590000; ImageSize=618,496; ProcessID=0; TimeDateStamp=-136,044,297; BuildTime=01/10/16 16:23:19.00...; OriginalFileName=sechost.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc25590000; GuidSig=0f733965-b12f-7923-b...; Age=1; PDBFileName=sechost.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=162; ImageBase=0x7ffc25590000; ImageSize=618,496; ImageChecksum=662,974; TimeDateStamp=0; DefaultBase=0x7ffc25590000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ProcessID=0; TimeDateStamp=87,082,528; BuildTime=72/10/04 21:35:28.00...; OriginalFileName=rpcrt4.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc25f70000; GuidSig=a3028d6b-45da-0062-4...; Age=1; PDBFileName=rpcrt4.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc25f70000; ImageSize=1,179,648; ImageChecksum=1,199,090; TimeDateStamp=0; DefaultBase=0x7ffc25f70000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=40; ImageBase=0x7ffc26410000; ImageSize=32,768; ProcessID=0; TimeDateStamp=1,693,425,343; BuildTime=23/08/30 19:55:43.00...; OriginalFileName=nsi.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=40; ImageBase=0x7ffc26410000; GuidSig=7c67fb7d-8805-fe58-4...; Age=1; PDBFileName=nsi.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=154; ImageBase=0x7ffc26410000; ImageSize=32,768; ImageChecksum=32,664; TimeDateStamp=0; DefaultBase=0x7ffc26410000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=46; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ProcessID=0; TimeDateStamp=-1,431,966,518; BuildTime=60/09/21 13:59:38.00...; OriginalFileName=user32.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=43; ImageBase=0x7ffc26420000; GuidSig=bc4cc7cc-9a33-b8a6-6...; Age=1; PDBFileName=user32.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=160; ImageBase=0x7ffc26420000; ImageSize=1,650,688; ImageChecksum=1,700,392; TimeDateStamp=0; DefaultBase=0x7ffc26420000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=44; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ProcessID=0; TimeDateStamp=-1,523,876,758; BuildTime=57/10/23 19:22:18.00...; OriginalFileName=ntdll.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=42; ImageBase=0x7ffc26600000; GuidSig=b54f3499-813e-bcf1-3...; Age=1; PDBFileName=ntdll.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2312; TID=-1; PName=svchost; ProceNum=2; DataLen=158; ImageBase=0x7ffc26600000; ImageSize=2,031,616; ImageChecksum=2,058,600; TimeDateStamp=0; DefaultBase=0x7ffc26600000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: Windows Kernel/Process/DCStart PID=2356; TID=-1; PName=NVDisplay.Container; ProceNum=2; DataLen=644; ProcessID=2,356; ParentID=836; ImageFileName=NVDisplay.Container....; PageDirectoryBase=0x1026a3d000; Flags=None; SessionID=0; ExitStatus=259; UniqueProcessKey=0xffffc50f692c4080; CommandLine="C:\Program Files\NV...; PackageFullName=; ApplicationID=; 
EVENT 0.000: KernelTraceControl/ImageID PID=2356; TID=-1; PName=NVDisplay.Container; ProceNum=2; DataLen=48; ImageBase=0x5dba0000; ImageSize=1,650,688; ProcessID=0; TimeDateStamp=1,509,118,471; BuildTime=17/10/27 15:34:31.00...; OriginalFileName=nvxdbat.dll; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2356; TID=-1; PName=NVDisplay.Container; ProceNum=2; DataLen=119; ImageBase=0x5dba0000; GuidSig=1fe674d4-44ee-43cf-8...; Age=1; PDBFileName=C:\dvs\p4\build\sw\r...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2356; TID=-1; PName=NVDisplay.Container; ProceNum=2; DataLen=210; ImageBase=0x5dba0000; ImageSize=1,650,688; ImageChecksum=1,623,426; TimeDateStamp=0; DefaultBase=0x5dba0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Program Files\NVI...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2356; TID=-1; PName=NVDisplay.Container; ProceNum=2; DataLen=56; ImageBase=0x7ff764360000; ImageSize=471,040; ProcessID=0; TimeDateStamp=1,509,121,447; BuildTime=17/10/27 16:24:07.00...; OriginalFileName=NvContainer.exe; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2356; TID=-1; PName=NVDisplay.Container; ProceNum=2; DataLen=132; ImageBase=0x7ff764360000; GuidSig=4c57b110-88d7-4e35-b...; Age=1; PDBFileName=C:\dvs\p4\build\sw\g...; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2356; TID=-1; PName=NVDisplay.Container; ProceNum=2; DataLen=258; ImageBase=0x7ff764360000; ImageSize=471,040; ImageChecksum=502,039; TimeDateStamp=0; DefaultBase=0x7ff764360000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Program Files\NVI...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2356; TID=-1; PName=NVDisplay.Container; ProceNum=2; DataLen=50; ImageBase=0x7ffc16ae0000; ImageSize=1,261,568; ProcessID=0; TimeDateStamp=409,894,886; BuildTime=82/12/28 03:41:26.00...; OriginalFileName=DRVSTORE.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2356; TID=-1; PName=NVDisplay.Container; ProceNum=2; DataLen=45; ImageBase=0x7ffc16ae0000; GuidSig=2ea9f785-78e1-8868-a...; Age=1; PDBFileName=drvstore.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2356; TID=-1; PName=NVDisplay.Container; ProceNum=2; DataLen=164; ImageBase=0x7ffc16ae0000; ImageSize=1,261,568; ImageChecksum=1,270,780; TimeDateStamp=0; DefaultBase=0x7ffc16ae0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2356; TID=-1; PName=NVDisplay.Container; ProceNum=2; DataLen=44; ImageBase=0x7ffc16cc0000; ImageSize=118,784; ProcessID=0; TimeDateStamp=-305,149,675; BuildTime=96/06/06 10:40:21.00...; OriginalFileName=SPINF.DLL; 
EVENT 0.000: KernelTraceControl/ImageID/DbgID_RSDS PID=2356; TID=-1; PName=NVDisplay.Container; ProceNum=2; DataLen=42; ImageBase=0x7ffc16cc0000; GuidSig=fa32edd9-d98a-5a21-5...; Age=1; PDBFileName=spinf.pdb; 
EVENT 0.000: Windows Kernel/Image/DCStart PID=2356; TID=-1; PName=NVDisplay.Container; ProceNum=2; DataLen=158; ImageBase=0x7ffc16cc0000; ImageSize=118,784; ImageChecksum=162,184; TimeDateStamp=0; DefaultBase=0x7ffc16cc0000; BuildTime=70/01/01 00:00:00.00...; FileName=C:\Windows\System32\...; 
EVENT 0.000: KernelTraceControl/ImageID PID=2356; TID=-1; PName=NVDisplay.Container; ProceNum=2; DataLen=46; ImageBase=0x7ffc16ce0000; ImageSiz