volatilityの作法 その7

概要

volatilityの作法、調べてみた。
winxpsp3のスナップショット、取ってみた。

filescan

Offset(P)            #Ptr   #Hnd Access Name
------------------ ------ ------ ------ ----
0x0000000001950138      2      1 ------ \Device\NamedPipe\lsass
0x00000000019503e0      1      1 RW---- \Device\HarddiskVolume1\Documents and Settings\testuser\ntuser.dat.LOG
0x00000000019506f0      3      1 RW-r-- \Device\HarddiskVolume1\WINDOWS\SchedLgU.Txt
0x00000000019538b8      1      1 RW-rw- \Device\HarddiskVolume1\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat
0x000000000196c5d8      1      1 ------ \Device\Afd\Endpoint
0x000000000196c7b8      3      1 ------ \Device\Afd\Endpoint
0x00000000019737d0      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001973878      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001973d40      1      0 R--rw- \Device\HarddiskVolume1\WINDOWS\system32\imjp81.ime
0x00000000019792c0      2      1 ------ \Device\NamedPipe\PCHHangRepExecPipe
0x0000000001979ef8      1      1 ------ \Device\NamedPipe\DAV RPC SERVICE
0x0000000001979f90      2      1 ------ \Device\NamedPipe\DAV RPC SERVICE
0x00000000019c4af8      4      1 RW---- \Device\HarddiskVolume1\Documents and Settings\LocalService\NTUSER.DAT
0x00000000019c4f00      3      1 ------ \Device\NamedPipe\net\NtControlPipe0
0x00000000019c7628      1      1 ------ \Device\NamedPipe\epmapper
0x00000000019c7710      2      1 ------ \Device\NamedPipe\epmapper
0x00000000019c9a48      1      1 ------ \Device\NamedPipe\wkssvc
0x00000000019c9eb8      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x00000000019ca890      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x00000000019cc2a8      1      1 ------ \Device\Afd\Endpoint
0x00000000019ccc08      2      1 ------ \Device\Afd\Endpoint
0x00000000019cdd40      1      1 RW-rw- \Device\HarddiskVolume1\Documents and Settings\testuser\Application Data\Microsoft\IMJP8_1\imjp81u.dic
0x00000000019cdec0      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x00000000019ce158      3      1 ------ \Device\NamedPipe\net\NtControlPipe7
0x00000000019ceb70      3      1 R--rwd \Device\HarddiskVolume1\Documents and Settings\testuser\デスクトップ
0x00000000019cf238      1      1 ------ \Device\Afd\Endpoint
0x00000000019d1158      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\stobject.dll
0x00000000019d1938      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x00000000019d2028      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\cryptsvc.dll
0x00000000019d3028      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\odbcint.dll
0x00000000019d3b60      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x00000000019d4160      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\psbase.dll
0x00000000019d4428      2      1 R--rw- \Device\HarddiskVolume1\Program Files\Common Files\Microsoft Shared\Triedit
0x00000000019d44c0      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\ime\IMJP8_1
0x00000000019d45e8      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\system32\Setup
0x00000000019d47e0      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x00000000019d4988      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x00000000019d5028      2      1 R--rw- \Device\HarddiskVolume1\Program Files\MSN Gaming Zone\Windows
0x00000000019d51c8      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\system32\drivers\disdn
0x00000000019d52b0      2      1 R--rw- \Device\HarddiskVolume1\Program Files\NetMeeting
0x00000000019d5348      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\PCHealth\HelpCtr\Binaries
0x00000000019d5628      1      1 ------ \Device\NamedPipe\lsarpc
0x00000000019d5a08      2      1 ------ \Device\NamedPipe\scerpc
0x00000000019d5b78      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\AppPatch
0x00000000019d5c10      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\system32
0x00000000019d60e0      2      1 ------ \Device\Afd\Endpoint
0x00000000019d6ac0      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x00000000019d6e98      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x00000000019d6f30      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x00000000019d7028      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\certcli.dll
0x00000000019d9158      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\ime\sptip.dll
0x00000000019d9308      2      1 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wbem\mof
0x00000000019da2b0      2      1 R--rw- \Device\HarddiskVolume1\Program Files\Common Files\Microsoft Shared\web server extensions\40\servsupp
0x00000000019da348      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\system32\drivers
0x00000000019da3e0      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\Fonts
0x00000000019da508      2      1 R--rw- \Device\HarddiskVolume1\Program Files\Common Files\Microsoft Shared\web server extensions\40\bin
0x00000000019dad18      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\win.ini
0x00000000019dc130      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\dot3api.dll
0x00000000019dc2f0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\KBDJPN.DLL
0x00000000019dd600      2      1 ------ \Device\NamedPipe\SfcApi
0x00000000019ddeb8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wzcsapi.dll
0x00000000019de228      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\usbmon.dll
0x00000000019de7e8      1      1 ------ \Device\NamedPipe\SfcApi
0x00000000019dec60      4      1 RW---- \Device\HarddiskVolume1\Documents and Settings\NetworkService\NTUSER.DAT
0x00000000019e1028      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wscsvc.dll
0x00000000019e1648      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x00000000019e1e98      1      1 R--r-- \Device\HarddiskVolume1\WINDOWS\system32\kbdnec.dll
0x00000000019e2130      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\logonui.exe
0x00000000019e3130      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\cscdll.dll
0x00000000019e3410      1      0 R--r-- \Device\HarddiskVolume1\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.Networking.RtcRes_6595b64144ccf1df_5.2.2.3_ja_25380412.Manifest
0x00000000019e3548      5      1 RWDr-- \Device\HarddiskVolume1\System Volume Information\tracking.log
0x00000000019e35e0      1      0 R--r-- \Device\HarddiskVolume1\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.Networking.RtcDll_6595b64144ccf1df_5.2.2.3_x-ww_d6bd8b95.Manifest
0x00000000019e37b0      1      0 R--r-- \Device\HarddiskVolume1\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_5.2.2.3_x-ww_468466a7.Manifest
0x00000000019e3980      1      0 R--r-- \Device\HarddiskVolume1\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.5512_x-ww_dfb54e0c.Manifest
0x00000000019e3b50      1      0 R--r-- \Device\HarddiskVolume1\WINDOWS\WinSxS\Policies\x86_policy.5.2.Microsoft.Windows.Networking.Rtcdll_6595b64144ccf1df_x-ww_c7b7206f\5.2.2.3.Policy
0x00000000019e3d20      1      0 R--r-- \Device\HarddiskVolume1\WINDOWS\WinSxS\Policies\x86_policy.5.2.Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_x-ww_362e60dd\5.2.2.3.Policy
0x00000000019e4380      1      0 R--rwd \Device\HarddiskVolume1\Documents and Settings\testuser\スタート メニュー\プログラム\スタートアップ\desktop.ini
0x00000000019e49c0      3      1 R--rwd \Device\HarddiskVolume1\Documents and Settings\testuser\Local Settings\Application Data\Microsoft\CD Burning
0x00000000019e4a58      3      1 R--rwd \Device\HarddiskVolume1\Documents and Settings\All Users\デスクトップ
0x00000000019e59b0      1      1 RW---- \Device\HarddiskVolume1\Documents and Settings\LocalService\ntuser.dat.LOG
0x00000000019e6130      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\duser.dll
0x00000000019e6f90      1      0 R--r-- \Device\HarddiskVolume1\System Volume Information\_restore{40F29F75-F15D-426C-A93C-3569C8AB5373}\RP4\rp.log
0x00000000019e78a8      1      1 R--rw- \Device\HarddiskVolume1\Documents and Settings\testuser
0x00000000019e7f90      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x00000000019e8158      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\mydocs.dll
0x00000000019e85a8      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\system32\dllcache
0x00000000019e8828      2      1 R--rw- \Device\HarddiskVolume1\Program Files\Common Files\Microsoft Shared\web server extensions\40\isapi\_vti_adm
0x00000000019e9028      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\cabinet.dll
0x00000000019ea130      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\mswsock.dll
0x00000000019eb150      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\rasman.dll
0x00000000019eb5b8      1      1 RW-rw- \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x00000000019eb750      1      1 ------ \Device\Afd\Endpoint
0x00000000019ed130      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\winrnr.dll
0x00000000019ef8b0      1      0 RW---- \Device\HarddiskVolume1\WINDOWS\SoftwareDistribution\EventCache\{FFD8C705-CBFA-426B-A078-942C405C02F4}.bin
0x00000000019efde0      1      1 RW-r-- \Device\HarddiskVolume1\WINDOWS\SoftwareDistribution\ReportingEvents.log
0x00000000019f1028      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\ersvc.dll
0x00000000019f2160      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\oakley.dll
0x00000000019f2708      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\system32\xircom
0x00000000019f2830      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\ime\IMKR6_1\Applets
0x00000000019f2958      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\ime\IMJP8_1\APPLETS
0x00000000019f37d8      1      1 RW-r-- \Device\HarddiskVolume1\WINDOWS\system32\config\Internet.evt
0x00000000019f42c0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\termsrv.dll
0x00000000019f4470      3      1 R--rwd \Device\HarddiskVolume1\WINDOWS\Tasks
0x00000000019f4630      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x00000000019f5138      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\winspool.drv
0x00000000019f5aa0      1      0 R--r-- \Device\HarddiskVolume1\WINDOWS\WinSxS\Policies\x86_policy.6.0.Microsoft.Windows.Common-Controls_6595b64144ccf1df_x-ww_5ddad775\6.0.2600.5512.Policy
0x00000000019f6470      2      1 R--rw- \Device\HarddiskVolume1\Program Files\microsoft frontpage\version3.0\bin
0x00000000019f6628      2      1 R--rw- \Device\HarddiskVolume1\Program Files\Common Files\Microsoft Shared\web server extensions\40\bots\vinavbar
0x00000000019f70e0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x00000000019f7228      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\imm32.dll
0x00000000019f8c60      1      1 ------ \Device\NamedPipe\net\NtControlPipe3
0x00000000019f9228      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\msgina.dll
0x00000000019f9300      2      1 RW-r-- \Device\HarddiskVolume1\WINDOWS\system32\config\SecEvent.Evt
0x00000000019f9e08      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x00000000019f9f90      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x00000000019fb028      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\es.dll
0x00000000019fc138      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\msi.dll
0x00000000019fc5f8      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\Resources\Themes\Luna\Shell\NormalColor
0x00000000019fc720      2      1 R--rw- \Device\HarddiskVolume1\Program Files\Common Files\Microsoft Shared\Speech
0x00000000019fc898      2      1 R--rw- \Device\HarddiskVolume1\Program Files\Common Files\SpeechEngines\Microsoft\TTS\1033
0x00000000019fc930      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\system32\Restore
0x00000000019fceb8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\desk.cpl
0x00000000019fd228      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wscntfy.exe
0x00000000019fdca0      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\Help
0x00000000019fe150      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\rasdlg.dll
0x00000000019fec30      1      1 RW---- \Device\HarddiskVolume1\Documents and Settings\NetworkService\ntuser.dat.LOG
0x00000000019ff138      1      0 R--r-- \Device\HarddiskVolume1\WINDOWS\system32\c_1252.nls
0x00000000019ff348      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x0000000001a00158      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE
0x0000000001a005e0      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x0000000001a01158      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\batmeter.dll
0x0000000001a01470      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\system32
0x0000000001a01508      3      1 ------ \Device\NamedPipe\net\NtControlPipe4
0x0000000001a01808      1      1 ------ \Device\Afd\Endpoint
0x0000000001a01ae8      2      1 ------ \Device\Afd\Endpoint
0x0000000001a01cc8      2      1 ------ \Device\Afd\Endpoint
0x0000000001a02130      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\esent.dll
0x0000000001a02ef8      1      1 RW-rw- \Device\HarddiskVolume1\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\IMJP8_1\imjp81u.dic
0x0000000001a03908      1      1 RW-rw- \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x0000000001a039a0      1      1 RW-rw- \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x0000000001a03a38      1      1 RW-rw- \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x0000000001a03ad0      1      1 RW-rw- \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x0000000001a03b68      1      1 RW-rw- \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x0000000001a03c00      1      1 RW-rw- \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x0000000001a03c98      1      1 RW-rw- \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x0000000001a03d30      1      1 RW-rw- \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x0000000001a03dc8      1      1 RW-rw- \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x0000000001a03e60      1      1 RW-rw- \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x0000000001a03ef8      1      1 RW-rw- \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x0000000001a03f90      1      1 RW-rw- \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x0000000001a04158      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\ntshrui.dll
0x0000000001a05150      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\rasapi32.dll
0x0000000001a05220      1      0 R--r-- \Device\HarddiskVolume1\WINDOWS\Registration\R000000000007.clb
0x0000000001a05f90      1      1 ------ \Device\Afd\Endpoint
0x0000000001a06150      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\adsldpc.dll
0x0000000001a07028      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wbem\wbemprox.dll
0x0000000001a070c8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wbem\wbemcomn.dll
0x0000000001a09160      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\winipsec.dll
0x0000000001a0a990      1      1 R--r-- \Device\HarddiskVolume1\WINDOWS\system32\kbdnec.dll
0x0000000001a0b028      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\win32spl.dll
0x0000000001a0b150      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\netrap.dll
0x0000000001a0b508      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\alg.exe
0x0000000001a0c130      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\atl.dll
0x0000000001a0c278      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\imjp81.ime
0x0000000001a0c5a8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\mstlsapi.dll
0x0000000001a0c718      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\icaapi.dll
0x0000000001a0cf30      1      0 R--r-- \Device\HarddiskVolume1\WINDOWS\Resources\Themes\Luna\luna.msstyles
0x0000000001a0d138      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\clbcatq.dll
0x0000000001a0de90      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\spoolsv.exe
0x0000000001a0e178      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\upnp.dll
0x0000000001a0e908      2      1 RW-r-- \Device\HarddiskVolume1\WINDOWS\system32\config\AppEvent.Evt
0x0000000001a0f158      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001a10028      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\msxml3.dll
0x0000000001a10320      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\kbd101.dll
0x0000000001a10b78      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001a10c10      1      1 ------ \Device\NamedPipe\net\NtControlPipe2
0x0000000001a11840      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001a11aa0      3      1 ------ \Device\NamedPipe\net\NtControlPipe3
0x0000000001a11b38      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x0000000001a12130      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\dnsrslvr.dll
0x0000000001a127b0      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x0000000001a13028      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\ws2help.dll
0x0000000001a13bf8      3      2 ------ \Device\RawIp\255
0x0000000001a13d68      1      1 ------ \Device\Afd\Endpoint
0x0000000001a15158      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\ctfmon.exe
0x0000000001a15e58      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x0000000001a15f40      2      1 ------ \Device\NamedPipe\winlogonrpc
0x0000000001a16288      1      1 RW---- \Device\HarddiskVolume1\Documents and Settings\testuser\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG
0x0000000001a16698      4      1 RW---- \Device\HarddiskVolume1\Documents and Settings\testuser\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
0x0000000001a17158      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\mlang.dll
0x0000000001a18160      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\srsvc.dll
0x0000000001a18348      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\kbdnec.dll
0x0000000001a18a10      1      1 RW---- \Device\HarddiskVolume1\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG
0x0000000001a18d78      3      1 ------ \Device\NamedPipe\net\NtControlPipe5
0x0000000001a19720      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\system32
0x0000000001a197e8      1      1 ------ \Device\NamedPipe\net\NtControlPipe6
0x0000000001a19eb8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\netshell.dll
0x0000000001a1a028      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\xpsp1res.dll
0x0000000001a1a9b0      1      1 ------ \Device\NamedPipe\ntsvcs
0x0000000001a1bb48      3      1 R--rwd \Device\HarddiskVolume1\Documents and Settings\testuser\スタート メニュー
0x0000000001a1be30      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x0000000001a1c800      1      1 ------ \Device\NamedPipe\lsarpc
0x0000000001a1d028      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\srvsvc.dll
0x0000000001a1d2a0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\ws2_32.dll
0x0000000001a1d3b0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\eappprxy.dll
0x0000000001a1e028      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\shsvcs.dll
0x0000000001a1f330      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\msidle.dll
0x0000000001a20158      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\webcheck.dll
0x0000000001a20860      2      1 ------ \Device\NamedPipe\lsass
0x0000000001a208f8      1      1 ------ \Device\NamedPipe\lsass
0x0000000001a21130      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\dhcpcsvc.dll
0x0000000001a216f0      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\system32
0x0000000001a22028      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\raschap.dll
0x0000000001a22268      3      1 R--rwd \Device\HarddiskVolume1\Documents and Settings\testuser\PrintHood
0x0000000001a23028      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS
0x0000000001a23848      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x0000000001a24150      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\riched20.dll
0x0000000001a25150      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\tapi32.dll
0x0000000001a255a8      2      1 R--rw- \Device\HarddiskVolume1\Program Files\Windows NT\Pinball
0x0000000001a27028      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\kbd106.dll
0x0000000001a271e0      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\system32\mui\0411
0x0000000001a272f0      2      1 R--rw- \Device\HarddiskVolume1\Program Files\Internet Explorer
0x0000000001a274a8      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\ime\IMKR6_1\Dicts
0x0000000001a28b88      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wkssvc.dll
0x0000000001a293e8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\msv1_0.dll
0x0000000001a29c38      2      1 RW-r-- \Device\HarddiskVolume1\WINDOWS\system32\config\SysEvent.Evt
0x0000000001a2b700      2      1 ------ \Device\NamedPipe\lsass
0x0000000001a2c130      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\eapolqec.dll
0x0000000001a2db20      4      1 RW---- \Device\HarddiskVolume1\Documents and Settings\testuser\NTUSER.DAT
0x0000000001a2e160      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\pstorsvc.dll
0x0000000001a2ed78      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\srchasst
0x0000000001a2ee10      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\ime
0x0000000001a2eea8      2      1 R--rw- \Device\HarddiskVolume1\Program Files\Movie Maker
0x0000000001a2ef40      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\Resources\Themes\Luna
0x0000000001a2f1d0      2      1 ------ \Device\NamedPipe\lsass
0x0000000001a30340      2      1 ------ \Device\NamedPipe\lsass
0x0000000001a309f8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\ssdpapi.dll
0x0000000001a30bc0      1      1 ------ \Device\NamedPipe\net\NtControlPipe1
0x0000000001a31028      2      1 R--rw- \Device\HarddiskVolume1\Program Files\Common Files\Microsoft Shared\DAO
0x0000000001a311d0      2      1 R--rw- \Device\HarddiskVolume1\Program Files\Common Files\System\msadc
0x0000000001a312f8      2      1 R--rw- \Device\HarddiskVolume1\Program Files\Windows Media Player
0x0000000001a314b0      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\system32\Com
0x0000000001a315d8      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\system32\IME\CINTLGNT
0x0000000001a31670      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\system32\wbem
0x0000000001a317c0      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\ime\CHTIME\Applets
0x0000000001a32a90      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\imjp81k.dll
0x0000000001a32f90      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\kerberos.dll
0x0000000001a33160      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\sens.dll
0x0000000001a33450      1      1 RW---- \Device\HarddiskVolume1\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG
0x0000000001a33cf0      3      1 ------ \Device\NamedPipe\net\NtControlPipe6
0x0000000001a34028      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\inf\unregmp2.exe
0x0000000001a340d8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wuaucpl.cpl
0x0000000001a34170      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\linkinfo.dll
0x0000000001a35150      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\shdoclc.dll
0x0000000001a35338      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\browseui.dll
0x0000000001a367e8      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001a36918      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\explorer.exe
0x0000000001a37240      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\actxprxy.dll
0x0000000001a37f90      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\msprivs.dll
0x0000000001a38130      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\oleacc.dll
0x0000000001a385d8      2      1 R--rw- \Device\HarddiskVolume1\Program Files\Common Files\Microsoft Shared\web server extensions\40\_vti_bin\_vti_aut
0x0000000001a38700      2      1 R--rw- \Device\HarddiskVolume1\Program Files\Common Files\Microsoft Shared\web server extensions\40\isapi\_vti_aut
0x0000000001a38ad8      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x0000000001a39dc0      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001a39e58      1      1 ------ \Device\NamedPipe\net\NtControlPipe4
0x0000000001a3a028      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\rpcss.dll
0x0000000001a3b2b8      1      0 R--r-- \Device\HarddiskVolume1\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83.Manifest
0x0000000001a3d0b0      3      1 R--rwd \Device\HarddiskVolume1\Documents and Settings\All Users\スタート メニュー
0x0000000001a3e130      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\msimg32.dll
0x0000000001a3e4b0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\msctf.dll
0x0000000001a3f778      2      1 ------ \Device\NamedPipe\wkssvc
0x0000000001a40078      2      1 R--rw- \Device\HarddiskVolume1\Program Files\Common Files\Microsoft Shared\VGX
0x0000000001a40240      1      1 ------ \Device\NamedPipe\lsarpc
0x0000000001a40328      1      1 ------ \Device\NamedPipe\scerpc
0x0000000001a41028      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
0x0000000001a41d00      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\iphlpapi.dll
0x0000000001a425a8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\netlogon.dll
0x0000000001a429d0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\w32time.dll
0x0000000001a42df8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wdigest.dll
0x0000000001a42f90      1      0 R--rw- \Device\HarddiskVolume1\WINDOWS\system32\ctfmon.exe
0x0000000001a43318      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\winscard.dll
0x0000000001a434b0      2      1 ------ \Device\NamedPipe\atsvc
0x0000000001a43d00      2      1 ------ \Device\NamedPipe\lsass
0x0000000001a44158      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\webclnt.dll
0x0000000001a44918      3      1 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\drivers\etc
0x0000000001a44af0      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x0000000001a460e0      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\system32\wbem\xml
0x0000000001a47130      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\qutil.dll
0x0000000001a474b0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\rsaenh.dll
0x0000000001a49028      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\ntmarta.dll
0x0000000001a494c8      2      1 ------ \Device\NamedPipe\lsass
0x0000000001a498c0      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\system32
0x0000000001a4a130      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wzcsvc.dll
0x0000000001a4aae8      1      0 R--r-- \Device\HarddiskVolume1\WINDOWS\WinSxS\Policies\x86_policy.1.0.Microsoft.Windows.GdiPlus_6595b64144ccf1df_x-ww_4e8510ac\1.0.2600.5512.Policy
0x0000000001a4abb0      1      0 R--r-- \Device\HarddiskVolume1\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.SystemCompatible_6595b64144ccf1df_5.1.2600.2000_x-ww_bcc9a281.Manifest
0x0000000001a4ac48      1      1 ------ \Device\NamedPipe\net\NtControlPipe7
0x0000000001a4b288      1      1 RW-rw- \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x0000000001a4b320      1      1 RW-rw- \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x0000000001a4b3b8      1      1 RW-rw- \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x0000000001a4b450      1      1 RW-rw- \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x0000000001a4b4e8      1      1 RW-rw- \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x0000000001a4b580      1      1 RW-rw- \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x0000000001a4b618      1      1 RW-rw- \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x0000000001a4b6b0      3      1 RW-rw- \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x0000000001a4b748      1      1 RW-rw- \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x0000000001a4b828      2      1 ------ \Device\NamedPipe\srvsvc
0x0000000001a4b990      2      1 ------ \Device\NamedPipe\srvsvc
0x0000000001a4c158      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001a4c648      1      1 -W-rw- \Device\HarddiskVolume1\WINDOWS\Debug\PASSWD.LOG
0x0000000001a4cba8      1      0 R--rw- \Device\HarddiskVolume1\WINDOWS\system32\shell32.dll
0x0000000001a4d158      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\ime\IMJP8_1\imjpmig.exe
0x0000000001a51b80      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wbem\wmiutils.dll
0x0000000001a51c18      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wbem\wbemsvc.dll
0x0000000001a661f8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\csrsrv.dll
0x0000000001a663b0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\msacm32.dll
0x0000000001a67028      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\xpsp2res.dll
0x0000000001a67130      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\eventlog.dll
0x0000000001a68138      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\ime\IMJP8_1\DICTS\imjpcd.dic
0x0000000001a68e68      2      1 R--rw- \Device\HarddiskVolume1\Program Files\Common Files\SpeechEngines\Microsoft\Lexicon\1033
0x0000000001a68f90      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\system32\IME\PINTLGNT
0x0000000001a69130      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\rasadhlp.dll
0x0000000001a6a910      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\ime\SHARED
0x0000000001a6a9a8      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\ime\IMKR6_1
0x0000000001a6aad0      2      1 R--rw- \Device\HarddiskVolume1\Program Files\Common Files\Microsoft Shared\MSInfo
0x0000000001a6abb8      2      1 R--rw- \Device\HarddiskVolume1\Program Files\Internet Explorer\Connection Wizard
0x0000000001a6acd0      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS
0x0000000001a6ad68      2      1 R--rw- \Device\HarddiskVolume1\Program Files\Common Files\Microsoft Shared\web server extensions\40\isapi
0x0000000001a6ae90      2      1 R--rw- \Device\HarddiskVolume1\Program Files\Common Files\Microsoft Shared\web server extensions\40\bin\1041
0x0000000001a6af28      2      1 R--rw- \Device\HarddiskVolume1\Program Files\Common Files\Microsoft Shared\web server extensions\40\_vti_bin
0x0000000001a6b028      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\lsasrv.dll
0x0000000001a6b0e0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\ntdsapi.dll
0x0000000001a6baf0      2      1 R--rw- \Device\HarddiskVolume1\Program Files\Common Files\MSSoap\Binaries
0x0000000001a6bc18      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\system32\oobe
0x0000000001a6bcb0      2      1 R--rw- \Device\HarddiskVolume1\Program Files\Outlook Express
0x0000000001a6be20      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\browser.dll
0x0000000001a6bf90      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wbem\ncprov.dll
0x0000000001a6e130      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\rtutils.dll
0x0000000001a6ef68      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS
0x0000000001a709a0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\eappcfg.dll
0x0000000001a70b60      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\schannel.dll
0x0000000001a70d48      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\audiosrv.dll
0x0000000001a71140      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\cryptui.dll
0x0000000001a71698      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\verclsid.exe
0x0000000001a72170      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\dssenh.dll
0x0000000001a72398      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\themeui.dll
0x0000000001a72908      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\msutb.dll
0x0000000001a72b10      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\onex.dll
0x0000000001a72c90      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\system32
0x0000000001a72e78      2      1 ------ \Device\NamedPipe\wkssvc
0x0000000001a73278      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\userinit.exe
0x0000000001a74140      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\dpcdll.dll
0x0000000001a744b0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\dot3dlg.dll
0x0000000001a74678      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\credui.dll
0x0000000001a74eb8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\msctfime.ime
0x0000000001a75130      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wmi.dll
0x0000000001a757e8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\shdocvw.dll
0x0000000001a76028      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\vga64k.dll
0x0000000001a76a80      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\rpcrt4.dll
0x0000000001a76b90      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wbem\fastprox.dll
0x0000000001a76e20      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\comsvcs.dll
0x0000000001a76f90      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wbem\wbemess.dll
0x0000000001a775d0      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\system32\usmt
0x0000000001a77788      2      1 R--rw- \Device\HarddiskVolume1\Program Files\Common Files\Microsoft Shared\web server extensions\40\admisapi\scripts
0x0000000001a778d8      2      1 R--rw- \Device\HarddiskVolume1\Program Files\Common Files\Microsoft Shared\web server extensions\40\admcgi\scripts
0x0000000001a78140      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\cscui.dll
0x0000000001a78310      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\profmap.dll
0x0000000001a79b58      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x0000000001a7aa30      1      1 R--rw- \Device\HarddiskVolume1\Documents and Settings\testuser
0x0000000001a7ad68      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x0000000001a7b1c8      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\peernet
0x0000000001a7b2f0      2      1 R--rw- \Device\HarddiskVolume1\Program Files\Common Files\Microsoft Shared\Speech\1041
0x0000000001a7b388      2      1 R--rw- \Device\HarddiskVolume1\Program Files\Common Files\SpeechEngines\Microsoft
0x0000000001a7b448      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\system32\wbem\snmp
0x0000000001a7bac8      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x0000000001a7bb90      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x0000000001a7bf90      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\shell32.dll
0x0000000001a7c0e0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\urlmon.dll
0x0000000001a7c288      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\umpnpmgr.dll
0x0000000001a7c320      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\scesrv.dll
0x0000000001a7c448      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\user32.dll
0x0000000001a7dd70      2      1 ------ \Device\Afd\Endpoint
0x0000000001a7dee8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\version.dll
0x0000000001a7e4a8      3      1 R--rwd \Device\HarddiskVolume1\WINDOWS\PCHealth\HelpCtr\BATCH
0x0000000001a7ea50      2      1 ------ \Device\NamedPipe\PCHFaultRepExecPipe
0x0000000001a805f0      1      1 ------ \Device\NamedPipe\atsvc
0x0000000001a83798      1      0 R--r-- \Device\HarddiskVolume1\WINDOWS\system32\wpa.dbl
0x0000000001a83860      1      1 ------ \Device\NamedPipe\lsarpc
0x0000000001a83f90      1      0 R--rw- \Device\HarddiskVolume1\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE
0x0000000001a84028      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\msasn1.dll
0x0000000001a85440      1      1 ------ \Device\NamedPipe\trkwks
0x0000000001a855b0      2      1 ------ \Device\NamedPipe\trkwks
0x0000000001a87690      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\crypt32.dll
0x0000000001a877d0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wbem\wmisvc.dll
0x0000000001a88328      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x0000000001a88c90      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001a89130      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\system32\inetsrv
0x0000000001a894e0      2      1 ------ \Device\Afd\Endpoint
0x0000000001a89dd0      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x0000000001a8ae58      1      0 R--rwd \Device\HarddiskVolume1\Documents and Settings\testuser\スタート メニュー\プログラム\アクセサリ\desktop.ini
0x0000000001a8d368      2      1 ------ \Device\NamedPipe\srvsvc
0x0000000001a8d548      1      0 R--r-- \Device\HarddiskVolume1\WINDOWS\system32\sens.dll
0x0000000001a8e690      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\ime\SHARED\RES
0x0000000001a8e7b8      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\system32\npp
0x0000000001a8e930      2      1 R--rw- \Device\HarddiskVolume1\Program Files\Common Files\MSSoap\Binaries\Resources\1033
0x0000000001a8e9c8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wininet.dll
0x0000000001a8f3b8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wldap32.dll
0x0000000001a91028      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\netapi32.dll
0x0000000001a91a20      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\comctl32.dll
0x0000000001a91af0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\shlwapi.dll
0x0000000001a92168      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\trkwks.dll
0x0000000001a932a0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\vssapi.dll
0x0000000001a93370      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\PCHealth\UploadLB\Binaries
0x0000000001a93790      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\msvcrt.dll
0x0000000001a93900      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\mpr.dll
0x0000000001a93eb8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wuauserv.dll
0x0000000001a942d8      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\system32
0x0000000001a944a8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wuaueng.dll
0x0000000001a951f8      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\msagent\intl
0x0000000001a95320      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\msagent
0x0000000001a95470      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\secur32.dll
0x0000000001a96028      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\sxs.dll
0x0000000001a96950      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\iertutil.dll
0x0000000001a96a70      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\ieframe.dll
0x0000000001a96b80      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\normaliz.dll
0x0000000001a97028      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\vga256.dll
0x0000000001a97118      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\apphelp.dll
0x0000000001a97468      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\userenv.dll
0x0000000001a97e58      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x0000000001a98940      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\win32k.sys
0x0000000001a98a60      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\csrss.exe
0x0000000001a9b7c8      1      1 ------ \Device\NamedPipe\net\NtControlPipe0
0x0000000001a9be38      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\xpsp3res.dll
0x0000000001a9c1c8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\msimtf.dll
0x0000000001a9c2d0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\imagehlp.dll
0x0000000001a9c438      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\sensapi.dll
0x0000000001a9c6a0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\regsvr32.exe
0x0000000001a9c8a0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\spupdsvc.exe
0x0000000001a9cc08      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001a9cca0      1      0 R--rwd \Device\HarddiskVolume1\Documents and Settings\testuser\Favorites\Desktop.ini
0x0000000001a9ce98      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\rundll32.exe
0x0000000001a9d150      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001a9d1e8      1      0 R--rwd \Device\HarddiskVolume1\Documents and Settings\testuser\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
0x0000000001a9d3e0      1      0 R--rwd \Device\HarddiskVolume1\Documents and Settings\testuser\Application Data\desktop.ini
0x0000000001a9d5d8      1      0 R--rwd \Device\HarddiskVolume1\Documents and Settings\All Users\Application Data\desktop.ini
0x0000000001a9d908      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001a9d9a0      1      0 R--rwd \Device\HarddiskVolume1\Program Files\Internet Explorer\iexplore.exe
0x0000000001a9db38      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\sfc.dll
0x0000000001a9dca0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\msls31.dll
0x0000000001a9de28      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\winsta.dll
0x0000000001a9df90      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\mshtml.dll
0x0000000001a9f500      1      1 ------ \Device\NamedPipe\W32TIME
0x0000000001a9f828      2      1 ------ \Device\NamedPipe\W32TIME
0x0000000001a9fb78      1      1 RW-rw- \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x0000000001aa0a88      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\ieuinit.inf
0x0000000001aa0e28      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001aa0ec0      1      0 R--rwd \Device\HarddiskVolume1\Documents and Settings\All Users\Documents\My Music\Sample Music\desktop.ini
0x0000000001aa2028      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\basesrv.dll
0x0000000001aa2d98      2      1 ------ \Device\NamedPipe\lsass
0x0000000001aa2ec0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\shdoclc.dll
0x0000000001aa30d8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wuaucpl.cpl
0x0000000001aa32d0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\linkinfo.dll
0x0000000001aa34f8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\hnetwiz.dll
0x0000000001aa3708      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\compatui.dll
0x0000000001aa3910      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\mshearts.exe
0x0000000001aa3b18      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\spider.exe
0x0000000001aa3d28      1      0 R--rwd \Device\HarddiskVolume1\PROGRA~1\MSNGAM~1\Windows\Rvseres.dll
0x0000000001aa3f28      1      0 R--rwd \Device\HarddiskVolume1\PROGRA~1\MSNGAM~1\Windows\bckgres.dll
0x0000000001aa4028      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001aa41a0      1      0 R--rwd \Device\HarddiskVolume1\PROGRA~1\MSNGAM~1\Windows\Hrtzres.dll
0x0000000001aa43a0      1      0 R--rwd \Device\HarddiskVolume1\PROGRA~1\MSNGAM~1\Windows\chkrres.dll
0x0000000001aa46d8      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001aa4770      1      0 R--rwd \Device\HarddiskVolume1\PROGRA~1\MSNGAM~1\Windows\Shvlres.dll
0x0000000001aa4aa8      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001aa4b40      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\usmt\migwiz.exe
0x0000000001aa4d50      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\Restore\rstrui.exe
0x0000000001aa50e8      1      0 R--rwd \Device\HarddiskVolume1\PROGRA~1\MOVIEM~1\wmmres.dll
0x0000000001aa5300      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\tourstart.exe
0x0000000001aa5508      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\rcbdyctl.dll
0x0000000001aa5848      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001aa58e0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\inf\unregmp2.exe
0x0000000001aa5a00      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\comres.dll
0x0000000001aa5c60      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\xpsp1res.dll
0x0000000001aa5e70      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x0000000001aa60a0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\inetpp.dll
0x0000000001aa62d0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\netrap.dll
0x0000000001aa64f0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\win32spl.dll
0x0000000001aa6720      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\usbmon.dll
0x0000000001aa6938      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\tcpmon.dll
0x0000000001aa6b60      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\pjlmon.dll
0x0000000001aa6d78      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\cnbjmon.dll
0x0000000001aa6f90      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\localspl.dll
0x0000000001aa7310      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\spoolss.dll
0x0000000001aa7570      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wscntfy.exe
0x0000000001aa7790      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\rasdlg.dll
0x0000000001aa7a68      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\netcfgx.dll
0x0000000001aa7b78      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wbem\wmiprvsd.dll
0x0000000001aa7c10      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wbem\repdrvfs.dll
0x0000000001aa7e70      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wbem\Logs\wbemcore.log
0x0000000001aa80f8      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001aa8190      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wbem\Logs\wbemess.log
0x0000000001aa83a0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wbem\wbemcons.dll
0x0000000001aa8570      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\alg.exe
0x0000000001aa87c0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\ssdpsrv.dll
0x0000000001aa8990      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\drivers\http.sys
0x0000000001aa8d88      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\ssdpapi.dll
0x0000000001aa8f90      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\upnp.dll
0x0000000001aa91b0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\mstlsapi.dll
0x0000000001aa92d8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\winlogon.exe
0x0000000001aa9440      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\icaapi.dll
0x0000000001aa9658      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\termsrv.dll
0x0000000001aa99b8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\ipnathlp.dll
0x0000000001aa9ad0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\advpack.dll
0x0000000001aa9d70      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\browser.dll
0x0000000001aaa1d0      2      1 ------ \Device\Afd\Endpoint
0x0000000001aaa3c8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wbem\ncprov.dll
0x0000000001aaa618      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wuapi.dll
0x0000000001aaa798      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\regapi.dll
0x0000000001aaa900      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\resutils.dll
0x0000000001aaab28      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\clusapi.dll
0x0000000001aaad70      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wsock32.dll
0x0000000001aaaf90      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\mtxclu.dll
0x0000000001aab098      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\kernel32.dll
0x0000000001aab200      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\colbact.dll
0x0000000001aab428      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\comsvcs.dll
0x0000000001aab7a8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wbem\wbemess.dll
0x0000000001aabb50      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wbem\wmiprvsd.dll
0x0000000001aabdb0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\sensapi.dll
0x0000000001aabf90      1      0 R--rw- \Device\HarddiskVolume1\WINDOWS\system32\drivers\etc\hosts
0x0000000001aac2b0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR
0x0000000001aac7d0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA
0x0000000001aacf28      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP
0x0000000001aad3c0      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001aad458      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER
0x0000000001aad650      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wbem\Repository\$WinMgmt.CFG
0x0000000001aad848      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wbem\repdrvfs.dll
0x0000000001aadb70      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wbem\wmiutils.dll
0x0000000001aadd40      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wbem\wbemsvc.dll
0x0000000001aadf90      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wbem\fastprox.dll
0x0000000001aae1c8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wbem\esscli.dll
0x0000000001aae308      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\samlib.dll
0x0000000001aae3a0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\dnsapi.dll
0x0000000001aae508      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wbem\wbemcore.dll
0x0000000001aae9a8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wbem\wbemcomn.dll
0x0000000001aaec68      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wbem\wbemprox.dll
0x0000000001aaee90      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\msxml3r.dll
0x0000000001aaf288      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\msxml3.dll
0x0000000001aaf390      1      1 R--r-- \Device\HarddiskVolume1\WINDOWS\system32\kbd106.dll
0x0000000001aaf9a0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wscsvc.dll
0x0000000001aafad8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\nddeapi.dll
0x0000000001aafe50      1      1 ------ \Device\Afd\Endpoint
0x0000000001ab0028      2      1 R--rw- \Device\HarddiskVolume1\Program Files\Common Files\System\ado
0x0000000001ab0120      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\system
0x0000000001ab01b8      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\inf
0x0000000001ab02e0      2      1 R--rw- \Device\HarddiskVolume1\Program Files\Common Files\System\Ole DB
0x0000000001ab0420      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\winhttp.dll
0x0000000001ab05f0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\shfolder.dll
0x0000000001ab0808      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\mspatcha.dll
0x0000000001ab0a50      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\cabinet.dll
0x0000000001ab0c88      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\advpack.dll
0x0000000001ab0d90      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\lsass.exe
0x0000000001ab0e28      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\services.exe
0x0000000001ab0f90      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wuaueng.dll
0x0000000001ab11f0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wuauserv.dll
0x0000000001ab1400      2      1 R--rwd \Device\HarddiskVolume1\$Extend\$ObjId
0x0000000001ab15f8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\dssenh.dll
0x0000000001ab1708      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wbem\esscli.dll
0x0000000001ab17a0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wbem\wbemcore.dll
0x0000000001ab19e0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\vssapi.dll
0x0000000001ab1ce8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wbem\wmisvc.dll
0x0000000001ab1f90      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\trkwks.dll
0x0000000001ab2218      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\seclogon.dll
0x0000000001ab2438      1      0 R--r-- \Device\HarddiskVolume1\WINDOWS\system32\stdole2.tlb
0x0000000001ab2690      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\srsvc.dll
0x0000000001ab2c68      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\msimtf.dll
0x0000000001ab2dd0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\psbase.dll
0x0000000001ab3028      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
0x0000000001ab30d0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\pstorsvc.dll
0x0000000001ab3308      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\winipsec.dll
0x0000000001ab3530      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\oakley.dll
0x0000000001ab3780      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\ipsecsvc.dll
0x0000000001ab39d8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\netmsg.dll
0x0000000001ab3be8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\srvsvc.dll
0x0000000001ab3f90      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001ab4260      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\es.dll
0x0000000001ab44b8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\mspatcha.dll
0x0000000001ab4620      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\ersvc.dll
0x0000000001ab4850      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\certcli.dll
0x0000000001ab4a80      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\cryptsvc.dll
0x0000000001ab4ce8      2      1 ------ \Device\NamedPipe\keysvc
0x0000000001ab4ee8      1      0 R--rwd \Device\HarddiskVolume1\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat
0x0000000001ab5028      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\framebuf.dll
0x0000000001ab5168      1      0 R--rwd \Device\HarddiskVolume1\Documents and Settings\LocalService\Cookies\index.dat
0x0000000001ab54b0      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001ab5548      1      0 R--rwd \Device\HarddiskVolume1\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat
0x0000000001ab5760      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\webclnt.dll
0x0000000001ab5d00      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\batmeter.dll
0x0000000001ab5f28      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\stobject.dll
0x0000000001ab6178      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\mlang.dll
0x0000000001ab62b8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\shgina.dll
0x0000000001ab64f8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\webcheck.dll
0x0000000001ab6600      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\ipsecsvc.dll
0x0000000001ab6730      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\netmsg.dll
0x0000000001ab6898      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\ime\sptip.dll
0x0000000001ab69a0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\msvcp60.dll
0x0000000001ab6a38      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\ncobjapi.dll
0x0000000001ab6ba0      1      0 R--rw- \Device\HarddiskVolume1\DELL\DELLSUPPORT.ICO
0x0000000001ab6ef8      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001ab6f90      1      0 R--rwd \Device\HarddiskVolume1\Documents and Settings\testuser\My Documents\My Pictures\Desktop.ini
0x0000000001ab7028      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001ab71b8      1      1 R--rw- \Device\HarddiskVolume1\Documents and Settings\testuser
0x0000000001ab77e8      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x0000000001ab7c40      1      0 R--rwd \Device\HarddiskVolume1\Documents and Settings\testuser\My Documents\desktop.ini
0x0000000001ab8028      1      0 R--rw- \Device\HarddiskVolume1\WINDOWS\system32\mydocs.dll
0x0000000001ab80c8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\ja-jp\ieframe.dll.mui
0x0000000001ab83c8      1      0 R--rw- \Device\HarddiskVolume1\WINDOWS\ime\IMJP8_1\imjpmig.exe
0x0000000001ab8c58      1      0 R--rwd \Device\HarddiskVolume1\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\testuser.bmp
0x0000000001ab8f90      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001ab92d8      1      1 ------ \Device\NamedPipe\samr
0x0000000001ab9608      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001ab96a0      1      0 R--rwd \Device\HarddiskVolume1\Documents and Settings\All Users\スタート メニュー\プログラム\アクセサリ\ユーザー補助\desktop.ini
0x0000000001ab9898      1      0 R--rwd \Device\HarddiskVolume1\Documents and Settings\All Users\スタート メニュー\プログラム\アクセサリ\システム ツール\desktop.ini
0x0000000001ab9bc8      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001ab9c60      1      0 R--rwd \Device\HarddiskVolume1\Documents and Settings\All Users\スタート メニュー\プログラム\アクセサリ\エンターテイメント\desktop.ini
0x0000000001ab9e58      1      0 R--rwd \Device\HarddiskVolume1\Documents and Settings\All Users\スタート メニュー\プログラム\アクセサリ\通信\desktop.ini
0x0000000001aba0a0      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001aba138      1      0 R--rwd \Device\HarddiskVolume1\Documents and Settings\All Users\スタート メニュー\プログラム\管理ツール\desktop.ini
0x0000000001aba330      1      0 R--rwd \Device\HarddiskVolume1\Documents and Settings\All Users\スタート メニュー\プログラム\ゲーム\desktop.ini
0x0000000001aba660      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001aba6f8      1      0 R--rwd \Device\HarddiskVolume1\Documents and Settings\All Users\スタート メニュー\プログラム\アクセサリ\desktop.ini
0x0000000001aba8f0      1      0 R--rwd \Device\HarddiskVolume1\Documents and Settings\testuser\スタート メニュー\プログラム\アクセサリ\ユーザー補助\desktop.ini
0x0000000001abaae8      1      0 R--rwd \Device\HarddiskVolume1\Documents and Settings\testuser\スタート メニュー\プログラム\desktop.ini
0x0000000001abace0      1      0 R--rwd \Device\HarddiskVolume1\Documents and Settings\testuser\スタート メニュー\プログラム\アクセサリ\エンターテイメント\desktop.ini
0x0000000001abaed8      1      0 R--rwd \Device\HarddiskVolume1\Documents and Settings\All Users\スタート メニュー\プログラム\desktop.ini
0x0000000001abb028      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wtsapi32.dll
0x0000000001abb428      1      0 R--rwd \Device\HarddiskVolume1\Documents and Settings\All Users\スタート メニュー\プログラム\スタートアップ\desktop.ini
0x0000000001abb620      1      0 R--rwd \Device\HarddiskVolume1\Documents and Settings\All Users\スタート メニュー\desktop.ini
0x0000000001abb818      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\msutb.dll
0x0000000001abbb60      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\actxprxy.dll
0x0000000001abbd30      1      0 R--rwd \Device\HarddiskVolume1\Documents and Settings\testuser\Application Data\Microsoft\IMJP8_1\imjp81u.dic
0x0000000001abbf28      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\themeui.dll
0x0000000001abd2c8      1      0 R--rwd \Device\HarddiskVolume1\Documents and Settings\testuser\My Documents\My Music\Desktop.ini
0x0000000001abd908      1      0 R--rwd \Device\HarddiskVolume1\Documents and Settings\All Users\Documents\desktop.ini
0x0000000001abdb30      3      1 R--rwd \Device\HarddiskVolume1\Documents and Settings\testuser\NetHood
0x0000000001abe3b0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\desk.cpl
0x0000000001abe608      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x0000000001abe7d8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\shdocvw.dll
0x0000000001abe8e0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system.ini
0x0000000001abec08      1      0 R--r-- \Device\HarddiskVolume1\Documents and Settings\testuser\Local Settings\Application Data\IconCache.db
0x0000000001abed70      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\browseui.dll
0x0000000001abee90      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\AppPatch\acadproc.dll
0x0000000001abef28      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\shimeng.dll
0x0000000001abf118      1      0 R--rw- \Device\HarddiskVolume1\WINDOWS\system32\moricons.dll
0x0000000001abf2e8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\userinit.exe
0x0000000001abf528      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wkssvc.dll
0x0000000001abf780      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\audiosrv.dll
0x0000000001abf950      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\msidle.dll
0x0000000001abfb60      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\spoolsv.exe
0x0000000001abfda8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wzcsapi.dll
0x0000000001abff90      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\eappprxy.dll
0x0000000001ac0028      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\sfc_os.dll
0x0000000001ac02e0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\eappcfg.dll
0x0000000001ac0538      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\onex.dll
0x0000000001ac0768      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\dot3dlg.dll
0x0000000001ac0980      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\credui.dll
0x0000000001ac0bd8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\netshell.dll
0x0000000001ac0f28      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\netman.dll
0x0000000001ac1028      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\tapi32.dll
0x0000000001ac11d0      1      1 R--r-- \Device\HarddiskVolume1\WINDOWS\system32\kbd101.dll
0x0000000001ac13c8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\schedsvc.dll
0x0000000001ac16d8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\oembios.bin
0x0000000001ac1bc8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\raschap.dll
0x0000000001ac1e30      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\riched20.dll
0x0000000001ac21c0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\rasman.dll
0x0000000001ac2418      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\rasapi32.dll
0x0000000001ac2528      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\winsrv.dll
0x0000000001ac2690      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\adsldpc.dll
0x0000000001ac2860      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\activeds.dll
0x0000000001ac2a98      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\mprapi.dll
0x0000000001ac2cc8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\cryptui.dll
0x0000000001ac2f28      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\rastls.dll
0x0000000001ac3780      2      1 ------ \Device\NamedPipe\winlogonrpc
0x0000000001ac3b60      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\Microsoft\Protect\S-1-5-18\User\4e2e0405-d641-4c56-8afd-e15cb50a0349
0x0000000001ac3e90      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001ac3f28      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\Web\Wallpaper\草原.bmp
0x0000000001ac4188      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\oembios.dat
0x0000000001ac4388      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\oembios.sig
0x0000000001ac4588      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\dpcdll.dll
0x0000000001ac4758      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\powrprof.dll
0x0000000001ac4980      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\cscui.dll
0x0000000001ac4c20      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x0000000001ac4e18      1      0 RW-rwd \Device\HarddiskVolume1\Documents and Settings\testuser\Local Settings\desktop.ini
0x0000000001ac4f28      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\lpk.dll
0x0000000001ac5230      2      1 ------ \Device\NamedPipe\Winsock2\CatalogChangeListener-2e0-0
0x0000000001ac5888      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\shgina.dll
0x0000000001ac5b90      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001ac5c28      1      1 ------ \Device\NamedPipe\samr
0x0000000001ac5e48      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\comres.dll
0x0000000001ac6098      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\clbcatq.dll
0x0000000001ac6228      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\odbc32.dll
0x0000000001ac6390      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\ime\IMJP8_1\DICTS\imjpcd.dic
0x0000000001ac6560      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\ime\IMJP8_1\DICTS\imjpsb.dic
0x0000000001ac6770      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\ime\IMJP8_1\DICTS\imjpln.dic
0x0000000001ac6988      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\ime\IMJP8_1\DICTS\imjpnm.dic
0x0000000001ac6b98      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\ime\IMJP8_1\DICTS\imjpch.dic
0x0000000001ac6da8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\ime\IMJP8_1\DICTS\imjptk.dic
0x0000000001ac6f90      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\ime\IMJP8_1\DICTS\imjpzp.dic
0x0000000001ac75c0      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x0000000001ac7b40      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\ime\IMJP8_1\DICTS\imjpst.dic
0x0000000001ac7d60      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\IMJP8_1\imjp81u.dic
0x0000000001ac8110      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001ac81a8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\ime\IMJP8_1\DICTS\imjpgn.grm
0x0000000001ac82f0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\mprapi.dll
0x0000000001ac8530      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\msi.dll
0x0000000001ac88f8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\winspool.drv
0x0000000001ac8ac8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wlnotify.dll
0x0000000001ac8d00      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\dimsntfy.dll
0x0000000001ac8f28      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\cscdll.dll
0x0000000001ac9148      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\oleaccrc.dll
0x0000000001ac9318      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\oleacc.dll
0x0000000001ac9428      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\usp10.dll
0x0000000001ac9590      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\msimg32.dll
0x0000000001ac97a0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\duser.dll
0x0000000001ac98b0      1      1 ------ \Device\NamedPipe\InitShutdown
0x0000000001ac9b30      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\esent.dll
0x0000000001ac9ef8      2      1 R--rw- \Device\HarddiskVolume1\Program Files\Common Files\Microsoft Shared\web server extensions\40\_vti_bin\_vti_adm
0x0000000001aca098      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\dot3api.dll
0x0000000001aca2c8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\qutil.dll
0x0000000001aca528      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\atl.dll
0x0000000001aca6f8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\eapolqec.dll
0x0000000001aca8c8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wmi.dll
0x0000000001acaad0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\rtutils.dll
0x0000000001acaca0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wzcsvc.dll
0x0000000001acaea0      2      1 ------ \Device\NamedPipe\lsass
0x0000000001ace078      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\lmhsvc.dll
0x0000000001ace290      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\logonui.exe.manifest
0x0000000001ace488      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\logonui.exe
0x0000000001ace6a0      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\Resources\Themes\Luna\Shell\Metallic
0x0000000001ace7c8      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\Resources\Themes\Luna\Shell\Homestead
0x0000000001acee18      1      0 RW-rwd \Device\HarddiskVolume1\Documents and Settings\LocalService\Local Settings\desktop.ini
0x0000000001acef28      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\drivers\dxg.sys
0x0000000001acf0c0      4      1 RW---- \Device\HarddiskVolume1\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
0x0000000001acf4b0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\dnsrslvr.dll
0x0000000001acf680      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\dhcpcsvc.dll
0x0000000001acf850      1      1 ------ \Device\NamedPipe\net\NtControlPipe5
0x0000000001acfa60      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\rasadhlp.dll
0x0000000001acfc70      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\winrnr.dll
0x0000000001acfe40      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wshtcpip.dll
0x0000000001ad0090      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\hnetcfg.dll
0x0000000001ad0460      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\mswsock.dll
0x0000000001ad0708      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\system32
0x0000000001ad0900      1      0 RW-rwd \Device\HarddiskVolume1\Documents and Settings\NetworkService\Local Settings\desktop.ini
0x0000000001ad0ad0      4      1 RW---- \Device\HarddiskVolume1\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
0x0000000001ad0ec0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\config\SysEvent.Evt
0x0000000001ad10a8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\config\SecEvent.Evt
0x0000000001ad1310      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\config\Internet.evt
0x0000000001ad1508      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\config\AppEvent.Evt
0x0000000001ad1720      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\netevent.dll
0x0000000001ad18f0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\eventlog.dll
0x0000000001ad1b50      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\ntkrnlpa.exe
0x0000000001ad1d60      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\xpsp2res.dll
0x0000000001ad1f68      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\scecli.dll
0x0000000001ad2028      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\rsaenh.dll
0x0000000001ad2130      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\rpcss.dll
0x0000000001ad2278      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\activeds.dll
0x0000000001ad24b8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\ntmarta.dll
0x0000000001ad2688      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\svchost.exe
0x0000000001ad2858      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\scecli.dll
0x0000000001ad2a28      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\ntoskrnl.exe
0x0000000001ad2c30      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wtsapi32.dll
0x0000000001ad2e58      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\winscard.dll
0x0000000001ad3528      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wdigest.dll
0x0000000001ad36f8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\w32time.dll
0x0000000001ad3880      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wintrust.dll
0x0000000001ad39e8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\netlogon.dll
0x0000000001ad3c10      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\iphlpapi.dll
0x0000000001ad3de0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\msv1_0.dll
0x0000000001ad3f50      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\psapi.dll
0x0000000001ad4288      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\kerberos.dll
0x0000000001ad4568      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\msprivs.dll
0x0000000001ad4738      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\WindowsLogon.manifest
0x0000000001ad4930      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\msctf.dll
0x0000000001ad4d50      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\Fonts\serife.fon
0x0000000001ad4f90      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\Fonts\sserife.fon
0x0000000001ad5248      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\Fonts\coure.fon
0x0000000001ad5550      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001ad55e8      2      1 ------ \Device\NamedPipe\protected_storage
0x0000000001ad57e0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\imjp81k.dll
0x0000000001ad5cc0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\msctfime.ime
0x0000000001ad5f90      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\schannel.dll
0x0000000001ad6200      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\uxtheme.dll
0x0000000001ad6540      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\msacm32.dll
0x0000000001ad6710      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\winmm.dll
0x0000000001ad68e0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\AppPatch\acgenral.dll
0x0000000001ad6bb0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\cryptdll.dll
0x0000000001ad6de8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\samsrv.dll
0x0000000001ad6f68      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\setupapi.dll
0x0000000001ad7178      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\samlib.dll
0x0000000001ad73b0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\dnsapi.dll
0x0000000001ad7580      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\ntdsapi.dll
0x0000000001ad77a8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\lsasrv.dll
0x0000000001ad7c88      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\AppPatch\acadproc.dll
0x0000000001ad7e58      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\shimeng.dll
0x0000000001ad8078      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\umpnpmgr.dll
0x0000000001ad8248      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\scesrv.dll
0x0000000001ad8418      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\msvcp60.dll
0x0000000001ad86c0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\ncobjapi.dll
0x0000000001ad88f8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\lsass.exe
0x0000000001ad8d08      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\system32
0x0000000001ad9028      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\services.exe
0x0000000001ad94a0      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001ad9538      1      1 ------ \Device\NamedPipe\lsarpc
0x0000000001ad9868      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001ad9900      1      0 R--r-- \Device\HarddiskVolume1\WINDOWS\WinSxS\Policies\x86_policy.5.1.Microsoft.Windows.SystemCompatible_6595b64144ccf1df_x-ww_a0111510\5.1.2600.2000.Policy
0x0000000001ad9c30      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001ad9cc8      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x0000000001ad9ec0      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x0000000001ada220      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\AppPatch\sysmain.sdb
0x0000000001ada388      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\seclogon.dll
0x0000000001ada5c8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\sfc_os.dll
0x0000000001ada798      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\sfc.dll
0x0000000001ada9a8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\shsvcs.dll
0x0000000001adac90      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\odbcint.dll
0x0000000001adae98      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\WindowsShell.Manifest
0x0000000001adb2a8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x0000000001adb9d0      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001adba68      2      1 ------ \Device\NamedPipe\InitShutdown
0x0000000001adbd98      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001adbe30      3      1 ------ \Device\NamedPipe\net\NtControlPipe1
0x0000000001adc028      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\Fonts\wst_swed.fon
0x0000000001adc0e8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\sxs.dll
0x0000000001adc2b8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\odbc32.dll
0x0000000001adc488      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\msgina.dll
0x0000000001adc6e0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\shfolder.dll
0x0000000001adc968      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\mtxclu.dll
0x0000000001adca00      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\colbact.dll
0x0000000001adcc60      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\Fonts\marlett.ttf
0x0000000001adce30      1      1 ------ \Device\NamedPipe\lsarpc
0x0000000001add230      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\Fonts\wst_span.fon
0x0000000001add448      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\Fonts\wst_ital.fon
0x0000000001add618      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\Fonts\wst_germ.fon
0x0000000001add7e8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\Fonts\wst_fren.fon
0x0000000001add9b8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\Fonts\wst_engl.fon
0x0000000001addb88      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\Fonts\wst_czec.fon
0x0000000001addd58      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\Fonts\symbole.fon
0x0000000001addf28      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\Fonts\jsmalle.fon
0x0000000001ade138      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\Fonts\modern.fon
0x0000000001ade340      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\Fonts\script.fon
0x0000000001ade548      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\Fonts\roman.fon
0x0000000001ade950      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\kbdnec.dll
0x0000000001adeb20      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\kbd106.dll
0x0000000001adecf0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\kbd101.dll
0x0000000001adeec0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\KBDJPN.DLL
0x0000000001adf1e8      1      1 ------ \Device\NamedPipe\protected_storage
0x0000000001adf348      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\imm32.dll
0x0000000001adf5a0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\ctype.nls
0x0000000001adf770      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\ws2help.dll
0x0000000001adf940      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\ws2_32.dll
0x0000000001adfb10      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wintrust.dll
0x0000000001adfe30      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\winsta.dll
0x0000000001ae0388      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\setupapi.dll
0x0000000001ae0558      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\regapi.dll
0x0000000001ae0790      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\psapi.dll
0x0000000001ae0960      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\netapi32.dll
0x0000000001ae0c88      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\profmap.dll
0x0000000001ae0e58      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\nddeapi.dll
0x0000000001ae1058      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\msasn1.dll
0x0000000001ae1228      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\crypt32.dll
0x0000000001ae13f8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\authz.dll
0x0000000001ae1630      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\winlogon.exe
0x0000000001ae1748      3      1 ------ \Device\NamedPipe\net\NtControlPipe2
0x0000000001ae1b88      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\Fonts\cga40woa.fon
0x0000000001ae1d58      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\Fonts\cga80woa.fon
0x0000000001ae1f28      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\Fonts\ega40woa.fon
0x0000000001ae2028      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\Fonts\mingliu.ttc
0x0000000001ae2180      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\Fonts\ega80woa.fon
0x0000000001ae2350      1      1 R--r-- \Device\HarddiskVolume1\WINDOWS\system32\kbd101.dll
0x0000000001ae2520      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\Fonts\app932.fon
0x0000000001ae26f0      2      1 ------ \Device\NamedPipe\TerminalServer\AutoReconnect
0x0000000001ae28e8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\vga64k.dll
0x0000000001ae2ab8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\vga256.dll
0x0000000001ae2c88      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\framebuf.dll
0x0000000001ae2e58      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\vga.dll
0x0000000001af1090      1      0 R--rwd \Device\HarddiskVolume1\Documents and Settings\testuser\スタート メニュー\desktop.ini
0x0000000001af1158      2      1 ------ \Device\NamedPipe\spoolss
0x0000000001af2310      1      1 ------ \Device\NamedPipe\lsarpc
0x0000000001af4160      1      1 ------ \Device\NamedPipe\spoolss
0x0000000001af4bb0      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x0000000001af5158      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001af75a0      1      1 RW-rw- \Device\HarddiskVolume1\Documents and Settings\LocalService\Cookies\index.dat
0x0000000001af7638      1      1 RW-rw- \Device\HarddiskVolume1\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat
0x0000000001af7e88      1      1 ------ \Device\NamedPipe\keysvc
0x0000000001af91a0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\Fonts\gulim.ttc
0x0000000001af9370      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\Fonts\simsun.ttc
0x0000000001af9540      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\Fonts\micross.ttf
0x0000000001af9708      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\$winnt$.inf
0x0000000001af9ab8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\Fonts\l_10646.ttf
0x0000000001af9dc0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\mshtml.dll
0x0000000001af9f28      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\Fonts\msgothic.ttc
0x0000000001afa270      2      1 RW-rw- \Device\NamedPipe\
0x0000000001afaee8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\drivers\dxg.sys
0x0000000001aff240      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\FNTCACHE.DAT
0x0000000001aff938      1      1 R--r-- \Device\HarddiskVolume1\WINDOWS\system32\kbd106.dll
0x0000000001b00028      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\unicode.nls
0x0000000001b005a0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\rpcrt4.dll
0x0000000001b00e00      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001b00e98      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\Fonts\jvgasys.fon
0x0000000001b01140      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\powrprof.dll
0x0000000001b02028      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\svchost.exe
0x0000000001b02370      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\winhttp.dll
0x0000000001b02498      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\rastls.dll
0x0000000001b02648      1      0 R--rw- \Device\HarddiskVolume1\WINDOWS\explorer.exe
0x0000000001b029d0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\locale.nls
0x0000000001b02b78      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\Help\Tours\mmTour
0x0000000001b02c10      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\system32\IME\TINTLGNT
0x0000000001b02e18      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\system32\spool\drivers\color
0x0000000001b033c8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\url.dll
0x0000000001b035a0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\rundll32.exe
0x0000000001b03a80      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\urlmon.dll
0x0000000001b03d08      2      1 R--rw- \Device\HarddiskVolume1\Program Files\xerox\nwwia
0x0000000001b03e30      2      1 R--rw- \Device\HarddiskVolume1\Program Files\Windows NT\Accessories
0x0000000001b041b0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\ipnathlp.dll
0x0000000001b04518      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\sorttbls.nls
0x0000000001b048e8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\user32.dll
0x0000000001b04eb8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\AppPatch\acgenral.dll
0x0000000001b05138      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\dimsntfy.dll
0x0000000001b05888      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\system32\1041
0x0000000001b05970      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\system32\1033
0x0000000001b05a08      2      1 R--rw- \Device\HarddiskVolume1\Program Files\Common Files\System
0x0000000001b05aa0      2      1 R--rw- \Device\HarddiskVolume1\Program Files\Windows NT
0x0000000001b05b78      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\version.dll
0x0000000001b05f90      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wininet.dll
0x0000000001b06380      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\sortkey.nls
0x0000000001b06530      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\clusapi.dll
0x0000000001b066a0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wsock32.dll
0x0000000001b067e0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\xjis.nls
0x0000000001b06a40      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\resutils.dll
0x0000000001b06c30      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\lpk.dll
0x0000000001b07130      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\hnetcfg.dll
0x0000000001b07248      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\basesrv.dll
0x0000000001b074a8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wuapi.dll
0x0000000001b07740      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wldap32.dll
0x0000000001b07f28      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\comctl32.dll
0x0000000001b080f0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\usp10.dll
0x0000000001b08420      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\shlwapi.dll
0x0000000001b08898      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\msvcrt.dll
0x0000000001b08ad8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\ie4uinit.exe
0x0000000001b08c98      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\mpr.dll
0x0000000001b08eb8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\ssdpsrv.dll
0x0000000001b09130      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wshtcpip.dll
0x0000000001b095a0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\ntvdm.exe
0x0000000001b09e98      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wow32.dll
0x0000000001b0a130      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\lmhsvc.dll
0x0000000001b0ab00      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\secur32.dll
0x0000000001b0ac90      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\localspl.dll
0x0000000001b0ae00      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\spoolss.dll
0x0000000001b0af00      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\iertutil.dll
0x0000000001b0b028      1      1 ------ \Device\NamedPipe\winlogonrpc
0x0000000001b0b3e0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\ieframe.dll
0x0000000001b0b550      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\regsvr32.exe
0x0000000001b0b6a0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\spupdsvc.exe
0x0000000001b0b870      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\apphelp.dll
0x0000000001b0ba00      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\tcpmon.dll
0x0000000001b0bb70      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\pjlmon.dll
0x0000000001b0bc70      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\userenv.dll
0x0000000001b0c138      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wlnotify.dll
0x0000000001b0c2f8      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\system32
0x0000000001b0cb40      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\normaliz.dll
0x0000000001b0cd00      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\cnbjmon.dll
0x0000000001b0d7e0      2      1 RW--w- \Device\HarddiskVolume1\pagefile.sys
0x0000000001b0de20      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\netcfgx.dll
0x0000000001b0df90      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\wbem\wbemcons.dll
0x0000000001b0e580      1      1 RW---- \Device\HarddiskVolume1\WINDOWS\system32\config\SECURITY.LOG
0x0000000001b0e640      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\winmm.dll
0x0000000001b0e9d0      4      1 RW---- \Device\HarddiskVolume1\WINDOWS\system32\config\software
0x0000000001b0eb90      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\inetpp.dll
0x0000000001b0ed90      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\win32k.sys
0x0000000001b0f378      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\schedsvc.dll
0x0000000001b0f600      2      1 ------ \Device\NamedPipe\lsass
0x0000000001b0f9a0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\netman.dll
0x0000000001b100d0      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\system32
0x0000000001b10398      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\csrss.exe
0x0000000001b106b0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\csrsrv.dll
0x0000000001b10808      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\winsrv.dll
0x0000000001b10cc0      1      0 R--r-d \Device\HarddiskVolume1\WINDOWS\system32\lz32.dll
0x0000000001b110f0      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\system32
0x0000000001b113f8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\authz.dll
0x0000000001b115d0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\autochk.exe
0x0000000001b117d8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\Fonts\jvgafix.fon
0x0000000001b119a8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\Fonts\vga932.fon
0x0000000001b11f90      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\olecli32.dll
0x0000000001b12100      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\olesvr32.dll
0x0000000001b12210      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\sfcfiles.dll
0x0000000001b12360      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\imagehlp.dll
0x0000000001b12868      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001b129d0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\oleaut32.dll
0x0000000001b12b10      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001b12bb8      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001b13218      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\advapi32.dll
0x0000000001b13600      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\comdlg32.dll
0x0000000001b13a38      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\olecnv32.dll
0x0000000001b13f90      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\ntdll.dll
0x0000000001b14110      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\olethk32.dll
0x0000000001b14260      1      0 R--rwd \Device\HarddiskVolume1\Program Files\Internet Explorer\iexplore.exe
0x0000000001b14428      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\msls31.dll
0x0000000001b14f90      1      1 RW---- \Device\HarddiskVolume1\WINDOWS\system32\config\SAM.LOG
0x0000000001b151a0      4      1 RW---- \Device\HarddiskVolume1\WINDOWS\system32\config\SAM
0x0000000001b15370      1      1 RW---- \Device\HarddiskVolume1\WINDOWS\system32\config\default.LOG
0x0000000001b155a8      4      1 RW---- \Device\HarddiskVolume1\WINDOWS\system32\config\default
0x0000000001b15740      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\kernel32.dll
0x0000000001b158a8      1      1 RW---- \Device\HarddiskVolume1\WINDOWS\system32\config\system.LOG
0x0000000001b15bd8      4      1 RW---- \Device\HarddiskVolume1\WINDOWS\system32\config\system
0x0000000001b160d8      1      1 RW---- \Device\HarddiskVolume1\WINDOWS\system32\config\software.LOG
0x0000000001b162a8      4      1 RW---- \Device\HarddiskVolume1\WINDOWS\system32\config\SECURITY
0x0000000001b16680      1      0 R--r-d \Device\HarddiskVolume1\WINDOWS\system32\wow32.dll
0x0000000001b16898      1      0 R--r-d \Device\HarddiskVolume1\WINDOWS\system32\url.dll
0x0000000001b16a98      1      0 R--r-d \Device\HarddiskVolume1\WINDOWS\system32\olethk32.dll
0x0000000001b16c98      1      0 R--r-d \Device\HarddiskVolume1\WINDOWS\system32\olesvr32.dll
0x0000000001b16f28      1      0 R--r-d \Device\HarddiskVolume1\WINDOWS\system32\olecnv32.dll
0x0000000001b171a8      1      0 R--r-d \Device\HarddiskVolume1\WINDOWS\system32\olecli32.dll
0x0000000001b175a0      1      0 RW---- \Device\HarddiskVolume1\WINDOWS\bootstat.dat
0x0000000001b18b90      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x0000000001b18cc8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\lz32.dll
0x0000000001b1a028      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\ole32.dll
0x0000000001b1a760      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\smss.exe
0x0000000001b1ba28      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001b1be68      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001b1c2f0      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001b1c548      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001b1c648      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001b1c818      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001b1cf40      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\sfcfiles.dll
0x0000000001b4d028      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001b4d8c0      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001b4d968      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\gdi32.dll
0x0000000001b4dc78      3      0 RWD--- \Device\HarddiskVolume1\$Mft
0x0000000001b4df08      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\comdlg32.dll
0x0000000001b4e7d8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\cryptdll.dll
0x0000000001b4ea30      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\samsrv.dll
0x0000000001b4ec68      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\ole32.dll
0x0000000001b4f470      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\vga.dll
0x0000000001b4fa60      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001b4fb60      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\advapi32.dll
0x0000000001b4fd30      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001b70368      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\oleaut32.dll
0x0000000001b71f90      3      0 RWD--- \Device\HarddiskVolume1\$LogFile
0x0000000001b72718      3      0 RWD--- \Device\HarddiskVolume1\$MftMirr
0x0000000001b78168      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001b78698      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001b78798      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001b79308      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001b79408      1      0 R--rwd \Device\HarddiskVolume1\Documents and Settings\All Users\Documents\My Pictures\Desktop.ini
0x0000000001b79878      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\ie4uinit.exe
0x0000000001b79e40      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001b79f40      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001b7aae0      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001b7abe0      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001b7b248      2      1 R--rw- \Device\HarddiskVolume1\WINDOWS\ime\CHSIME\APPLETS
0x0000000001b7b748      2      1 ------ \Device\NamedPipe\ntsvcs
0x0000000001b7be78      1      0 R--rwd \Device\HarddiskVolume1\Documents and Settings\testuser\Application Data\Microsoft\Protect\CREDHIST
0x0000000001b7e028      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001b7e6e8      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001b7e788      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001b7e820      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001b7fa08      1      1 R--rw- \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x0000000001b7faf0      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\verclsid.exe
0x0000000001b9a890      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\AppPatch\drvmain.sdb
0x0000000001b9c458      1      0 R--rwd \Device\HarddiskVolume1\Documents and Settings\All Users\Documents\My Music\Desktop.ini
0x0000000001b9cbd8      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001b9d028      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001b9d180      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001b9d3e0      1      0 R--rwd \Device\HarddiskVolume1\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\desktop.ini
0x0000000001b9d678      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001b9d778      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001b9f350      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001b9f5e8      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001b9f6e8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\autochk.exe
0x0000000001ba2b90      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001bc7750      1      0 R----- \Device\HarddiskVolume1\WINDOWS\Prefetch\NTOSBOOT-B00DFAAD.pf
0x0000000001bc7b20      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001bc7e58      3      0 RWD--- \Device\HarddiskVolume1\$BitMap
0x0000000001bc7f68      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001bc8428      1      0 R--r-- \Device\HarddiskVolume1\WINDOWS\system32\drivers\fips.sys
0x0000000001bc8f90      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001bc91a8      1      0 R--rwd \Device\HarddiskVolume1\Documents and Settings\testuser\Application Data\Microsoft\Protect\S-1-5-21-1957994488-2052111302-1078081533-1004\c96a9b95-69ee-4407-ab96-9d94b9cf84c8
0x0000000001bc9380      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\ntshrui.dll
0x0000000001bc95d8      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001bc9e30      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001bca2a0      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001bca4c8      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\gdi32.dll
0x0000000001bcaa78      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001bcb378      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001bcb478      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001bcbb98      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001bcbf90      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001bcc130      3      0 RWD--- \Device\HarddiskVolume1\$Directory
0x0000000001bd1230      1      0 R--rwd \Device\HarddiskVolume1\WINDOWS\system32\uxtheme.dll
0x0000000001bd1bc8      1      0 R--r-- \Device\HarddiskVolume1\WINDOWS\system32\ntdll.dll
0x0000000001bd3f90      3      0 RWD--- \Device\HarddiskVolume1\$Mft

mutantscan

Offset(P)              #Ptr     #Hnd Signal Thread           CID Name
------------------ -------- -------- ------ ---------- --------- ----
0x000000000193cbd0        1        1      1 0x00000000           
0x000000000193cc40        1        1      1 0x00000000           
0x000000000194d9e0        1        1      1 0x00000000           
0x00000000019744a8        2        1      1 0x00000000           ExplorerIsShellMutex
0x0000000001979928        2        1      1 0x00000000           238FAD3109D3473aB4764B20B3731840
0x0000000001979978        2        1      1 0x00000000           4FCC0DEFE22C4f138FB9D5AF25FD9398
0x00000000019799c8        2        1      1 0x00000000           0CADFD67AF62496dB34264F000F5624A
0x00000000019c72d8        1        1      1 0x00000000           
0x00000000019cb148        1        1      1 0x00000000           
0x00000000019cb1b8        1        1      1 0x00000000           
0x00000000019ce110        2        1      1 0x00000000           MSCTF.GCompartListMUTEX.DefaultS-1-5-21-1957994488-2052111302-1078081533-1004
0x00000000019ce868        2        1      1 0x00000000           Mutex__Satori_GlobalFlag_Satori_81__S-1-5-21-1957994488-2052111302-1078081533-1004
0x00000000019cee10        2        1      1 0x00000000           _Satori_81_Satori_KnlDict_DicWriteMutex_S-1-5-21-1957994488-2052111302-1078081533-1004
0x00000000019cf030        2        1      1 0x00000000           c:!documents and settings!localservice!cookies!
0x00000000019d3e90        2        1      1 0x00000000           {A3BD3259-3E4F-428a-84C8-F0463A9D3EB5}
0x00000000019d42e0        1        1      1 0x00000000           
0x00000000019d5520        1        1      1 0x00000000           
0x00000000019d8108        2        1      1 0x00000000           _!MSFTHISTORY!_
0x00000000019d8aa0        2        1      1 0x00000000           SingleSesMutex
0x00000000019d8f30        1        1      1 0x00000000           
0x00000000019d9290        1        1      1 0x00000000           
0x00000000019dd168        1        1      1 0x00000000           
0x00000000019dd1d8        1        1      1 0x00000000           
0x00000000019e07f0        1        1      1 0x00000000           
0x00000000019e3e48        4        2      0 0x81645558   736:760 NETMAN
0x00000000019e4308        3        2      1 0x00000000           CTF.Compart.MutexDefaultS-1-5-21-1957994488-2052111302-1078081533-1004
0x00000000019e4910        3        2      1 0x00000000           CTF.LBES.MutexDefaultS-1-5-21-1957994488-2052111302-1078081533-1004
0x00000000019e4b28        1        1      1 0x00000000           
0x00000000019e4e28        3        2      1 0x00000000           CTF.TMD.MutexDefaultS-1-5-21-1957994488-2052111302-1078081533-1004
0x00000000019e4e78        3        2      1 0x00000000           CTF.Layouts.MutexDefaultS-1-5-21-1957994488-2052111302-1078081533-1004
0x00000000019e4ec8        3        2      1 0x00000000           CTF.Asm.MutexDefaultS-1-5-21-1957994488-2052111302-1078081533-1004
0x00000000019e5ac0        2        1      1 0x00000000           PnP_Init_Mutex
0x00000000019ec2a8        1        1      1 0x00000000           
0x00000000019f8778        2        1      1 0x00000000           CtfmonInstMutexDefaultS-1-5-21-1957994488-2052111302-1078081533-1004
0x00000000019fa030        2        1      1 0x00000000           c:!documents and settings!localservice!local settings!temporary internet files!content.ie5!
0x00000000019fabb8        3        2      1 0x00000000           ZoneAttributeCacheCounterMutex
0x00000000019faca8        2        1      1 0x00000000           ZonesCacheCounterMutex
0x0000000001a0b8a8        1        1      1 0x00000000           
0x0000000001a113a0        1        1      1 0x00000000           
0x0000000001a11410        1        1      1 0x00000000           
0x0000000001a15dc0        2        1      1 0x00000000           _Satori_81_Satori_KnlDict_DicWriteMutex_S-1-5-18
0x0000000001a15e10        4        3      1 0x00000000           _Satori_81_MutexObject_S-1-5-18
0x0000000001a17750        2        1      1 0x00000000           Mutex__Satori_GlobalFlag_Satori_81__S-1-5-18
0x0000000001a1a0c0        1        1      1 0x00000000           
0x0000000001a1a130        1        1      1 0x00000000           
0x0000000001a1e8b8        2        1      1 0x00000000           WPA_LICSTORE_MUTEX
0x0000000001a1e908        2        1      1 0x00000000           WPA_HWID_MUTEX
0x0000000001a1e958        2        1      1 0x00000000           WPA_LT_MUTEX
0x0000000001a1e9a8        2        1      1 0x00000000           WPA_RT_MUTEX
0x0000000001a1e9f8        2        1      1 0x00000000           WPA_PR_MUTEX
0x0000000001a21f00        1        1      1 0x00000000           
0x0000000001a21f70        1        1      1 0x00000000           
0x0000000001a21fe0        1        1      1 0x00000000           
0x0000000001a233e8        6        5      1 0x00000000           ShimCacheMutex
0x0000000001a2a2e0        1        1      1 0x00000000           
0x0000000001a2a320        1        1      1 0x00000000           
0x0000000001a2b7b0        2        1      1 0x00000000           !IETld!Mutex
0x0000000001a2c468        1        1      1 0x00000000           
0x0000000001a2c500        1        1      1 0x00000000           
0x0000000001a2d808        1        1      1 0x00000000           
0x0000000001a33118        2        1      1 0x00000000           userenv: User Registry policy mutex
0x0000000001a3e580        2        1      1 0x00000000           RasPbFile
0x0000000001a3e668        1        1      1 0x00000000           
0x0000000001a3f020        1        1      1 0x00000000           
0x0000000001a3f0a8        1        1      1 0x00000000           
0x0000000001a3f698        4        3      1 0x00000000           _Satori_81_MutexObject_S-1-5-21-1957994488-2052111302-1078081533-1004
0x0000000001a48208        2        1      1 0x00000000           userenv: Machine Registry policy mutex
0x0000000001a48518        1        1      1 0x00000000           
0x0000000001a49c90        2        1      1 0x00000000           msgina: InteractiveLogonRequestMutex
0x0000000001a4a408        1        1      1 0x00000000           
0x0000000001a65fe0        2        1      1 0x00000000           userenv: machine policy mutex
0x0000000001a75d80        2        1      1 0x00000000           _SHuassist.mtx
0x0000000001a75dd0        2        1      1 0x00000000           ZonesCounterMutex
0x0000000001a80838        1        1      1 0x00000000           
0x0000000001a84460        1        1      1 0x00000000           
0x0000000001a880e0        3        2      1 0x00000000           CTF.TimListCache.FMPDefaultS-1-5-21-1957994488-2052111302-1078081533-1004MUTEX.DefaultS-1-5-21-1957994488-2052111302-1078081533-1004
0x0000000001a88fe0        2        1      1 0x00000000           ZonesLockedCacheCounterMutex
0x0000000001a89758        3        2      1 0x00000000           SRDataStore
0x0000000001a8f858        1        1      1 0x00000000           
0x0000000001a8f8c8        1        1      1 0x00000000           
0x0000000001a92120        1        1      1 0x00000000           
0x0000000001a92d70        2        1      1 0x00000000           WindowsUpdateTracingMutex
0x0000000001a93b68        1        1      1 0x00000000           
0x0000000001a93bd8        1        1      1 0x00000000           
0x0000000001a95698        1        1      1 0x00000000           
0x0000000001a9b260        2        1      1 0x00000000           c:!documents and settings!localservice!local settings!history!history.ie5!
0x0000000001a9b568        1        1      1 0x00000000           
0x0000000001ab2aa0        2        1      1 0x00000000           WininetProxyRegistryMutex
0x0000000001abd178        1        1      1 0x00000000           
0x0000000001ac33a8        1        1      1 0x00000000           
0x0000000001acadd8        1        1      1 0x00000000           
0x0000000001acae18        1        1      1 0x00000000           
0x0000000001ad0190        1        1      1 0x00000000           
0x0000000001ad0200        1        1      1 0x00000000           
0x0000000001ad4ea0        2        1      1 0x00000000           WininetStartupMutex
0x0000000001ad78c8        1        1      1 0x00000000           
0x0000000001aebc50        1        1      1 0x00000000           
0x0000000001af3148        1        1      1 0x00000000           
0x0000000001af31b8        1        1      1 0x00000000           
0x0000000001af5260        2        1      1 0x00000000           msgina: InteractiveLogonMutex
0x0000000001af7238        1        1      1 0x00000000           
0x0000000001b04260        1        1      1 0x00000000           
0x0000000001b042d0        1        1      1 0x00000000           
0x0000000001b064e8       12       11      1 0x00000000           SHIMLIB_LOG_MUTEX
0x0000000001b0d548        1        1      1 0x00000000           
0x0000000001b0d5b8        1        1      1 0x00000000           
0x0000000001b131d0        1        1      1 0x00000000           
0x0000000001b4f7b8        1        1      1 0x00000000           
0x0000000001b4f828        1        1      1 0x00000000           
0x0000000001b73b80        1        1      1 0x00000000           
0x0000000001b73bf0        1        1      1 0x00000000           
0x0000000001b73d58        1        1      1 0x00000000           
0x0000000001b7f3b0        2        1      1 0x00000000           winlogon: Logon UserProfileMapping Mutex
0x0000000001bc8308        2        1      1 0x00000000           userenv: user policy mutex
0x0000000001bc8c58        1        1      1 0x00000000           
0x0000000001bcae98        1        1      1 0x00000000           
0x0000000001bcb990        1        1      1 0x00000000           

symlinkscan

Offset(P)            #Ptr   #Hnd Creation time                  From                 To                                                          
------------------ ------ ------ ------------------------------ -------------------- ------------------------------------------------------------
0x0000000001f29200      1      0 2020-02-11 12:57:10 UTC+0000   DosDevices           \??                                                         
0x0000000001f94030      1      0 2020-02-11 12:57:10 UTC+0000   Global               \GLOBAL??                                                   
0x0000000001f949e0      1      0 2020-02-11 12:57:18 UTC+0000   SystemRoot           \Device\Harddisk0\Partition1\WINDOWS                        
0x00000000023292f8      1      0 2020-02-11 12:57:19 UTC+0000   IPNAT                \Device\IPNAT                                               
0x0000000002329d30      1      0 2020-02-11 12:57:18 UTC+0000   DISPLAY3             \Device\Video2                                              
0x0000000002329de0      1      0 2020-02-11 12:57:18 UTC+0000   IPSECDev             \Device\IPSEC                                               
0x0000000002330128      1      0 2020-02-11 12:57:10 UTC+0000   WMIDataDevice        \Device\WMIDataDevice                                       
0x0000000002637fe0      1      0 2020-02-11 12:57:10 UTC+0000   ACPI#Fixe...9062857} \Device\00000034                                            
0x00000000026de788      1      0 2020-02-11 12:57:11 UTC+0000   MountPointManager    \Device\MountPointManager                                   
0x00000000026ee530      1      0 2020-02-11 12:57:18 UTC+0000   DISPLAY2             \Device\Video1                                              
0x00000000026fc2d8      1      0 2020-02-11 12:57:11 UTC+0000   Scsi0:               \Device\Ide\IdePort0                                        
0x00000000026fc638      1      0 2020-02-11 12:57:12 UTC+0000   IDE#DiskQ...91efb8b} \Device\Ide\IdeDeviceP0T0L0-3                               
0x00000000026fcfc0      1      0 2020-02-11 12:57:11 UTC+0000   FtControl            \Device\FtControl                                           
0x0000000002760130      1      0 2020-02-11 12:57:11 UTC+0000   Scsi1:               \Device\Ide\IdePort1                                        
0x00000000027608f0      1      0 2020-02-11 12:57:11 UTC+0000   Root#ftdi...91efb8b} \Device\00000003                                            
0x00000000027651f8      1      0 2020-02-11 12:57:12 UTC+0000   FltMgrMsg            \FileSystem\Filters\FltMgrMsg                               
0x0000000002765660      1      0 2020-02-11 12:57:12 UTC+0000   Volume{85...172696f} \Device\HarddiskVolume1                                     
0x00000000027658d0      1      0 2020-02-11 12:57:12 UTC+0000   STORAGE#V...91efb8b} \Device\HarddiskVolume1                                     
0x0000000002765ec0      1      0 2020-02-11 12:57:11 UTC+0000   ScsiPort0            \Device\Ide\IdePort0                                        
0x000000000278f030      1      0 2020-02-11 12:57:12 UTC+0000   Partition0           \Device\Harddisk0\DR0                                       
0x000000000278f698      1      0 2020-02-11 12:57:12 UTC+0000   Partition1           \Device\HarddiskVolume1                                     
0x000000000278fa00      1      0 2020-02-11 12:57:11 UTC+0000   ScsiPort1            \Device\Ide\IdePort1                                        
0x000000000278fc20      1      0 2020-02-11 12:57:12 UTC+0000   PhysicalDrive0       \Device\Harddisk0\DR0                                       
0x00000000027ac148      1      0 2020-02-11 12:57:12 UTC+0000   multi(0)d...ition(3) \Device\Harddisk0\Partition3                                
0x00000000027ac1e8      1      0 2020-02-11 12:57:12 UTC+0000   multi(0)d...ition(2) \Device\Harddisk0\Partition2                                
0x00000000027ac6c8      1      0 2020-02-11 12:57:12 UTC+0000   multi(0)d...ition(4) \Device\Harddisk0\Partition4                                
0x00000000027e74e8      1      0 2020-02-11 12:57:12 UTC+0000   multi(0)d...rdisk(0) \Device\Harddisk0\Partition0                                
0x00000000027e7618      1      0 2020-02-11 12:57:12 UTC+0000   multi(0)d...ition(1) \Device\Harddisk0\Partition1                                
0x00000000027e7d98      1      0 2020-02-11 12:57:12 UTC+0000   C:                   \Device\HarddiskVolume1                                     
0x00000000027e7e70      1      0 2020-02-11 12:57:12 UTC+0000   NDIS                 \Device\Ndis                                                
0x00000000027e7f50      1      0 2020-02-11 12:57:12 UTC+0000   FltMgr               \FileSystem\Filters\FltMgr                                  
0x0000000002d764f8      1      0 2020-02-11 12:57:19 UTC+0000   WanArp               \Device\WANARP                                              
0x0000000002dad680      2      1 2020-02-11 12:57:19 UTC+0000   0                    \BaseNamedObjects                                           
0x0000000002dd64a8      1      0 2020-02-11 12:57:19 UTC+0000   Session              \Sessions\BNOLINKS                                          
0x0000000002dd8668      1      0 2020-02-11 12:57:19 UTC+0000   Global               \BaseNamedObjects                                           
0x0000000002ddb5f0      1      0 2020-02-11 12:57:19 UTC+0000   Local                \BaseNamedObjects                                           
0x0000000002f341e0      1      0 2020-02-11 12:57:19 UTC+0000   AUX                  \DosDevices\COM1                                            
0x0000000002f371c8      2      1 2020-02-11 12:57:19 UTC+0000   KnownDllPath         C:\WINDOWS\system32                                         
0x0000000002f37d00      1      0 2020-02-11 12:57:19 UTC+0000   UNC                  \Device\Mup                                                 
0x0000000002f38508      1      0 2020-02-11 12:57:16 UTC+0000   IDE#CdRom...91efb8b} \Device\Ide\IdeDeviceP1T0L0-e                               
0x0000000002f3bc28      1      0 2020-02-11 12:57:19 UTC+0000   MAILSLOT             \Device\MailSlot                                            
0x0000000002f3bf28      1      0 2020-02-11 12:57:16 UTC+0000   PTILINK1             \Device\ParTechInc0                                         
0x00000000037308d0      1      0 2020-02-11 12:57:14 UTC+0000   CdRom0               \Device\CdRom0                                              
0x00000000037666d0      1      0 2020-02-11 12:57:16 UTC+0000   PTILINK2             \Device\ParTechInc1                                         
0x0000000004942030      1      0 2020-02-11 12:57:18 UTC+0000   LPTENUM#M...8753ed1} \Device\Parallel0                                           
0x0000000004992110      1      0 2020-02-11 12:57:16 UTC+0000   Volume{85...172696f} \Device\CdRom0                                              
0x0000000004993340      1      0 2020-02-11 12:57:16 UTC+0000   ACPI#PNP0...91405dd} \Device\00000040                                            
0x0000000004993a00      1      0 2020-02-11 12:57:16 UTC+0000   PTILINK3             \Device\ParTechInc2                                         
0x000000000673a250      1      0 2020-02-11 12:57:16 UTC+0000   Root#MS_P...fc3358c} \Device\00000026                                            
0x000000000673a2a0      1      0 2020-02-11 12:57:16 UTC+0000   Root#MS_L...fc3358c} \Device\00000023                                            
0x000000000673a3d0      1      0 2020-02-11 12:57:16 UTC+0000   {D75CC30F...6EFC23D} \Device\{D75CC30F-6690-4B5F-8877-6772B6EFC23D}              
0x000000000673a5a0      1      0 2020-02-11 12:57:16 UTC+0000   {333FD06D...755471E} \Device\{333FD06D-65F1-4C26-9F91-20A01755471E}              
0x000000000673a5f0      1      0 2020-02-11 12:57:16 UTC+0000   {98CAB9EE...7A37F7F} \Device\{98CAB9EE-7036-4655-B15D-5CEBF7A37F7F}              
0x000000000673a640      1      0 2020-02-11 12:57:16 UTC+0000   NDISWANIP            \Device\NdisWanIp                                           
0x000000000673adb0      1      0 2020-02-11 12:57:16 UTC+0000   IDE#CdRom...91efb8b} \Device\Ide\IdeDeviceP1T0L0-e                               
0x00000000067c12b0      1      0 2020-02-11 12:57:18 UTC+0000   LPT1                 \Device\Parallel0                                           
0x00000000067c1418      1      0 2020-02-11 12:57:18 UTC+0000   PCI#VEN_8...1e6af27} \Device\NTPNP_PCI0003                                       
0x00000000067c1490      1      0 2020-02-11 12:57:18 UTC+0000   USB#ROOT_...906bed8} \Device\USBPDO-0                                            
0x00000000067c1748      1      0 2020-02-11 12:57:18 UTC+0000   HCD0                 \Device\USBFDO-0                                            
0x00000000067c1908      1      0 2020-02-11 12:57:16 UTC+0000   Root#SYST...fc3358c} \Device\0000002c                                            
0x00000000067c1958      1      0 2020-02-11 12:57:16 UTC+0000   Root#SYST...4c10000} \Device\0000002c                                            
0x00000000067c1ba8      1      0 2020-02-11 12:57:16 UTC+0000   Root#MS_P...fc3358c} \Device\00000025                                            
0x00000000067c1c30      1      0 2020-02-11 12:57:16 UTC+0000   {5F58C9B7...17523EE} \Device\{5F58C9B7-EEFE-40F2-A41D-7514117523EE}              
0x00000000067c1c80      1      0 2020-02-11 12:57:16 UTC+0000   Root#MS_P...fc3358c} \Device\00000027                                            
0x00000000067c1f40      1      0 2020-02-11 12:57:16 UTC+0000   PSched               \Device\PSched                                              
0x000000000680c1a8      1      0 2020-02-11 12:57:18 UTC+0000   ACPI#PNP0...800845c} \Device\00000043                                            
0x000000000680c1f8      1      0 2020-02-11 12:57:18 UTC+0000   PCI#VEN_1...fc3358c} \Device\NTPNP_PCI0005                                       
0x000000000680c248      1      0 2020-02-11 12:57:18 UTC+0000   Root#MS_P...fc3358c} \Device\00000028                                            
0x000000000680c4f8      1      0 2020-02-11 12:57:18 UTC+0000   {C9CCA781...73CDC54} \Device\{C9CCA781-1E30-4BDD-A33E-13F3373CDC54}              
0x000000000680c670      1      0 2020-02-11 12:57:16 UTC+0000   Root#MS_P...fc3358c} \Device\00000029                                            
0x000000000680c768      1      0 2020-02-11 12:57:16 UTC+0000   A:                   \Device\Floppy0                                             
0x000000000680c830      1      0 2020-02-11 12:57:16 UTC+0000   Volume{85...172696f} \Device\Floppy0                                             
0x000000000680c980      1      0 2020-02-11 12:57:16 UTC+0000   FDC#GENER...91efb8b} \Device\FloppyPDO0                                          
0x000000000680cb78      1      0 2020-02-11 12:57:16 UTC+0000   ACPI#PNP0...91405dd} \Device\00000041                                            
0x000000000680cdd8      1      0 2020-02-11 12:57:16 UTC+0000   Root#MS_N...fc3358c} \Device\00000024                                            
0x000000000680cf38      1      0 2020-02-11 12:57:16 UTC+0000   Root#RDP_...91405dd} \Device\0000002b                                            
0x000000000680cfe0      1      0 2020-02-11 12:57:16 UTC+0000   Root#RDP_...91405dd} \Device\0000002a                                            
0x000000000682f140      1      0 2020-02-11 12:57:18 UTC+0000   ACPI#PNP0...be10318} \Device\00000044                                            
0x000000000682f218      1      0 2020-02-11 12:57:18 UTC+0000   DISPLAY1             \Device\Video0                                              
0x000000000682fa78      1      0 2020-02-11 12:57:16 UTC+0000   {18DD0775...14B6CEF} \Device\{18DD0775-33B7-4F93-9D30-4475914B6CEF}              
0x000000000682fcb8      1      0 2020-02-11 12:57:16 UTC+0000   multi(0)d...fdisk(0) \Device\Floppy0                                             
0x000000000687cbf8      1      0 2020-02-11 12:57:18 UTC+0000   COM1                 \Device\Serial0                                             
0x000000000687cf10      1      0 2020-02-11 12:57:18 UTC+0000   ACPI#PNP0...e301f73} \Device\00000044                                            
0x00000000068ef668      1      0 2020-02-11 12:57:19 UTC+0000   PIPE                 \Device\NamedPipe                                           
0x00000000068ef710      1      0 2020-02-11 12:57:18 UTC+0000   Shadow               \Device\LanmanRedirector                                    
0x00000000068f17d0      1      0 2020-02-11 12:57:19 UTC+0000   PRN                  \DosDevices\LPT1                                            
0x00000000068f1a18      1      0 2020-02-11 12:57:18 UTC+0000   Ip                   \Device\Ip                                                  
0x0000000006a00590      1      0 2020-02-11 12:57:16 UTC+0000   ACPI#Genu...29dbdd0} \Device\00000035                                            
0x0000000006a00708      1      0 2020-02-11 12:57:16 UTC+0000   D:                   \Device\CdRom0                                              
0x0000000006a009d8      1      0 2020-02-11 12:57:16 UTC+0000   NdisWan              \Device\NdisWan                                             
0x0000000006a00c50      1      0 2020-02-11 12:57:16 UTC+0000   {470AC39E...84F057F} \Device\{470AC39E-8BC9-4AC9-B48E-C9B7E84F057F}              
0x0000000006b80ad0      1      0 2020-02-11 12:57:18 UTC+0000   fsWrap               \Device\FsWrap                                              
0x0000000006b80b28      1      0 2020-02-11 12:57:19 UTC+0000   NUL                  \Device\Null                                                
0x0000000006b80d98      1      0 2020-02-11 12:57:18 UTC+0000   Tcp                  \Device\Tcp                                                 
0x0000000006b80de8      1      0 2020-02-11 12:57:18 UTC+0000   IPMULTICAST          \Device\IPMULTICAST                                         
0x0000000008943118      1      0 2020-02-11 12:57:20 UTC+0000   Global               \Global??                                                   
0x0000000008bc3fe0      1      0 2020-02-11 12:57:20 UTC+0000   Ndisuio              \Device\Ndisuio                                             
0x0000000008bffdf0      1      0 2020-02-11 12:57:20 UTC+0000   Global               \Global??                                                   
0x000000000a1cefe0      1      0 2020-02-11 12:57:21 UTC+0000   Global               \Global??                                                   
0x000000000c60f2e0      1      0 2020-02-11 12:57:30 UTC+0000   $VDMLPT1             \Device\ParallelVdm0                                        

thrdscan

Offset(P)             PID    TID Start Address Create Time                    Exit Time                     
------------------ ------ ------ ------------- ------------------------------ ------------------------------
0x00000000018f71a8    800   1736    0x7c8106e9 2020-02-11 12:57:30 UTC+0000                                 
0x00000000018f78d0    844   1732    0x7c8106e9 2020-02-11 12:57:30 UTC+0000                                 
0x0000000001944020      4    124    0xf9b6c92d 2020-02-11 12:57:16 UTC+0000                                 
0x0000000001944da8      4    128    0xf9b6d133 2020-02-11 12:57:16 UTC+0000                                 
0x0000000001953328    876   1512    0x7c8106e9 2020-02-11 12:57:30 UTC+0000                                 
0x00000000019535a0    876   1508    0x7c8106e9 2020-02-11 12:57:30 UTC+0000                                 
0x000000000195f020      4    252    0xf98686c4 2020-02-11 12:57:18 UTC+0000                                 
0x000000000196c8a8    528   1668    0x7c8106e9 2020-02-11 12:57:30 UTC+0000                                 
0x0000000001973540   1284   1348    0x7c8106e9 2020-02-11 12:57:22 UTC+0000                                 
0x00000000019746a8   1172   1180    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x0000000001974da8    800   1424    0x7c8106e9 2020-02-11 12:57:23 UTC+0000                                 
0x00000000019793d0    800   1524    0x7c8106e9 2020-02-11 12:57:30 UTC+0000                                 
0x0000000001979c78    876   1516    0x7c8106e9 2020-02-11 12:57:30 UTC+0000                                 
0x00000000019b8578   1172   1196    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x00000000019b88b8   1172   1192    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x00000000019b8b30   1172   1188    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x00000000019b8da8   1172   1184    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x00000000019c4650    288    308    0x485893b2 2020-02-11 12:57:19 UTC+0000                                 
0x00000000019c4be0    516    824    0x7c8106e9 2020-02-11 12:57:20 UTC+0000                                 
0x00000000019c7020    800   1152    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x00000000019c7358    800   1164    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x00000000019c77a0    800   1160    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x00000000019c7a18    800   1156    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x00000000019c7da8    388    432    0x764c7cdf 2020-02-11 12:57:19 UTC+0000                                 
0x00000000019ca980    388    404    0x75a84616 2020-02-11 12:57:19 UTC+0000                                 
0x00000000019cada8    388    396    0x764c7d63 2020-02-11 12:57:19 UTC+0000                                 
0x00000000019cbc10    412    728    0x7c8106e9 2020-02-11 12:57:20 UTC+0000                                 
0x00000000019cc470    736   1616    0x7c8106e9 2020-02-11 12:57:30 UTC+0000                                 
0x00000000019cc6e8    800   1612    0x7c8106e9 2020-02-11 12:57:30 UTC+0000                                 
0x00000000019cc960    800   1608    0x7c8106e9 2020-02-11 12:57:30 UTC+0000                                 
0x00000000019ccda8    800   1632    0x7c8106e9 2020-02-11 12:57:30 UTC+0000                                 
0x00000000019cd4d8   1284   1300    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x00000000019cd7b0   1284   1296    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x00000000019ce350    516   1320    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x00000000019d1da8    412    508    0x7c8106e9 2020-02-11 12:57:19 UTC+0000                                 
0x00000000019d2530      4    268    0xf9630517 2020-02-11 12:57:18 UTC+0000                                 
0x00000000019d8558    516    652    0x7c8106e9 2020-02-11 12:57:19 UTC+0000                                 
0x00000000019dada8    528    620    0x7c8106e9 2020-02-11 12:57:19 UTC+0000                                 
0x00000000019dc660    800   1056    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x00000000019dda00    412    504    0x7c8106e9 2020-02-11 12:57:19 UTC+0000                                 
0x00000000019e0da8   1284   1328    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x00000000019e2cb0    528    576    0x7c8106e9 2020-02-11 12:57:19 UTC+0000                                 
0x00000000019e52c8    528    612    0x7c8106e9 2020-02-11 12:57:19 UTC+0000                                 
0x00000000019e64f8    800   1208    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x00000000019e6840    800   1204    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x00000000019e8da8    516    724    0x7c8106e9 2020-02-11 12:57:20 UTC+0000                                 
0x00000000019e9600    412   1264    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x00000000019e98b8    412   1252    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x00000000019e9b38   1284   1336    0x7c8106e9 2020-02-11 12:57:22 UTC+0000                                 
0x00000000019eb290      4   1648    0xf8e75ce4 2020-02-11 12:57:30 UTC+0000                                 
0x00000000019ebda8    800   1644    0x7c8106e9 2020-02-11 12:57:30 UTC+0000                                 
0x00000000019ef3b8    516   1704    0x7c8106e9 2020-02-11 12:57:30 UTC+0000                                 
0x00000000019f0b38    876    968    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x00000000019f4a58    800    840    0x7c8106e9 2020-02-11 12:57:20 UTC+0000                                 
0x00000000019f6da8    412    712    0x7c8106e9 2020-02-11 12:57:19 UTC+0000                                 
0x00000000019f88b8    800    976    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x00000000019fb4a8   1284   1444    0x7c8106e9 2020-02-11 12:57:24 UTC+0000                                 
0x00000000019fb720    736   1440    0x7c8106e9 2020-02-11 12:57:24 UTC+0000                                 
0x00000000019fbc10    516   1432    0x7c8106e9 2020-02-11 12:57:24 UTC+0000                                 
0x00000000019fc2d0    412    524    0x7c8106e9 2020-02-11 12:57:19 UTC+0000                                 
0x00000000019fd878    676    696    0x7c8106e9 2020-02-11 12:57:19 UTC+0000                                 
0x00000000019fdda8    676    704    0x7c8106e9 2020-02-11 12:57:19 UTC+0000                                 
0x00000000019ffda8    412    512    0x7c8106e9 2020-02-11 12:57:19 UTC+0000                                 
0x0000000001a01da8    736    768    0x7c8106e9 2020-02-11 12:57:20 UTC+0000                                 
0x0000000001a02928   1268   1272    0x7c8106f5 2020-02-11 12:57:21 UTC+0000                                 
0x0000000001a033b8    800   1664    0x7c8106e9 2020-02-11 12:57:30 UTC+0000                                 
0x0000000001a046f0    528    580    0x7c8106e9 2020-02-11 12:57:19 UTC+0000                                 
0x0000000001a05328    736   1640    0x7c8106e9 2020-02-11 12:57:30 UTC+0000                                 
0x0000000001a05640    516   1636    0x7c8106e9 2020-02-11 12:57:30 UTC+0000                                 
0x0000000001a058b8    800   1628    0x7c8106e9 2020-02-11 12:57:30 UTC+0000                                 
0x0000000001a05b30    800   1624    0x7c8106e9 2020-02-11 12:57:30 UTC+0000                                 
0x0000000001a066f0    528    596    0x7c8106e9 2020-02-11 12:57:19 UTC+0000                                 
0x0000000001a06b18    528    600    0x7c8106e9 2020-02-11 12:57:19 UTC+0000                                 
0x0000000001a074a0      4   1492    0xf8ee1814 2020-02-11 12:57:30 UTC+0000                                 
0x0000000001a07718      4   1488    0xf8eff5a8 2020-02-11 12:57:30 UTC+0000                                 
0x0000000001a07990      4   1484    0xf8eff5a8 2020-02-11 12:57:30 UTC+0000                                 
0x0000000001a07c08      4   1480    0xf8eff5a8 2020-02-11 12:57:30 UTC+0000                                 
0x0000000001a08298    800    820    0x7c8106e9 2020-02-11 12:57:20 UTC+0000                                 
0x0000000001a08598    800    816    0x7c8106e9 2020-02-11 12:57:20 UTC+0000                                 
0x0000000001a09ae0    800    916    0x7c8106e9 2020-02-11 12:57:20 UTC+0000                                 
0x0000000001a0ada8    528    560    0x7c8106e9 2020-02-11 12:57:19 UTC+0000                                 
0x0000000001a0c810    844    904    0x7c8106e9 2020-02-11 12:57:20 UTC+0000                                 
0x0000000001a0caf0    844    900    0x7c8106e9 2020-02-11 12:57:20 UTC+0000                                 
0x0000000001a0eda8    528    616    0x7c8106e9 2020-02-11 12:57:19 UTC+0000                                 
0x0000000001a10da8    516    660    0x7c8106e9 2020-02-11 12:57:19 UTC+0000                                 
0x0000000001a11cc8    736    740    0x7c8106f5 2020-02-11 12:57:20 UTC+0000                                 
0x0000000001a131d0    528   1676    0x7c8106e9 2020-02-11 12:57:30 UTC+0000                                 
0x0000000001a13680    528   1672    0x7c8106e9 2020-02-11 12:57:30 UTC+0000                                 
0x0000000001a14200    800   1688    0x7c8106e9 2020-02-11 12:57:30 UTC+0000                                 
0x0000000001a149b8    800   1684    0x7c8106e9 2020-02-11 12:57:30 UTC+0000                                 
0x0000000001a14cb0    528   1680    0x7c8106e9 2020-02-11 12:57:30 UTC+0000                                 
0x0000000001a172c8    528    608    0x7c8106e9 2020-02-11 12:57:19 UTC+0000                                 
0x0000000001a19020    736    752    0x7c8106e9 2020-02-11 12:57:20 UTC+0000                                 
0x0000000001a192f8    736    756    0x7c8106e9 2020-02-11 12:57:20 UTC+0000                                 
0x0000000001a1eda8    412    984    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x0000000001a20590    528   1020    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x0000000001a21c10    388    408    0x75a83b3a 2020-02-11 12:57:19 UTC+0000                                 
0x0000000001a22b30    736   1452    0x7c8106e9 2020-02-11 12:57:24 UTC+0000                                 
0x0000000001a22da8    676   1448    0x7c8106e9 2020-02-11 12:57:24 UTC+0000                                 
0x0000000001a23da8   1268   1360    0x7c8106e9 2020-02-11 12:57:22 UTC+0000                                 
0x0000000001a24320    800   1476    0x7c8106e9 2020-02-11 12:57:30 UTC+0000                                 
0x0000000001a24a20   1284   1464    0x7c8106e9 2020-02-11 12:57:27 UTC+0000                                 
0x0000000001a25da8    528    732    0x7c8106e9 2020-02-11 12:57:20 UTC+0000                                 
0x0000000001a28320    516    664    0x7c8106e9 2020-02-11 12:57:19 UTC+0000                                 
0x0000000001a29490    288    304    0x485893b2 2020-02-11 12:57:19 UTC+0000                                 
0x0000000001a2ab00    800    804    0x7c8106f5 2020-02-11 12:57:20 UTC+0000                                 
0x0000000001a2d200    388    536    0x764c7cdf 2020-02-11 12:57:19 UTC+0000                                 
0x0000000001a2fda8    528    668    0x7c8106e9 2020-02-11 12:57:19 UTC+0000                                 
0x0000000001a30c90    516    672    0x7c8106e9 2020-02-11 12:57:19 UTC+0000                                 
0x0000000001a33a20    516    868    0x7c8106e9 2020-02-11 12:57:20 UTC+0000                                 
0x0000000001a38da8    676    808    0x7c8106e9 2020-02-11 12:57:20 UTC+0000                                 
0x0000000001a3f358    528   1224    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x0000000001a3f848    800   1216    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x0000000001a3fba8    800   1212    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x0000000001a406f0    412    572    0x7c8106e9 2020-02-11 12:57:19 UTC+0000                                 
0x0000000001a41da8    288    292    0x4858a4c8 2020-02-11 12:57:18 UTC+0000                                 
0x0000000001a44558    412    496    0x7c8106e9 2020-02-11 12:57:19 UTC+0000                                 
0x0000000001a45558    736    760    0x7c8106e9 2020-02-11 12:57:20 UTC+0000                                 
0x0000000001a48558    516    588    0x7c8106e9 2020-02-11 12:57:19 UTC+0000                                 
0x0000000001a49558    412    416     0x103e5e1 2020-02-11 12:57:19 UTC+0000                                 
0x0000000001a49980    388    428    0x764c7cdf 2020-02-11 12:57:19 UTC+0000                                 
0x0000000001a49da8    388    424    0x75a84616 2020-02-11 12:57:19 UTC+0000                                 
0x0000000001a4a488   1172   1176    0x7c8106f5 2020-02-11 12:57:21 UTC+0000                                 
0x0000000001a4ad18    800   1168    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x0000000001a4bb00    412   1656    0x7c8106e9 2020-02-11 12:57:30 UTC+0000                                 
0x0000000001a4bda8    412   1652    0x7c8106e9 2020-02-11 12:57:30 UTC+0000                                 
0x0000000001a4d620    516    584    0x7c8106e9 2020-02-11 12:57:19 UTC+0000                                 
0x0000000001a4f3d0    800   1604    0x7c8106e9 2020-02-11 12:57:30 UTC+0000                                 
0x0000000001a4f648      4   1600    0xf8e75ce4 2020-02-11 12:57:30 UTC+0000                                 
0x0000000001a4fda8    800   1592    0x7c8106e9 2020-02-11 12:57:30 UTC+0000                                 
0x0000000001a68460    876    936    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x0000000001a689a8    844    920    0x7c8106e9 2020-02-11 12:57:20 UTC+0000                                 
0x0000000001a69320    800   1140    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x0000000001a69608    800   1136    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x0000000001a69958    516   1132    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x0000000001a69c38    412   1116    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x0000000001a6b678    516    656    0x7c8106e9 2020-02-11 12:57:19 UTC+0000                                 
0x0000000001a6d4e0    800   1692    0x7c8106e9 2020-02-11 12:57:30 UTC+0000                                 
0x0000000001a6e3b8    736    748    0x7c8106e9 2020-02-11 12:57:20 UTC+0000                                 
0x0000000001a6ec88    412    708    0x7c8106e9 2020-02-11 12:57:19 UTC+0000                                 
0x0000000001a6fa50    516    872    0x7c8106e9 2020-02-11 12:57:20 UTC+0000                                 
0x0000000001a70248    516    520    0x7c8106f5 2020-02-11 12:57:19 UTC+0000                                 
0x0000000001a706a8    676    680    0x7c8106f5 2020-02-11 12:57:19 UTC+0000                                 
0x0000000001a71da8    528    604    0x7c8106e9 2020-02-11 12:57:19 UTC+0000                                 
0x0000000001a738d0    800   1128    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x0000000001a754f0    528    556    0x7c8106e9 2020-02-11 12:57:19 UTC+0000                                 
0x0000000001a764f0    800    896    0x7c8106e9 2020-02-11 12:57:20 UTC+0000                                 
0x0000000001a7a508   1284   1392    0x7c8106e9 2020-02-11 12:57:22 UTC+0000                                 
0x0000000001a7e5a8    800   1536    0x7c8106e9 2020-02-11 12:57:30 UTC+0000                                 
0x0000000001a7eda8    800   1528    0x7c8106e9 2020-02-11 12:57:30 UTC+0000                                 
0x0000000001a7fb70    528   1008    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x0000000001a83968    412    992    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x0000000001a85640    528   1552    0x7c8106e9 2020-02-11 12:57:30 UTC+0000                                 
0x0000000001a858b8    800   1548    0x7c8106e9 2020-02-11 12:57:30 UTC+0000                                 
0x0000000001a85da8    800   1540    0x7c8106e9 2020-02-11 12:57:30 UTC+0000                                 
0x0000000001a8d9f8    800   1696    0x7c8106e9 2020-02-11 12:57:30 UTC+0000                                 
0x0000000001a8f0f8      4    272    0xf9630517 2020-02-11 12:57:18 UTC+0000                                 
0x0000000001a90250    800   1048    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x0000000001a904c8    800   1044    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x0000000001a90740    412   1040    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x0000000001a90da8      4    264    0xf9f11038 2020-02-11 12:57:18 UTC+0000                                 
0x0000000001a91c30    516    540    0x7c8106e9 2020-02-11 12:57:19 UTC+0000                                 
0x0000000001a934a0      4    256    0xf982d086 2020-02-11 12:57:18 UTC+0000                                 
0x0000000001a959b0    528    640    0x7c8106e9 2020-02-11 12:57:19 UTC+0000                                 
0x0000000001a95da8    528    544    0x7c8106e9 2020-02-11 12:57:19 UTC+0000                                 
0x0000000001a99550    844    848    0x7c8106f5 2020-02-11 12:57:20 UTC+0000                                 
0x0000000001a99da8    516    648    0x7c8106e9 2020-02-11 12:57:19 UTC+0000                                 
0x0000000001a9b858    800    812    0x7c8106e9 2020-02-11 12:57:20 UTC+0000                                 
0x0000000001a9f8b8    800   1588    0x7c8106e9 2020-02-11 12:57:30 UTC+0000                                 
0x0000000001aac480    528    548    0x7c8106e9 2020-02-11 12:57:19 UTC+0000                                 
0x0000000001ac5538    736    764    0x7c8106e9 2020-02-11 12:57:20 UTC+0000                                 
0x0000000001ac7788    412    996    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x0000000001ac9c48    676    692    0x7c8106e9 2020-02-11 12:57:19 UTC+0000                                 
0x0000000001ad5970    528    552    0x7c8106e9 2020-02-11 12:57:19 UTC+0000                                 
0x0000000001ae1838    516    688    0x7c8106e9 2020-02-11 12:57:19 UTC+0000                                 
0x0000000001aee640    412   1100    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x0000000001aeeb30    388   1092    0x75a84616 2020-02-11 12:57:21 UTC+0000                                 
0x0000000001af2568   1284   1292    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x0000000001af28f8   1284   1288    0x7c8106f5 2020-02-11 12:57:21 UTC+0000                                 
0x0000000001af3da8   1412   1416    0x7c8106f5 2020-02-11 12:57:22 UTC+0000                                 
0x0000000001af6470   1284   1316    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x0000000001af6800   1284   1312    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x0000000001af6ae0   1284   1308    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x0000000001af6da8   1284   1304    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x0000000001af7278      4   1504    0xf8eded14 2020-02-11 12:57:30 UTC+0000                                 
0x0000000001af7b30    876   1500    0x7c8106e9 2020-02-11 12:57:30 UTC+0000                                 
0x0000000001afb558    388    400    0x764cbebd 2020-02-11 12:57:19 UTC+0000                                 
0x0000000001afbda8    800    892    0x7c8106e9 2020-02-11 12:57:20 UTC+0000                                 
0x0000000001afc620    844   1716    0x7c8106e9 2020-02-11 12:57:30 UTC+0000                                 
0x0000000001afc898    516   1712    0x7c8106e9 2020-02-11 12:57:30 UTC+0000                                 
0x0000000001afcce8    736   1708    0x7c8106e9 2020-02-11 12:57:30 UTC+0000                                 
0x0000000001b002e0    528    624    0x7c8106e9 2020-02-11 12:57:19 UTC+0000                                 
0x0000000001b008a8    736    744    0x7c8106e9 2020-02-11 12:57:20 UTC+0000                                 
0x0000000001b01820    800   1148    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x0000000001b01da8    800   1144    0x7c8106e9 2020-02-11 12:57:21 UTC+0000                                 
0x0000000001b04628      4    284    0x805aba3e 2020-02-11 12:57:18 UTC+0000                                 
0x0000000001b06da8      4    280    0xf96198b1 2020-02-11 12:57:18 UTC+0000                                 
0x0000000001b098c0    876    880    0x7c8106f5 2020-02-11 12:57:20 UTC+0000                                 
0x0000000001b0bda8    412    500    0x7c8106e9 2020-02-11 12:57:19 UTC+0000                                 
0x0000000001b0c798    412    716    0x7c8106e9 2020-02-11 12:57:19 UTC+0000                                 
0x0000000001b10da8      4    276    0xf9630517 2020-02-11 12:57:18 UTC+0000                                 
0x0000000001b14c40    676    700    0x7c8106e9 2020-02-11 12:57:19 UTC+0000                                 
0x0000000001b74b38      4    104    0xf98b8b85 2020-02-11 12:57:12 UTC+0000                                 
0x0000000001bad7b0      4     96    0xf9a0db10 2020-02-11 12:57:10 UTC+0000                                 
0x0000000001bbf020      4     84    0x804e8aa0 2020-02-11 12:57:10 UTC+0000                                 
0x0000000001bbf4b0      4     88    0x8051185a 2020-02-11 12:57:10 UTC+0000                                 
0x0000000001bc22c8      4     80    0x804e757a 2020-02-11 12:57:10 UTC+0000                                 
0x0000000001bc25c0      4     76    0x80660eaa 2020-02-11 12:57:10 UTC+0000                                 
0x0000000001bc2838      4     72    0x80516f8b 2020-02-11 12:57:10 UTC+0000                                 
0x0000000001bc3020      4     64    0x804e6196 2020-02-11 12:57:10 UTC+0000                                 
0x0000000001bc3da8      4     68    0x80566811 2020-02-11 12:57:10 UTC+0000                                 
0x0000000001bc4020      4     40    0x804e6196 2020-02-11 12:57:10 UTC+0000                                 
0x0000000001bc43c8      4     60    0x804e6196 2020-02-11 12:57:10 UTC+0000                                 
0x0000000001bc4640      4     56    0x804e6196 2020-02-11 12:57:10 UTC+0000                                 
0x0000000001bc48b8      4     52    0x804e6196 2020-02-11 12:57:10 UTC+0000                                 
0x0000000001bc4b30      4     48    0x804e6196 2020-02-11 12:57:10 UTC+0000                                 
0x0000000001bc4da8      4     44    0x804e6196 2020-02-11 12:57:10 UTC+0000                                 
0x0000000001bc5020      4     16    0x804e6196 2020-02-11 12:57:10 UTC+0000                                 
0x0000000001bc53c8      4     36    0x804e6196 2020-02-11 12:57:10 UTC+0000                                 
0x0000000001bc5640      4     32    0x804e6196 2020-02-11 12:57:10 UTC+0000                                 
0x0000000001bc58b8      4     28    0x804e6196 2020-02-11 12:57:10 UTC+0000                                 
0x0000000001bc5b30      4     24    0x804e6196 2020-02-11 12:57:10 UTC+0000                                 
0x0000000001bc5da8      4     20    0x804e6196 2020-02-11 12:57:10 UTC+0000                                 
0x0000000001bc6510      4     12    0x8050aa31                                2020-02-11 12:57:19 UTC+0000  
0x0000000001bc6958      4      8    0x806a32fa                                                              
0x0000000001bcf3a8      4    100    0x804fe4b9 2020-02-11 12:57:10 UTC+0000                                 
0x0000000001bf0020      4     92    0x8051185a 2020-02-11 12:57:10 UTC+0000                                 

unloadedmodules

Name                 StartAddress EndAddress Time
-------------------- ------------ ---------- ----
Sfloppy.SYS          0x00f9f0c000 0xf9f0f000 2020-02-11 12:57:18 
Cdaudio.SYS          0x00f9d54000 0xf9d59000 2020-02-11 12:57:18 
redbook.sys          0x00f9bdc000 0xf9bea000 2020-02-11 12:57:18 
imapi.sys            0x00f9bec000 0xf9bf7000 2020-02-11 12:57:18 

sockets

Offset(V)       PID   Port  Proto Protocol        Address         Create Time
---------- -------- ------ ------ --------------- --------------- -----------
0x816f0210      800    123     17 UDP             10.0.2.15       2020-02-11 12:57:30 UTC+0000
0x8156cba8      528    500     17 UDP             0.0.0.0         2020-02-11 12:57:30 UTC+0000
0x816b5aa0        4    445      6 TCP             0.0.0.0         2020-02-11 12:57:18 UTC+0000
0x8170e1c8      736    135      6 TCP             0.0.0.0         2020-02-11 12:57:20 UTC+0000
0x81613920      528      0    255 Reserved        0.0.0.0         2020-02-11 12:57:30 UTC+0000
0x8164fb88      800    123     17 UDP             127.0.0.1       2020-02-11 12:57:30 UTC+0000
0x81673748        4    139      6 TCP             10.0.2.15       2020-02-11 12:57:24 UTC+0000
0x814f7b30      844   1025     17 UDP             0.0.0.0         2020-02-11 12:57:30 UTC+0000
0x8160be98        4    137     17 UDP             10.0.2.15       2020-02-11 12:57:24 UTC+0000
0x8156c228      528   4500     17 UDP             0.0.0.0         2020-02-11 12:57:30 UTC+0000
0x815f5260        4    445     17 UDP             0.0.0.0         2020-02-11 12:57:18 UTC+0000
0x81632548        4    138     17 UDP             10.0.2.15       2020-02-11 12:57:24 UTC+0000

sockscan

Offset(P)       PID   Port  Proto Protocol        Address         Create Time
---------- -------- ------ ------ --------------- --------------- -----------
0x018f7b30      844   1025     17 UDP             0.0.0.0         2020-02-11 12:57:30 UTC+0000
0x0196c228      528   4500     17 UDP             0.0.0.0         2020-02-11 12:57:30 UTC+0000
0x0196cba8      528    500     17 UDP             0.0.0.0         2020-02-11 12:57:30 UTC+0000
0x019f5260        4    445     17 UDP             0.0.0.0         2020-02-11 12:57:18 UTC+0000
0x01a0be98        4    137     17 UDP             10.0.2.15       2020-02-11 12:57:24 UTC+0000
0x01a13920      528      0    255 Reserved        0.0.0.0         2020-02-11 12:57:30 UTC+0000
0x01a32548        4    138     17 UDP             10.0.2.15       2020-02-11 12:57:24 UTC+0000
0x01a4fb88      800    123     17 UDP             127.0.0.1       2020-02-11 12:57:30 UTC+0000
0x01a73748        4    139      6 TCP             10.0.2.15       2020-02-11 12:57:24 UTC+0000
0x01ab5aa0        4    445      6 TCP             0.0.0.0         2020-02-11 12:57:18 UTC+0000
0x01af0210      800    123     17 UDP             10.0.2.15       2020-02-11 12:57:30 UTC+0000
0x01b0e1c8      736    135      6 TCP             0.0.0.0         2020-02-11 12:57:20 UTC+0000

以上。