概要
volatilityの作法、調べてみた。
winxpsp3のスナップショット、取ってみた。
handles
Offset(V) Pid Handle Access Type Details
---------- ------ ---------- ---------- ---------------- -------
0x817c6bd0 4 0x4 0x1f0fff Process System(4)
0x817c6510 4 0x8 0x0 Thread TID 12 PID 4
0xe1325b10 4 0xc 0xf003f Key MACHINE\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\MEMORY MANAGEMENT\PREFETCHPARAMETERS
0xe10070e0 4 0x10 0x0 Key
0xe132e140 4 0x14 0x20019 Key MACHINE\SYSTEM\WPA\KEY-QQDRV3JCYR96TMX49FWYR
0xe132fcd0 4 0x18 0x20019 Key MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MULTIFUNCTIONADAPTER
0xe132fd90 4 0x1c 0x20019 Key MACHINE\SYSTEM\WPA\KEY-28W34WWKYT9TPVMYFTKXT
0xe1336a90 4 0x20 0x2001f Key MACHINE\SYSTEM\SETUP
0xe132e338 4 0x24 0x20019 Key MACHINE\SYSTEM\WPA\KEY-QB73PBDMF6XM2798HY4BB
0xe1330020 4 0x28 0x20019 Key MACHINE\SYSTEM\WPA\PNP
0xe132fb68 4 0x2c 0x20019 Key MACHINE\SYSTEM\WPA\SIGNINGHASH-2J946TKMBDVV39
0xe1330f88 4 0x30 0x20019 Key MACHINE\SYSTEM\WPA\SIGNINGHASH-J2X2CYPVVTP4HV
0xe132fad0 4 0x34 0x20019 Key MACHINE\SYSTEM\WPA\SIGNINGHASH-XT33R8KXVF2JY7
0xe1324748 4 0x38 0x2001f Key MACHINE\SYSTEM\CONTROLSET001\CONTROL\PRODUCTOPTIONS
0xe132f8c0 4 0x3c 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG
0x817bfcd0 4 0x40 0x1f0003 Event TRKWKS_EVENT
0x816934a0 4 0x7c 0x1f03ff Thread TID 256 PID 4
0x817ad7b0 4 0x88 0x1f03ff Thread TID 96 PID 4
0xe1397328 4 0x8c 0xf000f Directory WinDfs
0xe1393818 4 0x94 0xf000f Directory Harddisk0
0x816204b0 4 0x330 0x12019f File \Device\Gpc
0x816841d8 4 0x334 0xf0003 Desktop Disconnect
0x81611980 4 0x338 0x1200a0 File \Device\Tcp
0x816d0ad0 4 0x33c 0x2000003 File \Device\HarddiskVolume1\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
0x81714f90 4 0x340 0x2000003 File \Device\HarddiskVolume1\WINDOWS\system32\config\SAM.LOG
0x817158a8 4 0x344 0x3 File \Device\HarddiskVolume1\WINDOWS\system32\config\system.LOG
0x817155a8 4 0x348 0x2000003 File \Device\HarddiskVolume1\WINDOWS\system32\config\default
0x81715370 4 0x34c 0x2000003 File \Device\HarddiskVolume1\WINDOWS\system32\config\default.LOG
0x81636180 4 0x350 0x438 Process lsass.exe(528)
0x81715bd8 4 0x354 0x3 File \Device\HarddiskVolume1\WINDOWS\system32\config\system
0xe17d5a80 4 0x358 0x1f0001 Port
0x817160d8 4 0x35c 0x2000003 File \Device\HarddiskVolume1\WINDOWS\system32\config\software.LOG
0x8170e9d0 4 0x360 0x2000003 File \Device\HarddiskVolume1\WINDOWS\system32\config\software
0xe17d6c28 4 0x364 0x1f0001 Port
0x81690da8 4 0x368 0x1f03ff Thread TID 264 PID 4
0x8170e580 4 0x36c 0x2000003 File \Device\HarddiskVolume1\WINDOWS\system32\config\SECURITY.LOG
0x81717bc0 4 0x370 0x12019f File \Device\Tcp
0x81717028 4 0x374 0x12019f File \Device\Gpc
0x8166f488 4 0x378 0x12019f File \Device\Gpc
0x815e56a0 4 0x37c 0x12019f File \Device\Tcp
0x81717dc0 4 0x380 0x12019f File \Device\Udp
0x817162a8 4 0x384 0x2000003 File \Device\HarddiskVolume1\WINDOWS\system32\config\SECURITY
0x816302a8 4 0x388 0x12019f File \Device\Tcp
0x8170d7e0 4 0x38c 0x140003 File \Device\HarddiskVolume1\pagefile.sys
0x816b3ae0 4 0x390 0x100003 Event LanmanServerAnnounceEvent
0x816c82b8 4 0x394 0x1f0003 Event StuckThreadEvent
0xe1463380 4 0x398 0x4 Directory WindowStations
0x8166a028 4 0x39c 0x120089 File \Device\Tcp
0xe1648610 4 0x3a0 0x2 Key MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\RNG
0x816dc848 4 0x3a4 0x12019f File \Device\Udp
0x81714a20 4 0x3a8 0x12019f File \Device\Tcp
0x81636180 4 0x3ac 0x28 Process lsass.exe(528)
0x816bb230 4 0x3b0 0x12019f File \Device\Udp
0xe15fb7f8 4 0x3b4 0x1f0001 Port SeRmCommandPort
0x815dec60 4 0x3b8 0x2000003 File \Device\HarddiskVolume1\Documents and Settings\NetworkService\NTUSER.DAT
0x81633450 4 0x3bc 0x2000003 File \Device\HarddiskVolume1\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG
0x817151a0 4 0x3c0 0x2000003 File \Device\HarddiskVolume1\WINDOWS\system32\config\SAM
0x815fec30 4 0x3c4 0x2000003 File \Device\HarddiskVolume1\Documents and Settings\NetworkService\ntuser.dat.LOG
0x81630210 4 0x3c8 0x12019f File \Device\Tcp
0x8168e468 4 0x3cc 0x12019f File \Device\Tcp
0x8167a0a0 4 0x3d0 0x12019f File \Device\Tcp
0x816cb140 4 0x3d4 0x12019f File \Device\Tcp
0x815cd028 4 0x3d8 0x12019f File \Device\Tcp
0x815cd0f0 4 0x3dc 0x12019f File \Device\Tcp
0x816ab5c0 4 0x3e0 0x12019f File \Device\Tcp
0x8170f028 4 0x3e4 0x12019f File \Device\Tcp
0x8166e328 4 0x3e8 0x12019f File \Device\Tcp
0x8166e290 4 0x3ec 0x12019f File \Device\Tcp
0x816454c8 4 0x3f0 0x12019f File \Device\Tcp
0x816453b0 4 0x3f4 0x12019f File \Device\Tcp
0x81645298 4 0x3f8 0x12019f File \Device\Tcp
0x8166a738 4 0x3fc 0x12019f File \Device\Tcp
0x8166a620 4 0x400 0x12019f File \Device\Tcp
0x8166a468 4 0x404 0x12019f File \Device\Tcp
0x816acde8 4 0x408 0x12019f File \Device\Tcp
0x816accb0 4 0x40c 0x12019f File \Device\Tcp
0x816acaf8 4 0x410 0x12019f File \Device\Tcp
0x816ac940 4 0x414 0x12019f File \Device\Tcp
0x816f5ea0 4 0x418 0x12019f File \Device\Tcp
0x816f5d18 4 0x41c 0x12019f File \Device\Tcp
0x816f5b60 4 0x420 0x12019f File \Device\Tcp
0x8161fef0 4 0x424 0x12019f File \Device\Tcp
0x8161fd68 4 0x428 0x12019f File \Device\Tcp
0x8161fbe0 4 0x42c 0x12019f File \Device\Tcp
0x81651738 4 0x430 0x12019f File \Device\Tcp
0x816515b0 4 0x434 0x12019f File \Device\Tcp
0x816513f8 4 0x438 0x12019f File \Device\Tcp
0x81651240 4 0x43c 0x12019f File \Device\Tcp
0x81636e70 4 0x440 0x12019f File \Device\Tcp
0x81636cb8 4 0x444 0x12019f File \Device\Tcp
0x81636b00 4 0x448 0x12019f File \Device\Tcp
0x8162b558 4 0x44c 0x12019f File \Device\Tcp
0x8162b3a0 4 0x450 0x12019f File \Device\Tcp
0x8162b1e8 4 0x454 0x12019f File \Device\Tcp
0x8162b0d0 4 0x458 0x12019f File \Device\Tcp
0x8161c438 4 0x45c 0x12019f File \Device\Tcp
0x8161c280 4 0x460 0x12019f File \Device\Tcp
0x8160a798 4 0x464 0x12019f File \Device\Tcp
0x8160a660 4 0x468 0x12019f File \Device\Tcp
0x8160a4a8 4 0x46c 0x12019f File \Device\Tcp
0x8160a2f0 4 0x470 0x12019f File \Device\Tcp
0x815d7838 4 0x474 0x12019f File \Device\Tcp
0x815d7680 4 0x478 0x12019f File \Device\Tcp
0x815d74c8 4 0x47c 0x12019f File \Device\Tcp
0x815d6028 4 0x480 0x12019f File \Device\Tcp
0x815d6460 4 0x484 0x12019f File \Device\Tcp
0x815d62a8 4 0x488 0x12019f File \Device\Tcp
0x8164def0 4 0x48c 0x12019f File \Device\Tcp
0x815e59b0 4 0x490 0x2000003 File \Device\HarddiskVolume1\Documents and Settings\LocalService\ntuser.dat.LOG
0x8163f5f8 4 0x494 0x20 File \Device\LanmanRedirector
0x815c4af8 4 0x498 0x2000003 File \Device\HarddiskVolume1\Documents and Settings\LocalService\NTUSER.DAT
0x8161ca60 4 0x49c 0x12019f File \Device\NetBT_Tcpip_{18DD0775-33B7-4F93-9D30-4475914B6CEF}
0x816cf0c0 4 0x4a0 0x2000003 File \Device\HarddiskVolume1\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
0x81618a10 4 0x4a4 0x2000003 File \Device\HarddiskVolume1\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG
0x8163f6e0 4 0x4a8 0x120116 File \Device\Mup
0x81632788 4 0x4ac 0x12019f File \Device\Tcp
0x81616698 4 0x4b0 0x2000003 File \Device\HarddiskVolume1\Documents and Settings\testuser\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
0x8162db20 4 0x4b4 0x2000003 File \Device\HarddiskVolume1\Documents and Settings\testuser\NTUSER.DAT
0x815503e0 4 0x4b8 0x2000003 File \Device\HarddiskVolume1\Documents and Settings\testuser\ntuser.dat.LOG
0x81616288 4 0x4bc 0x2000003 File \Device\HarddiskVolume1\Documents and Settings\testuser\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG
0x816c3448 4 0x4c0 0x12019f File \Device\Tcp
0x815e34b0 4 0x4c4 0x12019f File \Device\Tcp
0x815e3718 4 0x4c8 0x12019f File \Device\Tcp
0x816324d0 4 0x4cc 0x12019f File \Device\Tcp
0x816383c8 4 0x4d0 0x12019f File \Device\Tcp
0x8160be20 4 0x4d4 0x12019f File \Device\Tcp
0x8166c358 4 0x4d8 0x12019f File \Device\Tcp
0x815e3f90 4 0x4dc 0x12019f File \Device\Tcp
0x816423b8 4 0x4e0 0x12019f File \Device\Tcp
0x81688b90 4 0x4e4 0x12019f File \Device\Tcp
0x81623c30 4 0x4e8 0x12019f File \Device\Tcp
0x816f3c98 4 0x4ec 0x12019f File \Device\Tcp
0x816f3a70 4 0x4f0 0x12019f File \Device\Tcp
0x816f37f8 4 0x4f4 0x12019f File \Device\Tcp
0x816f3580 4 0x4f8 0x12019f File \Device\Tcp
0x8163af90 4 0x4fc 0x12019f File \Device\Tcp
0x8163ad68 4 0x500 0x12019f File \Device\Tcp
0x8163aaf0 4 0x504 0x12019f File \Device\Tcp
0x8163a878 4 0x508 0x12019f File \Device\Tcp
0x8163a600 4 0x50c 0x12019f File \Device\Tcp
0x8163a388 4 0x510 0x12019f File \Device\Tcp
0x816cbe00 4 0x514 0x12019f File \Device\Tcp
0x816cbbd8 4 0x518 0x12019f File \Device\Tcp
0x816cb960 4 0x51c 0x12019f File \Device\Tcp
0x816cb6e8 4 0x520 0x12019f File \Device\Tcp
0x816cb470 4 0x524 0x12019f File \Device\Tcp
0x815edf10 4 0x528 0x12019f File \Device\Tcp
0x815edce8 4 0x52c 0x12019f File \Device\Tcp
0x815eda70 4 0x530 0x12019f File \Device\Tcp
0x815ed7f8 4 0x534 0x12019f File \Device\Tcp
0x815ed580 4 0x538 0x12019f File \Device\Tcp
0x815ed308 4 0x53c 0x12019f File \Device\Tcp
0x816f1db0 4 0x540 0x12019f File \Device\Tcp
0x816f1b38 4 0x544 0x12019f File \Device\Tcp
0x816f18c0 4 0x548 0x12019f File \Device\Tcp
0x816f1648 4 0x54c 0x12019f File \Device\Tcp
0x816f13d0 4 0x550 0x12019f File \Device\Tcp
0x8155fe80 4 0x554 0x12019f File \Device\Tcp
0x8155fc08 4 0x558 0x12019f File \Device\Tcp
0x8155f990 4 0x55c 0x12019f File \Device\Tcp
0x8155f718 4 0x560 0x12019f File \Device\Tcp
0x8155f4a0 4 0x564 0x12019f File \Device\Tcp
0x8163df90 4 0x568 0x12019f File \Device\Tcp
0x8163dd18 4 0x56c 0x12019f File \Device\Tcp
0x8163daa0 4 0x570 0x12019f File \Device\Tcp
0x8163d828 4 0x574 0x12019f File \Device\Tcp
0x8163d5b0 4 0x578 0x12019f File \Device\Tcp
0x8163d338 4 0x57c 0x12019f File \Device\Tcp
0x8163be00 4 0x580 0x12019f File \Device\Tcp
0x8163bbd8 4 0x584 0x12019f File \Device\Tcp
0x8163b960 4 0x588 0x12019f File \Device\Tcp
0x8163b5f0 4 0x58c 0x12019f File \Device\NetbiosSmb
0x8163b4d8 4 0x590 0x12019f File \Device\NetbiosSmb
0x8161cd58 4 0x594 0x12019f File \Device\NetBT_Tcpip_{18DD0775-33B7-4F93-9D30-4475914B6CEF}
0x815e7dc8 4 0x598 0x120116 File \Device\Mup
0x81646220 4 0x59c 0x12019f File \Device\NetBT_Tcpip_{18DD0775-33B7-4F93-9D30-4475914B6CEF}
0x816f7278 4 0x5a0 0x1f03ff Thread TID 1504 PID 4
0x81691f90 4 0x5a4 0x12019f File \Device\NetBT_Tcpip_{18DD0775-33B7-4F93-9D30-4475914B6CEF}
0x816f74f8 4 0x5a8 0x20 File \Device\WebDavRedirector
0x815ee268 4 0x5ac 0x1f01ff File \Device\Udp
0x8164fd18 4 0x5b0 0x1f01ff File \Device\Udp
0xe1c20248 4 0x5b4 0x2 Key MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\RNG
0x816fa270 4 0x5b8 0x12019f File \Device\NamedPipe\
0x815eb6b8 4 0x5bc 0x1f01ff File \Device\Udp
0x8156c3e8 4 0x5c0 0x1f01ff File \Device\Udp
0x81613bf8 4 0x5c4 0x1f01ff File \Device\RawIp\255
0xe1c2b030 4 0x5c8 0x20f01ff Token
0xe1c0d860 4 0x5cc 0xf001f Section
0xe1c2c9e0 4 0x5d0 0x1f0001 Port
0x8156f7d0 4 0x5d4 0x12019f File \Device\Tcp
0x8166d450 4 0x5d8 0x180 File \Device\NetbiosSmb
0x8156fa98 4 0x5dc 0x0 File \Device\NetbiosSmb
0x8157af90 4 0x5e0 0x12019f File \Device\Tcp
0x8156f3c0 4 0x5e4 0x0 File \Device\NetbiosSmb
0x8157ac48 4 0x5e8 0x180 File \Device\NetbiosSmb
0x8157a3d0 4 0x5ec 0x12019f File \Device\Tcp
0x8157a690 4 0x5f0 0x0 File \Device\NetbiosSmb
0x8168dd78 4 0x5f4 0x12019f File \Device\Tcp
0x8157a1f8 4 0x5f8 0x0 File \Device\NetbiosSmb
0x816fa1d8 4 0x5fc 0x1200a0 File \Device\Udp
0xe15bd338 4 0x6fc 0x20019 Key MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MULTIFUNCTIONADAPTER
0xe15bef78 4 0x70c 0x20019 Key MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MULTIFUNCTIONADAPTER
0xe1006e20 288 0x4 0xf0003 KeyedEvent CritSecOutOfMemoryEvent
0x81623028 288 0x8 0x100020 File \Device\HarddiskVolume1\WINDOWS
0xe15fc4c8 288 0xc 0x1f0001 Port SmApiPort
0xe16172d0 288 0x10 0x1f0001 Port
0xe10003b8 288 0x14 0xf000f Directory GLOBAL??
0xe1403cb8 288 0x18 0xf000f Directory Sessions
0x817110f0 288 0x1c 0x100001 File \Device\HarddiskVolume1\WINDOWS\system32
0xe14f61c8 288 0x20 0xf0001 SymbolicLink KnownDllPath
0xe14f3230 288 0x24 0xf000f Directory KnownDlls
0x816ca9c8 288 0x28 0x1f0003 Event
0x816c9698 288 0x2c 0x1f0003 Event UniqueSessionIdEvent
0x816f53b8 288 0x30 0x1f0fff Process csrss.exe(388)
0x816f53b8 288 0x34 0x400 Process csrss.exe(388)
0xe161aae0 288 0x38 0x1f0001 Port
0xe14ca670 288 0x3c 0x1f0001 Port
0xe14bc528 288 0x40 0x1f0001 Port
0x816f57e0 288 0x48 0x1f0fff Process winlogon.exe(412)
0xe1006e20 388 0x4 0xf0003 KeyedEvent CritSecOutOfMemoryEvent
0xe14f3230 388 0x8 0x3 Directory KnownDlls
0x816942d8 388 0xc 0x100020 File \Device\HarddiskVolume1\WINDOWS\system32
0xe1447b48 388 0x10 0xf000f Directory BNOLINKS
0x816f57e0 388 0x14 0x1f0fff Process winlogon.exe(412)
0xe14c4680 388 0x18 0xf0001 SymbolicLink 0
0xe1447980 388 0x1c 0xf000f Directory 0
0xe14478a8 388 0x20 0xf000f Directory DosDevices
0xe14038f8 388 0x24 0xf000f Directory Windows
0xe1445b28 388 0x28 0xf001f Section
0xe14477d0 388 0x2c 0xf000f Directory BaseNamedObjects
0x815d2220 388 0x30 0x100003 Semaphore
0xe144b9f0 388 0x34 0xf000f Directory Restricted
0xe13fd178 388 0x38 0x4 Section NlsSectionUnicode
0xe144bc30 388 0x3c 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE\ALTERNATE SORTS
0xe14f3688 388 0x40 0x4 Section NlsSectionLocale
0xe14f36f0 388 0x44 0x4 Section NlsSectionCType
0xe14499a8 388 0x48 0x4 Section NlsSectionSortkey
0xe144bbe8 388 0x4c 0x4 Section NlsSectionSortTbls
0xe1449a60 388 0x50 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE
0xe1449ac8 388 0x54 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS
0x81653858 388 0x58 0x100003 Semaphore
0x81620220 388 0x5c 0x100003 Semaphore
0xe1449b30 388 0x60 0x20f003f Key MACHINE
0x815d11f0 388 0x64 0x1f0003 Event
0x81716d98 388 0x68 0x1f0003 Event
0x8169b4f0 388 0x6c 0x1f0003 Event
0x8174ded0 388 0x70 0x1f0003 Event
0x81692208 388 0x74 0x1f0003 Event
0xe1617a20 388 0x78 0x1f0001 Port
0x815cada8 388 0x7c 0x1f03ff Thread TID 396 PID 388
0xe14477d0 388 0x80 0x2000f Directory BaseNamedObjects
0x816c6880 388 0x84 0x1f0003 Event TermSrvReadyEvent
0x816fb558 388 0x88 0x1f03ff Thread TID 400 PID 388
0xe14bfe60 388 0x8c 0x1f0001 Port ApiPort
0xe14c5f68 388 0x90 0x1f0001 Port SbApiPort
0x815ca980 388 0x94 0x1f03ff Thread TID 404 PID 388
0x8169b2a0 388 0x98 0x21f0003 Event
0x81621c10 388 0x9c 0x1f03ff Thread TID 408 PID 388
0xe14df730 388 0xa0 0x1f0001 Port
0x81649558 388 0xa4 0x1f03ff Thread TID 416 PID 412
0xe161a8d8 388 0xa8 0x1f0001 Port
0x81649da8 388 0xac 0x1f03ff Thread TID 424 PID 388
0x81649980 388 0xb0 0x1f03ff Thread TID 428 PID 388
0x815f41b0 388 0xb4 0x21f0003 Event
0x815c7da8 388 0xb8 0x1f03ff Thread TID 432 PID 388
0x8170ced8 388 0xbc 0x21f0003 Event
0x8168f820 388 0xc0 0x1f0003 Event WinSta0_DesktopSwitch
0x81692240 388 0xc4 0x100001 File \Device\0000002a
0x815ff720 388 0xc8 0x100001 File \Device\0000002b
0x816de758 388 0xcc 0x100001 File \Device\00000041
0x815f6250 388 0xd0 0x100001 File \Device\00000040
0xe16c4358 388 0xd4 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\CONTROL\PRIORITYCONTROL
0x815fdbf0 388 0xd8 0xf0003 WindowStation WinSta0
0x81644558 388 0xdc 0x1f03ff Thread TID 496 PID 412
0xe1648978 388 0xe0 0x20019 Key MACHINE\SYSTEM\SETUP
0x816046f0 388 0xe4 0x1f03ff Thread TID 580 PID 528
0x8170bda8 388 0xe8 0x1f03ff Thread TID 500 PID 412
0x815dda00 388 0xec 0x1f03ff Thread TID 504 PID 412
0x815d1da8 388 0xf0 0x1f03ff Thread TID 508 PID 412
0x815ffda8 388 0xf4 0x1f03ff Thread TID 512 PID 412
0x8153e020 388 0xf8 0x1f0fff Process services.exe(516)
0x81670248 388 0xfc 0x1f03ff Thread TID 520 PID 516
0x815fc2d0 388 0x100 0x1f03ff Thread TID 524 PID 412
0x816f28f8 388 0x104 0x1f03ff Thread TID 1288 PID 1284
0x8161f160 388 0x108 0x100001 File \Device\KsecDD
0x81636180 388 0x10c 0x1f0fff Process lsass.exe(528)
0x81610da8 388 0x110 0x1f03ff Thread TID 660 PID 516
0xe17cfb00 388 0x114 0x1f0001 Port
0xe17cf8e0 388 0x118 0x1f0001 Port
0x8169ddc0 388 0x11c 0x21f0003 Event
0x8162d200 388 0x120 0x1f03ff Thread TID 536 PID 388
0x817077d8 388 0x124 0x21f0003 Event
0x81691c30 388 0x128 0x1f03ff Thread TID 540 PID 516
0x816ac480 388 0x12c 0x1f03ff Thread TID 548 PID 528
0x81695da8 388 0x130 0x1f03ff Thread TID 544 PID 528
0x816d5970 388 0x134 0x1f03ff Thread TID 552 PID 528
0x816754f0 388 0x138 0x1f03ff Thread TID 556 PID 528
0x8160ada8 388 0x13c 0x1f03ff Thread TID 560 PID 528
0x815cbc10 388 0x140 0x1f03ff Thread TID 728 PID 412
0x816406f0 388 0x144 0x1f03ff Thread TID 572 PID 412
0x815e2cb0 388 0x148 0x1f03ff Thread TID 576 PID 528
0x8164d620 388 0x14c 0x1f03ff Thread TID 584 PID 516
0x81648558 388 0x150 0x1f03ff Thread TID 588 PID 516
0x816066f0 388 0x154 0x1f03ff Thread TID 596 PID 528
0x81606b18 388 0x158 0x1f03ff Thread TID 600 PID 528
0x81671da8 388 0x15c 0x1f03ff Thread TID 604 PID 528
0x816172c8 388 0x160 0x1f03ff Thread TID 608 PID 528
0x815e52c8 388 0x164 0x1f03ff Thread TID 612 PID 528
0x8160eda8 388 0x168 0x1f03ff Thread TID 616 PID 528
0x815dada8 388 0x16c 0x1f03ff Thread TID 620 PID 528
0x817002e0 388 0x170 0x1f03ff Thread TID 624 PID 528
0x81624a20 388 0x174 0x1f03ff Thread TID 1464 PID 1284
0x815d8558 388 0x178 0x1f03ff Thread TID 652 PID 516
0x8166b678 388 0x17c 0x1f03ff Thread TID 656 PID 516
0x816959b0 388 0x180 0x1f03ff Thread TID 640 PID 528
0x81699da8 388 0x184 0x1f03ff Thread TID 648 PID 516
0xe1854548 388 0x188 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE
0x81628320 388 0x18c 0x1f03ff Thread TID 664 PID 516
0x8162fda8 388 0x190 0x1f03ff Thread TID 668 PID 528
0x81630c90 388 0x194 0x1f03ff Thread TID 672 PID 516
0x81671398 388 0x198 0x1f0fff Process svchost.exe(676)
0x816706a8 388 0x19c 0x1f03ff Thread TID 680 PID 676
0xe185d6e8 388 0x1a0 0x1f0001 Port
0x816e1838 388 0x1a4 0x1f03ff Thread TID 688 PID 516
0x8166ec88 388 0x1a8 0x1f03ff Thread TID 708 PID 412
0x816c9c48 388 0x1ac 0x1f03ff Thread TID 692 PID 676
0x815fd878 388 0x1b0 0x1f03ff Thread TID 696 PID 676
0x81714c40 388 0x1b4 0x1f03ff Thread TID 700 PID 676
0x815fdda8 388 0x1b8 0x1f03ff Thread TID 704 PID 676
0x815f6da8 388 0x1bc 0x1f03ff Thread TID 712 PID 412
0x8170c798 388 0x1c0 0x1f03ff Thread TID 716 PID 412
0x815e8da8 388 0x1c4 0x1f03ff Thread TID 724 PID 516
0x81625da8 388 0x1c8 0x1f03ff Thread TID 732 PID 528
0x815f5da0 388 0x1cc 0x1f0fff Process svchost.exe(736)
0x81611cc8 388 0x1d0 0x1f03ff Thread TID 740 PID 736
0xe189a458 388 0x1d4 0x1f0001 Port
0x8166e3b8 388 0x1d8 0x1f03ff Thread TID 748 PID 736
0x817008a8 388 0x1dc 0x1f03ff Thread TID 744 PID 736
0x81619020 388 0x1e0 0x1f03ff Thread TID 752 PID 736
0x816192f8 388 0x1e4 0x1f03ff Thread TID 756 PID 736
0x81645558 388 0x1e8 0x1f03ff Thread TID 760 PID 736
0x816c5538 388 0x1ec 0x1f03ff Thread TID 764 PID 736
0x81601da8 388 0x1f0 0x1f03ff Thread TID 768 PID 736
0x8162ad78 388 0x1f4 0x1f0fff Process svchost.exe(800)
0x8162ab00 388 0x1f8 0x1f03ff Thread TID 804 PID 800
0x81638da8 388 0x1fc 0x1f03ff Thread TID 808 PID 676
0xe18a3e28 388 0x200 0x1f0001 Port
0x81608598 388 0x204 0x1f03ff Thread TID 816 PID 800
0x8169b858 388 0x208 0x1f03ff Thread TID 812 PID 800
0x81608298 388 0x20c 0x1f03ff Thread TID 820 PID 800
0x815c4be0 388 0x210 0x1f03ff Thread TID 824 PID 516
0xe18a5130 388 0x214 0x1f0001 Port
0x81709b78 388 0x218 0x1f0fff Process svchost.exe(876)
0x815f4a58 388 0x21c 0x1f03ff Thread TID 840 PID 800
0x81699838 388 0x220 0x1f0fff Process svchost.exe(844)
0x81699550 388 0x224 0x1f03ff Thread TID 848 PID 844
0x81633a20 388 0x228 0x1f03ff Thread TID 868 PID 516
0x81668460 388 0x22c 0x1f03ff Thread TID 936 PID 876
0x8166fa50 388 0x230 0x1f03ff Thread TID 872 PID 516
0x817098c0 388 0x234 0x1f03ff Thread TID 880 PID 876
0x816fbda8 388 0x238 0x1f03ff Thread TID 892 PID 800
0xe18a9b78 388 0x23c 0x1f0001 Port
0x816764f0 388 0x240 0x1f03ff Thread TID 896 PID 800
0x8160c810 388 0x244 0x1f03ff Thread TID 904 PID 844
0x8160caf0 388 0x248 0x1f03ff Thread TID 900 PID 844
0x81609ae0 388 0x24c 0x1f03ff Thread TID 916 PID 800
0x816689a8 388 0x250 0x1f03ff Thread TID 920 PID 844
0x81669320 388 0x254 0x1f03ff Thread TID 1140 PID 800
0x8167a508 388 0x258 0x1f03ff Thread TID 1392 PID 1284
0x81679788 388 0x25c 0x1f0fff Process ctfmon.exe(1412)
0x815dc660 388 0x260 0x1f03ff Thread TID 1056 PID 800
0x816f3da8 388 0x264 0x1f03ff Thread TID 1416 PID 1412
0x815535a0 388 0x268 0x1f03ff Thread TID 1508 PID 876
0x815f0b38 388 0x26c 0x1f03ff Thread TID 968 PID 876
0x816f7b30 388 0x270 0x1f03ff Thread TID 1500 PID 876
0x815f88b8 388 0x274 0x1f03ff Thread TID 976 PID 800
0x8161eda8 388 0x278 0x1f03ff Thread TID 984 PID 412
0x81623da8 388 0x27c 0x1f03ff Thread TID 1360 PID 1268
0xe1d02a90 388 0x280 0x1f0001 Port
0x81683968 388 0x284 0x1f03ff Thread TID 992 PID 412
0x816c7788 388 0x288 0x1f03ff Thread TID 996 PID 412
0x8167fb70 388 0x28c 0x1f03ff Thread TID 1008 PID 528
0x81620590 388 0x290 0x1f03ff Thread TID 1020 PID 528
0x81624320 388 0x294 0x1f03ff Thread TID 1476 PID 800
0x81690740 388 0x298 0x1f03ff Thread TID 1040 PID 412
0x81573540 388 0x29c 0x1f03ff Thread TID 1348 PID 1284
0x81690250 388 0x2a0 0x1f03ff Thread TID 1048 PID 800
0x816904c8 388 0x2a4 0x1f03ff Thread TID 1044 PID 800
0x81669958 388 0x2a8 0x1f03ff Thread TID 1132 PID 516
0xe1ac6990 388 0x2ac 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004\CONTROL PANEL\INTERNATIONAL
0xe1a97910 388 0x2b0 0x20006 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004\CONTROL PANEL\INTERNATIONAL
0x816738d0 388 0x2b4 0x1f03ff Thread TID 1128 PID 800
0x81701da8 388 0x2b8 0x1f03ff Thread TID 1144 PID 800
0x81669608 388 0x2bc 0x1f03ff Thread TID 1136 PID 800
0x816ee640 388 0x2c0 0x1f03ff Thread TID 1100 PID 412
0x816eeb30 388 0x2c4 0x1f03ff Thread TID 1092 PID 388
0x81622b30 388 0x2c8 0x1f03ff Thread TID 1452 PID 736
0x81669c38 388 0x2cc 0x1f03ff Thread TID 1116 PID 412
0x81701820 388 0x2d0 0x1f03ff Thread TID 1148 PID 800
0x815c7a18 388 0x2d4 0x1f03ff Thread TID 1156 PID 800
0x815c7020 388 0x2d8 0x1f03ff Thread TID 1152 PID 800
0x815c77a0 388 0x2dc 0x1f03ff Thread TID 1160 PID 800
0x815c7358 388 0x2e0 0x1f03ff Thread TID 1164 PID 800
0x8164ad18 388 0x2e4 0x1f03ff Thread TID 1168 PID 800
0x8164a810 388 0x2e8 0x1f0fff Process spoolsv.exe(1172)
0x8164a488 388 0x2ec 0x1f03ff Thread TID 1176 PID 1172
0xe16765f0 388 0x2f0 0x1f0001 Port
0xe16769d0 388 0x2f4 0xf0007 Section
0x816eb540 388 0x2f8 0x21f0003 Event
0x815b8da8 388 0x2fc 0x1f03ff Thread TID 1184 PID 1172
0x815746a8 388 0x300 0x1f03ff Thread TID 1180 PID 1172
0x815b8b30 388 0x304 0x1f03ff Thread TID 1188 PID 1172
0x815b88b8 388 0x308 0x1f03ff Thread TID 1192 PID 1172
0x815b8578 388 0x30c 0x1f03ff Thread TID 1196 PID 1172
0x8169f8b8 388 0x310 0x1f03ff Thread TID 1588 PID 800
0x815e6840 388 0x314 0x1f03ff Thread TID 1204 PID 800
0x815e64f8 388 0x318 0x1f03ff Thread TID 1208 PID 800
0x8163fba8 388 0x31c 0x1f03ff Thread TID 1212 PID 800
0x8163f848 388 0x320 0x1f03ff Thread TID 1216 PID 800
0x8163f358 388 0x324 0x1f03ff Thread TID 1224 PID 528
0x815e9b38 388 0x328 0x1f03ff Thread TID 1336 PID 1284
0x81602c70 388 0x32c 0x1f0fff Process userinit.exe(1268)
0x815e98b8 388 0x330 0x1f03ff Thread TID 1252 PID 412
0x81602928 388 0x334 0x1f03ff Thread TID 1272 PID 1268
0x815e9600 388 0x338 0x1f03ff Thread TID 1264 PID 412
0xe167dec0 388 0x33c 0x1f0001 Port
0x816f2b70 388 0x340 0x1f0fff Process explorer.exe(1284)
0xe167c930 388 0x344 0x1f0001 Port
0x815cd7b0 388 0x348 0x1f03ff Thread TID 1296 PID 1284
0x816f2568 388 0x34c 0x1f03ff Thread TID 1292 PID 1284
0x815cd4d8 388 0x350 0x1f03ff Thread TID 1300 PID 1284
0x816f6da8 388 0x354 0x1f03ff Thread TID 1304 PID 1284
0x816f6ae0 388 0x358 0x1f03ff Thread TID 1308 PID 1284
0x816f6800 388 0x35c 0x1f03ff Thread TID 1312 PID 1284
0x816f6470 388 0x360 0x1f03ff Thread TID 1316 PID 1284
0x815ce350 388 0x364 0x1f03ff Thread TID 1320 PID 516
0x815e0da8 388 0x368 0x1f03ff Thread TID 1328 PID 1284
0x815fb4a8 388 0x36c 0x1f03ff Thread TID 1444 PID 1284
0x81574da8 388 0x370 0x1f03ff Thread TID 1424 PID 800
0x815fb720 388 0x374 0x1f03ff Thread TID 1440 PID 736
0x815fbc10 388 0x378 0x1f03ff Thread TID 1432 PID 516
0x81622da8 388 0x37c 0x1f03ff Thread TID 1448 PID 676
0x81553328 388 0x380 0x1f03ff Thread TID 1512 PID 876
0x81579c78 388 0x384 0x1f03ff Thread TID 1516 PID 876
0x815793d0 388 0x388 0x1f03ff Thread TID 1524 PID 800
0x8167eda8 388 0x38c 0x1f03ff Thread TID 1528 PID 800
0x8167e5a8 388 0x390 0x1f03ff Thread TID 1536 PID 800
0x81685da8 388 0x394 0x1f03ff Thread TID 1540 PID 800
0x816858b8 388 0x398 0x1f03ff Thread TID 1548 PID 800
0x81685640 388 0x39c 0x1f03ff Thread TID 1552 PID 528
0x8164bda8 388 0x3a0 0x1f03ff Thread TID 1652 PID 412
0x8164fda8 388 0x3a4 0x1f03ff Thread TID 1592 PID 800
0x816033b8 388 0x3ac 0x1f03ff Thread TID 1664 PID 800
0x8164f3d0 388 0x3b0 0x1f03ff Thread TID 1604 PID 800
0x815cc960 388 0x3b4 0x1f03ff Thread TID 1608 PID 800
0x815cc6e8 388 0x3b8 0x1f03ff Thread TID 1612 PID 800
0x815cc470 388 0x3bc 0x1f03ff Thread TID 1616 PID 736
0x81605b30 388 0x3c0 0x1f03ff Thread TID 1624 PID 800
0x816058b8 388 0x3c4 0x1f03ff Thread TID 1628 PID 800
0x815ccda8 388 0x3c8 0x1f03ff Thread TID 1632 PID 800
0x81605640 388 0x3cc 0x1f03ff Thread TID 1636 PID 516
0x81605328 388 0x3d0 0x1f03ff Thread TID 1640 PID 736
0x815ebda8 388 0x3d4 0x1f03ff Thread TID 1644 PID 800
0x8164bb00 388 0x3d8 0x1f03ff Thread TID 1656 PID 412
0x8156c8a8 388 0x3dc 0x1f03ff Thread TID 1668 PID 528
0x81613680 388 0x3e0 0x1f03ff Thread TID 1672 PID 528
0x816131d0 388 0x3e4 0x1f03ff Thread TID 1676 PID 528
0x81614cb0 388 0x3e8 0x1f03ff Thread TID 1680 PID 528
0x816149b8 388 0x3ec 0x1f03ff Thread TID 1684 PID 800
0x81614200 388 0x3f0 0x1f03ff Thread TID 1688 PID 800
0x8166d4e0 388 0x3f4 0x1f03ff Thread TID 1692 PID 800
0x8168d9f8 388 0x3f8 0x1f03ff Thread TID 1696 PID 800
0x815ef3b8 388 0x3fc 0x1f03ff Thread TID 1704 PID 516
0x816fcce8 388 0x400 0x1f03ff Thread TID 1708 PID 736
0x816fc898 388 0x404 0x1f03ff Thread TID 1712 PID 516
0x816fc620 388 0x408 0x1f03ff Thread TID 1716 PID 844
0x814f78d0 388 0x40c 0x1f03ff Thread TID 1732 PID 844
0x814f71a8 388 0x410 0x1f03ff Thread TID 1736 PID 800
0xe1006e20 412 0x4 0xf0003 KeyedEvent CritSecOutOfMemoryEvent
0xe14f3230 412 0x8 0x3 Directory KnownDlls
0x81615e10 412 0xc 0x1f0001 Mutant _Satori_81_MutexObject_S-1-5-18
0x8170d1f8 412 0x10 0x100003 Semaphore
0xe14038f8 412 0x14 0xf000f Directory Windows
0xe16176f8 412 0x18 0x21f0001 Port
0x81609220 412 0x1c 0x100003 Semaphore
0xe1617580 412 0x20 0x20f003f Key MACHINE
0x8167d2c8 412 0x24 0x1f0003 Event crypt32LogoffEvent
0x815ff898 412 0x28 0x21f0003 Event
0xe14477d0 412 0x2c 0x2000f Directory BaseNamedObjects
0x817cb720 412 0x30 0x1f0003 Event userenv: User Profile setup event
0x81665fe0 412 0x34 0x1f0001 Mutant userenv: machine policy mutex
0x81648208 412 0x38 0x1f0001 Mutant userenv: Machine Registry policy mutex
0x81618128 412 0x3c 0x1f0003 Event userenv: Machine Group Policy has been applied
0x815d4128 412 0x40 0x1f0003 Event userenv: Machine Group Policy ForcedRefresh Needs Foreground Processing
0x8161d240 412 0x44 0x1f0003 Event userenv: Machine Group Policy Processing is done
0x815d81a0 412 0x48 0x1f0003 Event userenv: Machine Policy Foreground Done Event
0x817c8308 412 0x4c 0x1f0001 Mutant userenv: user policy mutex
0x81633118 412 0x50 0x1f0001 Mutant userenv: User Registry policy mutex
0x81609128 412 0x54 0x1f0003 Event userenv: User Group Policy has been applied
0x815f2128 412 0x58 0x1f0003 Event userenv: User Group Policy ForcedRefresh Needs Foreground Processing
0x8162e128 412 0x5c 0x1f0003 Event userenv: User Group Policy Processing is done
0x815f7310 412 0x60 0x1f0003 Event userenv: User Policy Foreground Done Event
0x8160b118 412 0x64 0x1f0003 Event
0x81692120 412 0x68 0x1f0001 Mutant
0x816da350 412 0x6c 0x1f0003 Event
0x817c8c58 412 0x70 0x1f0001 Mutant
0x816da320 412 0x74 0x1f0003 Event
0x817131d0 412 0x78 0x1f0001 Mutant
0x816d78c8 412 0x7c 0x1f0001 Mutant
0x81611318 412 0x80 0x1f0003 Event
0x815d42e0 412 0x84 0x1f0001 Mutant
0x816112e8 412 0x88 0x1f0003 Event
0x81645900 412 0x8c 0x1f0003 Event
0xe161df50 412 0x90 0x20f003f Key MACHINE\SOFTWARE\CLASSES
0x816801a0 412 0x94 0x1f0003 Event WinlogonTSSynchronizeEvent
0x816e26f0 412 0x98 0x12019f File \Device\NamedPipe\TerminalServer\AutoReconnect
0x8174d888 412 0x9c 0x1f0003 Event TS-WPAAE
0x816458d0 412 0xa0 0x1f0003 Event
0x816e2350 412 0xa4 0x120089 File \Device\HarddiskVolume1\WINDOWS\system32\kbd101.dll
0x8162a930 412 0xa8 0x1f0003 Semaphore shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}
0x816af390 412 0xac 0x120089 File \Device\HarddiskVolume1\WINDOWS\system32\kbd106.dll
0x8160a990 412 0xb0 0x120089 File \Device\HarddiskVolume1\WINDOWS\system32\kbdnec.dll
0x815fdbf0 412 0xb4 0xf037f WindowStation WinSta0
0xe1648b18 412 0xb8 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE
0xe1648b80 412 0xbc 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE\ALTERNATE SORTS
0xe1623ae0 412 0xc0 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS
0x817cb768 412 0xc4 0xf01ff Desktop Winlogon
0x815fdbf0 412 0xc8 0xf037f WindowStation WinSta0
0x816841d8 412 0xcc 0xf01ff Desktop Disconnect
0x816db158 412 0xd0 0xf01ff Desktop Default
0x815d8aa0 412 0xd4 0x1f0001 Mutant SingleSesMutex
0x815d8ea8 412 0xd8 0x1f0003 Event ReconEvent
0x81649558 412 0xdc 0x1f03ff Thread TID 416 PID 412
0xe164b188 412 0xe0 0x20f003f Key USER\.DEFAULT
0x8177f3b0 412 0xe4 0x1f0001 Mutant winlogon: Logon UserProfileMapping Mutex
0x815e1db0 412 0xe8 0x1f0003 Event
0x81718b90 412 0xec 0x100020 File \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x815d18f0 412 0xf0 0x1f0003 Event
0xe1447ad0 412 0xf4 0xf003f Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9
0xe16c43c0 412 0xf8 0xf003f Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5
0x81647590 412 0xfc 0x1f0003 Event NetworkProviderLoad
0x81608e98 412 0x100 0x1f0003 Event
0xe1648590 412 0x104 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\CRYPT32CHAIN
0x81718e98 412 0x108 0x100001 File \Device\KsecDD
0xe16484a0 412 0x10c 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\CRYPTNET
0x8161e9f8 412 0x110 0x1f0001 Mutant WPA_PR_MUTEX
0x8160c440 412 0x114 0x1f0003 Event
0x815e6dd0 412 0x11c 0x100003 Semaphore
0xe17ef740 412 0x120 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\SCLGNTFY
0x816ae7d0 412 0x128 0x21f0003 Event
0x816ee448 412 0x12c 0x1f0003 Event
0xe14cab60 412 0x130 0x1f0001 Port sclogonrpc
0xe17c19b8 412 0x134 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\CONTROL\LSA
0x81710438 412 0x13c 0x1f0003 Event
0x8161ae70 412 0x140 0x1f0003 Event
0x8162c8d8 412 0x144 0x1f0003 Event
0x8162c648 412 0x148 0x1f0003 Event
0x81649558 412 0x14c 0x1f03ff Thread TID 416 PID 412
0xe14ca578 412 0x150 0x1f0001 Port IUserProfile
0x816403f8 412 0x154 0x1f0003 Event
0x81644558 412 0x158 0x1f03ff Thread TID 496 PID 412
0x8164d358 412 0x15c 0x1f0003 Event
0x8170bda8 412 0x160 0x1f03ff Thread TID 500 PID 412
0x816233e8 412 0x164 0x1f0001 Mutant ShimCacheMutex
0xe17ef118 412 0x168 0xf0007 Section ShimSharedMemory
0x8167f020 412 0x16c 0x1f0003 Timer
0x816063c8 412 0x170 0x21f0003 Event
0x815dda00 412 0x174 0x1f03ff Thread TID 504 PID 412
0x816d9cc8 412 0x178 0x100020 File \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x81683648 412 0x17c 0x1f0003 IoCompletion
0x81716778 412 0x180 0x1f0003 IoCompletion
0x81717898 412 0x184 0x1f0003 IoCompletion
0x81716778 412 0x188 0x1f0003 IoCompletion
0x816dba68 412 0x18c 0x12019f File \Device\NamedPipe\InitShutdown
0x816c98b0 412 0x190 0x12019f File \Device\NamedPipe\InitShutdown
0x81646e98 412 0x194 0x1f0003 Event
0x815ffda8 412 0x198 0x1f03ff Thread TID 512 PID 412
0x8160cd98 412 0x19c 0x100003 Semaphore
0x815fc2d0 412 0x1a0 0x1f03ff Thread TID 524 PID 412
0x81701358 412 0x1a4 0x1f0003 Timer
0x8153e020 412 0x1a8 0x1f0fff Process services.exe(516)
0x81648d50 412 0x1ac 0x1f0003 Event
0xe17d58d0 412 0x1b0 0x1f0001 Port
0x81636180 412 0x1b4 0x1f0fff Process lsass.exe(528)
0xe17d8fb8 412 0x1b8 0x2001f Key MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON
0x81602880 412 0x1bc 0x1f0003 Event
0x815df4d8 412 0x1c0 0x1f0003 Event
0x815cbc10 412 0x1c4 0x1f03ff Thread TID 728 PID 412
0x81648d20 412 0x1c8 0x1f0003 Event
0x815e8570 412 0x1cc 0x1f0003 Event WFP_IDLE_TRIGGER
0x815e8530 412 0x1d0 0x1f0003 Event
0x815e8500 412 0x1d4 0x1f0003 Event
0xe181cc00 412 0x1d8 0x2001f Key MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON
0x815e85a8 412 0x1dc 0x160001 File \Device\HarddiskVolume1\WINDOWS\system32\dllcache
0x81671d00 412 0x1e0 0x100003 Event
0xe1853c58 412 0x1e4 0x1f0001 Port
0x81671af0 412 0x1e8 0x1f0003 Event
0x8166b648 412 0x1ec 0x1f0003 Event
0x815d5c10 412 0x1f0 0x160001 File \Device\HarddiskVolume1\WINDOWS\system32
0x815d5b78 412 0x1f4 0x160001 File \Device\HarddiskVolume1\WINDOWS\AppPatch
0xe1857728 412 0x1f8 0x1f0001 Port
0x81610ce0 412 0x1fc 0x1f0003 Event Microsoft Smart Card Resource Manager Started
0x815d56b8 412 0x200 0x1f0003 Event
0x815d5628 412 0x204 0x12019f File \Device\NamedPipe\lsarpc
0xe185b390 412 0x208 0x1 Key MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\CREDENTIALS
0x815d5ae8 412 0x20c 0x1f0003 Event msgina: ReturnToWelcome
0x8161a938 412 0x210 0x1f0003 Event
0x816f5678 412 0x214 0x1f0003 Event msgina: ShutdownEvent
0x816f5260 412 0x218 0x1f0001 Mutant msgina: InteractiveLogonMutex
0x81649c90 412 0x21c 0x1f0001 Mutant msgina: InteractiveLogonRequestMutex
0x815e8828 412 0x220 0x160001 File \Device\HarddiskVolume1\Program Files\Common Files\Microsoft Shared\web server extensions\40\isapi\_vti_adm
0x816c9ef8 412 0x224 0x160001 File \Device\HarddiskVolume1\Program Files\Common Files\Microsoft Shared\web server extensions\40\_vti_bin\_vti_adm
0x815fdca0 412 0x228 0x160001 File \Device\HarddiskVolume1\WINDOWS\Help
0x81638700 412 0x22c 0x160001 File \Device\HarddiskVolume1\Program Files\Common Files\Microsoft Shared\web server extensions\40\isapi\_vti_aut
0x816385d8 412 0x230 0x160001 File \Device\HarddiskVolume1\Program Files\Common Files\Microsoft Shared\web server extensions\40\_vti_bin\_vti_aut
0x815da508 412 0x234 0x160001 File \Device\HarddiskVolume1\Program Files\Common Files\Microsoft Shared\web server extensions\40\bin
0x815da3e0 412 0x238 0x160001 File \Device\HarddiskVolume1\WINDOWS\Fonts
0x815da348 412 0x23c 0x160001 File \Device\HarddiskVolume1\WINDOWS\system32\drivers
0x815da2b0 412 0x240 0x160001 File \Device\HarddiskVolume1\Program Files\Common Files\Microsoft Shared\web server extensions\40\servsupp
0x815f6628 412 0x244 0x160001 File \Device\HarddiskVolume1\Program Files\Common Files\Microsoft Shared\web server extensions\40\bots\vinavbar
0x815f6470 412 0x248 0x160001 File \Device\HarddiskVolume1\Program Files\microsoft frontpage\version3.0\bin
0x8166af28 412 0x24c 0x160001 File \Device\HarddiskVolume1\Program Files\Common Files\Microsoft Shared\web server extensions\40\_vti_bin
0x8166ae90 412 0x250 0x160001 File \Device\HarddiskVolume1\Program Files\Common Files\Microsoft Shared\web server extensions\40\bin\1041
0x8166ad68 412 0x254 0x160001 File \Device\HarddiskVolume1\Program Files\Common Files\Microsoft Shared\web server extensions\40\isapi
0x8166acd0 412 0x258 0x160001 File \Device\HarddiskVolume1\WINDOWS
0x81631028 412 0x25c 0x160001 File \Device\HarddiskVolume1\Program Files\Common Files\Microsoft Shared\DAO
0x816312f8 412 0x260 0x160001 File \Device\HarddiskVolume1\Program Files\Windows Media Player
0x816311d0 412 0x264 0x160001 File \Device\HarddiskVolume1\Program Files\Common Files\System\msadc
0x816b0028 412 0x268 0x160001 File \Device\HarddiskVolume1\Program Files\Common Files\System\ado
0x816b02e0 412 0x26c 0x160001 File \Device\HarddiskVolume1\Program Files\Common Files\System\Ole DB
0x816b01b8 412 0x270 0x160001 File \Device\HarddiskVolume1\WINDOWS\inf
0x816b0120 412 0x274 0x160001 File \Device\HarddiskVolume1\WINDOWS\system
0x81695320 412 0x278 0x160001 File \Device\HarddiskVolume1\WINDOWS\msagent
0x816951f8 412 0x27c 0x160001 File \Device\HarddiskVolume1\WINDOWS\msagent\intl
0x81689130 412 0x280 0x160001 File \Device\HarddiskVolume1\WINDOWS\system32\inetsrv
0x815d5028 412 0x284 0x160001 File \Device\HarddiskVolume1\Program Files\MSN Gaming Zone\Windows
0x815d5348 412 0x288 0x160001 File \Device\HarddiskVolume1\WINDOWS\PCHealth\HelpCtr\Binaries
0x815d52b0 412 0x28c 0x160001 File \Device\HarddiskVolume1\Program Files\NetMeeting
0x815d51c8 412 0x290 0x160001 File \Device\HarddiskVolume1\WINDOWS\system32\drivers\disdn
0x816317c0 412 0x294 0x160001 File \Device\HarddiskVolume1\WINDOWS\ime\CHTIME\Applets
0x81631670 412 0x298 0x160001 File \Device\HarddiskVolume1\WINDOWS\system32\wbem
0x816315d8 412 0x29c 0x160001 File \Device\HarddiskVolume1\WINDOWS\system32\IME\CINTLGNT
0x816314b0 412 0x2a0 0x160001 File \Device\HarddiskVolume1\WINDOWS\system32\Com
0x815d45e8 412 0x2a4 0x160001 File \Device\HarddiskVolume1\WINDOWS\system32\Setup
0x815d44c0 412 0x2a8 0x160001 File \Device\HarddiskVolume1\WINDOWS\ime\IMJP8_1
0x815d4428 412 0x2ac 0x160001 File \Device\HarddiskVolume1\Program Files\Common Files\Microsoft Shared\Triedit
0x81705aa0 412 0x2b0 0x160001 File \Device\HarddiskVolume1\Program Files\Windows NT
0x81705a08 412 0x2b4 0x160001 File \Device\HarddiskVolume1\Program Files\Common Files\System
0x81705970 412 0x2b8 0x160001 File \Device\HarddiskVolume1\WINDOWS\system32\1033
0x81705888 412 0x2bc 0x160001 File \Device\HarddiskVolume1\WINDOWS\system32\1041
0x816778d8 412 0x2c0 0x160001 File \Device\HarddiskVolume1\Program Files\Common Files\Microsoft Shared\web server extensions\40\admcgi\scripts
0x81677788 412 0x2c4 0x160001 File \Device\HarddiskVolume1\Program Files\Common Files\Microsoft Shared\web server extensions\40\admisapi\scripts
0x816775d0 412 0x2c8 0x160001 File \Device\HarddiskVolume1\WINDOWS\system32\usmt
0x816274a8 412 0x2cc 0x160001 File \Device\HarddiskVolume1\WINDOWS\ime\IMKR6_1\Dicts
0x816271e0 412 0x2d0 0x160001 File \Device\HarddiskVolume1\WINDOWS\system32\mui\0411
0x816272f0 412 0x2d4 0x160001 File \Device\HarddiskVolume1\Program Files\Internet Explorer
0x815f2958 412 0x2d8 0x160001 File \Device\HarddiskVolume1\WINDOWS\ime\IMJP8_1\APPLETS
0x815f2830 412 0x2dc 0x160001 File \Device\HarddiskVolume1\WINDOWS\ime\IMKR6_1\Applets
0x815f2708 412 0x2e0 0x160001 File \Device\HarddiskVolume1\WINDOWS\system32\xircom
0x8166abb8 412 0x2e4 0x160001 File \Device\HarddiskVolume1\Program Files\Internet Explorer\Connection Wizard
0x8166aad0 412 0x2e8 0x160001 File \Device\HarddiskVolume1\Program Files\Common Files\Microsoft Shared\MSInfo
0x8166a9a8 412 0x2ec 0x160001 File \Device\HarddiskVolume1\WINDOWS\ime\IMKR6_1
0x8166a910 412 0x2f0 0x160001 File \Device\HarddiskVolume1\WINDOWS\ime\SHARED
0x81668f90 412 0x2f4 0x160001 File \Device\HarddiskVolume1\WINDOWS\system32\IME\PINTLGNT
0x81668e68 412 0x2f8 0x160001 File \Device\HarddiskVolume1\Program Files\Common Files\SpeechEngines\Microsoft\Lexicon\1033
0x8162ef40 412 0x2fc 0x160001 File \Device\HarddiskVolume1\WINDOWS\Resources\Themes\Luna
0x8162eea8 412 0x300 0x160001 File \Device\HarddiskVolume1\Program Files\Movie Maker
0x8162ee10 412 0x304 0x160001 File \Device\HarddiskVolume1\WINDOWS\ime
0x8162ed78 412 0x308 0x160001 File \Device\HarddiskVolume1\WINDOWS\srchasst
0x8166bcb0 412 0x30c 0x160001 File \Device\HarddiskVolume1\Program Files\Outlook Express
0x8166bc18 412 0x310 0x160001 File \Device\HarddiskVolume1\WINDOWS\system32\oobe
0x8166baf0 412 0x314 0x160001 File \Device\HarddiskVolume1\Program Files\Common Files\MSSoap\Binaries
0x8168e930 412 0x318 0x160001 File \Device\HarddiskVolume1\Program Files\Common Files\MSSoap\Binaries\Resources\1033
0x8168e7b8 412 0x31c 0x160001 File \Device\HarddiskVolume1\WINDOWS\system32\npp
0x8168e690 412 0x320 0x160001 File \Device\HarddiskVolume1\WINDOWS\ime\SHARED\RES
0x816255a8 412 0x324 0x160001 File \Device\HarddiskVolume1\Program Files\Windows NT\Pinball
0x8177b248 412 0x328 0x160001 File \Device\HarddiskVolume1\WINDOWS\ime\CHSIME\APPLETS
0x815fc930 412 0x32c 0x160001 File \Device\HarddiskVolume1\WINDOWS\system32\Restore
0x815fc898 412 0x330 0x160001 File \Device\HarddiskVolume1\Program Files\Common Files\SpeechEngines\Microsoft\TTS\1033
0x815fc720 412 0x334 0x160001 File \Device\HarddiskVolume1\Program Files\Common Files\Microsoft Shared\Speech
0x815fc5f8 412 0x338 0x160001 File \Device\HarddiskVolume1\WINDOWS\Resources\Themes\Luna\Shell\NormalColor
0x816ce7c8 412 0x33c 0x160001 File \Device\HarddiskVolume1\WINDOWS\Resources\Themes\Luna\Shell\Homestead
0x816ce6a0 412 0x340 0x160001 File \Device\HarddiskVolume1\WINDOWS\Resources\Themes\Luna\Shell\Metallic
0x8167b448 412 0x344 0x160001 File \Device\HarddiskVolume1\WINDOWS\system32\wbem\snmp
0x8167b388 412 0x348 0x160001 File \Device\HarddiskVolume1\Program Files\Common Files\SpeechEngines\Microsoft
0x8167b2f0 412 0x34c 0x160001 File \Device\HarddiskVolume1\Program Files\Common Files\Microsoft Shared\Speech\1041
0x8167b1c8 412 0x350 0x160001 File \Device\HarddiskVolume1\WINDOWS\peernet
0x81702e18 412 0x354 0x160001 File \Device\HarddiskVolume1\WINDOWS\system32\spool\drivers\color
0x81702c10 412 0x358 0x160001 File \Device\HarddiskVolume1\WINDOWS\system32\IME\TINTLGNT
0x81702b78 412 0x35c 0x160001 File \Device\HarddiskVolume1\WINDOWS\Help\Tours\mmTour
0x81693370 412 0x360 0x160001 File \Device\HarddiskVolume1\WINDOWS\PCHealth\UploadLB\Binaries
0x81640078 412 0x364 0x160001 File \Device\HarddiskVolume1\Program Files\Common Files\Microsoft Shared\VGX
0x816460e0 412 0x368 0x160001 File \Device\HarddiskVolume1\WINDOWS\system32\wbem\xml
0x81703e30 412 0x36c 0x160001 File \Device\HarddiskVolume1\Program Files\Windows NT\Accessories
0x81703d08 412 0x370 0x160001 File \Device\HarddiskVolume1\Program Files\xerox\nwwia
0x8166ef30 412 0x374 0x1f0003 Event
0xe187cc08 412 0x378 0x20019 Key MACHINE\SYSTEM\SETUP
0x8166ef00 412 0x37c 0x1f0003 Event
0x8166ef68 412 0x380 0x160001 File \Device\HarddiskVolume1\WINDOWS\WinSxS
0x8166ec88 412 0x384 0x1f03ff Thread TID 708 PID 412
0x8166ec18 412 0x388 0x1f0003 Event
0x81705688 412 0x38c 0x1f0003 Event
0x81705658 412 0x390 0x1f0003 Event
0x81705628 412 0x394 0x1f0003 Event
0x817055f8 412 0x398 0x1f0003 Event
0x81705430 412 0x39c 0x1f0003 Event
0x8162a8c0 412 0x3a0 0x1f0003 Event
0x8162a6f8 412 0x3a4 0x1f0003 Event
0x8162a530 412 0x3a8 0x1f0003 Event
0x8162a500 412 0x3ac 0x1f0003 Event
0x8162a4d0 412 0x3b0 0x1f0003 Event
0x8166e848 412 0x3b4 0x1f0003 Event
0x8166e818 412 0x3b8 0x1f0003 Event
0x8166e7e8 412 0x3bc 0x1f0003 Event
0x8166e7b8 412 0x3c0 0x1f0003 Event
0x8166e788 412 0x3c4 0x1f0003 Event
0x8168fb30 412 0x3c8 0x1f0003 Event
0x8168fb00 412 0x3cc 0x1f0003 Event
0x8168fad0 412 0x3d0 0x1f0003 Event
0x8168faa0 412 0x3d4 0x1f0003 Event
0x8168fa70 412 0x3d8 0x1f0003 Event
0x81699288 412 0x3dc 0x1f0003 Event
0x81699258 412 0x3e0 0x1f0003 Event
0x81699228 412 0x3e4 0x1f0003 Event
0x816991f8 412 0x3e8 0x1f0003 Event
0x816991c8 412 0x3ec 0x1f0003 Event
0x81643708 412 0x3f0 0x1f0003 Event
0x816436d8 412 0x3f4 0x1f0003 Event
0x816436a8 412 0x3f8 0x1f0003 Event
0x81643678 412 0x3fc 0x1f0003 Event
0x81643648 412 0x400 0x1f0003 Event
0x81629820 412 0x404 0x1f0003 Event
0x816297f0 412 0x408 0x1f0003 Event
0x816297c0 412 0x40c 0x1f0003 Event
0x81629790 412 0x410 0x1f0003 Event
0x81629760 412 0x414 0x1f0003 Event
0x8162e3a8 412 0x418 0x1f0003 Event
0x8162e378 412 0x41c 0x1f0003 Event
0x8162e348 412 0x420 0x1f0003 Event
0x8162e318 412 0x424 0x1f0003 Event
0x8162e2e8 412 0x428 0x1f0003 Event
0x8162f4c8 412 0x42c 0x1f0003 Event
0x8162f498 412 0x430 0x1f0003 Event
0x8162f468 412 0x434 0x1f0003 Event
0x8162f438 412 0x438 0x1f0003 Event
0x8162f408 412 0x43c 0x1f0003 Event
0x81631968 412 0x440 0x1f0003 Event
0x81631938 412 0x444 0x1f0003 Event
0x81631908 412 0x448 0x1f0003 Event
0x816318d8 412 0x44c 0x1f0003 Event
0x816318a8 412 0x450 0x1f0003 Event
0x81635848 412 0x454 0x1f0003 Event
0x81635818 412 0x458 0x1f0003 Event
0x816357e8 412 0x45c 0x1f0003 Event
0x816357b8 412 0x460 0x1f0003 Event
0x81635788 412 0x464 0x1f0003 Event
0x816104c8 412 0x468 0x1f0003 Event
0x81610498 412 0x46c 0x1f0003 Event
0x81610468 412 0x470 0x1f0003 Event
0x81610438 412 0x474 0x1f0003 Event
0x81610408 412 0x478 0x1f0003 Event
0x815f2b00 412 0x47c 0x1f0003 Event
0x815f2ad0 412 0x480 0x1f0003 Event
0x815f2aa0 412 0x484 0x1f0003 Event
0x815f2a70 412 0x488 0x1f0003 Event
0x815f2a40 412 0x48c 0x1f0003 Event
0x81635cc0 412 0x490 0x1f0003 Event
0x81635c90 412 0x494 0x1f0003 Event
0x81635c60 412 0x498 0x1f0003 Event
0x81635c30 412 0x49c 0x1f0003 Event
0x81635c00 412 0x4a0 0x1f0003 Event
0x81630568 412 0x4a4 0x1f0003 Event
0x81630538 412 0x4a8 0x1f0003 Event
0x81630508 412 0x4ac 0x1f0003 Event
0x816304d8 412 0x4b0 0x1f0003 Event
0x816304a8 412 0x4b4 0x1f0003 Event
0x8162f940 412 0x4b8 0x1f0003 Event
0x8162f910 412 0x4bc 0x1f0003 Event
0x8162f8e0 412 0x4c0 0x1f0003 Event
0x8162f8b0 412 0x4c4 0x1f0003 Event
0x8162f880 412 0x4c8 0x1f0003 Event
0x815fcad8 412 0x4cc 0x1f0003 Event
0x815fcaa8 412 0x4d0 0x1f0003 Event
0x815fca78 412 0x4d4 0x1f0003 Event
0x815fca48 412 0x4d8 0x1f0003 Event
0x815fca18 412 0x4dc 0x1f0003 Event
0x815fe3d0 412 0x4e0 0x1f0003 Event
0x815fe3a0 412 0x4e4 0x1f0003 Event
0x815fe370 412 0x4e8 0x1f0003 Event
0x8166ec88 412 0x4ec 0x1f03ff Thread TID 708 PID 412
0x815dd600 412 0x4f0 0x12019f File \Device\NamedPipe\SfcApi
0x815de7e8 412 0x4f4 0x12019f File \Device\NamedPipe\SfcApi
0x815f6da8 412 0x4f8 0x1f03ff Thread TID 712 PID 412
0x8170c798 412 0x4fc 0x1f03ff Thread TID 716 PID 412
0xe18be188 412 0x500 0x1f0001 Port
0xe1882b70 412 0x504 0x1f0001 Port
0xe18c36d0 412 0x508 0x1f0001 Port
0xe187e188 412 0x50c 0x20f003f Key USER
0xe18bb388 412 0x510 0x4 Section
0x815c4fa0 412 0x514 0x1f0003 Event ThemesStartEvent
0x815f0f30 412 0x518 0x100003 Event
0x8162a930 412 0x51c 0x1f0003 Semaphore shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}
0xe18835a8 412 0x520 0x1f0001 Port
0x815f8bc0 412 0x524 0x1f0003 Event
0x815fecc0 412 0x52c 0x21f0003 Event
0xe1897e68 412 0x530 0x1f0001 Port
0x816f4db0 412 0x534 0x1f0003 Event
0x815e7110 412 0x538 0x1f0003 Semaphore shell.{7CB834F0-527B-11D2-9D1F-0000F805CA57}
0xe1679878 412 0x540 0x4 Section mmGlobalPnpInfo
0x816239a8 412 0x544 0x1f0003 Event SENS Started Event
0x816c3780 412 0x548 0x12019f File \Device\NamedPipe\winlogonrpc
0xe1aa65b8 412 0x54c 0x1f0001 Port
0x81632378 412 0x550 0x1f0003 Event
0x816ee500 412 0x554 0x1f0003 Event
0x81615f40 412 0x558 0x12019f File \Device\NamedPipe\winlogonrpc
0x81632340 412 0x55c 0x100003 Semaphore
0xe17c2f60 412 0x560 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32
0x81692380 412 0x564 0x1f0003 Event DINPUTWINMM
0x816c33a8 412 0x56c 0x1f0001 Mutant
0x8161e9a8 412 0x570 0x1f0001 Mutant WPA_RT_MUTEX
0x8161e958 412 0x574 0x1f0001 Mutant WPA_LT_MUTEX
0x8161e908 412 0x578 0x1f0001 Mutant WPA_HWID_MUTEX
0x8161e8b8 412 0x57c 0x1f0001 Mutant WPA_LICSTORE_MUTEX
0x8161e518 412 0x580 0x1f0003 Event
0x8161e588 412 0x584 0x1f0003 Event
0x8161e4e8 412 0x588 0x1f0003 Event
0x8161ea58 412 0x58c 0x1f0003 Semaphore
0x8161e6c8 412 0x590 0x100003 Event
0xe16483b0 412 0x594 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\CONTROL\NETWORKPROVIDER\HWORDER
0x8160c408 412 0x598 0x100003 Semaphore
0x8160c3d0 412 0x59c 0x100003 Semaphore
0xe1ac6de0 412 0x5a0 0xc Token
0x81683d80 412 0x5a4 0x1f0003 Event jjCSCSharedFillEvent_UM_KM
0x81683d40 412 0x5a8 0x1f0003 Event jjCSCSessEvent_UM_KM_0
0x81683d00 412 0x5ac 0x1f0003 Event WkssvcToAgentStartEvent
0x81683cc0 412 0x5b0 0x1f0003 Event WkssvcToAgentStopEvent
0x81683c80 412 0x5b4 0x1f0003 Event AgentToWkssvcEvent
0x81683c40 412 0x5b8 0x1f0003 Event AgentExistsEvent
0x81683c00 412 0x5bc 0x1f0003 Event
0x81683968 412 0x5c0 0x1f03ff Thread TID 992 PID 412
0x81550678 412 0x5c4 0x100003 Semaphore
0x8179b178 412 0x5c8 0x12019f File \Device\WMIDataDevice
0x8161e748 412 0x5cc 0x1f0003 Event
0x8170f690 412 0x5d0 0xa84 WmiGuid
0x816c8700 412 0x5d4 0x12019f File \Device\WMIDataDevice
0x81694738 412 0x5d8 0x1f0003 Event
0x816f57e0 412 0x5dc 0x1f0fff Process winlogon.exe(412)
0x81694708 412 0x5e0 0x1f0003 Event
0x816946d8 412 0x5e4 0x1f0003 Event
0xe166ed48 412 0x5e8 0xc Token
0x816c7448 412 0x5f0 0x1f0003 Event
0x815d1da8 412 0x5f4 0x1f03ff Thread TID 508 PID 412
0x816c73f8 412 0x5f8 0x100003 Event
0x816c73c8 412 0x5fc 0x1f0003 Event
0x81683860 412 0x600 0x12019f File \Device\NamedPipe\lsarpc
0x816ee640 412 0x604 0x1f03ff Thread TID 1100 PID 412
0x81669c38 412 0x608 0x1f03ff Thread TID 1116 PID 412
0x81615e58 412 0x60c 0x100020 File \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x81680838 412 0x610 0x1f0001 Mutant
0x815f6808 412 0x614 0x1f0003 Event CscCacheInitCompleteEvent
0xe1d05030 412 0x618 0xc Token
0x816f45d8 412 0x620 0x21f0003 Event
0x816c5c28 412 0x624 0x12019f File \Device\NamedPipe\samr
0x81620a38 412 0x628 0x1f0003 Event
0xe1bccd38 412 0x62c 0x1f0001 Port
0x815508b8 412 0x630 0x1f0003 Event
0xe1bfeb08 412 0x634 0xf01ff Token
0x815e75b0 412 0x638 0x1f0003 Event
0xe1bfeb08 412 0x63c 0xf01ff Token
0x81690740 412 0x640 0x1f03ff Thread TID 1040 PID 412
0x816c6880 412 0x644 0x1f0003 Event TermSrvReadyEvent
0x81692ab8 412 0x648 0x1f0003 Event
0x815e77b0 412 0x64c 0x1f0003 Event
0xe1c65020 412 0x650 0xf003f Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004
0x815d5480 412 0x654 0x21f0003 Event
0x816374d8 412 0x658 0x1f0003 Event
0xe1d02d70 412 0x65c 0xf003f Key USER\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\SHELLNOROAM
0xe1d02d08 412 0x660 0xf003f Key USER\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\SHELLNOROAM\MUICACHE
0xe1bfeb08 412 0x664 0xf01ff Token
0x816db158 412 0x66c 0xf01ff Desktop Default
0x816ad9f8 412 0x670 0x1f0003 Event WlballoonLogoffNotificationEventName
0x816ee640 412 0x674 0x1f03ff Thread TID 1100 PID 412
0x816ae760 412 0x678 0x1f0003 Event
0x815ebd78 412 0x67c 0x1f0003 Event
0x816ad9f8 412 0x680 0x100000 Event WlballoonLogoffNotificationEventName
0x816ad9b8 412 0x684 0x1f0003 Event 000000000000850b_WlballoonKerberosNotificationEventName
0x815506b0 412 0x688 0x100003 Semaphore
0x816eee30 412 0x68c 0x120116 File \Device\Tcp
0x816eef58 412 0x690 0x1200a0 File \Device\Tcp
0x81673d18 412 0x694 0x1200a0 File \Device\Ip
0x81673c80 412 0x698 0x100003 File \Device\Ip
0x81673be8 412 0x69c 0x1200a0 File \Device\Ip
0x81673ba8 412 0x6a0 0x100003 Semaphore
0x816eefe8 412 0x6a4 0x100003 Semaphore
0xe1c98a00 412 0x6a8 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\TCPIP\LINKAGE
0xe1d03e40 412 0x6ac 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS
0xe1649270 412 0x6b0 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\NETBT\PARAMETERS\INTERFACES
0xe1649208 412 0x6b4 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\NETBT\PARAMETERS
0x816eeac0 412 0x6b8 0x100003 Semaphore
0x816eeaf8 412 0x6bc 0x100003 Semaphore
0xe166fd90 412 0x6c0 0x600fe Token
0x815e98b8 412 0x6c4 0x1f03ff Thread TID 1252 PID 412
0x81574aa0 412 0x6c8 0x100003 Semaphore
0xe17ef890 412 0x6d0 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON
0x815e73a8 412 0x6d4 0x100003 Semaphore
0x815e9528 412 0x6d8 0x100003 Semaphore
0x815e94f0 412 0x6dc 0x100003 Semaphore
0x815e9480 412 0x6e0 0x100003 Semaphore
0x815e94b8 412 0x6e4 0x100003 Semaphore
0x815e9448 412 0x6e8 0x100003 Semaphore
0x815e9410 412 0x6ec 0x100003 Semaphore
0x815e93d8 412 0x6f0 0x100003 Semaphore
0x815e93a0 412 0x6f4 0x100003 Semaphore
0x815e9368 412 0x6f8 0x100003 Semaphore
0x81615e10 412 0x6fc 0x1f0001 Mutant _Satori_81_MutexObject_S-1-5-18
0xe17c1e98 412 0x700 0xf0007 Section FileView__Satori_PropMgrGlobal_Satori_81___00005bcc_S-1-5-18
0xe17c1d08 412 0x704 0xf0007 Section Imejp.ConfigrationIO_3_Satori_81__S-1-5-18
0x817100d0 412 0x70c 0x100020 File \Device\HarddiskVolume1\WINDOWS\system32
0x816406f0 412 0x710 0x1f03ff Thread TID 572 PID 412
0xe17c1d08 412 0x714 0xf0007 Section Imejp.ConfigrationIO_3_Satori_81__S-1-5-18
0x81615dc0 412 0x718 0x1f0001 Mutant _Satori_81_Satori_KnlDict_DicWriteMutex_S-1-5-18
0xe19e2b90 412 0x71c 0xf0007 Section SatoriKnlDict_MemoryDictionary_S-1-5-18
0x816023e8 412 0x720 0x1f0003 Event
0x81602ef8 412 0x724 0x12019f File \Device\HarddiskVolume1\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\IMJP8_1\imjp81u.dic
0xe167abc8 412 0x728 0xf0007 Section
0xe17ef548 412 0x72c 0xf0007 Section SatoriCodeDictionarySharedMemory_S-1-5-18
0xe17c1e98 412 0x730 0xf0007 Section FileView__Satori_PropMgrGlobal_Satori_81___00005bcc_S-1-5-18
0x81615e10 412 0x734 0x1f0001 Mutant _Satori_81_MutexObject_S-1-5-18
0xe17c1d08 412 0x738 0xf0007 Section Imejp.ConfigrationIO_3_Satori_81__S-1-5-18
0xe18f04f0 412 0x73c 0xf0007 Section FileView__Satori_GlobalFlag_Satori_81___00000008_S-1-5-18
0x81617750 412 0x740 0x1f0001 Mutant Mutex__Satori_GlobalFlag_Satori_81__S-1-5-18
0xe1c2c538 412 0x744 0x1f0001 Port
0x815eb678 412 0x78c 0x21f0003 Event
0x815eb648 412 0x794 0x1f0003 Event
0x815e9600 412 0x798 0x1f03ff Thread TID 1264 PID 412
0xe1c25700 412 0x79c 0x1f0001 Port
0x815eb580 412 0x7a0 0x1f0003 Event
0xe183d030 412 0x7a4 0x1f0001 Port OLE33A18106ECA44AADB0958A275163
0x815c96b8 412 0x7a8 0x1f0003 Event
0x8164bda8 412 0x7ac 0x1f03ff Thread TID 1652 PID 412
0x8164bd78 412 0x7b4 0x1f0003 Event
0x815e9600 412 0x7bc 0x1f03ff Thread TID 1264 PID 412
0x816031f0 412 0x7c0 0x1f0003 Event
0xe1c27780 412 0x7c8 0x1f0001 Port
0xe1006e20 516 0x4 0xf0003 KeyedEvent CritSecOutOfMemoryEvent
0xe14f3230 516 0x8 0x3 Directory KnownDlls
0x816d8d08 516 0xc 0x100020 File \Device\HarddiskVolume1\WINDOWS\system32
0x816ae2c8 516 0x10 0x100003 Semaphore
0xe14038f8 516 0x14 0xf000f Directory Windows
0xe17e8548 516 0x18 0x21f0001 Port
0x816731c0 516 0x1c 0x100003 Semaphore
0x817064e8 516 0x20 0x1f0001 Mutant SHIMLIB_LOG_MUTEX
0xe14477d0 516 0x24 0x2000f Directory BaseNamedObjects
0xe17c1780 516 0x28 0x20f003f Key MACHINE
0x816d8b20 516 0x2c 0xf037f WindowStation Service-0x0-3e7$
0x81632c20 516 0x30 0x21f0003 Event
0x815f6970 516 0x34 0xf01ff Desktop Default
0x816d8b20 516 0x38 0xf037f WindowStation Service-0x0-3e7$
0xe17d2de8 516 0x3c 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE
0x817cb720 516 0x40 0x1f0003 Event userenv: User Profile setup event
0xe17c1190 516 0x44 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE\ALTERNATE SORTS
0xe17d02b0 516 0x48 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS
0xe17d0248 516 0x4c 0xf003f Key MACHINE\SYSTEM\CONTROLSET001\ENUM
0xe17d01e0 516 0x50 0xf003f Key MACHINE\SYSTEM\CONTROLSET001\SERVICES
0xe17d00d0 516 0x54 0xf003f Key MACHINE\SOFTWARE\POLICIES
0xe17d28c8 516 0x58 0xf003f Key MACHINE\SYSTEM\CONTROLSET001\CONTROL\CLASS
0xe17d2860 516 0x5c 0xf003f Key MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PERHWIDSTORAGE
0x81627110 516 0x60 0x1f0003 Event
0x816bd178 516 0x64 0x1f0001 Mutant
0x81709298 516 0x68 0x1f0003 Event
0x816cae18 516 0x6c 0x1f0001 Mutant
0x816ab8b0 516 0x70 0x1f0003 Event
0x816cadd8 516 0x74 0x1f0001 Mutant
0x816bd148 516 0x78 0x1f0003 Event
0x8162a320 516 0x7c 0x1f0001 Mutant
0x816cada8 516 0x80 0x1f0003 Event
0x8162a2e0 516 0x84 0x1f0001 Mutant
0x8162a2b0 516 0x88 0x1f0003 Event
0x8170d5b8 516 0x8c 0x1f0001 Mutant
0x8170d588 516 0x90 0x1f0003 Event
0x8170d548 516 0x94 0x1f0001 Mutant
0x8154da20 516 0x98 0x1f0003 Event
0x8154d9e0 516 0x9c 0x1f0001 Mutant
0x8154d9b0 516 0xa0 0x1f0003 Event
0x817042d0 516 0xa4 0x1f0001 Mutant
0x817042a0 516 0xa8 0x1f0003 Event
0x81704260 516 0xac 0x1f0001 Mutant
0x817caed8 516 0xb0 0x1f0003 Event
0x817cae98 516 0xb4 0x1f0001 Mutant
0x817cae68 516 0xb8 0x1f0003 Event
0x815dd1d8 516 0xbc 0x1f0001 Mutant
0x815dd1a8 516 0xc0 0x1f0003 Event
0x815dd168 516 0xc4 0x1f0001 Mutant
0x8161a170 516 0xc8 0x1f0003 Event
0x8161a130 516 0xcc 0x1f0001 Mutant
0x8161a100 516 0xd0 0x1f0003 Event
0x8161a0c0 516 0xd4 0x1f0001 Mutant
0x816d0240 516 0xd8 0x1f0003 Event
0x816d0200 516 0xdc 0x1f0001 Mutant
0x816d01d0 516 0xe0 0x1f0003 Event
0x816d0190 516 0xe4 0x1f0001 Mutant
0x81693c18 516 0xe8 0x1f0003 Event
0x81693bd8 516 0xec 0x1f0001 Mutant
0x81693ba8 516 0xf0 0x1f0003 Event
0x81693b68 516 0xf4 0x1f0001 Mutant
0x816f31f8 516 0xf8 0x1f0003 Event
0x816f31b8 516 0xfc 0x1f0001 Mutant
0x816f3188 516 0x100 0x1f0003 Event
0x816f3148 516 0x104 0x1f0001 Mutant
0x815cb1f8 516 0x108 0x1f0003 Event
0x815cb1b8 516 0x10c 0x1f0001 Mutant
0x815cb188 516 0x110 0x1f0003 Event
0x815cb148 516 0x114 0x1f0001 Mutant
0x8153cc80 516 0x118 0x1f0003 Event
0x8153cc40 516 0x11c 0x1f0001 Mutant
0x8153cc10 516 0x120 0x1f0003 Event
0x8153cbd0 516 0x124 0x1f0001 Mutant
0x81611450 516 0x128 0x1f0003 Event
0x81611410 516 0x12c 0x1f0001 Mutant
0x816113e0 516 0x130 0x1f0003 Event
0x816113a0 516 0x134 0x1f0001 Mutant
0x8174f868 516 0x138 0x1f0003 Event
0x8174f828 516 0x13c 0x1f0001 Mutant
0x8174f7f8 516 0x140 0x1f0003 Event
0x8174f7b8 516 0x144 0x1f0001 Mutant
0x8174f788 516 0x148 0x1f0003 Event
0x81773bf0 516 0x14c 0x1f0001 Mutant
0x81773bc0 516 0x150 0x1f0003 Event
0x81773b80 516 0x154 0x1f0001 Mutant
0x81773b50 516 0x158 0x1f0003 Event
0x81773d58 516 0x15c 0x1f0001 Mutant
0x81773d28 516 0x160 0x1f0003 Event SC_AutoStartComplete
0xe17d3020 516 0x164 0xf003f Key MACHINE\SYSTEM\CONTROLSET001\CONTROL\NETWORKPROVIDER\ORDER
0x81773b20 516 0x168 0x1f0003 Event
0x81773ce8 516 0x16c 0x21f0003 Event
0x815d4f40 516 0x170 0x1f0003 Timer
0x81691c30 516 0x174 0x1f03ff Thread TID 540 PID 516
0x81719558 516 0x178 0x1f0003 IoCompletion
0x8164d620 516 0x17c 0x1f03ff Thread TID 584 PID 516
0x816704c0 516 0x180 0x1f0003 Timer
0x81648558 516 0x184 0x1f03ff Thread TID 588 PID 516
0x8164d5b0 516 0x188 0x1f0003 Event SvcctrlStartEvent_A3752DX
0x81606678 516 0x18c 0x100003 Semaphore
0x81648518 516 0x190 0x1f0001 Mutant
0x815e29f0 516 0x194 0x100003 Semaphore
0x815e2a60 516 0x198 0x100003 Semaphore
0x815e2a98 516 0x19c 0x100003 Semaphore
0x81671d30 516 0x1a0 0x100003 Semaphore
0x81611670 516 0x1a4 0x100003 Semaphore
0xe1852d80 516 0x1a8 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\CONTROL\SERVICEGROUPORDER
0x8171cb80 516 0x1ac 0x1f0003 Event
0x816e0310 516 0x1b0 0x1f0003 Event
0x81643fc0 516 0x1b4 0x1f0003 Event
0x817085c8 516 0x1b8 0x1f0003 Event
0x81670248 516 0x1bc 0x1f03ff Thread TID 520 PID 516
0x81710c68 516 0x1c0 0x1f0003 IoCompletion
0x81710d50 516 0x1c4 0x1f0003 IoCompletion
0x81710c68 516 0x1c8 0x1f0003 IoCompletion
0x81699cf0 516 0x1cc 0x1f0003 Event ScNetDrvMsg
0x81630138 516 0x1d0 0x1f0003 Event
0xe1854a30 516 0x1d4 0x1f0001 Port ntsvcs
0x81630168 516 0x1d8 0x1f0003 Event
0x81630108 516 0x1dc 0x1f0003 Event
0x815d8558 516 0x1e0 0x1f03ff Thread TID 652 PID 516
0x8177b748 516 0x1e4 0x12019f File \Device\NamedPipe\ntsvcs
0x8161a9b0 516 0x1e8 0x12019f File \Device\NamedPipe\ntsvcs
0x815d8488 516 0x1ec 0x1f0003 Event
0x8166b678 516 0x1f0 0x1f03ff Thread TID 656 PID 516
0xe1857670 516 0x1f4 0x1f0001 Port
0x8166b618 516 0x1f8 0x1f0003 Event
0x81610da8 516 0x1fc 0x1f03ff Thread TID 660 PID 516
0xe18575a8 516 0x200 0x1f0001 Port
0x8166b5a8 516 0x204 0x100003 Event
0x81640328 516 0x208 0x12019f File \Device\NamedPipe\scerpc
0x81610d18 516 0x20c 0x100001 File \Device\KsecDD
0x815d5a08 516 0x210 0x12019f File \Device\NamedPipe\scerpc
0x816f5220 516 0x214 0x1f0003 Event
0x815d5980 516 0x218 0x1f0003 Event
0x81649c50 516 0x21c 0x1f0003 Event
0x81628320 516 0x220 0x1f03ff Thread TID 664 PID 516
0x81699da8 516 0x224 0x1f03ff Thread TID 648 PID 516
0x816282b0 516 0x228 0x1f0003 Event
0x81628280 516 0x22c 0x1f0003 Event
0xe185ddc8 516 0x230 0x1f0001 Port
0xe185cd80 516 0x234 0x1f0001 Port
0x81628250 516 0x238 0x1f0003 Event
0xe185ccc8 516 0x23c 0x1f0001 Port
0x8162fd38 516 0x240 0x1f0003 Event
0x8162fd08 516 0x244 0x1f0003 Event
0x8162fcd8 516 0x248 0x1f0003 Event
0x816f5780 516 0x24c 0x1f0003 Event
0x816f5750 516 0x250 0x1f0003 Event
0x81640240 516 0x254 0x12019f File \Device\NamedPipe\lsarpc
0x8162fd78 516 0x258 0x1f0003 Event WBEM_ESS_OPEN_FOR_BUSINESS
0x81630c90 516 0x25c 0x1f03ff Thread TID 672 PID 516
0x81630bc0 516 0x260 0x1a019f File \Device\NamedPipe\net\NtControlPipe1
0xe185b1a8 516 0x264 0x2 Key MACHINE\SYSTEM\CONTROLSET001\CONTROL\SERVICECURRENT
0x816233e8 516 0x268 0x120001 Mutant ShimCacheMutex
0xe17ef118 516 0x26c 0x2 Section ShimSharedMemory
0x81671398 516 0x270 0x1f0fff Process svchost.exe(676)
0xe1861d88 516 0x274 0x1f0001 Port
0xe187d660 516 0x278 0x2001b Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG
0x81610c10 516 0x27c 0x1a019f File \Device\NamedPipe\net\NtControlPipe2
0x816e1748 516 0x280 0x12019f File \Device\NamedPipe\net\NtControlPipe2
0x8162f380 516 0x284 0x1f0003 Event
0x816e1838 516 0x288 0x1f03ff Thread TID 688 PID 516
0xe1861a60 516 0x28c 0x1f0001 Port
0xe187d4c8 516 0x290 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME
0xe1883c98 516 0x294 0xf01ff Token
0x815f6bb0 516 0x298 0x1f0003 Event
0x815fdd30 516 0x29c 0x100003 Semaphore
0x81629c00 516 0x2a0 0x1f0003 Event
0x81714bc8 516 0x2a4 0x100003 Semaphore
0x8160e908 516 0x2a8 0x12019f File \Device\HarddiskVolume1\WINDOWS\system32\config\AppEvent.Evt
0xe187a420 516 0x2ac 0x17 Section
0x8160e898 516 0x2b0 0x100003 Semaphore
0x815f3868 516 0x2b4 0x100003 Semaphore
0x815f37d8 516 0x2b8 0x12019f File \Device\HarddiskVolume1\WINDOWS\system32\config\Internet.evt
0xe187e5d0 516 0x2bc 0x17 Section
0x815f93c8 516 0x2c0 0x100003 Semaphore
0x815f9390 516 0x2c4 0x100003 Semaphore
0x815f9300 516 0x2c8 0x12019f File \Device\HarddiskVolume1\WINDOWS\system32\config\SecEvent.Evt
0xe187e470 516 0x2cc 0x17 Section
0x8162e780 516 0x2d0 0x100003 Semaphore
0x8162e748 516 0x2d4 0x100003 Semaphore
0x81629c38 516 0x2d8 0x12019f File \Device\HarddiskVolume1\WINDOWS\system32\config\SysEvent.Evt
0xe187e310 516 0x2dc 0x17 Section
0x815f33f0 516 0x2e0 0x100003 Semaphore
0x815f33b8 516 0x2e4 0x100003 Semaphore
0x815e8da8 516 0x2e8 0x1f03ff Thread TID 724 PID 516
0x815f3310 516 0x2ec 0x1f0003 Event
0x8161a3d0 516 0x2f0 0x1f0003 Event
0xe1866280 516 0x2f4 0x1f0001 Port ErrorLogPort
0x815fe7b0 516 0x2f8 0x100003 Event
0xe18961b0 516 0x2fc 0x1f0001 Port
0xe1872f68 516 0x300 0x1f0001 Port
0xe1883b40 516 0x304 0x1f0001 Port
0xe187e668 516 0x308 0x20f003f Key USER
0xe1887608 516 0x30c 0xf003f Key USER\S-1-5-20
0x81601508 516 0x310 0x1a019f File \Device\NamedPipe\net\NtControlPipe4
0x815f8c60 516 0x314 0x1a019f File \Device\NamedPipe\net\NtControlPipe3
0x815f5da0 516 0x318 0x1f0fff Process svchost.exe(736)
0xe189b4d0 516 0x31c 0x1f0001 Port
0x8169b7c8 516 0x320 0x1a019f File \Device\NamedPipe\net\NtControlPipe0
0x8162ad78 516 0x324 0x1f0fff Process svchost.exe(800)
0xe18a5d98 516 0x328 0x1f0001 Port
0x815c4be0 516 0x32c 0x1f03ff Thread TID 824 PID 516
0x815c4e78 516 0x330 0x1f0003 Event
0xe18a48b0 516 0x334 0x1f0001 Port
0xe18a60d8 516 0x338 0xf01ff Token
0xe1bc3768 516 0x33c 0x1f0001 Port
0x815c49d0 516 0x340 0x1f0003 Event
0x815c49a0 516 0x344 0x1f0003 Event
0x815c4970 516 0x348 0x1f0003 Event PnP_No_Pending_Install_Events
0x815c4930 516 0x34c 0x1f0003 Event
0x815e5ac0 516 0x350 0x1f0001 Mutant PnP_Init_Mutex
0xe18a4bf0 516 0x354 0xf003f Key USER\S-1-5-20
0xe18a5a08 516 0x358 0xf003f Key USER\S-1-5-19
0xe18a5700 516 0x35c 0xf01ff Token
0x81773d28 516 0x360 0x100000 Event SC_AutoStartComplete
0x816cf850 516 0x364 0x1a019f File \Device\NamedPipe\net\NtControlPipe5
0x81699838 516 0x368 0x1f0fff Process svchost.exe(844)
0xe18a63d8 516 0x36c 0x1f0001 Port
0x81709b78 516 0x370 0x1f0fff Process svchost.exe(876)
0x816197e8 516 0x374 0x1a019f File \Device\NamedPipe\net\NtControlPipe6
0xe19e3920 516 0x378 0x1f0001 Port
0x81669bd0 516 0x37c 0x1f0003 Event
0x81550780 516 0x380 0x100003 Event
0x81669958 516 0x384 0x1f03ff Thread TID 1132 PID 516
0x8164a810 516 0x388 0x1f0fff Process spoolsv.exe(1172)
0x8164ac48 516 0x38c 0x1a019f File \Device\NamedPipe\net\NtControlPipe7
0x815ce5e8 516 0x390 0x1f0003 Event
0xe1bd03c0 516 0x394 0x1f0001 Port
0xe18459e8 516 0x398 0x1f0001 Port
0x815ce350 516 0x39c 0x1f03ff Thread TID 1320 PID 516
0x815fbc10 516 0x3a0 0x1f03ff Thread TID 1432 PID 516
0xe1d8c678 516 0x3a4 0x1f0001 Port
0x815cccc8 516 0x3a8 0x1f0003 Event
0xe167a358 516 0x3ac 0xf01ff Token
0x816f3318 516 0x3b0 0x1f0003 Event
0x81605640 516 0x3b4 0x1f03ff Thread TID 1636 PID 516
0x8156f938 516 0x3b8 0x1f0003 Event
0x8168d368 516 0x3bc 0x12019f File \Device\NamedPipe\srvsvc
0x815efe70 516 0x3c0 0x1f0003 Event
0x815ef3b8 516 0x3c4 0x1f03ff Thread TID 1704 PID 516
0x816fcb10 516 0x3c8 0x1f0003 Event
0x816fc898 516 0x3cc 0x1f03ff Thread TID 1712 PID 516
0xe1006e20 528 0x4 0xf0003 KeyedEvent CritSecOutOfMemoryEvent
0xe14f3230 528 0x8 0x3 Directory KnownDlls
0x8170c2f8 528 0xc 0x100020 File \Device\HarddiskVolume1\WINDOWS\system32
0x817a2260 528 0x10 0x100003 Semaphore
0xe14038f8 528 0x14 0xf000f Directory Windows
0xe17cf998 528 0x18 0x21f0001 Port
0x816daaa8 528 0x1c 0x100003 Semaphore
0xe14477d0 528 0x20 0x2000f Directory BaseNamedObjects
0x817064e8 528 0x24 0x1f0001 Mutant SHIMLIB_LOG_MUTEX
0xe17d3eb0 528 0x28 0x20f003f Key MACHINE
0x816d8b20 528 0x2c 0xf016e WindowStation Service-0x0-3e7$
0x8170f600 528 0x30 0x12019f File \Device\NamedPipe\lsass
0x815f6970 528 0x34 0xf00cf Desktop Default
0x816d8b20 528 0x38 0xf016e WindowStation Service-0x0-3e7$
0x815f80d0 528 0x3c 0x1f0003 Event
0x81698bb0 528 0x40 0x1f0003 Semaphore
0xe17d3f50 528 0x44 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\CONTROL\NETWORKPROVIDER\HWORDER
0x8167f1b8 528 0x48 0x100003 Semaphore
0x8167f180 528 0x4c 0x100003 Semaphore
0x8167f120 528 0x50 0x1f0003 Event
0x8167f150 528 0x54 0x1f0003 Event
0x8167f0e8 528 0x58 0x100003 Semaphore
0x816923b0 528 0x5c 0x100003 Semaphore
0xe17d3898 528 0x60 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32
0x81692380 528 0x64 0x1f0003 Event DINPUTWINMM
0x815fd568 528 0x68 0x100001 File \Device\KsecDD
0x815d48d0 528 0x6c 0x1f0003 Event
0x815d48a0 528 0x70 0x1f0003 Event
0xe17d2478 528 0x74 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32
0x8162a930 528 0x78 0x1f0003 Semaphore shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}
0x817cb720 528 0x7c 0x1f0003 Event userenv: User Profile setup event
0x816d9ec0 528 0x80 0x100020 File \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x81695d38 528 0x84 0x1f0003 Event
0xe17d2298 528 0x88 0x2001f Key MACHINE\SYSTEM\CONTROLSET001\CONTROL\LSA\SSPICACHE\MSAPSSPC.DLL
0xe17d3220 528 0x8c 0x2001f Key MACHINE\SYSTEM\CONTROLSET001\CONTROL\LSA\SSPICACHE\DIGEST.DLL
0x815f8130 528 0x90 0x1f0003 Timer
0xe17d31a0 528 0x94 0x2001f Key MACHINE\SYSTEM\CONTROLSET001\CONTROL\LSA\SSPICACHE\MSNSSPC.DLL
0x815d4738 528 0x98 0x21f0003 Event
0x816ac480 528 0x9c 0x1f03ff Thread TID 548 PID 528
0x815c4f00 528 0xa0 0x12019f File \Device\NamedPipe\net\NtControlPipe0
0x81718140 528 0xa4 0x1f0003 IoCompletion
0x815f73c8 528 0xa8 0x1f0003 Timer
0x816754f0 528 0xac 0x1f03ff Thread TID 556 PID 528
0xe17d2318 528 0xb0 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\CONTROL\LSA
0x816754c0 528 0xb4 0x1f0003 Event
0x815ff6e0 528 0xb8 0x21f0003 Semaphore
0x81675458 528 0xbc 0x1f0003 Event
0xe14c0e58 528 0xc0 0x1f0001 Port SeLsaCommandPort
0x81695510 528 0xc4 0x2 Event SeLsaInitEvent
0xe17d2f68 528 0xc8 0x1f0001 Port
0xe17d59c8 528 0xcc 0x1f0001 Port
0x8160ad30 528 0xd0 0x100003 Semaphore
0x815ff5f0 528 0xd4 0x100003 Semaphore
0x815ff5b8 528 0xd8 0x100003 Semaphore
0x815ff580 528 0xdc 0x100003 Semaphore
0x815ff548 528 0xe0 0x100003 Semaphore
0x815ff510 528 0xe4 0x100003 Semaphore
0x815ff4e0 528 0xe8 0x1f0003 Event
0x815ff4a8 528 0xec 0x100003 Semaphore
0x815ff470 528 0xf0 0x100003 Semaphore
0xe17d5c38 528 0xf4 0x6001d Key MACHINE\SECURITY
0xe17d30f0 528 0xf8 0x3001f Key MACHINE\SECURITY\RXACT
0x815ff440 528 0xfc 0x1f0003 Event
0x815ff410 528 0x100 0x1f0003 Event
0x816e0020 528 0x104 0x1f0003 Event
0x817085f8 528 0x108 0xa84 WmiGuid
0x81648b20 528 0x10c 0xa84 WmiGuid
0xe17d69f0 528 0x110 0x2001f Key MACHINE\SECURITY\POLICY
0x8167b8f8 528 0x114 0x100003 Semaphore
0x81712620 528 0x118 0x100003 Semaphore
0x815d6cf8 528 0x11c 0x100003 Semaphore
0x816406b8 528 0x120 0x100003 Semaphore
0x815d5d60 528 0x124 0x1f0003 Event
0x815fdaf0 528 0x128 0x1f0003 Timer
0xe15255f8 528 0x12c 0x11 Key MACHINE\SYSTEM\CONTROLSET001\CONTROL\LSA\AUDIT\PERUSERAUDITING\SYSTEM
0x815e1898 528 0x130 0x100003 Semaphore
0x815e17e8 528 0x134 0x100003 Semaphore
0x81640648 528 0x138 0x100003 Semaphore
0xe181c030 528 0x13c 0xf01ff Token
0x815e1820 528 0x140 0x100003 Semaphore
0x8166fdb8 528 0x144 0x100003 Semaphore
0x8166fd80 528 0x148 0x100003 Semaphore
0x8166fd48 528 0x14c 0x100003 Semaphore
0x8166fd10 528 0x150 0x100003 Semaphore
0x8161f800 528 0x154 0x1f0003 Event
0xe184a868 528 0x158 0xf0007 Section Debug.Memory.210
0xe184a988 528 0x15c 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\CONTROL\LSA\KERBEROS
0x815e2cb0 528 0x160 0x1f03ff Thread TID 576 PID 528
0x816042d8 528 0x164 0x100003 Semaphore
0x816d3028 528 0x168 0x12019f File \Device\WMIDataDevice
0x815e2c50 528 0x16c 0x1f0003 Event
0x816b27a0 528 0x170 0xa84 WmiGuid
0x816d9170 528 0x174 0x12019f File \Device\WMIDataDevice
0x815d7b30 528 0x178 0x1f0003 Event
0x81636180 528 0x17c 0x1f0fff Process lsass.exe(528)
0x815d7b00 528 0x180 0x1f0003 Event
0x815d7ad0 528 0x184 0x1f0003 Event
0x8161f758 528 0x188 0x100003 Semaphore
0xe184a8b0 528 0x18c 0x2001f Key MACHINE\SECURITY\POLICY
0x816046b8 528 0x190 0x100003 Semaphore
0x81604680 528 0x194 0x100003 Semaphore
0x81640b28 528 0x198 0x100003 Semaphore
0xe184a510 528 0x19c 0xf003f Key MACHINE\SYSTEM\CONTROLSET001\CONTROL\LSA\KERBEROS\SIDCACHE
0x81640af0 528 0x1a0 0x100003 Semaphore
0x81640ab8 528 0x1a4 0x100003 Semaphore
0x81640a80 528 0x1a8 0x100003 Semaphore
0x816257f8 528 0x1ac 0x100003 Semaphore
0x816257c0 528 0x1b0 0x100003 Semaphore
0xe181cfb8 528 0x1b4 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\CONTROL\LSA\KERBEROS\DOMAINS
0x815e2c80 528 0x1b8 0x1f0003 Event
0x815e2990 528 0x1bc 0x100003 Semaphore
0x815e2958 528 0x1c0 0x100003 Semaphore
0x8153e020 528 0x1c4 0x478 Process services.exe(516)
0x815e2928 528 0x1c8 0x1f0003 Event
0xe181cee8 528 0x1cc 0xf003f Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9
0x815e28c0 528 0x1d0 0x1f0003 Event
0xe181ce80 528 0x1d4 0xf003f Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5
0x816d8f00 528 0x1d8 0x1200a0 File \Device\Tcp
0x81604cd0 528 0x1dc 0x120116 File \Device\Tcp
0x81604c08 528 0x1e0 0x1200a0 File \Device\Ip
0x81604b70 528 0x1e4 0x100003 File \Device\Ip
0x81604ad8 528 0x1e8 0x1200a0 File \Device\Ip
0x81604a68 528 0x1ec 0x100003 Semaphore
0x8164d898 528 0x1f0 0x100003 Event
0x81625750 528 0x1f4 0x100003 Semaphore
0xe181ce18 528 0x1f8 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\TCPIP\LINKAGE
0xe181cf50 528 0x1fc 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS
0xe184a498 528 0x200 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\NETBT\PARAMETERS\INTERFACES
0xe184a360 528 0x204 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\NETBT\PARAMETERS
0xe184cfb8 528 0x208 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\CONTROL\LSA
0x8174f658 528 0x20c 0xa84 WmiGuid
0xe184cea8 528 0x210 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\CONTROL\LSA\MSV1_0
0x816a35f8 528 0x214 0x100003 Semaphore
0x81604648 528 0x218 0x100003 Semaphore
0x8161f790 528 0x21c 0x100003 Semaphore
0x81648908 528 0x220 0x100003 Semaphore
0x816488d0 528 0x224 0x100003 Semaphore
0x81648f10 528 0x228 0x100003 Semaphore
0x81648ed8 528 0x22c 0x100003 Semaphore
0x81648ea0 528 0x230 0x100003 Semaphore
0xe181ccd0 528 0x234 0x2001f Key MACHINE\SECURITY\POLICY
0x81648e28 528 0x238 0x100003 Semaphore
0xe181c990 528 0x23c 0x600fe Token
0x81648df0 528 0x240 0x100003 Semaphore
0x81604aa0 528 0x244 0x1f0003 Event
0x8164c648 528 0x248 0x120196 File \Device\HarddiskVolume1\WINDOWS\Debug\PASSWD.LOG
0x8170a320 528 0x24c 0x100003 Semaphore
0x81648d80 528 0x250 0x100003 Semaphore
0x815e8388 528 0x254 0x100003 Semaphore
0x815e8350 528 0x258 0x100003 Semaphore
0x81649400 528 0x25c 0x1f0003 Event
0x81649430 528 0x260 0x1f0003 Event
0x816493c8 528 0x264 0x100003 Semaphore
0x815e8a28 528 0x268 0x100003 Semaphore
0x815e89f0 528 0x26c 0x100003 Semaphore
0x815e89b8 528 0x270 0x100003 Semaphore
0x8167d2c8 528 0x274 0x1f0003 Event crypt32LogoffEvent
0x816caf60 528 0x278 0x100003 Event
0x815e2ad0 528 0x27c 0x1f0003 Event
0xe181cc68 528 0x280 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\CONTROL\SECURITYPROVIDERS\WDIGEST
0x81719340 528 0x284 0x1f0003 IoCompletion
0x817aa420 528 0x288 0x1f0003 IoCompletion
0x81719340 528 0x28c 0x1f0003 IoCompletion
0x816494c8 528 0x290 0x12019f File \Device\NamedPipe\lsass
0x816caea0 528 0x294 0x12019f File \Device\NamedPipe\lsass
0x816caf30 528 0x298 0x1f0003 Event
0x816066f0 528 0x29c 0x1f03ff Thread TID 596 PID 528
0xe14c1558 528 0x2a0 0x1f0001 Port audit
0x816cae68 528 0x2a4 0x1f0003 Event
0x81606b18 528 0x2a8 0x1f03ff Thread TID 600 PID 528
0xe184c2c8 528 0x2ac 0x1f0001 Port securityevent
0x81606648 528 0x2b0 0x1f0003 Event
0x81671da8 528 0x2b4 0x1f03ff Thread TID 604 PID 528
0x816172c8 528 0x2b8 0x1f03ff Thread TID 608 PID 528
0x81617238 528 0x2bc 0x12019f File \Device\KsecDD
0xe1852030 528 0x2c0 0x1f0001 Port LsaAuthenticationPort
0x815e52c8 528 0x2c4 0x1f03ff Thread TID 612 PID 528
0x815e5218 528 0x2c8 0x1f0003 Event
0x81636180 528 0x2cc 0x478 Process lsass.exe(528)
0xe1853f50 528 0x2d0 0x1f0001 Port
0xe1853e98 528 0x2d4 0x1f0001 Port
0x816f57e0 528 0x2d8 0x478 Process winlogon.exe(412)
0x81606aa0 528 0x2dc 0x21f0003 Semaphore
0x815fd620 528 0x2e0 0x1f0003 Event LSA_RPC_SERVER_ACTIVE
0x8160ed10 528 0x2e4 0x1f0003 Event
0xe181c320 528 0x2e8 0x11 Key MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROTECT\PROVIDERS\DF9D8CD0-1501-11D1-8C7A-00C04FC297EB
0x816df2a8 528 0x2ec 0x1f0003 Event
0xe1853d40 528 0x2f0 0x1f0001 Port protected_storage
0x816df278 528 0x2f4 0x1f0003 Event
0x817002e0 528 0x2f8 0x1f03ff Thread TID 624 PID 528
0x816d55e8 528 0x2fc 0x12019f File \Device\NamedPipe\protected_storage
0x816df1e8 528 0x300 0x12019f File \Device\NamedPipe\protected_storage
0xe1853ba0 528 0x304 0x1f0001 Port
0x816f57e0 528 0x308 0x478 Process winlogon.exe(412)
0x815e84d0 528 0x30c 0x1f0003 Event
0xe18547e8 528 0x310 0x1f0001 Port
0x81636180 528 0x314 0x478 Process lsass.exe(528)
0xe184c090 528 0x318 0x1f0001 Port
0x81636180 528 0x31c 0x478 Process lsass.exe(528)
0x815e84d0 528 0x320 0x1f0003 Event
0x815e84d0 528 0x324 0x1f0003 Event
0x815ffa18 528 0x328 0x100003 Semaphore
0x815ff9e0 528 0x32c 0x100003 Semaphore
0x816df1b0 528 0x330 0x1f0003 Event
0x816109c0 528 0x334 0x1f0003 Event
0x81610988 528 0x338 0x100003 Semaphore
0x816ad220 528 0x33c 0x100003 Semaphore
0xe1852d18 528 0x340 0x2001f Key MACHINE\SAM\SAM
0xe1852148 528 0x344 0x3001f Key MACHINE\SAM\SAM\RXACT
0xe1855f90 528 0x348 0x2001f Key MACHINE\SAM\SAM\DOMAINS\BUILTIN
0xe1854730 528 0x34c 0x2001f Key MACHINE\SAM\SAM\DOMAINS\ACCOUNT
0xe146cca8 528 0x350 0xf01ff Token
0x815d55f0 528 0x354 0x1f0003 Event
0x816ad150 528 0x358 0x1f0003 Event
0x81621fe0 528 0x35c 0x1f0001 Mutant
0x81621fb0 528 0x360 0x1f0003 Event
0x81621f70 528 0x364 0x1f0001 Mutant
0x81621f40 528 0x368 0x1f0003 Event
0x81621f00 528 0x36c 0x1f0001 Mutant
0x81645020 528 0x370 0x1f0003 Event
0xe1bc7178 528 0x374 0x1f0001 Port
0x815d4c60 528 0x378 0x1f0003 Event
0x816d9538 528 0x37c 0x12019f File \Device\NamedPipe\lsarpc
0x815d4c30 528 0x380 0x1f0003 Event
0x815d4c00 528 0x384 0x1f0003 Event
0x816959b0 528 0x388 0x1f03ff Thread TID 640 PID 528
0x81643ff0 528 0x38c 0x1f0003 Event
0xe1856c58 528 0x390 0x1f0001 Port
0x8164c568 528 0x394 0xa84 WmiGuid
0x816301a8 528 0x398 0x100002 Event SAM_SERVICE_STARTED
0x816f57b0 528 0x39c 0x1f0003 Event
0x8162fda8 528 0x3a0 0x1f03ff Thread TID 668 PID 528
0xe185dd10 528 0x3a4 0x1f0001 Port
0x816a2d98 528 0x3a8 0x12019f File \Device\NamedPipe\lsass
0x816f56d0 528 0x3ac 0x1f0003 Event
0x8162f1d0 528 0x3b0 0x12019f File \Device\NamedPipe\lsass
0x8160eda8 528 0x3b4 0x1f03ff Thread TID 616 PID 528
0x8162f088 528 0x3b8 0x1f0003 Event
0xe18601a8 528 0x3bc 0x1f0001 Port
0x81671398 528 0x3c0 0x478 Process svchost.exe(676)
0xe18600f0 528 0x3c4 0x1f0001 Port
0xe18603f8 528 0x3c8 0x1f0001 Port
0x81671398 528 0x3cc 0x478 Process svchost.exe(676)
0xe1883f68 528 0x3d0 0x1f0001 Port
0x8153e020 528 0x3d4 0x478 Process services.exe(516)
0xe1888710 528 0x3d8 0x1f0001 Port
0xe1882c38 528 0x3dc 0xf01ff Token
0x816f57e0 528 0x3e0 0x478 Process winlogon.exe(412)
0x815f5da0 528 0x3e4 0x478 Process svchost.exe(736)
0x81639240 528 0x3e8 0x1f0003 Event
0xe187e0c8 528 0x3ec 0x2020019 Key USER
0x816081c8 528 0x3f0 0x1f0003 Event
0x81695da8 528 0x3f4 0x1f03ff Thread TID 544 PID 528
0x815c4ec8 528 0x3f8 0x1f0003 Event
0x815df9c8 528 0x3fc 0x100003 Event
0x81550138 528 0x400 0x12019f File \Device\NamedPipe\lsass
0xe18a5b40 528 0x404 0x1f0001 Port
0xe189b3d8 528 0x408 0x1f0001 Port
0x8170fcf0 528 0x40c 0x1f0003 Event
0x81625da8 528 0x410 0x1f03ff Thread TID 732 PID 528
0xe18a9da8 528 0x414 0xf01ff Token
0xe18a9c98 528 0x418 0x1f0001 Port
0x8162ad78 528 0x41c 0x478 Process svchost.exe(800)
0x817096f8 528 0x420 0x1f0003 Event
0x8162b700 528 0x424 0x12019f File \Device\NamedPipe\lsass
0x81683760 528 0x428 0x1f0003 Event
0x81620a08 528 0x42c 0x1f0003 Event
0x8167fe08 528 0x430 0x1f0003 Event
0x8167fb70 528 0x434 0x1f03ff Thread TID 1008 PID 528
0xe1bc3a48 528 0x438 0x1f0001 Port
0x816209d8 528 0x43c 0x21f0003 Event
0xe1bccc80 528 0x440 0x1f0001 Port
0x816f57e0 528 0x444 0x478 Process winlogon.exe(412)
0x816208f8 528 0x448 0x12019f File \Device\NamedPipe\lsass
0xe1bfe5e8 528 0x44c 0xf01ff Token
0x81620860 528 0x450 0x12019f File \Device\NamedPipe\lsass
0x8162d920 528 0x454 0x1f0003 Event
0x81692860 528 0x458 0x1f0003 Event
0xe1ac4278 528 0x45c 0x1f0001 Port
0x8162ad78 528 0x460 0x478 Process svchost.exe(800)
0xe166cc30 528 0x464 0x1f0001 Port
0x8162ad78 528 0x468 0x478 Process svchost.exe(800)
0xe167a020 528 0x46c 0x1f0001 Port
0x81643d00 528 0x470 0x12019f File \Device\NamedPipe\lsass
0x8162ad78 528 0x474 0x478 Process svchost.exe(800)
0xe167af00 528 0x478 0x1f0001 Port
0x817c6bd0 528 0x47c 0x478 Process System(4)
0x815e6ef0 528 0x480 0x21f0003 Semaphore
0xe183b020 528 0x484 0x1f0001 Port
0x816f2b70 528 0x488 0x478 Process explorer.exe(1284)
0x816f6338 528 0x48c 0x1f0003 Event
0x81617d50 528 0x490 0x1f0003 Event
0x81630340 528 0x494 0x12019f File \Device\NamedPipe\lsass
0xe17bd3e0 528 0x498 0x1f0001 Port
0x81602c70 528 0x49c 0x478 Process userinit.exe(1268)
0x816754f0 528 0x4a0 0x1f03ff Thread TID 556 PID 528
0x81550d28 528 0x4a4 0x100003 Event
0x81616660 528 0x4a8 0x100003 Event
0x8167ecc8 528 0x4ac 0x12019f File \Device\IPSEC
0x816f76c8 528 0x4b0 0xa84 WmiGuid
0x8162b7f0 528 0x4b4 0x1f0003 Event
0x816d5970 528 0x4b8 0x1f03ff Thread TID 552 PID 528
0x81610a60 528 0x4bc 0x1f0003 Event
0x81685640 528 0x4c0 0x1f03ff Thread TID 1552 PID 528
0x81709b78 528 0x4c4 0x478 Process svchost.exe(876)
0x81550588 528 0x4c8 0x1f0003 Event
0x816f52d8 528 0x4cc 0x1f0003 Event IPSEC_POLICY_CHANGE_EVENT
0x816727a0 528 0x4d0 0x1f0003 Event
0x816be2a8 528 0x4d4 0x1f0003 Event
0x816be278 528 0x4d8 0x1f0003 Event
0x816be248 528 0x4dc 0x1f0003 Event IPSEC_POLICY_CHANGE_NOTIFY
0x816be208 528 0x4e0 0x1f0003 Event
0x816be1d8 528 0x4e4 0x1f0003 Event IPSEC_GP_REFRESH_EVENT
0x81685640 528 0x4e8 0x1f03ff Thread TID 1552 PID 528
0x81689478 528 0x4ec 0x1f0003 Event
0x81689718 528 0x4f0 0x1f0003 Event
0x816894e0 528 0x4f4 0x1f01ff File \Device\Afd\Endpoint
0x816896e8 528 0x4f8 0x1f0003 Event
0x815d1ac0 528 0x4fc 0x1200a0 File \Device\Tcp
0x8162ad78 528 0x500 0x478 Process svchost.exe(800)
0xe1c20ca8 528 0x504 0x1f0001 Port
0x81689898 528 0x508 0x1f0003 Event
0x816852c0 528 0x50c 0x1f0003 Event PS_SERVICE_STARTED
0x8168b368 528 0x510 0x1f0003 Event
0x815ccd38 528 0x514 0x1f0003 Event
0x815cc270 528 0x518 0x1f0003 Event
0x815c98a0 528 0x51c 0x1f0003 Event
0x815c9870 528 0x520 0x1f0003 Event
0x815c9970 528 0x524 0x12019f File \Device\IPSEC
0xe1c26020 528 0x528 0x11 Key MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\IPSEC
0x816fa300 528 0x52c 0x1f0003 Event
0xe1c25928 528 0x530 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\NETWORKACCESSPROTECTION\NAPCLIENT
0xe1c26210 528 0x534 0xf01ff Token
0x8167eae8 528 0x538 0x1f0003 Event
0x815cc440 528 0x53c 0x1f0003 Event
0x8163f358 528 0x540 0x1f03ff Thread TID 1224 PID 528
0x815eb750 528 0x544 0x1f01ff File \Device\Afd\Endpoint
0x815eb6b8 528 0x548 0x1f01ff File \Device\Udp
0x8156cb50 528 0x54c 0x1f0003 Event
0xe1c27298 528 0x550 0x1f0001 Port
0x8156c668 528 0x554 0x1f0003 Event
0x8156c8a8 528 0x558 0x1f03ff Thread TID 1668 PID 528
0xe1c27160 528 0x55c 0x10 Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\EPOCH
0x8156c878 528 0x560 0x1f0003 Event
0x8156c8a8 528 0x564 0x1f03ff Thread TID 1668 PID 528
0x8156c848 528 0x568 0x1f0003 Event
0x8156c7b8 528 0x56c 0x1f01ff File \Device\Afd\Endpoint
0x8156c5d8 528 0x570 0x1f01ff File \Device\Afd\Endpoint
0x8156c3e8 528 0x574 0x1f01ff File \Device\Udp
0x8156cb20 528 0x578 0x1f0003 Event
0x8156c8a8 528 0x57c 0x1f03ff Thread TID 1668 PID 528
0x8156c1d0 528 0x580 0x1f0003 Event
0x81613f90 528 0x584 0x1f0003 Event
0x81613fc0 528 0x588 0x100003 Event
0x81613d68 528 0x58c 0x1f01ff File \Device\Afd\Endpoint
0x81613bf8 528 0x590 0x1f01ff File \Device\RawIp\255
0x81613680 528 0x594 0x1f03ff Thread TID 1672 PID 528
0x81613650 528 0x598 0x1f0003 Event
0x816131d0 528 0x59c 0x1f03ff Thread TID 1676 PID 528
0x81614f28 528 0x5a0 0x1f0003 Timer
0x81614cb0 528 0x5a4 0x1f03ff Thread TID 1680 PID 528
0xe1006e20 676 0x4 0xf0003 KeyedEvent CritSecOutOfMemoryEvent
0xe14f3230 676 0x8 0x3 Directory KnownDlls
0x816498c0 676 0xc 0x100020 File \Device\HarddiskVolume1\WINDOWS\system32
0x815d4c90 676 0x10 0x100003 Semaphore
0xe14038f8 676 0x14 0xf000f Directory Windows
0xe185dad0 676 0x18 0x21f0001 Port
0x815e28f0 676 0x1c 0x100003 Semaphore
0xe14477d0 676 0x20 0x2000f Directory BaseNamedObjects
0x817064e8 676 0x24 0x1f0001 Mutant SHIMLIB_LOG_MUTEX
0xe185a108 676 0x28 0x20f003f Key MACHINE
0x816d8b20 676 0x2c 0xf016e WindowStation Service-0x0-3e7$
0x815ca098 676 0x30 0x21f0003 Event
0x815f6970 676 0x34 0xf00cf Desktop Default
0x816d8b20 676 0x38 0xf016e WindowStation Service-0x0-3e7$
0x816ad258 676 0x3c 0x100003 Semaphore
0x815ca828 676 0x40 0x1f0003 Event
0x816109f0 676 0x44 0x100003 Semaphore
0xe185c798 676 0x48 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32
0x81692380 676 0x4c 0x1f0003 Event DINPUTWINMM
0x816fb4c8 676 0x50 0x100001 File \Device\KsecDD
0x8167dbd8 676 0x54 0x1f0003 Event
0x8167dba8 676 0x58 0x1f0003 Event
0xe185a170 676 0x5c 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32
0x8162a930 676 0x60 0x1f0003 Semaphore shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}
0x817cb720 676 0x64 0x1f0003 Event userenv: User Profile setup event
0x815ca890 676 0x68 0x100020 File \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0xe185d890 676 0x6c 0x8 Token
0x815d4e18 676 0x70 0x1f0003 Event
0x81648db8 676 0x74 0x100003 Semaphore
0x815e2a28 676 0x78 0x100003 Semaphore
0x81606a68 676 0x7c 0x100003 Semaphore
0x81695938 676 0x80 0x100003 Semaphore
0x81675cc0 676 0x84 0x100003 Semaphore
0x81675c88 676 0x88 0x100003 Semaphore
0x81675c50 676 0x8c 0x100003 Semaphore
0x81675c18 676 0x90 0x100003 Semaphore
0x81675be0 676 0x94 0x100003 Semaphore
0x81675ba8 676 0x98 0x100003 Semaphore
0x81675b70 676 0x9c 0x100003 Semaphore
0x81675b38 676 0xa0 0x100003 Semaphore
0x81675ad8 676 0xa4 0x1f0003 Event
0x81675b08 676 0xa8 0x1f0003 Event
0x81675aa8 676 0xac 0x1f0003 Event
0x81675a78 676 0xb0 0x1f0003 Event
0x816706a8 676 0xb4 0x1f03ff Thread TID 680 PID 676
0x81675a48 676 0xb8 0x1f0003 Event
0x816dbe30 676 0xbc 0x12019f File \Device\NamedPipe\net\NtControlPipe1
0xe185d590 676 0xc0 0x1f0001 Port
0x81638da8 676 0xc4 0x1f03ff Thread TID 808 PID 676
0x8162f2c0 676 0xc8 0x1f0003 Event
0x8162aa70 676 0xcc 0x1f0003 Event
0x8162f2f0 676 0xd0 0x1f0003 Event
0x8162f290 676 0xd4 0x1f0003 Event
0x81712978 676 0xd8 0x1f0003 IoCompletion
0x817130f0 676 0xdc 0x1f0003 IoCompletion
0x81712978 676 0xe0 0x1f0003 IoCompletion
0xe1861d20 676 0xe4 0x20f003f Key MACHINE\SOFTWARE\CLASSES
0xe1861fb8 676 0xe8 0x20019 Key MACHINE\SOFTWARE\CLASSES\CLSID
0xe1860c18 676 0xec 0x20019 Key MACHINE\SOFTWARE\CLASSES\APPID
0x8162f260 676 0xf0 0x1f0003 Event
0x8162f148 676 0xf4 0x1f0003 Event
0x8162f118 676 0xf8 0x1f0003 Event
0x8162f0e8 676 0xfc 0x1f0003 Event
0x81638490 676 0x100 0x100000 File \Device\Dfs
0xe1861b30 676 0x104 0x1f0001 Port
0x816c9ec0 676 0x108 0x1f0003 Event
0xe1861940 676 0x10c 0x1f0001 Port
0xe1860088 676 0x110 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\OLE
0xe18619f8 676 0x114 0x10 Key MACHINE\SOFTWARE\MICROSOFT\OLE
0x815d3280 676 0x118 0x1f0003 Timer
0x816c9f88 676 0x11c 0x21f0003 Event
0x816c9c48 676 0x120 0x1f03ff Thread TID 692 PID 676
0x81713780 676 0x124 0x1f0003 IoCompletion
0x815fd780 676 0x128 0x1f0003 Timer
0x81714c40 676 0x12c 0x1f03ff Thread TID 700 PID 676
0xe1860390 676 0x130 0x20019 Key MACHINE\SOFTWARE\POLICIES
0x81714b98 676 0x134 0x1f0003 Event
0xe1860328 676 0x138 0x10 Key MACHINE\SOFTWARE\POLICIES
0xe1855ce8 676 0x13c 0x1f0001 Port actkernel
0x81714b30 676 0x140 0x1f0003 Event
0x815fdda8 676 0x144 0x1f03ff Thread TID 704 PID 676
0x815f5da0 676 0x148 0x1f0fff Process svchost.exe(736)
0xe18a1370 676 0x14c 0xf0007 Section RotHintTable
0xe18a3ee0 676 0x150 0x1f0001 Port
0x81639270 676 0x154 0x1f0003 Event
0x816dce30 676 0x158 0x12019f File \Device\NamedPipe\lsarpc
0x815d3e90 676 0x15c 0x1f0001 Mutant {A3BD3259-3E4F-428a-84C8-F0463A9D3EB5}
0xe18a4b10 676 0x160 0xf0007 Section {A64C7F33-DA35-459b-96CA-63B51FB0CDB9}
0xe1d9f438 676 0x164 0xf01ff Token
0xe1d9fe30 676 0x168 0xf003f Key MACHINE\SOFTWARE\CLASSES
0xe1d9fdc8 676 0x16c 0xf003f Key MACHINE\SOFTWARE\CLASSES
0x816164c8 676 0x170 0x1f0003 Event
0xe1bfa818 676 0x174 0xf003f Key MACHINE\SOFTWARE\MICROSOFT\COM3
0x81616498 676 0x178 0x1f0003 Event
0xe1bfa7b0 676 0x17c 0x10 Key USER
0x81616468 676 0x180 0x1f0003 Event
0xe1bfa748 676 0x184 0xf003f Key MACHINE\SOFTWARE\CLASSES
0x81616438 676 0x188 0x1f0003 Event
0xe1bfa6e0 676 0x18c 0x10 Key USER
0x81616408 676 0x190 0x1f0003 Event
0xe1d9f3c0 676 0x194 0xf003f Key MACHINE\SOFTWARE\MICROSOFT\COM3
0x81679758 676 0x198 0x1f0003 Event
0xe1bfc638 676 0x19c 0xf003f Key MACHINE\SOFTWARE\MICROSOFT\COM3
0x81679728 676 0x1a0 0x1f0003 Event
0xe1d9f320 676 0x1a4 0xf003f Key MACHINE\SOFTWARE\CLASSES\CLSID
0x816796f8 676 0x1a8 0x1f0003 Event
0xe1bfc598 676 0x1ac 0xf003f Key MACHINE\SOFTWARE\CLASSES
0x816796c8 676 0x1b0 0x1f0003 Event
0xe1d9f280 676 0x1b4 0xf003f Key MACHINE\SOFTWARE\MICROSOFT\COM3
0x81679698 676 0x1b8 0x1f0003 Event
0xe1bfc4f8 676 0x1bc 0x10 Key USER
0x81679668 676 0x1c0 0x1f0003 Event
0xe1d9f1e0 676 0x1c4 0xf003f Key MACHINE\SOFTWARE\MICROSOFT\COM3
0x81679638 676 0x1c8 0x1f0003 Event
0xe1bf6020 676 0x1cc 0xf003f Key MACHINE\SOFTWARE\MICROSOFT\COM3
0x81679608 676 0x1d0 0x1f0003 Event
0xe1d9f140 676 0x1d4 0xf003f Key MACHINE\SOFTWARE\CLASSES\CLSID
0x816795d8 676 0x1d8 0x1f0003 Event
0x815fb348 676 0x1dc 0x1f0003 Event
0x81622da8 676 0x1e0 0x1f03ff Thread TID 1448 PID 676
0xe1bf68e8 676 0x1e4 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004_CLASSES
0xe1006e20 736 0x4 0x20003 KeyedEvent CritSecOutOfMemoryEvent
0xe14f3230 736 0x8 0x3 Directory KnownDlls
0x816d0708 736 0xc 0x100020 File \Device\HarddiskVolume1\WINDOWS\system32
0x815e8b60 736 0x10 0x100003 Semaphore
0xe14038f8 736 0x14 0xf000f Directory Windows
0xe1896508 736 0x18 0x21f0001 Port
0x815500b8 736 0x1c 0x100003 Semaphore
0xe14477d0 736 0x20 0x2000f Directory BaseNamedObjects
0x817064e8 736 0x24 0x1f0001 Mutant SHIMLIB_LOG_MUTEX
0xe18873e8 736 0x28 0x2020019 Key MACHINE
0x8170c6b0 736 0x2c 0xf037f WindowStation Service-0x0-3e4$
0x81625cc8 736 0x30 0x21f0003 Event
0x81625c20 736 0x34 0xf01ff Desktop Default
0x8170c6b0 736 0x38 0xf037f WindowStation Service-0x0-3e4$
0x81611c00 736 0x3c 0x100003 Semaphore
0x81646900 736 0x40 0x1f0003 Event
0x81611bc8 736 0x44 0x100003 Semaphore
0xe18978d8 736 0x48 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32
0x81611a68 736 0x4c 0x1f0003 Event
0x81646968 736 0x50 0x100001 File \Device\KsecDD
0x81712ee0 736 0x54 0x1f0003 Event
0xe18967a8 736 0x58 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32
0x8162a930 736 0x5c 0x100002 Semaphore shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}
0x8179b140 736 0x60 0x1f0003 Event
0x81611b38 736 0x64 0x100020 File \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x81700be8 736 0x68 0x1f0003 Event
0x81700bb8 736 0x6c 0x1f0003 Event
0x81611aa0 736 0x70 0x12019f File \Device\NamedPipe\net\NtControlPipe3
0x81700b88 736 0x74 0x1f0003 Event
0x81611cc8 736 0x78 0x1f03ff Thread TID 740 PID 736
0x81700b20 736 0x7c 0x1f0003 Event
0xe18838c0 736 0x80 0x1f0001 Port
0x817008a8 736 0x84 0x1f03ff Thread TID 744 PID 736
0x81700758 736 0x88 0x1f0003 Event
0x817007e8 736 0x8c 0x1f0003 Event
0x81700788 736 0x90 0x1f0003 Event
0x81700728 736 0x94 0x1f0003 Event
0x81644268 736 0x98 0x1f0003 IoCompletion
0x815dc1f0 736 0x9c 0x1f0003 IoCompletion
0x81644268 736 0xa0 0x1f0003 IoCompletion
0xe1896440 736 0xa4 0x20f003f Key USER\S-1-5-20_CLASSES
0xe1896148 736 0xa8 0x20019 Key MACHINE\SOFTWARE\CLASSES\CLSID
0x817006f8 736 0xac 0x1f0003 Event
0xe18a0f08 736 0xb0 0x20019 Key MACHINE\SOFTWARE\CLASSES\APPID
0x8166e700 736 0xb4 0x1f0003 Event
0x8166e690 736 0xb8 0x1f0003 Event
0x8166e660 736 0xbc 0x1f0003 Event
0x815fe7e8 736 0xc0 0x100000 File \Device\Dfs
0xe18a0e50 736 0xc4 0x1f0001 Port
0xe189ffb8 736 0xc8 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\OLE
0x81778b48 736 0xcc 0x1f0003 Event
0x81778b18 736 0xd0 0x1f0003 Event
0xe18965c0 736 0xd4 0x10 Key MACHINE\SOFTWARE\MICROSOFT\OLE
0x8177b3c8 736 0xd8 0x1f0003 Timer
0x8177b398 736 0xdc 0x21f0003 Event
0x8166e3b8 736 0xe0 0x1f03ff Thread TID 748 PID 736
0x815e6240 736 0xe4 0x1f0003 IoCompletion
0x8177a4f0 736 0xe8 0x1f0003 Timer
0x816192f8 736 0xec 0x1f03ff Thread TID 756 PID 736
0xe18a0de8 736 0xf0 0x20019 Key MACHINE\SOFTWARE\POLICIES
0x817795e8 736 0xf4 0x1f0003 Event
0xe189ff50 736 0xf8 0x10 Key MACHINE\SOFTWARE\POLICIES
0x81779580 736 0xfc 0x1f0003 Event
0xe189fe20 736 0x100 0x1f0001 Port epmapper
0x81779550 736 0x104 0x1f0003 Event
0x81645558 736 0x108 0x1f03ff Thread TID 760 PID 736
0x81778c58 736 0x10c 0x1f0003 Event
0x817008a8 736 0x110 0x1f03ff Thread TID 744 PID 736
0xe18a0d80 736 0x114 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9
0x81778c28 736 0x118 0x1f0003 Event
0xe18a0d18 736 0x11c 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5
0x81672728 736 0x120 0x1f0003 Event
0x81611980 736 0x124 0x1200a0 File \Device\Tcp
0x8167dd70 736 0x128 0x1f01ff File \Device\Afd\Endpoint
0x815d61f0 736 0x12c 0x1f0003 Event
0x815d61c0 736 0x130 0x1f0003 Event
0x816c5538 736 0x134 0x1f03ff Thread TID 764 PID 736
0xe18a0970 736 0x138 0x1f0001 Port
0xe18a0b18 736 0x13c 0x1f0001 Port
0x815d60e0 736 0x140 0x1f01ff File \Device\Afd\Endpoint
0x816c5300 736 0x144 0x1f0003 Event
0x81601da8 736 0x148 0x1f03ff Thread TID 768 PID 736
0x816c5230 736 0x14c 0x160089 File \Device\NamedPipe\Winsock2\CatalogChangeListener-2e0-0
0x816c51a0 736 0x150 0x1f0003 Event
0x81601cc8 736 0x154 0x1f01ff File \Device\Afd\Endpoint
0x81601da8 736 0x158 0x1f03ff Thread TID 768 PID 736
0x81601b78 736 0x15c 0x1f0003 Event
0x81601ae8 736 0x160 0x1f01ff File \Device\Afd\Endpoint
0x8164db68 736 0x164 0x1200a0 File \Device\Ip
0x8164dc90 736 0x168 0x1200a0 File \Device\Tcp
0x8164dad0 736 0x16c 0x1200a0 File \Device\Ip
0x816c5168 736 0x170 0x100003 Semaphore
0x817795b0 736 0x174 0x100003 Semaphore
0xe18a0cb0 736 0x178 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\TCPIP\LINKAGE
0xe189fed8 736 0x17c 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS
0xe18a0c48 736 0x180 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\NETBT\PARAMETERS\INTERFACES
0xe18a0588 736 0x184 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\NETBT\PARAMETERS
0x8164d9d0 736 0x188 0x1200a0 File \Device\Tcp
0x816015a8 736 0x18c 0x1f0003 Event ScmCreatedEvent
0x816017a0 736 0x190 0x1f0003 Event
0x81601808 736 0x194 0x1f01ff File \Device\Afd\Endpoint
0x8162aaa0 736 0x198 0x1f0003 Event
0xe189f838 736 0x19c 0x1f0001 Port
0xe18a4ea8 736 0x1a0 0x1f0001 Port
0x816393a0 736 0x1a4 0x1f0003 Event
0xe18a4c68 736 0x1a8 0xf01ff Token
0xe18c4ef0 736 0x1ac 0x1f0001 Port
0xe1a1d030 736 0x1b0 0xf01ff Token
0xe1670570 736 0x1b4 0x20019 Key MACHINE\SOFTWARE\CLASSES
0xe16705d8 736 0x1b8 0x20019 Key MACHINE\SOFTWARE\CLASSES
0x8164c950 736 0x1bc 0x1f0003 Event
0xe17e8120 736 0x1c0 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\COM3
0x8164c920 736 0x1c4 0x1f0003 Event
0xe1bd1d58 736 0x1c8 0x10 Key USER
0x8164c8f0 736 0x1cc 0x1f0003 Event
0xe1bd1cf0 736 0x1d0 0x20019 Key MACHINE\SOFTWARE\CLASSES
0x8164c8c0 736 0x1d4 0x1f0003 Event
0xe1bd1c88 736 0x1d8 0x10 Key USER
0x81701d78 736 0x1dc 0x1f0003 Event
0xe1bd1c20 736 0x1e0 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\COM3
0x81701d48 736 0x1e4 0x1f0003 Event
0xe1bcfd60 736 0x1e8 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\COM3
0x81701d18 736 0x1ec 0x1f0003 Event
0xe1bcfcf8 736 0x1f0 0x20019 Key MACHINE\SOFTWARE\CLASSES\CLSID
0x81701ce8 736 0x1f4 0x1f0003 Event
0xe1bcfc90 736 0x1f8 0x20019 Key MACHINE\SOFTWARE\CLASSES
0x81701cb8 736 0x1fc 0x1f0003 Event
0xe1bcfc28 736 0x200 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\COM3
0x81701c88 736 0x204 0x1f0003 Event
0xe1bcfbc0 736 0x208 0x10 Key USER
0x81701c58 736 0x20c 0x1f0003 Event
0xe1bcfb58 736 0x210 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\COM3
0x81701c28 736 0x214 0x1f0003 Event
0xe1bcfaf0 736 0x218 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\COM3
0x81701bf8 736 0x21c 0x1f0003 Event
0xe1bcfa88 736 0x220 0x20019 Key MACHINE\SOFTWARE\CLASSES\CLSID
0x81701bc8 736 0x224 0x1f0003 Event
0x815c7710 736 0x228 0x12019f File \Device\NamedPipe\epmapper
0x815c7628 736 0x22c 0x12019f File \Device\NamedPipe\epmapper
0x81701b78 736 0x230 0x1f0003 Event
0x81701b48 736 0x234 0x1f0003 Event
0x81701b18 736 0x238 0x1f0003 Event
0x81701ae8 736 0x23c 0x1f0003 Event
0x81701ab8 736 0x240 0x1f0003 Event
0xe183be48 736 0x244 0x1f0001 Port
0xe183b970 736 0x248 0xf01ff Token
0x815cd468 736 0x24c 0x1f0003 Event
0x815cd318 736 0x250 0x1f0003 Event
0x815cd348 736 0x254 0x1f0003 Event
0x815cd2e8 736 0x258 0x1f0003 Event
0xe1844368 736 0x25c 0xc Token
0xe18447e8 736 0x260 0x1f0001 Port
0x815e4ca8 736 0x264 0x1f0003 Event
0xe1aa6500 736 0x268 0x1f0001 Port
0x815e3e88 736 0x26c 0x1f0003 Event
0x815e3e48 736 0x270 0x1f0001 Mutant NETMAN
0x816163c0 736 0x274 0x1f0003 Event
0x81623a98 736 0x278 0x1f0003 Event
0x81623a68 736 0x27c 0x1f0003 Event RPCSS_REGEVENT:{BA126AE5-2166-11D1-B1D0-00805FC1270E}
0xe1bfa880 736 0x280 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004_CLASSES
0xe17e7de0 736 0x284 0x1f0001 Port
0x816192f8 736 0x288 0x1f03ff Thread TID 756 PID 736
0x816f12c8 736 0x28c 0x1f0003 Event
0x81673660 736 0x290 0x1f0003 Event
0x816192f8 736 0x294 0x1f03ff Thread TID 756 PID 736
0x815e3f08 736 0x298 0x1f0003 Event
0xe1d93540 736 0x29c 0x1f0001 Port
0xe1d94de8 736 0x2a0 0x1f0001 Port
0x8163b768 736 0x2a4 0x1f0003 Event
0x815fb720 736 0x2a8 0x1f03ff Thread TID 1440 PID 736
0x8163b6f8 736 0x2ac 0x1f0003 Event
0xe1bf4f08 736 0x2b0 0x1f0001 Port
0x815fb318 736 0x2b4 0x1f0003 Event
0x815fb378 736 0x2b8 0x1f0003 Event
0x81622b30 736 0x2bc 0x1f03ff Thread TID 1452 PID 736
0x81624de0 736 0x2c0 0x1f0003 Event
0xe1c26c00 736 0x2c4 0x20019 Key MACHINE\SOFTWARE\CLASSES
0x815e3e48 736 0x2c8 0x1f0001 Mutant NETMAN
0x8169f590 736 0x2cc 0x1f0003 Event
0xe1bf6950 736 0x2d0 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004_CLASSES
0x8167e538 736 0x2d4 0x1f0003 Event
0x8167e8d0 736 0x2d8 0x1f0003 Event
0x8167e2c8 736 0x2dc 0x1f0003 Event
0x81685b48 736 0x2e0 0x1f0003 Event
0x815ec368 736 0x2e4 0x1f0003 Event
0x815cc470 736 0x2e8 0x1f03ff Thread TID 1616 PID 736
0x816055a0 736 0x2ec 0x1f0003 Event
0x8169f380 736 0x2f0 0x1f0003 Event
0x81605328 736 0x2f4 0x1f03ff Thread TID 1640 PID 736
0xe1c25648 736 0x2f8 0x1f0001 Port
0xe1c25408 736 0x2fc 0xf01ff Token
0xe1c26c78 736 0x300 0xc Token
0x8169fc08 736 0x304 0x1f0003 Event
0xe1c26148 736 0x30c 0x1f0001 Port
0x8164bad0 736 0x310 0x1f0003 Event
0x816fcf60 736 0x314 0x1f0003 Event
0x816fcce8 736 0x318 0x1f03ff Thread TID 1708 PID 736
0xe1c2d848 736 0x324 0x1f0001 Port
0xe1006e20 800 0x4 0xf0003 KeyedEvent CritSecOutOfMemoryEvent
0xe14f3230 800 0x8 0x3 Directory KnownDlls
0x81601470 800 0xc 0x100020 File \Device\HarddiskVolume1\WINDOWS\system32
0x8164da60 800 0x10 0x100003 Semaphore
0xe14038f8 800 0x14 0xf000f Directory Windows
0xe18a1f68 800 0x18 0x21f0001 Port
0x8162a9f8 800 0x1c 0x100003 Semaphore
0xe14477d0 800 0x20 0x2000f Directory BaseNamedObjects
0x817064e8 800 0x24 0x1f0001 Mutant SHIMLIB_LOG_MUTEX
0xe189fbd8 800 0x28 0x20f003f Key MACHINE
0x816d8b20 800 0x2c 0xf016e WindowStation Service-0x0-3e7$
0x815d3df0 800 0x30 0x21f0003 Event
0x815f6970 800 0x34 0xf00cf Desktop Default
0x816d8b20 800 0x38 0xf016e WindowStation Service-0x0-3e7$
0x815d3c68 800 0x3c 0x100003 Semaphore
0x81638a70 800 0x40 0x1f0003 Event
0x815d3c30 800 0x44 0x100003 Semaphore
0xe18a04a8 800 0x48 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32
0x81692380 800 0x4c 0x1f0003 Event DINPUTWINMM
0x816013d8 800 0x50 0x100001 File \Device\KsecDD
0x815d3a38 800 0x54 0x1f0003 Event
0x815d3a08 800 0x58 0x1f0003 Event
0xe189fb00 800 0x5c 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32
0x8162a930 800 0x60 0x1f0003 Semaphore shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}
0x817cb720 800 0x64 0x1f0003 Event userenv: User Profile setup event
0x81638ad8 800 0x68 0x100020 File \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0xe18a1030 800 0x6c 0x8 Token
0x81639760 800 0x70 0x1f0003 Event
0x81639728 800 0x74 0x100003 Semaphore
0x816396f0 800 0x78 0x100003 Semaphore
0x816396b8 800 0x7c 0x100003 Semaphore
0x81639680 800 0x80 0x100003 Semaphore
0x81639648 800 0x84 0x100003 Semaphore
0x81639610 800 0x88 0x100003 Semaphore
0x816395d8 800 0x8c 0x100003 Semaphore
0x816395a0 800 0x90 0x100003 Semaphore
0x81639568 800 0x94 0x100003 Semaphore
0x81639530 800 0x98 0x100003 Semaphore
0x816394f8 800 0x9c 0x100003 Semaphore
0x816394c0 800 0xa0 0x100003 Semaphore
0x81639460 800 0xa4 0x1f0003 Event
0x81639490 800 0xa8 0x1f0003 Event
0x81639430 800 0xac 0x1f0003 Event
0x81639400 800 0xb0 0x1f0003 Event
0x8162ab00 800 0xb4 0x1f03ff Thread TID 804 PID 800
0xe18a1e70 800 0xb8 0x1f0001 Port
0x816393d0 800 0xbc 0x1f0003 Event
0x817110a0 800 0xc0 0x1f0003 IoCompletion
0x81639e58 800 0xc4 0x12019f File \Device\NamedPipe\net\NtControlPipe4
0x8169bbf0 800 0xc8 0x1f0003 IoCompletion
0x817110a0 800 0xcc 0x1f0003 IoCompletion
0xe18a49d8 800 0xd0 0x1f0001 Port
0x8169bb90 800 0xd4 0x1f0003 Event
0x8169b770 800 0xd8 0x1f0003 Event
0x8169b740 800 0xdc 0x1f0003 Event
0xe18a5c58 800 0xe0 0x1f0001 Port ThemeApiPort
0x8169b710 800 0xe4 0x1f0003 Event
0x8169b6e0 800 0xe8 0x1f0003 Event
0x81608810 800 0xec 0x1f0003 Timer
0x8169b6b0 800 0xf0 0x21f0003 Event
0x81608598 800 0xf4 0x1f03ff Thread TID 816 PID 800
0x81608510 800 0xf8 0x1f0003 IoCompletion
0x81608228 800 0xfc 0x1f0003 Event
0x8169b858 800 0x100 0x1f03ff Thread TID 812 PID 800
0x815c4a90 800 0x104 0x1f0003 Event
0x81608298 800 0x108 0x1f03ff Thread TID 820 PID 800
0x815f4e88 800 0x10c 0x1200a0 File \Device\Tcp
0x815e5e40 800 0x110 0x1200a0 File \Device\Ip
0x81699ac0 800 0x114 0x120116 File \Device\Tcp
0x815e5da8 800 0x118 0x100003 File \Device\Ip
0x81621800 800 0x11c 0x1200a0 File \Device\Ip
0x815c4ba8 800 0x120 0x100003 Semaphore
0x81633910 800 0x124 0x100003 Semaphore
0xe18ad6f0 800 0x128 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\TCPIP\LINKAGE
0xe18ad460 800 0x12c 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS
0xe18a6350 800 0x130 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\NETBT\PARAMETERS\INTERFACES
0xe18bb688 800 0x134 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\NETBT\PARAMETERS
0x816217c8 800 0x138 0x1f0003 Event
0x815f4a58 800 0x13c 0x1f03ff Thread TID 840 PID 800
0x81612378 800 0x140 0x1f0003 Event
0xe18bb588 800 0x144 0xf003f Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9
0x8166f6d0 800 0x148 0x1f0003 Event
0xe18bcc78 800 0x14c 0xf003f Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5
0x81619c90 800 0x150 0x1f0003 Event
0x815f4a58 800 0x154 0x1f03ff Thread TID 840 PID 800
0xe18bb6f0 800 0x158 0xf Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\DHCP\PARAMETERS
0xe18a97c8 800 0x15c 0xf Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS
0xe18bcc10 800 0x160 0xf Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\DHCP\PARAMETERS\OPTIONS
0xe18a9760 800 0x164 0xf Key MACHINE\SYSTEM\CONTROLSET001\SERVICES
0x816198d8 800 0x168 0x1f0003 Timer
0x816198a8 800 0x16c 0x1f0003 Event
0x81619878 800 0x170 0x1f0003 Event
0x81612438 800 0x174 0x1f0003 Event DHCPNEWIPADDRESS
0x817096f8 800 0x178 0x1f0003 Event
0xe18bc458 800 0x17c 0x1f0001 Port
0x81676478 800 0x180 0x1f0003 Event
0xe18be990 800 0x184 0x2001f Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\DNSREGISTEREDADAPTERS
0x81676448 800 0x188 0x1f0003 Event
0x81676418 800 0x18c 0x1f0003 Event
0x816fbda8 800 0x190 0x1f03ff Thread TID 892 PID 800
0x816fb810 800 0x194 0x1f0003 Event
0x816fbb98 800 0x198 0x100003 File \Device\Ip
0x816763c0 800 0x19c 0x1f0003 Semaphore
0xe18a9690 800 0x1a0 0xf Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{18DD0775-33B7-4F93-9D30-4475914B6CEF}
0xe18bb388 800 0x1a4 0xf001f Section
0x816767d8 800 0x1a8 0x1f0003 Event
0xe18a5320 800 0x1ac 0x1f0001 Port dhcpcsvc
0x81676788 800 0x1b0 0x1f0003 Event
0x816764f0 800 0x1b4 0x1f03ff Thread TID 896 PID 800
0x816f57e0 800 0x1b8 0x478 Process winlogon.exe(412)
0xe18be4e8 800 0x1bc 0x1f0001 Port
0x816f57e0 800 0x1c0 0x478 Process winlogon.exe(412)
0x816f57e0 800 0x1c4 0x100000 Process winlogon.exe(412)
0x81609d78 800 0x1c8 0x1f0003 Timer
0x81609ae0 800 0x1cc 0x1f03ff Thread TID 916 PID 800
0xe18c4e38 800 0x1d0 0x1f0001 Port
0x816f57e0 800 0x1d4 0x47a Process winlogon.exe(412)
0x815faff0 800 0x1d8 0x1f0003 Event
0x81639ef0 800 0x1dc 0x21f0003 Event
0x81609a78 800 0x1e0 0x100003 Event
0x8167d2c8 800 0x1e4 0x1f0003 Event crypt32LogoffEvent
0x815f8590 800 0x1e8 0x100003 Event
0xe18c3ac8 800 0x1ec 0xf0007 Section AtlDebugAllocator_FileMappingNameStatic3_320
0x81675e18 800 0x1f0 0x12019f File \Device\WMIDataDevice
0x81550d58 800 0x1f4 0x4 WmiGuid
0x81648f48 800 0x1f8 0xa84 WmiGuid
0x815f07c8 800 0x1fc 0x1f0003 Event
0x81676928 800 0x200 0x12019f File \Device\WMIDataDevice
0x8162ad78 800 0x204 0x1f0fff Process svchost.exe(800)
0x815f0798 800 0x208 0x1f0003 Event
0x815f0768 800 0x20c 0x1f0003 Event
0xe1d95490 800 0x210 0x1f0001 Port
0x816f2df8 800 0x214 0x100003 Event
0x816c33e8 800 0x218 0x21f0003 Semaphore
0x81573020 800 0x21c 0x4 WmiGuid
0xe1cda5f8 800 0x220 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS
0x81624320 800 0x224 0x1f03ff Thread TID 1476 PID 800
0x81645020 800 0x228 0x1f0003 Event
0x816b7ae8 800 0x22c 0x1f0003 Event
0x8161a398 800 0x230 0x100003 Semaphore
0x8162b640 800 0x234 0x100003 Semaphore
0x8161c7c8 800 0x238 0x1f0003 Event
0x8161c680 800 0x23c 0x1f0003 Event
0x8161c648 800 0x240 0x100003 Semaphore
0x8167ffe8 800 0x244 0x100003 Semaphore
0xe19e3c48 800 0x248 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\TRACING\WZCTRACE
0x8161c618 800 0x24c 0x1f0003 Event
0x8167ff48 800 0x250 0x1f0003 Event
0x816098c8 800 0x254 0x1f0003 Event {4888D4DA-1222-4D45-AF7A-A09F6890622D}ShellHWDetection
0x8167ff18 800 0x258 0x1f0003 Event
0xe1ac61c0 800 0x25c 0x1f0001 Port
0x8167fe88 800 0x260 0x1f0003 Event
0x8167f5c0 800 0x264 0x1f0003 Event
0x8167fe58 800 0x268 0x1f0003 Event
0x816f7f70 800 0x26c 0x1f0003 Event
0xe1bd0e68 800 0x270 0x1f0001 Port
0x8162dcf0 800 0x274 0x1f0003 Event
0x8162dd60 800 0x278 0x100003 Semaphore
0x8162dcb8 800 0x27c 0x100003 Semaphore
0xe1bc32f0 800 0x280 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\TRACING\EAPOL
0x8162dc88 800 0x284 0x1f0003 Event
0x8162dbb0 800 0x288 0x1f0003 Event
0xe1aa45a8 800 0x28c 0xf003f Key MACHINE\SOFTWARE\CLASSES
0x816209a8 800 0x290 0x1f0003 Event
0x8162d7a0 800 0x294 0x100003 Semaphore
0x8162d768 800 0x298 0x100003 Semaphore
0xe1bc3700 800 0x29c 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\TRACING\EAPOLQEC
0x8162d738 800 0x2a0 0x1f0003 Event
0xe1bfce48 800 0x2a4 0xf003f Key MACHINE\SOFTWARE\CLASSES
0x816927d0 800 0x2a8 0x1f0003 Event
0x81690250 800 0x2ac 0x1f03ff Thread TID 1048 PID 800
0x81620828 800 0x2b0 0x1f0003 Event
0x816904c8 800 0x2b4 0x1f03ff Thread TID 1044 PID 800
0x8162d950 800 0x2b8 0x1f0003 Event
0x8161c800 800 0x2bc 0x12019f File \Device\NamedPipe\lsarpc
0xe1bff878 800 0x2c0 0x20f003f Key MACHINE\SOFTWARE\CLASSES
0x81605b30 800 0x2c4 0x1f03ff Thread TID 1624 PID 800
0x8170a5c0 800 0x2c8 0x1f0003 Event
0x8170a590 800 0x2cc 0x1f0003 Event
0x8161e778 800 0x2d0 0x1f0003 Event
0xe1bfceb0 800 0x2d4 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\NETWORKACCESSPROTECTION\NAPCLIENT
0x8170a540 800 0x2d8 0x1f0003 Event
0x8162da30 800 0x2dc 0x1f0003 Event
0xe1bff948 800 0x2e0 0xf003f Key MACHINE\SOFTWARE\MICROSOFT\COM3
0x8162daa0 800 0x2e4 0x1f0003 Event
0xe1bff7a8 800 0x2e8 0x10 Key USER
0x81692890 800 0x2ec 0x1f0003 Event
0xe1bff670 800 0x2f0 0xf003f Key MACHINE\SOFTWARE\CLASSES
0x8170a4d8 800 0x2f4 0x1f0003 Event
0x81672e78 800 0x2f8 0x12019f File \Device\NamedPipe\wkssvc
0x81645080 800 0x2fc 0x100003 Event
0x81683cc0 800 0x300 0x1f0003 Event WkssvcToAgentStopEvent
0xe1bff5a0 800 0x304 0x10 Key USER
0x81550cf8 800 0x308 0x1f0003 Event
0xe1bff538 800 0x30c 0xf003f Key MACHINE\SOFTWARE\MICROSOFT\COM3
0x81550c90 800 0x310 0x1f0003 Event
0xe1bff468 800 0x314 0xf003f Key MACHINE\SOFTWARE\MICROSOFT\COM3
0x81550c28 800 0x318 0x1f0003 Event
0xe1bff400 800 0x31c 0xf003f Key MACHINE\SOFTWARE\CLASSES\CLSID
0x81550bc0 800 0x320 0x1f0003 Event
0xe1bff398 800 0x324 0xf003f Key MACHINE\SOFTWARE\CLASSES
0x81550b58 800 0x328 0x1f0003 Event
0xe1bff330 800 0x32c 0xf003f Key MACHINE\SOFTWARE\MICROSOFT\COM3
0x81550af0 800 0x330 0x1f0003 Event
0xe1bff2c8 800 0x334 0x10 Key USER
0x81550a88 800 0x338 0x1f0003 Event
0xe1bff260 800 0x33c 0xf003f Key MACHINE\SOFTWARE\MICROSOFT\COM3
0x81550a20 800 0x340 0x1f0003 Event
0xe1bff1f8 800 0x344 0xf003f Key MACHINE\SOFTWARE\MICROSOFT\COM3
0x815509b8 800 0x348 0x1f0003 Event
0xe1bfe200 800 0x34c 0xf003f Key MACHINE\SOFTWARE\CLASSES\CLSID
0x81550950 800 0x350 0x1f0003 Event
0x81683c80 800 0x354 0x1f0003 Event AgentToWkssvcEvent
0xe1c65fb8 800 0x358 0x20019 Key MACHINE\SOFTWARE\CLASSES
0x8167fa58 800 0x35c 0x1f0003 Event wkssvc: MUP finished initializing event
0x81683d00 800 0x360 0x1f0003 Event WkssvcToAgentStartEvent
0xe1bf5ec8 800 0x364 0x1f0001 Port
0x81649cd0 800 0x368 0x4 WmiGuid
0xe1c81db8 800 0x36c 0x20f003f Key USER\.DEFAULT
0xe1d94b70 800 0x370 0x1f0001 Port
0x816f4d78 800 0x374 0x100003 Semaphore
0x816f4fe8 800 0x378 0x100003 Semaphore
0xe1bfe198 800 0x37c 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\TRACING\EAPOLQECCB
0x81617818 800 0x380 0x1f0003 Event
0x816323f8 800 0x384 0x1f0003 Event
0x81617a18 800 0x388 0x1f0003 Event
0x81617b60 800 0x38c 0x1f0003 Event
0x81617ca8 800 0x390 0x1f0003 Event
0x815f6838 800 0x394 0x100003 Semaphore
0x815f67c0 800 0x398 0x100003 Semaphore
0x815d8bc8 800 0x39c 0x1f0003 Event
0x815d1938 800 0x3a0 0x100020 File \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x815d8b98 800 0x3a4 0x1f0003 Event
0xe1d02e58 800 0x3a8 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_PROTOCOL_LOCKDOWN
0xe1c81e20 800 0x3ac 0x2001f Key USER\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
0x815d8b38 800 0x3b0 0x1f0003 Event
0x8170a400 800 0x3b4 0xa84 WmiGuid
0x8161c890 800 0x3b8 0x4 WmiGuid
0x816909f0 800 0x3bc 0xa84 WmiGuid
0x816c4c20 800 0x3c0 0x100020 File \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x81684460 800 0x3c4 0x1f0001 Mutant
0x815d8b08 800 0x3c8 0x1f0003 Event
0x815d8f30 800 0x3cc 0x1f0001 Mutant
0x816844f8 800 0x3d0 0x1f0003 Event
0x8168f938 800 0x3d4 0x1f0003 Event
0x81697e58 800 0x3d8 0x100020 File \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x8168f8c8 800 0x3dc 0x1f0001 Mutant
0x8168f908 800 0x3e0 0x1f0003 Event
0x8168f898 800 0x3e4 0x1f0003 Event
0x8168f858 800 0x3e8 0x1f0001 Mutant
0x8160b8e8 800 0x3ec 0x1f0003 Event
0x8160b8a8 800 0x3f0 0x1f0001 Mutant
0x8163e668 800 0x3f4 0x1f0001 Mutant
0x815e1648 800 0x3f8 0x100020 File \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x8163e580 800 0x3fc 0x1f0001 Mutant RasPbFile
0x8160b878 800 0x400 0x1f0003 Event
0x8163e638 800 0x404 0x1f0003 Event
0x8163e608 800 0x408 0x1f0003 Event
0x816f4608 800 0x40c 0x100003 Semaphore
0x8163e5d0 800 0x410 0x100003 Semaphore
0xe1d03ea8 800 0x414 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\TRACING\SVCHOST_RASTLS
0x8161d680 800 0x418 0x1f0003 Event
0xe17bb4f8 800 0x41c 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\TRACING\ONEEXSUP
0x816ae730 800 0x420 0x1f0003 Event
0x8162a120 800 0x424 0x1f0003 Event
0xe1bccdf0 800 0x428 0x1f0001 Port
0xe1bfeb08 800 0x42c 0xf01ff Token
0x8167b6e8 800 0x430 0x100003 Semaphore
0x8161aac0 800 0x434 0x100003 Semaphore
0xe1828b50 800 0x438 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\TRACING\SVCHOST_RASCHAP
0x815d2d00 800 0x43c 0x1f0003 Event
0x816466c0 800 0x440 0x100003 Event
0x81673568 800 0x444 0x1f0003 Event
0xe1bc4ec8 800 0x448 0x1f0001 Port
0x816ee608 800 0x44c 0x100003 Semaphore
0x816ee5d0 800 0x450 0x100003 Semaphore
0x816ee598 800 0x454 0x100003 Semaphore
0x816ee560 800 0x458 0x100003 Semaphore
0x816ee530 800 0x45c 0x1f0003 Event
0x8170b028 800 0x460 0x12019f File \Device\NamedPipe\winlogonrpc
0x81679788 800 0x464 0x478 Process ctfmon.exe(1412)
0xe1bfeb08 800 0x468 0xf01ff Token
0xe1bfeb08 800 0x46c 0xf01ff Token
0x816ff570 800 0x470 0xf037f WindowStation SAWinSta
0x8167b720 800 0x474 0x4 WmiGuid
0x816ee9a8 800 0x478 0x4 WmiGuid
0xe17e8030 800 0x47c 0x1f0001 Port wzcsvc
0x815fd3a8 800 0x480 0x1f0003 Event
0x816738d0 800 0x484 0x1f03ff Thread TID 1128 PID 800
0x81684730 800 0x488 0x100003 Semaphore
0x816846f8 800 0x48c 0x100003 Semaphore
0xe1bd1ae0 800 0x490 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\TRACING\WLPOLICY
0x816eedc8 800 0x494 0x1f0003 Event
0x81550648 800 0x498 0x1f0003 Event
0x8164cb10 800 0x49c 0x1f0003 Event
0x816098c8 800 0x4a0 0x100000 Event {4888D4DA-1222-4D45-AF7A-A09F6890622D}ShellHWDetection
0x81669608 800 0x4a4 0x1f03ff Thread TID 1136 PID 800
0xe17ef020 800 0x4a8 0x20019 Key MACHINE\SOFTWARE\CLASSES
0xe1846a98 800 0x4ac 0x1f0001 Port
0xe1bfe0e0 800 0x4b0 0x1f0001 Port OLE3225EF4D12CE42298A472CB3E2C0
0xe1d02890 800 0x4b4 0x20019 Key MACHINE\SOFTWARE\CLASSES
0x8164cae0 800 0x4b8 0x1f0003 Event
0x81669320 800 0x4bc 0x1f03ff Thread TID 1140 PID 800
0x8164ca90 800 0x4c0 0x1f0003 Event
0x8164ca20 800 0x4c4 0x1f0003 Event
0xe18468e0 800 0x4c8 0x20019 Key MACHINE\SOFTWARE\CLASSES
0xe1aa47e8 800 0x4cc 0x20019 Key MACHINE\SOFTWARE\CLASSES
0xe1bcf950 800 0x4d0 0x20019 Key MACHINE\SOFTWARE\CLASSES
0xe1aa4780 800 0x4d4 0x20019 Key MACHINE\SOFTWARE\CLASSES
0xe1bcf8e8 800 0x4d8 0x20019 Key MACHINE\SOFTWARE\CLASSES
0x81701790 800 0x4dc 0x1f0003 Event
0x815506f0 800 0x4e0 0x12019f File \Device\HarddiskVolume1\WINDOWS\SchedLgU.Txt
0x81701820 800 0x4e4 0x1f03ff Thread TID 1148 PID 800
0x81701480 800 0x4e8 0x1f0003 Event
0x816c11d0 800 0x4ec 0x120089 File \Device\HarddiskVolume1\WINDOWS\system32\kbd101.dll
0x817014e0 800 0x4f0 0x21f0003 Event
0x816ff938 800 0x4f4 0x120089 File \Device\HarddiskVolume1\WINDOWS\system32\kbd106.dll
0xe1847718 800 0x4f8 0xc Token
0x815e1e98 800 0x4fc 0x120089 File \Device\HarddiskVolume1\WINDOWS\system32\kbdnec.dll
0xe1846f00 800 0x500 0x1f0001 Port
0x817014b0 800 0x504 0x1f0003 Event
0x81680750 800 0x508 0xf01ff Desktop SADesktop
0x81701510 800 0x50c 0x1f0003 Event
0x816ffa78 800 0x510 0x1f0003 Event
0x81680680 800 0x514 0x1f0003 Timer
0x81701540 800 0x518 0x1f0003 Event
0x816ff9f8 800 0x51c 0x1f0003 Event
0xe1bfeb08 800 0x520 0xb Token
0x81701820 800 0x524 0x80 Thread TID 1148 PID 800
0x816434b0 800 0x528 0x12019f File \Device\NamedPipe\atsvc
0x816805f0 800 0x52c 0x12019f File \Device\NamedPipe\atsvc
0x816ff858 800 0x530 0x1f0003 Event
0x815c7020 800 0x534 0x1f03ff Thread TID 1152 PID 800
0x816ff9c8 800 0x538 0x1f0003 Event
0x815c7a18 800 0x53c 0x1f03ff Thread TID 1156 PID 800
0x816ff3f0 800 0x540 0x1f0003 Event
0x815c77a0 800 0x544 0x1f03ff Thread TID 1160 PID 800
0x816ff900 800 0x548 0x1f0003 Event
0x815c7358 800 0x54c 0x1f03ff Thread TID 1164 PID 800
0x815c72d8 800 0x550 0x1f0001 Mutant
0x815c72a8 800 0x554 0x1f0003 Event
0x8164aff0 800 0x558 0x1f0003 Event
0x8164afc0 800 0x55c 0x1f0003 Event
0x8164af90 800 0x560 0x1f0003 Event
0x8164ad18 800 0x564 0x1f03ff Thread TID 1168 PID 800
0x816ebdd0 800 0x568 0x21f0003 Event
0x8164a408 800 0x56c 0x1f0001 Mutant
0x816ebd70 800 0x570 0x1f0003 Event
0x816ebd40 800 0x574 0x1f0003 Event
0x816ebd10 800 0x578 0x1f0003 Event
0x816ebce0 800 0x57c 0x1f0003 Event PrefetchOverrideIdle
0x816ebca0 800 0x580 0x1f0003 Event PrefetchProcessingComplete
0x816ebc50 800 0x584 0x1f0001 Mutant
0xe1bcf9b8 800 0x588 0xf003f Key MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PREFETCHER
0x815e6b60 800 0x58c 0x1f0003 Event PrefetchTracesReady
0x816ebba0 800 0x590 0x1f0003 Event
0x8164ad18 800 0x594 0x1f03ff Thread TID 1168 PID 800
0x815f4470 800 0x598 0x100001 File \Device\HarddiskVolume1\WINDOWS\Tasks
0x8163fec0 800 0x59c 0x1f0003 Event
0x8163f848 800 0x5a0 0x1f03ff Thread TID 1216 PID 800
0x8163fb78 800 0x5a4 0x1f0003 Event SAConEvt
0x815b8500 800 0x5a8 0x100003 Semaphore
0x815b8840 800 0x5ac 0x100003 Semaphore
0x815b8468 800 0x5b0 0x100003 Semaphore
0x815743d0 800 0x5b4 0x100003 Semaphore
0xe1679878 800 0x5b8 0xf0007 Section mmGlobalPnpInfo
0x815e6bf8 800 0x5bc 0x21f0003 Event
0x815e6e88 800 0x5c0 0x1f0003 Event
0x815e6bc8 800 0x5c4 0x1f0003 Event
0x815e6b20 800 0x5c8 0x1f0003 Event PrefetchParametersChanged
0x815e6840 800 0x5cc 0x1f03ff Thread TID 1204 PID 800
0xe167ecf0 800 0x5d0 0x1f0001 Port AudioSrv
0x815e6790 800 0x5d4 0x1f0003 Event
0x815e64f8 800 0x5d8 0x1f03ff Thread TID 1208 PID 800
0xe1bfeb08 800 0x5dc 0xf01ff Token
0xe167f3f8 800 0x5e0 0x20f003f Key USER
0x815e63e8 800 0x5e4 0x1f0003 Event
0x8163fff0 800 0x5e8 0x1f0003 Event
0x815e6418 800 0x5ec 0x1f0003 Event
0x8163ff20 800 0x5f0 0x1f0003 Event
0x815e6840 800 0x5f4 0x1f03ff Thread TID 1204 PID 800
0x8163ff50 800 0x5f8 0x1f0003 Event
0x8163ff80 800 0x5fc 0x1f0003 Event
0x8163fef0 800 0x600 0x1f0003 Event
0x8163fe90 800 0x604 0x1f0003 Event
0xe167f4a8 800 0x608 0x1f0001 Port
0xe167fe20 800 0x60c 0x1f0001 Port
0x8163fe60 800 0x610 0x1f0003 Event
0x8163fba8 800 0x614 0x1f03ff Thread TID 1212 PID 800
0x815e6eb8 800 0x618 0x100003 Semaphore
0x8163ff20 800 0x61c 0x1f0003 Event
0x8163fef0 800 0x620 0x1f0003 Event
0x816ff5f0 800 0x624 0x20001 WmiGuid
0x816f7fa0 800 0x628 0x1f0003 Event
0x81579258 800 0x62c 0x1f0003 Event
0x815e6b90 800 0x630 0x100003 Semaphore
0xe167e0b0 800 0x634 0x1f0001 Port
0x81688158 800 0x638 0x100000 File \Device\LanmanRedirector
0x81627ae0 800 0x63c 0x100003 Semaphore
0x816ebe58 800 0x640 0x100000 File \Device\LanmanDatagramReceiver
0x81550608 800 0x644 0x100003 Semaphore
0x8163f778 800 0x648 0x12019f File \Device\NamedPipe\wkssvc
0x816023b8 800 0x64c 0x100003 Event
0x81602c70 800 0x650 0x478 Process userinit.exe(1268)
0xe166ddd0 800 0x654 0x1f0001 Port
0x8167a8e0 800 0x658 0x100003 Event
0x816f2b70 800 0x65c 0x478 Process explorer.exe(1284)
0xe168db50 800 0x660 0x1f0001 Port
0x816bea70 800 0x664 0x100003 Event
0xe1847ce0 800 0x668 0xc Token
0x8167e870 800 0x66c 0x1f0003 Event
0xe1845190 800 0x670 0x1f0001 Port
0x816f2b70 800 0x674 0x100068 Process explorer.exe(1284)
0x815e4b28 800 0x678 0x1f0001 Mutant
0x815e4b68 800 0x67c 0x1f0003 Event
0x815e0da8 800 0x680 0x1f03ff Thread TID 1328 PID 1284
0x81574da8 800 0x684 0x1f03ff Thread TID 1424 PID 800
0x815fab68 800 0x688 0x1f0003 Event
0xe1d8a9a8 800 0x68c 0x1f0001 Port
0xe1d946f8 800 0x690 0x1f0001 Port
0xe1c11768 800 0x694 0xc Token
0x815ed2d0 800 0x698 0x1f0003 Event
0x8167eda8 800 0x69c 0x1f03ff Thread TID 1528 PID 800
0x816b4ce8 800 0x6a0 0x12019f File \Device\NamedPipe\keysvc
0x816f7e88 800 0x6a4 0x12019f File \Device\NamedPipe\keysvc
0xe14bad38 800 0x6a8 0x1f0001 Port keysvc
0x81579648 800 0x6ac 0x1f0003 Event
0x815793d0 800 0x6b0 0x1f03ff Thread TID 1524 PID 800
0x815799c8 800 0x6b4 0x1f0001 Mutant 0CADFD67AF62496dB34264F000F5624A
0x81579978 800 0x6b8 0x1f0001 Mutant 4FCC0DEFE22C4f138FB9D5AF25FD9398
0x81579288 800 0x6bc 0x1f0003 Event
0x81579928 800 0x6c0 0x1f0001 Mutant 238FAD3109D3473aB4764B20B3731840
0x8167e5a8 800 0x6c4 0x1f03ff Thread TID 1536 PID 800
0x81579228 800 0x6c8 0x1f0003 Event
0x815792c0 800 0x6cc 0x12019f File \Device\NamedPipe\PCHHangRepExecPipe
0x8167e298 800 0x6d0 0x1f0003 Event
0xe1845ea0 800 0x6d4 0x20019 Key MACHINE\SOFTWARE\CLASSES
0x8167e900 800 0x6d8 0x1f0003 Event
0x8167e8a0 800 0x6dc 0x1f0003 Event
0x8167ea50 800 0x6e0 0x12019f File \Device\NamedPipe\PCHFaultRepExecPipe
0xe1bf69b8 800 0x6e4 0x20019 Key MACHINE\SOFTWARE\CLASSES
0x8167e2f8 800 0x6e8 0x1f0003 Event
0x8167e328 800 0x6ec 0x1f0003 Event
0xe18be120 800 0x6f0 0x20019 Key MACHINE\SOFTWARE\CLASSES
0xe1c1a998 800 0x6f4 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER
0xe1c1f7f0 800 0x6f8 0x20019 Key MACHINE\SOFTWARE\POLICIES
0x8167e4a8 800 0x6fc 0x100001 File \Device\HarddiskVolume1\WINDOWS\PCHealth\HelpCtr\BATCH
0x8167e268 800 0x700 0x1f0003 Event
0x8167e238 800 0x704 0x1f0003 Event
0x8167eb48 800 0x708 0x1f0003 Event
0x81685da8 800 0x70c 0x1f03ff Thread TID 1540 PID 800
0x81627bf8 800 0x710 0x100003 Semaphore
0x81627cd8 800 0x714 0x100003 Semaphore
0x816b2950 800 0x718 0xf01ff File \Device\LanmanServer
0x8167eb18 800 0x71c 0x1f0003 Event
0x8167eae8 800 0x720 0x1f0003 Event
0x81689bd8 800 0x724 0x100003 Event
0x815c9718 800 0x728 0x1f0003 Event
0x81689f30 800 0x72c 0x1f0003 Event
0x81689dd0 800 0x730 0x100020 File \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x815d1b50 800 0x734 0x21f0003 Event
0xe18c3ac8 800 0x738 0xf0007 Section AtlDebugAllocator_FileMappingNameStatic3_320
0xe18c3ac8 800 0x73c 0xf0007 Section AtlDebugAllocator_FileMappingNameStatic3_320
0x816727d0 800 0x740 0xa84 WmiGuid
0x815d1a88 800 0x744 0x1f0003 Event
0x816852f0 800 0x748 0xa84 WmiGuid
0x815ea320 800 0x74c 0x1f0003 IoCompletion
0x815c9eb8 800 0x750 0x100020 File \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x816fb110 800 0x754 0x100003 Semaphore PowerProfileRegistrySemaphore
0xe1bf7ae0 800 0x758 0x1f0001 Port
0x814f76b8 800 0x75c 0x1f0003 Event
0xe14b34f0 800 0x760 0x1f0001 Port SECLOGON
0x815c96e8 800 0x764 0x1f0003 Event
0x8169f8b8 800 0x768 0x1f03ff Thread TID 1588 PID 800
0x8164b748 800 0x76c 0x12019f File \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x8164b6b0 800 0x770 0x12019f File \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x816239a8 800 0x774 0x1f0003 Event SENS Started Event
0x815c9600 800 0x778 0x1f0003 Event
0xe167f330 800 0x77c 0xf0007 Section SENS Information Cache
0xe1c12890 800 0x780 0x20019 Key MACHINE\SOFTWARE\CLASSES
0xe18c3ac8 800 0x784 0xf0007 Section AtlDebugAllocator_FileMappingNameStatic3_320
0x815c9590 800 0x788 0x1f0003 Event
0xe1c128f8 800 0x78c 0x20019 Key MACHINE\SOFTWARE\CLASSES
0x816858b8 800 0x790 0x1f03ff Thread TID 1548 PID 800
0x81689758 800 0x794 0x1f0001 Mutant SRDataStore
0x815c95d0 800 0x798 0x1f0003 Event SRCounter
0x815c9b28 800 0x79c 0x1f0003 Event SRStopEvent
0x815c9b98 800 0x7a0 0x1f0003 Event SRInitEvent
0x815c9b58 800 0x7a4 0x1f0003 Event
0x815c9ae8 800 0x7a8 0x1f0003 Event SRIdleReqEvent
0x815c9e20 800 0x7ac 0x12019f File \Device\SystemRestore
0x81689758 800 0x7b0 0x100000 Mutant SRDataStore
0x8169fb78 800 0x7b4 0x12019f File \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x815c9a10 800 0x7b8 0x1f0003 Event NetmanClassObjectRegistrationEvent
0x815eb5b8 800 0x7bc 0x12019f File \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x8169f5f0 800 0x7c0 0x1f0003 Timer
0xe1c20bf0 800 0x7c4 0x20019 Key MACHINE\SOFTWARE\CLASSES
0x8169f5c0 800 0x7c8 0x1f0003 Event
0x8169f790 800 0x7cc 0x100180 File \Device\HarddiskVolume1
0x81685c98 800 0x7d0 0x1f0003 Event
0xe1c21020 800 0x7d4 0x20019 Key MACHINE\SOFTWARE\CLASSES
0xe1c21b30 800 0x7d8 0x20019 Key MACHINE\SOFTWARE\CLASSES
0x81685c68 800 0x7dc 0x1f0003 Event
0x815e8b30 800 0x7e0 0x1f0003 Event
0xe1c21b98 800 0x7e4 0xf003f Key MACHINE\SOFTWARE\MICROSOFT\EVENTSYSTEM\{26C409CC-AE86-11D1-B616-00805FC79216}
0xe15b0598 800 0x7e8 0x20019 Key MACHINE\SOFTWARE\CLASSES
0x815e8b00 800 0x7ec 0x1f0003 Event
0x8169f240 800 0x7f0 0x1f0003 Event
0x815e8ad0 800 0x7f4 0x1f0003 Event
0x815e8aa0 800 0x7f8 0x1f0003 Event
0x815e8a70 800 0x7fc 0x1f0003 Event
0x8160f368 800 0x804 0x1f0003 Event
0x8164fda8 800 0x808 0x1f03ff Thread TID 1592 PID 800
0x81685c30 800 0x80c 0x1f0003 Event W32TIME_NAMED_EVENT_SYSTIME_NOT_CORRECT
0x8160f298 800 0x810 0x1f0003 Event
0x8160f268 800 0x814 0x1f0003 Event
0x8160f238 800 0x818 0x1f0003 Event
0x8168b368 800 0x81c 0x1f0003 Event
0x8168b338 800 0x820 0x1f0003 Event
0x8169f828 800 0x824 0x12019f File \Device\NamedPipe\W32TIME
0x8169f500 800 0x828 0x12019f File \Device\NamedPipe\W32TIME
0x8168b278 800 0x82c 0x1f0003 Event
0x81618128 800 0x830 0x100000 Event userenv: Machine Group Policy has been applied
0x8164f3d0 800 0x834 0x1f03ff Thread TID 1604 PID 800
0x815cc230 800 0x838 0x1f0003 Event
0x815cc960 800 0x83c 0x1f03ff Thread TID 1608 PID 800
0x815cf2c8 800 0x840 0x1f0003 Event
0x815cc960 800 0x844 0x1f03ff Thread TID 1608 PID 800
0x8164fda8 800 0x848 0x1f03ff Thread TID 1592 PID 800
0x815ec278 800 0x84c 0x1f0003 Event
0x815cf238 800 0x850 0x1f01ff File \Device\Afd\Endpoint
0x815ee268 800 0x854 0x1f01ff File \Device\Udp
0x8164e250 800 0x858 0x1f0003 Event
0x815ec2a8 800 0x85c 0x1f0001 Mutant
0x815d9260 800 0x860 0x1f0003 Event
0x815d9290 800 0x864 0x1f0001 Mutant
0x815d9230 800 0x868 0x1f0003 Event
0x815cc6e8 800 0x86c 0x1f03ff Thread TID 1612 PID 800
0x81692c18 800 0x870 0x1f0003 Event
0xe1c21d68 800 0x874 0x20019 Key MACHINE\SOFTWARE\CLASSES
0x8164f330 800 0x878 0x1f0003 Event WINMGMT_COREDLL_CANSHUTDOWN
0x815d9308 800 0x87c 0x100001 File \Device\HarddiskVolume1\WINDOWS\system32\wbem\mof
0x8164f2f0 800 0x880 0x1f0003 Event WINMGMT_PROVIDER_CANSHUTDOWN
0x8164f2b0 800 0x884 0x1f0003 Event WMI_SysEvent_LodCtr
0x8164f270 800 0x888 0x1f0003 Event WMI_SysEvent_UnLodCtr
0x8164f230 800 0x88c 0x1f0003 Event WMI_RevAdap_Set
0x8169f480 800 0x890 0x1f0003 Event WMI_RevAdap_ACK
0x8169f440 800 0x894 0x1f0003 Event WMI_ProcessIdleTasksStart
0x8169f400 800 0x898 0x1f0003 Event WMI_ProcessIdleTasksComplete
0xe14b4f68 800 0x89c 0x1f0001 Port senssvc
0xe1c21618 800 0x8a0 0x20019 Key MACHINE\SOFTWARE\CLASSES
0x8169f350 800 0x8a4 0x1f0003 Event
0x816058b8 800 0x8a8 0x1f03ff Thread TID 1628 PID 800
0x8169f320 800 0x8ac 0x1f0003 Event
0x815c9f58 800 0x8b0 0x1f0001 WaitablePort TRKWKS_PORT
0x817bfcd0 800 0x8b4 0x1f0003 Event TRKWKS_EVENT
0x816855b0 800 0x8b8 0x12019f File \Device\NamedPipe\trkwks
0x81685440 800 0x8bc 0x12019f File \Device\NamedPipe\trkwks
0xe14b4af0 800 0x8c0 0x1f0001 Port trkwks
0x81692de0 800 0x8c4 0x1f0003 Event
0x815ccda8 800 0x8c8 0x1f03ff Thread TID 1632 PID 800
0x815ccd38 800 0x8cc 0x1f0003 Event
0xe15b0530 800 0x8d0 0x10 Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\EPOCH
0x815ccc98 800 0x8d4 0x1f0003 Event
0x81605b30 800 0x8d8 0x1f03ff Thread TID 1624 PID 800
0x81692db0 800 0x8dc 0x1f0003 Event
0x815ccc08 800 0x8e0 0x1f01ff File \Device\Afd\Endpoint
0x81605f90 800 0x8e4 0x1f01ff File \Device\Afd\Endpoint
0x8164fd18 800 0x8e8 0x1f01ff File \Device\Udp
0x81605dd0 800 0x8ec 0x1f0003 Event
0x8164fb70 800 0x8f0 0x1f0003 Event
0x8164fb40 800 0x8f4 0x1f0003 Event
0x81605b30 800 0x8f8 0x1f03ff Thread TID 1624 PID 800
0x8164f360 800 0x8fc 0x1f0003 Event
0x8164b580 800 0x900 0x12019f File \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x8164b4e8 800 0x904 0x12019f File \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x8164b618 800 0x908 0x12019f File \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x8164b450 800 0x90c 0x12019f File \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x8164b3b8 800 0x910 0x12019f File \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x8164b320 800 0x914 0x12019f File \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x8164b288 800 0x918 0x12019f File \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x81603f90 800 0x91c 0x12019f File \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x81603ef8 800 0x920 0x12019f File \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x81603e60 800 0x924 0x12019f File \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x81603dc8 800 0x928 0x12019f File \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x81603d30 800 0x92c 0x12019f File \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x81603c98 800 0x930 0x12019f File \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x81603c00 800 0x934 0x12019f File \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x81603b68 800 0x938 0x12019f File \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x81603ad0 800 0x93c 0x12019f File \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x81603a38 800 0x940 0x12019f File \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x816039a0 800 0x944 0x12019f File \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x81603908 800 0x948 0x12019f File \Device\HarddiskVolume1\WINDOWS\WindowsUpdate.log
0x81692d70 800 0x94c 0x1f0001 Mutant WindowsUpdateTracingMutex
0xe1c27540 800 0x950 0xc Token
0xe1c0d8a8 800 0x954 0x1f0001 Port
0x8169fb40 800 0x958 0x1f0003 Event
0x81624320 800 0x95c 0x1f03ff Thread TID 1476 PID 800
0x816b1400 800 0x960 0x100081 File \Device\HarddiskVolume1\$Extend\$ObjId
0x8164b210 800 0x964 0x1f0003 Event
0x815e3548 800 0x968 0x13019f File \Device\HarddiskVolume1\System Volume Information\tracking.log
0xe1aa5550 800 0x96c 0x1f0001 Port srrpc
0x81613ff0 800 0x970 0x1f0003 Event
0xe1c2cbd8 800 0x974 0x20019 Key MACHINE\SOFTWARE\CLASSES
0x815ebda8 800 0x978 0x1f03ff Thread TID 1644 PID 800
0x8162bc68 800 0x97c 0x100003 Semaphore
0x8162bca0 800 0x980 0x100003 Semaphore
0x8164ba20 800 0x984 0x1f0003 Event
0x8164b990 800 0x988 0x12019f File \Device\NamedPipe\srvsvc
0xe14b4538 800 0x98c 0x1f0001 Port XactSrvLpcPort
0x8164b828 800 0x990 0x12019f File \Device\NamedPipe\srvsvc
0xe1c2bda0 800 0x994 0x1f0001 Port
0x8164b958 800 0x998 0x21f0003 Event
0x81614778 800 0x99c 0x1f0003 Event
0x816033b8 800 0x9a0 0x1f03ff Thread TID 1664 PID 800
0x81614748 800 0x9a4 0x1f0003 Event
0xe1c260a8 800 0x9a8 0xf003f Key MACHINE\SOFTWARE\MICROSOFT\EVENTSYSTEM\{26C409CC-AE86-11D1-B616-00805FC79216}\SUBSCRIPTIONS
0x815eb880 800 0x9ac 0x1f0003 Event
0x81614200 800 0x9b0 0x1f03ff Thread TID 1688 PID 800
0xe1c2b330 800 0x9b4 0x1f0001 Port
0x815eb818 800 0x9b8 0x1f0003 Event
0x815eb8e8 800 0x9bc 0x1f0003 Event
0x815eba20 800 0x9c0 0x1f0003 Event
0x815eb9b8 800 0x9c4 0x1f0003 Event
0x815eb950 800 0x9c8 0x1f0003 Event
0x815ebaf0 800 0x9cc 0x1f0003 Event
0x815ebda8 800 0x9d0 0x1f03ff Thread TID 1644 PID 800
0x815eba88 800 0x9d4 0x1f0003 Event
0x815cc2a8 800 0x9d8 0x1f01ff File \Device\Afd\Endpoint
0xe1c197a0 800 0x9dc 0x3 Key MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\WINDOWSUPDATE\REPORTING
0x815ebc28 800 0x9e0 0x1f0003 Event
0xe1c259f8 800 0x9e4 0x20019 Key MACHINE\SOFTWARE\CLASSES
0x815ebda8 800 0x9e8 0x4a Thread TID 1644 PID 800
0x815ebb58 800 0x9ec 0x1f0003 Event
0x815eb8b0 800 0x9f0 0x1f0003 Semaphore
0x815eb9e8 800 0x9f4 0x1f0003 Semaphore
0x815eb980 800 0x9f8 0x1f0003 Semaphore
0x815ebc88 800 0x9fc 0x1f0003 Event
0x815ebc58 800 0xa00 0x1f0003 Event
0x815c9a48 800 0xa04 0x12019f File \Device\NamedPipe\wkssvc
0x815eb260 800 0xa08 0x1f0003 Event
0xe1c25a60 800 0xa0c 0x20019 Key MACHINE\SOFTWARE\CLASSES
0x81614718 800 0xa10 0x1f0003 Event
0x8168d290 800 0xa14 0x1f0003 Event
0x815efda8 800 0xa18 0x1f0003 Event
0x81608298 800 0xa1c 0x1f03ff Thread TID 820 PID 800
0x815efde0 800 0xa20 0x12019f File \Device\HarddiskVolume1\WINDOWS\SoftwareDistribution\ReportingEvents.log
0xe1c25b98 800 0xa24 0x20019 Key MACHINE\SOFTWARE\CLASSES
0xe1c25b30 800 0xa28 0x20019 Key MACHINE\SOFTWARE\CLASSES
0xe1c25ac8 800 0xa2c 0x3 Key MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\WINDOWSUPDATE\REPORTING\EVENTCACHE\SUS
0xe1c25990 800 0xa30 0x20019 Key MACHINE\SOFTWARE\CLASSES
0x8164c7a8 800 0xa34 0x1f0003 Event
0x815ef078 800 0xa38 0x1f0003 Event
0xe1c25da0 800 0xa3c 0x3 Key MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\WINDOWSUPDATE\REPORTING\EVENTCACHE\WU
0x8164c748 800 0xa40 0x1f0003 Event
0x8164c778 800 0xa44 0x1f0003 Event
0x8164c718 800 0xa48 0x1f0003 Event
0x8164c6e8 800 0xa4c 0x1f0003 Event
0x816fcff0 800 0xa50 0x1f0003 Event
0x816fcfc0 800 0xa54 0x1f0003 Event
0x816fcf90 800 0xa58 0x1f0003 Event
0xe1c25c00 800 0xa5c 0x20019 Key MACHINE\SOFTWARE\CLASSES
0xe1c25c68 800 0xa60 0xf003f Key MACHINE\SOFTWARE\MICROSOFT\EVENTSYSTEM\{26C409CC-AE86-11D1-B616-00805FC79216}\EVENTCLASSES
0xe1c2e020 800 0xa64 0x1f0001 Port
0xe1c20358 800 0xa68 0x20019 Key MACHINE\SOFTWARE\CLASSES
0xe1c25d38 800 0xa6c 0x20019 Key MACHINE\SYSTEM\SETUP
0x814f7688 800 0xa70 0x1f0003 Event
0x816fc2a8 800 0xa74 0x100003 Event
0x815efb30 800 0xa78 0x1f0003 Event
0x81608298 800 0xa7c 0x1f03ff Thread TID 820 PID 800
0x816fcc78 800 0xa80 0x1f0003 Event
0x815ebd18 800 0xa84 0x1f0003 Event
0x814f71a8 800 0xa88 0x1f03ff Thread TID 1736 PID 800
0x815c9b58 800 0xa90 0x1f0003 Event
0x815dc660 800 0xa94 0x1f03ff Thread TID 1056 PID 800
0x815c9718 800 0xa98 0x1f0003 Event
0xe1006e20 844 0x4 0x20003 KeyedEvent CritSecOutOfMemoryEvent
0xe14f3230 844 0x8 0x3 Directory KnownDlls
0x816216f0 844 0xc 0x100020 File \Device\HarddiskVolume1\WINDOWS\system32
0x815c48d8 844 0x10 0x100003 Semaphore
0xe14038f8 844 0x14 0xf000f Directory Windows
0xe18a4340 844 0x18 0x21f0001 Port
0x81639208 844 0x1c 0x100003 Semaphore
0xe14477d0 844 0x20 0x2000f Directory BaseNamedObjects
0x817064e8 844 0x24 0x1f0001 Mutant SHIMLIB_LOG_MUTEX
0xe18a42a0 844 0x28 0x2020019 Key MACHINE
0x8170c6b0 844 0x2c 0xf006e WindowStation Service-0x0-3e4$
0x815df938 844 0x30 0x21f0003 Event
0x81625c20 844 0x34 0xf00cf Desktop Default
0x8170c6b0 844 0x38 0xf006e WindowStation Service-0x0-3e4$
0x81618fc8 844 0x3c 0x100003 Semaphore
0x81612728 844 0x40 0x1f0003 Event
0x81618f90 844 0x44 0x100003 Semaphore
0xe18a59a0 844 0x48 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32
0x81618f60 844 0x4c 0x1f0003 Event
0x816128a8 844 0x50 0x100001 File \Device\KsecDD
0x81618f30 844 0x54 0x1f0003 Event
0xe18a5d10 844 0x58 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32
0x8162a930 844 0x5c 0x100002 Semaphore shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}
0x81618c88 844 0x60 0x1f0003 Event
0x816127b0 844 0x64 0x100020 File \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x816188d8 844 0x68 0x1f0003 Event
0x816188a8 844 0x6c 0x1f0003 Event
0x81618d78 844 0x70 0x12019f File \Device\NamedPipe\net\NtControlPipe5
0x81633ff0 844 0x74 0x1f0003 Event
0x81699550 844 0x78 0x1f03ff Thread TID 848 PID 844
0x81633f88 844 0x7c 0x1f0003 Event
0xe18a46f8 844 0x80 0x1f0001 Port
0x815dfd98 844 0x84 0x1200a0 File \Device\Tcp
0x816199c8 844 0x88 0x1200a0 File \Device\Ip
0x816cec20 844 0x8c 0x1200a0 File \Device\Ip
0x81633c98 844 0x90 0x100003 Semaphore
0x8160ce38 844 0x94 0x100003 Semaphore
0xe18be5e0 844 0x98 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\TCPIP\LINKAGE
0xe18c2500 844 0x9c 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS
0xe18c3b78 844 0xa0 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\NETBT\PARAMETERS\INTERFACES
0xe18c3b10 844 0xa4 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\NETBT\PARAMETERS
0x81619990 844 0xa8 0x1f0003 Event
0xe1c2d900 844 0xac 0x1f0001 Port
0x8160cef8 844 0xb0 0x1f0003 Event
0xe18c3a40 844 0xb4 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9
0x8160cdd0 844 0xb8 0x1f0003 Event
0xe18c39d8 844 0xbc 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5
0x8160cd68 844 0xc0 0x1f0003 Event
0x8160ca88 844 0xc4 0x1f0003 Event
0x8160caf0 844 0xc8 0x1f03ff Thread TID 900 PID 844
0x8160c810 844 0xcc 0x1f03ff Thread TID 904 PID 844
0x81644918 844 0xd0 0x100001 File \Device\HarddiskVolume1\WINDOWS\system32\drivers\etc
0x815efae0 844 0xd4 0x1f0003 Event
0x816fc620 844 0xd8 0x1f03ff Thread TID 1716 PID 844
0xe18c20e0 844 0xdc 0x1f0001 Port DNSResolver
0x81609a28 844 0xe0 0x1f0003 Event
0x816689a8 844 0xe4 0x1f03ff Thread TID 920 PID 844
0x816fc278 844 0xe8 0x1f0003 Event
0x816fc620 844 0xec 0x1f03ff Thread TID 1716 PID 844
0x816afc40 844 0xf0 0x1200a0 File \Device\Tcp
0x816fa1d8 844 0xf4 0x1200a0 File \Device\Udp
0x816afe50 844 0xf8 0x1f01ff File \Device\Afd\Endpoint
0x816fcbf8 844 0xfc 0x1f0003 Event
0xe1c2e7b0 844 0x100 0x1f0001 Port
0x816fcb48 844 0x104 0x1f0003 Event
0x814f78d0 844 0x108 0x1f03ff Thread TID 1732 PID 844
0xe1c25e08 844 0x10c 0x10 Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\EPOCH
0x815ef190 844 0x110 0x1f0003 Event
0x814f78d0 844 0x114 0x1f03ff Thread TID 1732 PID 844
0x815ef160 844 0x118 0x1f0003 Event
0x816aa1d0 844 0x11c 0x1f01ff File \Device\Afd\Endpoint
0x814f78d0 844 0x120 0x1f03ff Thread TID 1732 PID 844
0xe1006e20 876 0x4 0x20003 KeyedEvent CritSecOutOfMemoryEvent
0xe14f3230 876 0x8 0x3 Directory KnownDlls
0x81619720 876 0xc 0x100020 File \Device\HarddiskVolume1\WINDOWS\system32
0x81644f58 876 0x10 0x100003 Semaphore
0xe14038f8 876 0x14 0xf000f Directory Windows
0xe18be240 876 0x18 0x21f0001 Port
0x81644f90 876 0x1c 0x100003 Semaphore
0xe14477d0 876 0x20 0x2000f Directory BaseNamedObjects
0x817064e8 876 0x24 0x1f0001 Mutant SHIMLIB_LOG_MUTEX
0x81553328 876 0x28 0x1f03ff Thread TID 1512 PID 876
0x81709e10 876 0x2c 0xf037f WindowStation Service-0x0-3e5$
0x81644ec8 876 0x30 0x21f0003 Event
0x81644e20 876 0x34 0xf01ff Desktop Default
0x81709e10 876 0x38 0xf037f WindowStation Service-0x0-3e5$
0x81644c58 876 0x3c 0x100003 Semaphore
0x816fbb10 876 0x40 0x1f0003 Event
0x81644c20 876 0x44 0x100003 Semaphore
0xe18a9c30 876 0x48 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32
0x81644bb0 876 0x4c 0x1f0003 Event
0x81676810 876 0x50 0x100001 File \Device\KsecDD
0x81644b80 876 0x54 0x1f0003 Event
0xe18bf438 876 0x58 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32
0x8162a930 876 0x5c 0x100002 Semaphore shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}
0xe18bfda8 876 0x60 0x8 Token
0x81644af0 876 0x64 0x100020 File \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x815d2968 876 0x68 0x1f0003 Event
0x81644fe8 876 0x6c 0x100003 Semaphore
0x815d2930 876 0x70 0x100003 Semaphore
0x815d28f8 876 0x74 0x100003 Semaphore
0x815d28c0 876 0x78 0x100003 Semaphore
0x815d2888 876 0x7c 0x100003 Semaphore
0x815d2850 876 0x80 0x100003 Semaphore
0x815d2818 876 0x84 0x100003 Semaphore
0x815d27e0 876 0x88 0x100003 Semaphore
0x81609fe8 876 0x8c 0x100003 Semaphore
0x81609fb0 876 0x90 0x100003 Semaphore
0x81609f78 876 0x94 0x100003 Semaphore
0x81609f40 876 0x98 0x100003 Semaphore
0x81609ee0 876 0x9c 0x1f0003 Event
0x81609f10 876 0xa0 0x1f0003 Event
0x81609eb0 876 0xa4 0x1f0003 Event
0x81609e80 876 0xa8 0x1f0003 Event
0x817098c0 876 0xac 0x1f03ff Thread TID 880 PID 876
0xe18c3848 876 0xb0 0x1f0001 Port
0x81609e50 876 0xb4 0x1f0003 Event
0x815d2b58 876 0xb8 0x1f0003 IoCompletion
0x81633cf0 876 0xbc 0x12019f File \Device\NamedPipe\net\NtControlPipe6
0x815d2b10 876 0xc0 0x1f0003 IoCompletion
0x815d2b58 876 0xc4 0x1f0003 IoCompletion
0xe1a98bf8 876 0xc8 0x1f0001 Port
0x81639fc0 876 0xcc 0x1f0003 Event
0x816cea50 876 0xd0 0x1200a0 File \Device\Tcp
0x81668850 876 0xd4 0x1200a0 File \Device\Ip
0x816688e8 876 0xd8 0x1200a0 File \Device\Ip
0x8160cab8 876 0xdc 0x100003 Semaphore
0x81609aa8 876 0xe0 0x100003 Semaphore
0xe18c3668 876 0xe4 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\TCPIP\LINKAGE
0xe18c2320 876 0xe8 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS
0xe18c3970 876 0xec 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\NETBT\PARAMETERS\INTERFACES
0xe19f0bf8 876 0xf0 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\NETBT\PARAMETERS
0x81668818 876 0xf4 0x1f0003 Event
0x81615c18 876 0xf8 0x1f0003 Event
0x81615be8 876 0xfc 0x1f0003 Event
0x81615bb8 876 0x100 0x1f0003 Event
0x81615b88 876 0x104 0x1f0003 Event
0x81615b58 876 0x108 0x1f0003 Event
0x81615b28 876 0x10c 0x1f0003 Event
0x81668460 876 0x110 0x1f03ff Thread TID 936 PID 876
0x81668460 876 0x114 0x1f03ff Thread TID 936 PID 876
0x81615af8 876 0x118 0x1f0003 Event
0xe1900fb8 876 0x11c 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9
0x81615a90 876 0x120 0x1f0003 Event
0xe1978690 876 0x124 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5
0x815f0b38 876 0x128 0x1f03ff Thread TID 968 PID 876
0x8164cc40 876 0x12c 0x100003 File \Device\NetBt_Wins_Export
0x815f0a20 876 0x130 0x100003 File \Device\NetBt_Wins_Export
0x81553820 876 0x134 0x100000 File \Device\WebDavRedirector
0x815535a0 876 0x138 0x1f03ff Thread TID 1508 PID 876
0x816b77e8 876 0x13c 0x100020 File \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x815fbeb8 876 0x140 0x1f0003 Event
0x81624f28 876 0x144 0x1f0003 Event
0xe1d97e68 876 0x148 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_PROTOCOL_LOCKDOWN
0xe1bf6880 876 0x14c 0x2001f Key USER\S-1-5-19\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
0x816b59a8 876 0x150 0x12019f File \Device\WMIDataDevice
0x815faea8 876 0x154 0x1f0003 Event
0x81624e10 876 0x158 0xa84 WmiGuid
0x81624290 876 0x15c 0x12019f File \Device\WMIDataDevice
0x815fae78 876 0x160 0x1f0003 Event
0x81709b78 876 0x164 0x1f07fb Process svchost.exe(876)
0x81683020 876 0x168 0x1f0003 Event
0x81683080 876 0x16c 0x1f0003 Event
0x816073c8 876 0x170 0xa84 WmiGuid
0x81630080 876 0x174 0x100003 Event
0x815e7f90 876 0x178 0x100020 File \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x815e7e60 876 0x184 0x100000 File \Device\WebDavRedirector
0x815e7ef8 876 0x188 0x100000 File \Device\WebDavRedirector
0x815e74b0 876 0x18c 0x100002 Semaphore shell.{210A4BA0-3AEA-1069-A2D9-08002B30309D}
0xe1c237a8 876 0x190 0x20019 Key USER\S-1-5-19\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
0x816072f0 876 0x194 0xa84 WmiGuid
0xe1bf5ca0 876 0x198 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
0xe1a592f0 876 0x19c 0x20019 Key MACHINE\SOFTWARE\POLICIES
0xe1bc7368 876 0x1a0 0x20019 Key USER\S-1-5-19\SOFTWARE\POLICIES
0xe1bc7300 876 0x1a4 0x20019 Key USER\S-1-5-19\SOFTWARE
0xe1bc7298 876 0x1a8 0x20019 Key MACHINE\SOFTWARE
0xe1c1aae0 876 0x1ac 0x1f0001 Port
0x816f7638 876 0x1b0 0x12019f File \Device\HarddiskVolume1\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat
0x815d8108 876 0x1b4 0x1f0001 Mutant _!MSFTHISTORY!_
0x815fa030 876 0x1b8 0x1f0001 Mutant c:!documents and settings!localservice!local settings!temporary internet files!content.ie5!
0xe1bc7250 876 0x1bc 0xf0007 Section C:_Documents and Settings_LocalService_Local Settings_Temporary Internet Files_Content.IE5_index.dat_32768
0x816f75a0 876 0x1c0 0x12019f File \Device\HarddiskVolume1\Documents and Settings\LocalService\Cookies\index.dat
0x815cf030 876 0x1c4 0x1f0001 Mutant c:!documents and settings!localservice!cookies!
0xe1c1a950 876 0x1c8 0xf0007 Section C:_Documents and Settings_LocalService_Cookies_index.dat_16384
0x815538b8 876 0x1cc 0x12019f File \Device\HarddiskVolume1\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat
0x8169b260 876 0x1d0 0x1f0001 Mutant c:!documents and settings!localservice!local settings!history!history.ie5!
0xe1c1a8e8 876 0x1d4 0xf0007 Section C:_Documents and Settings_LocalService_Local Settings_History_History.IE5_index.dat_16384
0x816f7238 876 0x1d8 0x1f0001 Mutant
0x816d4ea0 876 0x1dc 0x1f0001 Mutant WininetStartupMutex
0x815f70a8 876 0x1e0 0x1f0003 Event
0x816b2aa0 876 0x1e4 0x1f0001 Mutant WininetProxyRegistryMutex
0x81627920 876 0x1e8 0x100003 Semaphore
0x81627c30 876 0x1ec 0x100003 Semaphore
0x81553298 876 0x1f0 0x100000 File \Device\WebDavRedirector
0x81579f90 876 0x1f4 0x12019f File \Device\NamedPipe\DAV RPC SERVICE
0x81579ef8 876 0x1f8 0x12019f File \Device\NamedPipe\DAV RPC SERVICE
0x816398e8 876 0x1fc 0x1f0003 Event
0x81579c78 876 0x200 0x1f03ff Thread TID 1516 PID 876
0xe1006e20 1172 0x4 0xf0003 KeyedEvent CritSecOutOfMemoryEvent
0xe14f3230 1172 0x8 0x3 Directory KnownDlls
0x81672c90 1172 0xc 0x100020 File \Device\HarddiskVolume1\WINDOWS\system32
0x81680408 1172 0x10 0x100003 Semaphore
0xe14038f8 1172 0x14 0xf000f Directory Windows
0xe1c65e18 1172 0x18 0x21f0001 Port
0x81669c00 1172 0x1c 0x100003 Semaphore
0xe14477d0 1172 0x20 0x2000f Directory BaseNamedObjects
0x817064e8 1172 0x24 0x1f0001 Mutant SHIMLIB_LOG_MUTEX
0xe17c1aa0 1172 0x28 0x20f003f Key MACHINE
0x815fdbf0 1172 0x2c 0xf037f WindowStation WinSta0
0x81573b98 1172 0x30 0x21f0003 Event
0x816db158 1172 0x34 0xf01ff Desktop Default
0x815fdbf0 1172 0x38 0xf037f WindowStation WinSta0
0x81573a30 1172 0x3c 0x100003 Semaphore
0x816eb5d0 1172 0x40 0x1f0003 Event
0x815739f8 1172 0x44 0x100003 Semaphore
0xe1679f90 1172 0x48 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32
0x81692380 1172 0x4c 0x1f0003 Event DINPUTWINMM
0x816fb150 1172 0x50 0x100001 File \Device\KsecDD
0x81573988 1172 0x54 0x1f0003 Event
0x81573958 1172 0x58 0x1f0003 Event
0xe1bcf5e8 1172 0x5c 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32
0x8162a930 1172 0x60 0x1f0003 Semaphore shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}
0x817cb720 1172 0x64 0x1f0003 Event userenv: User Profile setup event
0x816a5e70 1172 0x68 0x100020 File \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x815ce158 1172 0x6c 0x12019f File \Device\NamedPipe\net\NtControlPipe7
0x81574c78 1172 0x70 0x1f0003 Event
0x81574b38 1172 0x74 0x1f0003 Event
0x81574b08 1172 0x78 0x1f0003 Event
0x81574ad8 1172 0x7c 0x1f0003 Event
0x8164a488 1172 0x80 0x1f03ff Thread TID 1176 PID 1172
0x81574a70 1172 0x84 0x1f0003 Event
0xe16764f8 1172 0x88 0x1f0001 Port
0x81574678 1172 0x8c 0x1f0003 Event
0xe1679df8 1172 0x90 0x20f003f Key MACHINE\SOFTWARE\CLASSES
0x81574648 1172 0x94 0x1f0003 Event
0x815746a8 1172 0x98 0x1f03ff Thread TID 1180 PID 1172
0x81574618 1172 0x9c 0x1f0003 Event RouterPreInitEvent
0x81621780 1172 0xa0 0x1f0003 IoCompletion
0x81692ef0 1172 0xa4 0x1f0003 IoCompletion
0x81621780 1172 0xa8 0x1f0003 IoCompletion
0x816f1158 1172 0xac 0x12019f File \Device\NamedPipe\spoolss
0x816f4160 1172 0xb0 0x12019f File \Device\NamedPipe\spoolss
0x81574568 1172 0xb4 0x1f0003 Event
0x815b8da8 1172 0xb8 0x1f03ff Thread TID 1184 PID 1172
0xe1679ac0 1172 0xbc 0x1f0001 Port spoolss
0x81574468 1172 0xc0 0x1f0003 Event
0x815b8b30 1172 0xc4 0x1f03ff Thread TID 1188 PID 1172
0x815b8810 1172 0xc8 0x21f0003 Event
0x815b8438 1172 0xcc 0x21f0003 Event
0xe1006e20 1268 0x4 0xf0003 KeyedEvent CritSecOutOfMemoryEvent
0xe14f3230 1268 0x8 0x3 Directory KnownDlls
0x815e78a8 1268 0xc 0x100020 File \Device\HarddiskVolume1\Documents and Settings\testuser
0x816178a0 1268 0x10 0x21f0003 Event
0xe14038f8 1268 0x14 0xf000f Directory Windows
0xe167e6f0 1268 0x18 0x21f0001 Port
0x815fdbf0 1268 0x1c 0xf037f WindowStation WinSta0
0xe14477d0 1268 0x20 0x2000f Directory BaseNamedObjects
0x817064e8 1268 0x24 0x1f0001 Mutant SHIMLIB_LOG_MUTEX
0x816db158 1268 0x28 0xf01ff Desktop Default
0x815fdbf0 1268 0x2c 0xf037f WindowStation WinSta0
0x816028b0 1268 0x30 0x100003 Semaphore
0x816024a8 1268 0x34 0x100003 Semaphore
0xe18c4118 1268 0x38 0x20f003f Key MACHINE
0x8167d2c8 1268 0x3c 0x100000 Event crypt32LogoffEvent
0x815e9f30 1268 0x40 0x1f0003 Event
0x81673ee0 1268 0x44 0x1f0003 Event
0x81602500 1268 0x48 0x100003 Semaphore
0x81673ea8 1268 0x4c 0x100003 Semaphore
0xe1cb5308 1268 0x50 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32
0x81602f90 1268 0x54 0x100001 File \Device\KsecDD
0x81673df8 1268 0x58 0x1f0003 Event
0x81673dc8 1268 0x5c 0x1f0003 Event
0xe1cb5230 1268 0x60 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32
0x8162a930 1268 0x64 0x1f0003 Semaphore shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}
0x817cb720 1268 0x68 0x1f0003 Event userenv: User Profile setup event
0x8167ad68 1268 0x6c 0x100020 File \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0xe167a160 1268 0x70 0x1f0001 Port
0xe18bb388 1268 0x74 0x4 Section
0xe166df40 1268 0x78 0x20f003f Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004
0x81623da8 1268 0x7c 0x1f03ff Thread TID 1360 PID 1268
0x81692e80 1268 0x80 0x1f0003 Event
0x816233e8 1268 0x84 0x120001 Mutant ShimCacheMutex
0xe17ef118 1268 0x88 0x2 Section ShimSharedMemory
0x81611640 1268 0x90 0x1f0003 Event ShellReadyEvent
0xe1a8af68 1268 0x94 0x1f0001 Port
0x81623da8 1268 0x98 0x1f03ff Thread TID 1360 PID 1268
0x8162b820 1268 0x9c 0x1f0003 Event
0x8162b960 1268 0xa0 0x1f0003 Event
0x81615948 1268 0xa4 0x1f0003 Event
0x815f87b8 1268 0xa8 0x1f0003 Event
0x81602928 1268 0xac 0x1f03ff Thread TID 1272 PID 1268
0x815dfe88 1268 0xb0 0x1f0003 IoCompletion
0x815dfa80 1268 0xb4 0x1f0003 IoCompletion
0x815dfe88 1268 0xb8 0x1f0003 IoCompletion
0xe1006e20 1284 0x4 0xf0003 KeyedEvent CritSecOutOfMemoryEvent
0xe14f3230 1284 0x8 0x3 Directory KnownDlls
0x8167aa30 1284 0xc 0x100020 File \Device\HarddiskVolume1\Documents and Settings\testuser
0x816e0210 1284 0x10 0x100003 Semaphore
0xe14038f8 1284 0x14 0xf000f Directory Windows
0xe167cc50 1284 0x18 0x21f0001 Port
0x817cafe8 1284 0x1c 0x100003 Semaphore
0x817064e8 1284 0x20 0x1f0001 Mutant SHIMLIB_LOG_MUTEX
0xe14477d0 1284 0x24 0x2000f Directory BaseNamedObjects
0xe1670990 1284 0x28 0x20f003f Key MACHINE
0x815fdbf0 1284 0x2c 0xf037f WindowStation WinSta0
0x815f57e8 1284 0x30 0x21f0003 Event
0x816db158 1284 0x34 0xf01ff Desktop Default
0x815fdbf0 1284 0x38 0xf037f WindowStation WinSta0
0x8167a918 1284 0x3c 0x100001 File \Device\KsecDD
0x8162a930 1284 0x40 0x1f0003 Semaphore shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}
0x815d4988 1284 0x44 0x100020 File \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x81688328 1284 0x48 0x100020 File \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x8167d2c8 1284 0x4c 0x100000 Event crypt32LogoffEvent
0xe167ca48 1284 0x50 0x20f003f Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004_CLASSES
0xe167c380 1284 0x54 0x20f003f Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004
0x815f6a38 1284 0x58 0x1f0003 Event
0x8160d8e8 1284 0x5c 0x1f0003 Event
0xe167c118 1284 0x60 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_PROTOCOL_LOCKDOWN
0xe168b4a0 1284 0x64 0x2001f Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
0x81632cd8 1284 0x68 0x12019f File \Device\WMIDataDevice
0x8160d888 1284 0x6c 0x1f0003 Event
0x816804d0 1284 0x70 0xa84 WmiGuid
0x815f4588 1284 0x74 0x12019f File \Device\WMIDataDevice
0x816ab970 1284 0x78 0x1f0003 Event
0x816f2b70 1284 0x7c 0x1f0fff Process explorer.exe(1284)
0x815f4550 1284 0x80 0x1f0003 Event
0x815f4520 1284 0x84 0x1f0003 Event
0x816ab9a0 1284 0x88 0xa84 WmiGuid
0x8170c3b8 1284 0x8c 0x100003 Event
0x816005e0 1284 0x90 0x100020 File \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x8162c500 1284 0x94 0x1f0001 Mutant
0x816005a8 1284 0x98 0x1f0003 Event
0x8162c468 1284 0x9c 0x1f0001 Mutant
0x8162c438 1284 0xa0 0x1f0003 Event
0x815d6ff0 1284 0xa4 0x1f0003 Event
0x815d6fc0 1284 0xa8 0x1f0003 Event
0x815d6f30 1284 0xac 0x100020 File \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x815d6e98 1284 0xb0 0x100020 File \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x8170c428 1284 0xb4 0x100003 Semaphore
0x8167bb90 1284 0xb8 0x100020 File \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x8167ba08 1284 0xbc 0x1f0003 Event
0x816beb40 1284 0xc0 0x100003 Semaphore
0xe168b360 1284 0xc4 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32
0x816bead0 1284 0xc8 0x1f0003 Event
0x816beaa0 1284 0xcc 0x1f0003 Event
0xe168df40 1284 0xd0 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON
0x817cb720 1284 0xd4 0x1f0003 Event userenv: User Profile setup event
0xe167c878 1284 0xd8 0x1f0001 Port
0x8167bac8 1284 0xdc 0x100020 File \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0xe18bb388 1284 0xe0 0x4 Section
0xe168dde8 1284 0xe4 0xf003f Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER
0x815744a8 1284 0xe8 0x1f0001 Mutant ExplorerIsShellMutex
0x816233e8 1284 0xec 0x120001 Mutant ShimCacheMutex
0xe17ef118 1284 0xf0 0x2 Section ShimSharedMemory
0x815e74b0 1284 0xf4 0x1f0003 Semaphore shell.{210A4BA0-3AEA-1069-A2D9-08002B30309D}
0xe168dd80 1284 0xf8 0xf003f Key MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER
0xe17badb0 1284 0xfc 0xf003f Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER
0xe1696c48 1284 0x100 0xf003f Key MACHINE\SOFTWARE\CLASSES
0xe1695a58 1284 0x104 0xf003f Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004_CLASSES
0x81695638 1284 0x108 0x1f0003 Event
0xe1696670 1284 0x10c 0xf003f Key MACHINE\SOFTWARE\MICROSOFT\COM3
0x81709528 1284 0x110 0x1f0003 Event
0xe16a08f8 1284 0x114 0x10 Key USER
0x817094c0 1284 0x118 0x1f0003 Event
0xe16a0890 1284 0x11c 0xf003f Key MACHINE\SOFTWARE\CLASSES
0x81709458 1284 0x120 0x1f0003 Event
0xe16a0828 1284 0x124 0x10 Key USER
0x817093f0 1284 0x128 0x1f0003 Event
0xe16a07c0 1284 0x12c 0xf003f Key MACHINE\SOFTWARE\MICROSOFT\COM3
0x81709388 1284 0x130 0x1f0003 Event
0xe16a0758 1284 0x134 0xf003f Key MACHINE\SOFTWARE\MICROSOFT\COM3
0x81707a68 1284 0x138 0x1f0003 Event
0xe16a06f0 1284 0x13c 0xf003f Key MACHINE\SOFTWARE\CLASSES\CLSID
0x81707a00 1284 0x140 0x1f0003 Event
0xe16a0688 1284 0x144 0xf003f Key MACHINE\SOFTWARE\CLASSES
0x81707998 1284 0x148 0x1f0003 Event
0xe17bafb8 1284 0x14c 0xf003f Key MACHINE\SOFTWARE\MICROSOFT\COM3
0x81707930 1284 0x150 0x1f0003 Event
0xe17baf50 1284 0x154 0x10 Key USER
0x817078c8 1284 0x158 0x1f0003 Event
0xe17baee8 1284 0x15c 0xf003f Key MACHINE\SOFTWARE\MICROSOFT\COM3
0x816f2538 1284 0x160 0x1f0003 Event
0xe17bae80 1284 0x164 0xf003f Key MACHINE\SOFTWARE\MICROSOFT\COM3
0x816f24d0 1284 0x168 0x1f0003 Event
0xe17bae18 1284 0x16c 0xf003f Key MACHINE\SOFTWARE\CLASSES\CLSID
0x816f2468 1284 0x170 0x1f0003 Event
0x815cdf90 1284 0x174 0x1f0003 Semaphore shell.{090851A5-EB96-11D2-8BE4-00C04FA31A66}
0xe183a8f8 1284 0x178 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004_CLASSES
0x81695698 1284 0x17c 0x1f0001 Mutant
0x816be608 1284 0x180 0x100020 File \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x815cdec0 1284 0x184 0x100020 File \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0xe183a890 1284 0x188 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004_CLASSES
0x8162a930 1284 0x18c 0x1f0003 Semaphore shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}
0xe183a768 1284 0x190 0x2001f Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004\SOFTWARE\MICROSOFT\PLUS!\THEMES\APPLY
0x815e7110 1284 0x194 0x1f0003 Semaphore shell.{7CB834F0-527B-11D2-9D1F-0000F805CA57}
0xe17ba8a8 1284 0x198 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004_CLASSES
0xe168d808 1284 0x19c 0x1f0001 Port
0xe17baaf0 1284 0x1a0 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004_CLASSES
0x816f23a0 1284 0x1a4 0x1f0003 Event
0x815cde30 1284 0x1a8 0x1f0003 Event
0x815cddd0 1284 0x1ac 0x1f0003 Event
0x815cdb30 1284 0x1b0 0x1f0003 Event
0x816f28f8 1284 0x1b4 0x1f03ff Thread TID 1288 PID 1284
0xe183bf68 1284 0x1b8 0x1f0001 Port
0x815cdb00 1284 0x1bc 0x1f0003 Event
0x815cdc28 1284 0x1c0 0x1f0003 IoCompletion
0xe14bd908 1284 0x1c4 0x1f0001 Port OLE233A7A1F89E142CCBCAE13A687F3
0x815cda88 1284 0x1c8 0x1f0003 IoCompletion
0x815cdc28 1284 0x1cc 0x1f0003 IoCompletion
0x815cd7b0 1284 0x1d0 0x1f03ff Thread TID 1296 PID 1284
0x815cda58 1284 0x1d4 0x1f0003 Event
0x815cda28 1284 0x1d8 0x1f0003 Event
0xe1845f08 1284 0x1dc 0x2001b Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY\P3GLOBAL
0xe1846c08 1284 0x1e0 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004_CLASSES
0x815cd3e8 1284 0x1e4 0x1f0003 Event
0x816f6da8 1284 0x1e8 0x1f03ff Thread TID 1304 PID 1284
0x815cd378 1284 0x1ec 0x21f0003 Event
0x815cd2b8 1284 0x1f0 0x1f0003 Event
0x81573e88 1284 0x1f4 0x1f0003 Timer
0x816f6d78 1284 0x1f8 0x21f0003 Event
0xe17ba670 1284 0x1fc 0x1b Key MACHINE\SOFTWARE\CLASSES\HTTP\SHELL
0x816f6ae0 1284 0x200 0x1f03ff Thread TID 1308 PID 1284
0x816f6a98 1284 0x204 0x1f0003 IoCompletion
0x816f6708 1284 0x208 0x1f0003 Timer
0x816f6470 1284 0x20c 0x1f03ff Thread TID 1316 PID 1284
0xe183c1b8 1284 0x210 0xf0007 Section SatoriCodeDictionarySharedMemory_S-1-5-21-1957994488-2052111302-1078081533-1004
0x815ce930 1284 0x214 0x1f0003 Event
0x8163f698 1284 0x218 0x1f0001 Mutant _Satori_81_MutexObject_S-1-5-21-1957994488-2052111302-1078081533-1004
0xe17ba6f8 1284 0x21c 0xf0007 Section Imejp.ConfigrationIO_3_Satori_81__S-1-5-21-1957994488-2052111302-1078081533-1004
0x815cee10 1284 0x220 0x1f0001 Mutant _Satori_81_Satori_KnlDict_DicWriteMutex_S-1-5-21-1957994488-2052111302-1078081533-1004
0x8163f698 1284 0x224 0x1f0001 Mutant _Satori_81_MutexObject_S-1-5-21-1957994488-2052111302-1078081533-1004
0xe183b5f8 1284 0x228 0xf0007 Section FileView__Satori_PropMgrGlobal_Satori_81___00005bcc_S-1-5-21-1957994488-2052111302-1078081533-1004
0xe17ba6f8 1284 0x22c 0xf0007 Section Imejp.ConfigrationIO_3_Satori_81__S-1-5-21-1957994488-2052111302-1078081533-1004
0xe183c030 1284 0x230 0xf0007 Section
0xe183c630 1284 0x234 0x20f003f Key USER
0xe183cce8 1284 0x238 0xf0007 Section SatoriKnlDict_MemoryDictionary_S-1-5-21-1957994488-2052111302-1078081533-1004
0x815cdd40 1284 0x23c 0x12019f File \Device\HarddiskVolume1\Documents and Settings\testuser\Application Data\Microsoft\IMJP8_1\imjp81u.dic
0x816f2310 1284 0x240 0x12019f File \Device\NamedPipe\lsarpc
0xe183b5f8 1284 0x244 0xf0007 Section FileView__Satori_PropMgrGlobal_Satori_81___00005bcc_S-1-5-21-1957994488-2052111302-1078081533-1004
0x8163f698 1284 0x248 0x1f0001 Mutant _Satori_81_MutexObject_S-1-5-21-1957994488-2052111302-1078081533-1004
0xe17ba6f8 1284 0x24c 0xf0007 Section Imejp.ConfigrationIO_3_Satori_81__S-1-5-21-1957994488-2052111302-1078081533-1004
0x815ce868 1284 0x250 0x1f0001 Mutant Mutex__Satori_GlobalFlag_Satori_81__S-1-5-21-1957994488-2052111302-1078081533-1004
0xe183b530 1284 0x254 0xf0007 Section FileView__Satori_GlobalFlag_Satori_81___00000008_S-1-5-21-1957994488-2052111302-1078081533-1004
0xe183c130 1284 0x258 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE
0xe183e768 1284 0x25c 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE\ALTERNATE SORTS
0xe183e700 1284 0x260 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS
0xe1845b58 1284 0x264 0x1f0001 Port
0xe1841458 1284 0x268 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004_CLASSES
0x816842e0 1284 0x26c 0x1f0003 Event
0x815e0da8 1284 0x270 0x2 Thread TID 1328 PID 1284
0x815ceb70 1284 0x274 0x100001 File \Device\HarddiskVolume1\Documents and Settings\testuser\繝・せ繧ｯ繝医ャ繝・0x815e4d78 1284 0x278 0x1f0003 Event
0x816f63f8 1284 0x27c 0x1f0003 Semaphore
0x815e4d48 1284 0x280 0x21f0003 Event
0x815e0da8 1284 0x284 0x1f03ff Thread TID 1328 PID 1284
0x815e4cd8 1284 0x288 0x1f0003 Event
0x815e4a58 1284 0x28c 0x100001 File \Device\HarddiskVolume1\Documents and Settings\All Users\繝・せ繧ｯ繝医ャ繝・0x815e4500 1284 0x290 0x1f0003 Event
0xe18442f0 1284 0x294 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004_CLASSES
0xe1846e48 1284 0x298 0x1f0001 Port
0x815ce2c0 1284 0x29c 0x1f0003 Event
0x815e49c0 1284 0x2a0 0x100001 File \Device\HarddiskVolume1\Documents and Settings\testuser\Local Settings\Application Data\Microsoft\CD Burning
0xe1846fb8 1284 0x2a4 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004_CLASSES
0x815e4910 1284 0x2a8 0x1f0001 Mutant CTF.LBES.MutexDefaultS-1-5-21-1957994488-2052111302-1078081533-1004
0x815e4460 1284 0x2ac 0x1f0003 Event
0xe1846cd8 1284 0x2b0 0x1f0001 Port
0x815e4308 1284 0x2b4 0x1f0001 Mutant CTF.Compart.MutexDefaultS-1-5-21-1957994488-2052111302-1078081533-1004
0xe1847fd8 1284 0x2b8 0xf0007 Section CiceroSharedMemDefaultS-1-5-21-1957994488-2052111302-1078081533-1004
0x815e4ec8 1284 0x2bc 0x1f0001 Mutant CTF.Asm.MutexDefaultS-1-5-21-1957994488-2052111302-1078081533-1004
0x815e4e78 1284 0x2c0 0x1f0001 Mutant CTF.Layouts.MutexDefaultS-1-5-21-1957994488-2052111302-1078081533-1004
0x815e4e28 1284 0x2c4 0x1f0001 Mutant CTF.TMD.MutexDefaultS-1-5-21-1957994488-2052111302-1078081533-1004
0xe1847b48 1284 0x2c8 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004_CLASSES
0x815e07f0 1284 0x2cc 0x1f0001 Mutant
0x815e44b0 1284 0x2d0 0x1f0003 Event
0xe18494f8 1284 0x2d4 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004_CLASSES
0xe1849490 1284 0x2d8 0x2001d Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY\P3SITES
0x815e07c0 1284 0x2dc 0x1f0003 Event
0x815e0790 1284 0x2e0 0x1f0003 Event
0xe1842288 1284 0x2e4 0xf003f Key MACHINE\SOFTWARE\CLASSES\CLSID
0x815cd438 1284 0x2e8 0x21f0003 Event
0xe1bce740 1284 0x2ec 0xf003f Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FILEEXTS
0xe17e6fb8 1284 0x2f0 0xf003f Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004\SOFTWARE\MICROSOFT\WINDOWS\SHELL
0xe17e6dc8 1284 0x2f4 0xf003f Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004\SOFTWARE\MICROSOFT\WINDOWS\SHELLNOROAM
0xe17e6d60 1284 0x2f8 0xf003f Key MACHINE\SOFTWARE\CLASSES\APPLICATIONS\EXPLORER.EXE
0xe17e6bd8 1284 0x2fc 0xf003f Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004\SOFTWARE\MICROSOFT\WINDOWS\SHELLNOROAM\MUICACHE
0xe1d6f418 1284 0x300 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004\SOFTWARE\MICROSOFT\WINDOWS\SHELL\BAGS\1\DESKTOP
0xe1d73758 1284 0x304 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004_CLASSES
0x81616388 1284 0x308 0x1f0003 Semaphore
0xe1d77370 1284 0x30c 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004_CLASSES
0x8162a930 1284 0x310 0x1f0003 Semaphore shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}
0xe1d82bd8 1284 0x314 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004_CLASSES
0xe1d86430 1284 0x318 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004_CLASSES
0x816b92d8 1284 0x31c 0x12019f File \Device\NamedPipe\samr
0x81617d80 1284 0x320 0x1f0003 Event
0x816179c0 1284 0x324 0x1f0003 Event
0x8163f020 1284 0x328 0x1f0001 Mutant
0x8163f118 1284 0x32c 0x1f0003 Event
0x8163f0e8 1284 0x330 0x1f0003 Event
0x8163f0a8 1284 0x334 0x1f0001 Mutant
0x8163f078 1284 0x338 0x1f0003 Event
0x815d5520 1284 0x33c 0x1f0001 Mutant
0x815d54b0 1284 0x340 0x1f0003 Event
0xe1d8e020 1284 0x344 0x1f0001 Port
0x81602418 1284 0x348 0x21f0003 Event
0x816c32a0 1284 0x34c 0x100003 Event
0x8177fa08 1284 0x350 0x100020 File \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x815e9b38 1284 0x354 0x1f03ff Thread TID 1336 PID 1284
0x8168cd40 1284 0x358 0x1f0003 Event
0xe1d89578 1284 0x35c 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELL EXTENSIONS\BLOCKED
0xe1d863c8 1284 0x360 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELL EXTENSIONS\BLOCKED
0xe1d920a8 1284 0x364 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELL EXTENSIONS\CACHED
0xe1d94f40 1284 0x368 0x2001f Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELL EXTENSIONS\CACHED
0x81573540 1284 0x36c 0x1f03ff Thread TID 1348 PID 1284
0x816c9958 1284 0x370 0x1f0003 Event
0xe1bff4d0 1284 0x374 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004_CLASSES
0xe1d97ac0 1284 0x378 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004_CLASSES
0xe1aa6bc8 1284 0x37c 0xf0007 Section AtlDebugAllocator_FileMappingNameStatic3_504
0x8163d0b0 1284 0x380 0x100001 File \Device\HarddiskVolume1\Documents and Settings\All Users\繧ｹ繧ｿ繝ｼ繝・繝｡繝九Η繝ｼ
0xe1d97b90 1284 0x384 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004_CLASSES
0x8161bb48 1284 0x388 0x100001 File \Device\HarddiskVolume1\Documents and Settings\testuser\繧ｹ繧ｿ繝ｼ繝・繝｡繝九Η繝ｼ
0xe1bf9e40 1284 0x38c 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004_CLASSES
0x8162bd80 1284 0x390 0x1f0003 Semaphore
0x816fb028 1284 0x394 0x100003 File \Device\Ip
0x8162bd48 1284 0x398 0x1f0003 Semaphore
0xe1d771e0 1284 0x39c 0x10003 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERASSIST\{75048700-EF1F-11D0-9888-006097DEACF9}\COUNT
0xe1aa6bc8 1284 0x3a0 0xf0007 Section AtlDebugAllocator_FileMappingNameStatic3_504
0xe1d97bf8 1284 0x3a4 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004_CLASSES
0xe1bff8e0 1284 0x3a8 0x10003 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERASSIST\{5E6AB780-7743-11CF-A12B-00AA004AE837}\COUNT
0x8167a380 1284 0x3ac 0x1f0003 Event
0x81615828 1284 0x3b0 0x1f0003 Event
0x816c75c0 1284 0x3b4 0x100020 File \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x816ff728 1284 0x3b8 0xa84 WmiGuid
0x816ee8d0 1284 0x3bc 0xa84 WmiGuid
0x81600670 1284 0x3c0 0xa84 WmiGuid
0x81604f48 1284 0x3c4 0xa84 WmiGuid
0x81606f48 1284 0x3c8 0xa84 WmiGuid
0x816cc068 1284 0x3cc 0xa84 WmiGuid
0x815f8500 1284 0x3d0 0x1200a0 File \Device\Tcp
0x8164cea8 1284 0x3d4 0xa84 WmiGuid
0x81675dd0 1284 0x3d8 0x1f0001 Mutant ZonesCounterMutex
0xe1d933f0 1284 0x3dc 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004_CLASSES
0xe1d913b0 1284 0x3e0 0x20019 Key MACHINE\SOFTWARE\POLICIES
0xe1d94d30 1284 0x3e4 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004\SOFTWARE\POLICIES
0xe1d97f38 1284 0x3e8 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004\SOFTWARE
0xe1d97ed0 1284 0x3ec 0x20019 Key MACHINE\SOFTWARE
0x8164cdf0 1284 0x3f0 0x120116 File \Device\Tcp
0x816f2eb8 1284 0x3f4 0x1f0003 Event
0x816f2e58 1284 0x3f8 0x1f0003 Event
0x8162b7b0 1284 0x3fc 0x100001 Mutant !IETld!Mutex
0xe1d97e00 1284 0x400 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004\SOFTWARE\MICROSOFT\INTERNET EXPLORER\IETLD
0xe1d97d98 1284 0x404 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
0xe1d97d30 1284 0x408 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
0x815fabf8 1284 0x40c 0x1f0003 Event
0xe1d97ce8 1284 0x410 0xf0007 Section UrlZonesSM_testuser
0x815fabb8 1284 0x414 0x1f0001 Mutant ZoneAttributeCacheCounterMutex
0xe1d97c60 1284 0x418 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_LOCALMACHINE_LOCKDOWN
0x815faca8 1284 0x41c 0x1f0001 Mutant ZonesCacheCounterMutex
0x815fabb8 1284 0x420 0x1f0001 Mutant ZoneAttributeCacheCounterMutex
0x81688fe0 1284 0x424 0x1f0001 Mutant ZonesLockedCacheCounterMutex
0x816bdb30 1284 0x428 0x100001 File \Device\HarddiskVolume1\Documents and Settings\testuser\NetHood
0x81679a68 1284 0x42c 0x1200a0 File \Device\Ip
0x81675d80 1284 0x430 0x1f0001 Mutant _SHuassist.mtx
0x8161be30 1284 0x434 0x100020 File \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x81627748 1284 0x438 0x100003 Semaphore
0x81688028 1284 0x43c 0x1200a0 File \Device\Ip
0x816880e0 1284 0x440 0x1f0001 Mutant CTF.TimListCache.FMPDefaultS-1-5-21-1957994488-2052111302-1078081533-1004MUTEX.DefaultS-1-5-21-1957994488-2052111302-1078081533-1004
0xe1bf9fa0 1284 0x444 0xf001f Section CTF.TimListCache.FMPDefaultS-1-5-21-1957994488-2052111302-1078081533-1004SFM.DefaultS-1-5-21-1957994488-2052111302-1078081533-1004
0xe1d97548 1284 0x448 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004_CLASSES
0x816f2800 1284 0x44c 0x1f0003 Event
0x815fb4a8 1284 0x450 0x1f03ff Thread TID 1444 PID 1284
0x8163b6c8 1284 0x454 0x1f0003 Event
0xe14f84c8 1284 0x458 0x1f0001 Port
0x8162bbc0 1284 0x45c 0x100003 Semaphore
0xe1d97988 1284 0x460 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\TCPIP\LINKAGE
0xe1aa6228 1284 0x464 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS
0xe1aa61c0 1284 0x468 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\NETBT\PARAMETERS\INTERFACES
0xe1aa6158 1284 0x46c 0x20019 Key MACHINE\SYSTEM\CONTROLSET001\SERVICES\NETBT\PARAMETERS
0xe1d9f730 1284 0x470 0x1f0001 Port
0x815f9e08 1284 0x474 0x100020 File \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x816f6800 1284 0x478 0x1f03ff Thread TID 1312 PID 1284
0xe1c116a0 1284 0x47c 0x1f0001 Port
0xe1c0d580 1284 0x480 0xc Token
0x815fb3a8 1284 0x484 0x1f0003 Event
0xe1bff6d8 1284 0x488 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004_CLASSES
0x81611640 1284 0x48c 0x1f0003 Event ShellReadyEvent
0x816968c8 1284 0x490 0x1f0003 Event
0x81623848 1284 0x494 0x100020 File \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0xe1bc39e0 1284 0x498 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004_CLASSES
0xe1aa6b40 1284 0x49c 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004_CLASSES
0x816f4bb0 1284 0x4a0 0x100020 File \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x8169b568 1284 0x4a4 0x1f0001 Mutant
0xe1bf32e8 1284 0x4a8 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004_CLASSES
0x816fb110 1284 0x4ac 0x1f0003 Semaphore PowerProfileRegistrySemaphore
0x815ff348 1284 0x4b0 0x100020 File \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x815f9f90 1284 0x4b4 0x100020 File \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x8161c998 1284 0x4b8 0x21f0003 Event
0x81624a20 1284 0x4bc 0x1f03ff Thread TID 1464 PID 1284
0x815fb268 1284 0x4c0 0x1f0003 Event
0x8162d808 1284 0x4c4 0x1f0001 Mutant
0x815f7398 1284 0x4c8 0x1f0003 Event
0x817cb990 1284 0x4cc 0x1f0001 Mutant
0x815f7368 1284 0x4d0 0x1f0003 Event
0xe1a977f8 1284 0x4d4 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004_CLASSES
0xe1d93458 1284 0x4d8 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004_CLASSES
0xe1d95428 1284 0x4dc 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004_CLASSES
0x815fb9b0 1284 0x4e0 0x1f0003 Event
0x816309c0 1284 0x4e4 0x1f0003 Event HPlugEjectEvent
0xe1679878 1284 0x4e8 0x4 Section mmGlobalPnpInfo
0x816c1a00 1284 0x4ec 0x1f0003 Event
0xe1c106d8 1284 0x4f0 0x1f0001 Port
0x816883f8 1284 0x4f4 0x100004 WmiGuid
0x815ff080 1284 0x4f8 0x1f0003 Event
0xe1cda590 1284 0x4fc 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004_CLASSES
0x81622268 1284 0x500 0x100001 File \Device\HarddiskVolume1\Documents and Settings\testuser\PrintHood
0x81622660 1284 0x504 0x1f0003 Event
0xe1006e20 1412 0x4 0xf0003 KeyedEvent CritSecOutOfMemoryEvent
0xe14f3230 1412 0x8 0x3 Directory KnownDlls
0x816b71b8 1412 0xc 0x100020 File \Device\HarddiskVolume1\Documents and Settings\testuser
0x816276d8 1412 0x10 0x100003 Semaphore
0xe14038f8 1412 0x14 0xf000f Directory Windows
0xe1aa6f68 1412 0x18 0x21f0001 Port
0x816276a0 1412 0x1c 0x100003 Semaphore
0xe14477d0 1412 0x20 0x2000f Directory BaseNamedObjects
0x817064e8 1412 0x24 0x1f0001 Mutant SHIMLIB_LOG_MUTEX
0xe1d97a58 1412 0x28 0x20f003f Key MACHINE
0x815fdbf0 1412 0x2c 0xf037f WindowStation WinSta0
0x81573490 1412 0x30 0x21f0003 Event
0x816db158 1412 0x34 0xf01ff Desktop Default
0x815fdbf0 1412 0x38 0xf037f WindowStation WinSta0
0xe1847fd8 1412 0x3c 0xf0007 Section CiceroSharedMemDefaultS-1-5-21-1957994488-2052111302-1078081533-1004
0x815e4910 1412 0x40 0x1f0001 Mutant CTF.LBES.MutexDefaultS-1-5-21-1957994488-2052111302-1078081533-1004
0x815e4308 1412 0x44 0x1f0001 Mutant CTF.Compart.MutexDefaultS-1-5-21-1957994488-2052111302-1078081533-1004
0x815e4ec8 1412 0x48 0x1f0001 Mutant CTF.Asm.MutexDefaultS-1-5-21-1957994488-2052111302-1078081533-1004
0x815e4e78 1412 0x4c 0x1f0001 Mutant CTF.Layouts.MutexDefaultS-1-5-21-1957994488-2052111302-1078081533-1004
0x815e4e28 1412 0x50 0x1f0001 Mutant CTF.TMD.MutexDefaultS-1-5-21-1957994488-2052111302-1078081533-1004
0xe19e47b0 1412 0x54 0x20f003f Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004
0x81697bd8 1412 0x58 0x1f0003 Event
0x8162bdb8 1412 0x5c 0x100003 Semaphore
0x81627710 1412 0x60 0x100003 Semaphore
0xe19e2c50 1412 0x64 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32
0x81679d60 1412 0x68 0x100001 File \Device\KsecDD
0x81697ba8 1412 0x6c 0x1f0003 Event
0x81617de0 1412 0x70 0x1f0003 Event
0xe1bf9ee0 1412 0x74 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32
0x8162a930 1412 0x78 0x1f0003 Semaphore shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}
0x817cb720 1412 0x7c 0x1f0003 Event userenv: User Profile setup event
0x81679b58 1412 0x80 0x100020 File \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0x815d3b60 1412 0x84 0x100020 File \Device\HarddiskVolume1\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83
0xe1d8fb20 1412 0x88 0x1f0001 Port
0x815f8778 1412 0x8c 0x1f0001 Mutant CtfmonInstMutexDefaultS-1-5-21-1957994488-2052111302-1078081533-1004
0xe18bb388 1412 0x90 0x4 Section
0x816880e0 1412 0x94 0x1f0001 Mutant CTF.TimListCache.FMPDefaultS-1-5-21-1957994488-2052111302-1078081533-1004MUTEX.DefaultS-1-5-21-1957994488-2052111302-1078081533-1004
0xe1bf9fa0 1412 0x98 0xf0007 Section CTF.TimListCache.FMPDefaultS-1-5-21-1957994488-2052111302-1078081533-1004SFM.DefaultS-1-5-21-1957994488-2052111302-1078081533-1004
0x815ce110 1412 0x9c 0x1f0001 Mutant MSCTF.GCompartListMUTEX.DefaultS-1-5-21-1957994488-2052111302-1078081533-1004
0xe1bff628 1412 0xa0 0xf0007 Section MSCTF.GCompartListSFM.DefaultS-1-5-21-1957994488-2052111302-1078081533-1004
0x81573cd8 1412 0xa4 0x1f0003 Event
0xe1bf3350 1412 0xa8 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004\KEYBOARD LAYOUT\TOGGLE
0x81573ca8 1412 0xac 0x1f0003 Event
0x815e3688 1412 0xb0 0x1f0003 Event
0xe1aa6c10 1412 0xb4 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004\KEYBOARD LAYOUT\PRELOAD
0xe1bfbb78 1412 0xb8 0xf003f Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004\SOFTWARE\MICROSOFT\WINDOWS\SHELLNOROAM
0xe1aa6c78 1412 0xbc 0xf003f Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004\SOFTWARE\MICROSOFT\WINDOWS\SHELLNOROAM\MUICACHE
0xe1bcc680 1412 0xc0 0x20f003f Key USER
0xe1bf33b8 1412 0xc4 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\CTF\TIP
0xe1bcfe50 1412 0xc8 0xf0007 Section CTF.AsmListCache.FMPDefaultS-1-5-21-1957994488-2052111302-1078081533-1004
0x815e3b18 1412 0xcc 0x1f0003 Event
0xe1bcfdc8 1412 0xd0 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
0x815e3ae8 1412 0xd4 0x1f0003 Event
0xe1bfafb8 1412 0xd8 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004\SOFTWARE\MICROSOFT\CTF\TIP
0x815e3ab8 1412 0xdc 0x1f0003 Event
0xe1bf3248 1412 0xe0 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004\SOFTWARE\MICROSOFT\SPEECH
0x815e3a88 1412 0xe4 0x1f0003 Event
0xe1aa4d68 1412 0xe8 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004\CONTROL PANEL\APPEARANCE
0x815e3a58 1412 0xec 0x1f0003 Event
0xe1d975b0 1412 0xf0 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004\CONTROL PANEL\COLORS
0x815e3a28 1412 0xf4 0x1f0003 Event
0xe1aa60f0 1412 0xf8 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004\CONTROL PANEL\DESKTOP\WINDOWMETRICS
0x815e3ce8 1412 0xfc 0x1f0003 Event
0xe1683020 1412 0x100 0x20019 Key MACHINE\SOFTWARE\MICROSOFT\SPEECH
0x815e3cb8 1412 0x104 0x1f0003 Event
0xe1bf9690 1412 0x108 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004\KEYBOARD LAYOUT
0x815e3c88 1412 0x10c 0x1f0003 Event
0xe1cda6c8 1412 0x110 0x20019 Key USER\S-1-5-21-1957994488-2052111302-1078081533-1004\SOFTWARE\MICROSOFT\CTF\ASSEMBLIES
0x816233e8 1412 0x114 0x120001 Mutant ShimCacheMutex
0x8168f820 1412 0x118 0x100000 Event WinSta0_DesktopSwitch
0xe17ef118 1412 0x11c 0x2 Section ShimSharedMemory
以上。