diff --git a/Semaine_12/Jour_01/Lab01_Correction.pdf b/Semaine_12/Jour_01/Lab01_Correction.pdf new file mode 100644 index 0000000..f7bd353 Binary files /dev/null and b/Semaine_12/Jour_01/Lab01_Correction.pdf differ diff --git a/Semaine_12/Jour_02/Lab02_Correction.pdf b/Semaine_12/Jour_02/Lab02_Correction.pdf new file mode 100644 index 0000000..36ef8b7 Binary files /dev/null and b/Semaine_12/Jour_02/Lab02_Correction.pdf differ diff --git a/Semaine_12/Jour_03/Lab03_Correction.pdf b/Semaine_12/Jour_03/Lab03_Correction.pdf new file mode 100644 index 0000000..e610cc3 Binary files /dev/null and b/Semaine_12/Jour_03/Lab03_Correction.pdf differ diff --git a/Semaine_12/Jour_05/.gitignore b/Semaine_12/Jour_05/.gitignore new file mode 100644 index 0000000..da6497a --- /dev/null +++ b/Semaine_12/Jour_05/.gitignore @@ -0,0 +1,5 @@ +# Big dump files +*.vmem +*.mem +*.dmp +*.zip \ No newline at end of file diff --git a/Semaine_12/Jour_05/BOICHE_Gauvain_Lab_05_2026_08_07.md b/Semaine_12/Jour_05/BOICHE_Gauvain_Lab_05_2026_08_07.md new file mode 100644 index 0000000..0704627 --- /dev/null +++ b/Semaine_12/Jour_05/BOICHE_Gauvain_Lab_05_2026_08_07.md @@ -0,0 +1,240 @@ +# Lab 05 - Cybersecurity 3 +Analyse Forensic Android + +## 1. Mise en place + +Après lecture du Lab05, je fais moi-même un `Dockerfile` pour construire et adapter les besoins de l'outil aux dernières versions. Pas de Volatility 2, mais 3. Je dois juste rajouter une compatibilité avec les Service Pack des versions antérieures. + +Ensuite, je réfléchis à la correspondance des commandes d'une version à l'autre : + +| Action | Volatility 2 | Volatility 3 | +| ------ | ------------ | ------------ | +| **Informations image** | `volatility -f zeus.vmem imageinfo` | `vol -f zeus.vmem windows.info` | +| **Liste des processus** | `volatility -f zeus.vmem --profile=... pslist` | `vol -f zeus.vmem windows.pslist` | +| **Arborescence processus** | `volatility -f zeus.vmem --profile=... pstree` | `vol -f zeus.vmem windows.pstree` | +| **Détection masquage** | `volatility -f zeus.vmem --profile=... psscan` | `vol -f zeus.vmem windows.psscan` | +| **Analyse réseau** | `volatility -f zeus.vmem --profile=... connections` | `vol -f zeus.vmem windows.netscan` | +| **Détection d'injection** | `volatility -f zeus.vmem --profile=... malfind` | `vol -f zeus.vmem windows.malfind` | +| **Analyse DLL unlinked** | `volatility -f zeus.vmem --profile=... ldrmodules` | `vol -f zeus.vmem windows.ldrmodules` | +| **Dump mémoire processus** | `volatility -f zeus.vmem --profile=... memdump -p ` | `vol -f zeus.vmem windows.memdump --pid ` | + +Après le `Dockerfile`, le `docker-compose.yml` et les commandes corrigées, on peut lancer la stack. + +![alt text](image.png) + +![alt text](image-1.png) + +PS : après le lab, j'ai passé la commande `for f in ./dump/*.{img,dat,dmp}; do [ -f "$f" ] && truncate -s 0 "$f"; done` pour "vider" les fichiers dans le dossier `dump` afin de montrer leurs noms et variété, mais sans garder les 181Mo de stockage qui allaient avec. + +## 2. Analyses + +### A. Android avec `zeus.vmem` + +#### a. Identification de l'image + +Le processus de démarrage est assez long. + +![alt text](image-2.png) + +![alt text](image-3.png) + +#### CONCLUSION + +Je me rends compte avec des sorties vides de `pslist` et `psvolumes` que ce DUMP de mémoire est taillé pour la version 2 de Volatility. Refusant de travailler avec du matériel obsolète, je préfère passer sur une version récente, quitte à la retélécharger. Je tente l'aventure avec l'image Windows. + +### B. Windows avec `WinDump.mem` + +Je vais donner des captures d'écran des sorties CLI, mais faire ensuite des exports dans un fichier contigu pour analyse à froid. + +#### a. Identification de l'image + +![alt text](image-4.png) + +#### b. Inspection des processus + +![alt text](image-5.png) + +### REFLEXION alors que je suis sur l'analyse Windows + +Plutôt que m'embêter à faire les lignes à la main, je songe : pourquoi ne pas automatiser tout ça avec un simple script `.sh` ? Je le fais et je le mets à disposition de l'archive finale de rendu. + +J'ai fais une double boucle "for: do" un peu sommaire, améliorée à l'IA ensuite pour résilience et "bonne bouille" là où mes talents en shell sont très austères : + +![alt text](image-6.png) + +#### b. Inspection des processus² + +**Incohérences parent/enfant** + +Les services "normaux" ont des parents "normaux". `svchost.exe` a toujours `services.exe`. `lsass.exe` et `services.exe` ont `wininit.exe`. Un `cmd.exe` ou `powershell.exe` ont une commande utilisateur à l'origine aussi. + +On peut y aller à la comparaison regex : + +```bash +SERVICES_PID=$(awk '$3 == "services.exe" {print $1}' results/*_windows.pslist.log) + +awk -v spid="$SERVICES_PID" '$3 == "svchost.exe" && $2 != spid {print "SUSPECT (PPID anormale):", $0}' results/*_windows.pslist.log +``` + +![alt text](image-7.png) + +Hmmm... bah ça a l'air d'être bon pour `svchost.exe`. + +```bash +awk '$3 ~ /^(lsass\.exe|services\.exe|wininit\.exe)$/ && !($2 ~ /^(4|356|568)$/) {print "ANOMALIE PARENT:", $0}' results/*_windows.pslist.log +``` + +![alt text](image-8.png) + +AH-AH ! + +**Processus masqué** + +Ce qui est dans `psscan` mais pas dans `pslist` est un processus masqué. Un rootkit potentiel. Ou un anti-triche de FPS triple A. + +On va donc extraire : + +1. Les PID de `pslist` +2. Les PID de `psscan` +3. Comparer les deux + +```bash +awk 'NR>3 && $1 ~ /^[0-9]+$/ {print $1}' results/*_windows.pslist.log | sort -u > /tmp/pids_pslist.txt + +awk 'NR>3 && $1 ~ /^[0-9]+$/ {print $1}' results/*_windows.psscan.log | sort -u > /tmp/pids_psscan.txt + +comm -23 /tmp/pids_psscan.txt /tmp/pids_pslist.txt +``` + +![alt text](image-9.png) + +"Ca fait beaucoup, là, non ?" + +Alors, certains sont des faux positifs : si un `ExitTime` a une date, le processus s'est fini avec le DUMP de la RAM. Genre : + +![alt text](image-10.png) + +Maintenant, si ce champ est vide, il est actif MAIS masqué. Et l'infection par Rootkit / DKOM se confirme : + +![alt text](image-11.png) + +"SearchProtocol" pue donc le caca. + +**Faux noms** + +`scvhost.exe`, `expl0rer.exe` etc. C'est plus chaud à automatiser, parce qu'il faudrait un comparateur d'approximations basé sur un dictionnaire. Je suis sûr qu'il y a des bibliothèques Python qui pourraient aider, mais on peut se contenter d'un semi-manuel pour voir si un nom légitime est lancé depuis un endroit illogique : + +```bash +# Lancement d'un processus Win32 hors de System32 +grep -Ei "svchost\.exe|lsass\.exe|csrss\.exe" results/*_windows.pstree.log | grep -v -i "System32" + +# Fautes de frappe +grep -Ei "scvhost|svchost32|svchosts|lsasss|csrsss|explorerr|payloadd" results/*_windows.pslist.log +``` + +![alt text](image-12.png) + +A priori ça va. + +#### c. Analyse réseau + +Lister les connexions réseau est plutôt facile : + +```bash +grep -i "ESTABLISHED" results/*_windows.netscan.log +``` + +![alt text](image-13.png) + +Pour extraire les adresses publiques, simples : on élimine les adresses privées des "ForeignAddr", avec un regex `awk`. + +```bash +awk ' +$7 ~ /ESTABLISHED/ && +$5 !~ /^(127\.0\.0\.1|0\.0\.0\.0|::1|::|\*|-)$/ && +$5 !~ /^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[0-1])\.)/ { + print $0 +}' results/*_windows.netscan.log +``` + +![alt text](image-14.png) + +Allons plus loin en extrayant les PID et les états : + +```bash +awk ' +NR > 2 && $5 !~ /^(127\.0\.0\.1|0\.0\.0\.0|::1|::|\*|-|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[0-1])\.)/ { + printf "PID: %-6s | Processus: %-15s | IP Distante: %-15s | Port: %-5s | Etat: %s\n", $8, $9, $5, $6, $7 +}' results/*_windows.netscan.log | sort -u +``` + +![alt text](image-15.png) + +#### d. Analyse DDL et injections + +Si une DLL est injectée en mode caché (*Stealth mode*), elle sera découplée des listes classiques de DLL chargées sous Windows, qui sont `InLoadOrderModuleList`, `InMemoryOrderModuleList` et `InInitializationOrderModuleList` (ce que j'ignorais). Il suffit alors de trouver une formule qui récupère un argument "False" si elle ne le trouve pas dans ces listes, classées par Volatility dans les colonnes `InLoad`, `InInit` et `InMem`. + +```bash +awk ' +NR > 2 && ($3 == "False" || $4 == "False" || $5 == "False") { + printf "PID: %-6s | Processus: %-15s | InLoad: %-5s | InMem: %-5s | InInit: %-5s | DLL: %s\n", $1, $2, $3, $4, $5, $6 +}' results/*_windows.ldrmodules.log +``` + +Il y en a BEAUCOUP (plus de 850). J'ai sorti un fichier "WinDump_injected_DLL.logs" pour l'avoir en entier. C'est même fou d'avoir autant d'infections. + +A ce stade, on comprend le nombre d'éléments de `malfind`. + +On va pouvoir générer un dump d'un programme suspect. Le PID 1168 me semble prometteur : + +`PID: 1168 | Processus: SearchProtocol | InLoad: 0x7ff9a14e0000 | InMem: False | InInit: False | DLL: False` + +```bash +mkdir -p dump + +vol -f WinDump.mem windows.memdump --pid 1168 --output-dir dump/ +``` + +... et j'obtiens une erreur qui me prend pas mal la tête. J'interroge une IA pour parer au plus pressé, et elle me répond ceci : + +> windows.memdump n'existe plus dans Volatility 3. Le framework a divisé cette fonctionnalité en plusieurs plugins spécialisés selon ce que l'on souhaite extraire. + +Elle me donne alors trois options que je vais tester une à une : + +```bash +# Option A. Dumper toutes les pages mémoire du processus (Équivalent de memdump) +vol -o dump/ -f WinDump.mem windows.vadinfo --dump --pid 1168 + +# Option B. Extraire l'exécutable et les fichiers en mémoire (Recommandé) +vol -o dump/ -f WinDump.mem windows.dumpfiles --pid 1168 +``` + +En étudiant son fonctionnement : + +- Il indexait du contenu pour le moteur de recherche Windows +- Il chargeait des bibliothèques DLL natives +- Il était appelé par `SearchIndexer.exe` au PID 5380 + +En bref... je me suis complètement gourré, il est bien légitime. L'échec est total, mon humiliation est totale, et j'en tire les conclusions nécessaires, à savoir me retirer de la vie politique. + +#### e. Analyse manuelle + +Je revise ma situation précédente avec le PID 6620 : `software_reporter_tool.exe` lancé depuis `C:\Users\passmark\AppData\Local\` et qui contacte des adresses étranges comme `https://clients2.google.com/cr/report` explicitement. + +Je fais donc un extract des données mémoire : + +```bash +strings dump/*6620* | grep -Ei "http://|https://" | sort -u + +strings -e l dump/*6620* | grep -Ei "http://|https://|SwReporter|chrome" | sort -u +``` + +![alt text](image-16.png) + +![alt text](image-17.png) + +Bon... encore une fois, je pense avoir fait chou blanc, ça semble légitimement utilisé par Google (enfin... si on suppose que Google fasse quoi que ce soit de légitime dans la vie...), même si la simulation de comportement et son origine semblent étranges. + +### C. macOs avec `MacDump.dmp` + +Hélas, le dump n'est pas du tout compatible avec la version Volatility 3. diff --git a/Semaine_12/Jour_05/BOICHE_Gauvain_Lab_05_2026_08_07.pdf b/Semaine_12/Jour_05/BOICHE_Gauvain_Lab_05_2026_08_07.pdf new file mode 100644 index 0000000..f896764 Binary files /dev/null and b/Semaine_12/Jour_05/BOICHE_Gauvain_Lab_05_2026_08_07.pdf differ diff --git a/Semaine_12/Jour_05/BOICHE_Gauvain_Quiz_Cybersecurity3_Forensique_2026.pdf b/Semaine_12/Jour_05/BOICHE_Gauvain_Quiz_Cybersecurity3_Forensique_2026.pdf new file mode 100644 index 0000000..9807bd4 Binary files /dev/null and b/Semaine_12/Jour_05/BOICHE_Gauvain_Quiz_Cybersecurity3_Forensique_2026.pdf differ diff --git a/Semaine_12/Jour_05/Lab05.pdf b/Semaine_12/Jour_05/Lab05.pdf new file mode 100644 index 0000000..3a70833 Binary files /dev/null and b/Semaine_12/Jour_05/Lab05.pdf differ diff --git a/Semaine_12/Jour_05/Quiz_Cybersecurity3_Forensique_2026.pdf b/Semaine_12/Jour_05/Quiz_Cybersecurity3_Forensique_2026.pdf new file mode 100644 index 0000000..f1f9aec Binary files /dev/null and b/Semaine_12/Jour_05/Quiz_Cybersecurity3_Forensique_2026.pdf differ diff --git a/Semaine_12/Jour_05/image-1.png b/Semaine_12/Jour_05/image-1.png new file mode 100644 index 0000000..a9a8ccf Binary files /dev/null and b/Semaine_12/Jour_05/image-1.png differ diff --git a/Semaine_12/Jour_05/image-10.png b/Semaine_12/Jour_05/image-10.png new file mode 100644 index 0000000..8cb9192 Binary files /dev/null and b/Semaine_12/Jour_05/image-10.png differ diff --git a/Semaine_12/Jour_05/image-11.png b/Semaine_12/Jour_05/image-11.png new file mode 100644 index 0000000..e87a35e Binary files /dev/null and b/Semaine_12/Jour_05/image-11.png differ diff --git a/Semaine_12/Jour_05/image-12.png b/Semaine_12/Jour_05/image-12.png new file mode 100644 index 0000000..9d2ffeb Binary files /dev/null and b/Semaine_12/Jour_05/image-12.png differ diff --git a/Semaine_12/Jour_05/image-13.png b/Semaine_12/Jour_05/image-13.png new file mode 100644 index 0000000..7d10ad2 Binary files /dev/null and b/Semaine_12/Jour_05/image-13.png differ diff --git a/Semaine_12/Jour_05/image-14.png b/Semaine_12/Jour_05/image-14.png new file mode 100644 index 0000000..cde20d5 Binary files /dev/null and b/Semaine_12/Jour_05/image-14.png differ diff --git a/Semaine_12/Jour_05/image-15.png b/Semaine_12/Jour_05/image-15.png new file mode 100644 index 0000000..096d5a9 Binary files /dev/null and b/Semaine_12/Jour_05/image-15.png differ diff --git a/Semaine_12/Jour_05/image-16.png b/Semaine_12/Jour_05/image-16.png new file mode 100644 index 0000000..d4952e3 Binary files /dev/null and b/Semaine_12/Jour_05/image-16.png differ diff --git a/Semaine_12/Jour_05/image-17.png b/Semaine_12/Jour_05/image-17.png new file mode 100644 index 0000000..2bdd106 Binary files /dev/null and b/Semaine_12/Jour_05/image-17.png differ diff --git a/Semaine_12/Jour_05/image-2.png b/Semaine_12/Jour_05/image-2.png new file mode 100644 index 0000000..de49693 Binary files /dev/null and b/Semaine_12/Jour_05/image-2.png differ diff --git a/Semaine_12/Jour_05/image-3.png b/Semaine_12/Jour_05/image-3.png new file mode 100644 index 0000000..014416b Binary files /dev/null and b/Semaine_12/Jour_05/image-3.png differ diff --git a/Semaine_12/Jour_05/image-4.png b/Semaine_12/Jour_05/image-4.png new file mode 100644 index 0000000..77dca9f Binary files /dev/null and b/Semaine_12/Jour_05/image-4.png differ diff --git a/Semaine_12/Jour_05/image-5.png b/Semaine_12/Jour_05/image-5.png new file mode 100644 index 0000000..14f7dd2 Binary files /dev/null and b/Semaine_12/Jour_05/image-5.png differ diff --git a/Semaine_12/Jour_05/image-6.png b/Semaine_12/Jour_05/image-6.png new file mode 100644 index 0000000..16acf6e Binary files /dev/null and b/Semaine_12/Jour_05/image-6.png differ diff --git a/Semaine_12/Jour_05/image-7.png b/Semaine_12/Jour_05/image-7.png new file mode 100644 index 0000000..25a336d Binary files /dev/null and b/Semaine_12/Jour_05/image-7.png differ diff --git a/Semaine_12/Jour_05/image-8.png b/Semaine_12/Jour_05/image-8.png new file mode 100644 index 0000000..cb2dff5 Binary files /dev/null and b/Semaine_12/Jour_05/image-8.png differ diff --git a/Semaine_12/Jour_05/image-9.png b/Semaine_12/Jour_05/image-9.png new file mode 100644 index 0000000..dcd8a07 Binary files /dev/null and b/Semaine_12/Jour_05/image-9.png differ diff --git a/Semaine_12/Jour_05/image.png b/Semaine_12/Jour_05/image.png new file mode 100644 index 0000000..a18b91c Binary files /dev/null and b/Semaine_12/Jour_05/image.png differ diff --git a/Semaine_12/Jour_05/volatility/Dockerfile b/Semaine_12/Jour_05/volatility/Dockerfile new file mode 100644 index 0000000..b5bd421 --- /dev/null +++ b/Semaine_12/Jour_05/volatility/Dockerfile @@ -0,0 +1,30 @@ +FROM python:3.10-slim + +ENV DEBIAN_FRONTEND=noninteractive + +RUN apt-get update && apt-get install -y --no-install-recommends \ + git \ + build-essential \ + binutils \ + file \ + grep \ + curl \ + unzip \ + && rm -rf /var/lib/apt/lists/* + +RUN pip install --no-cache-dir \ + volatility3 \ + pefile \ + pycryptodome \ + capstone \ + yara-python + +RUN ln -s /usr/local/bin/vol /usr/local/bin/volatility + +RUN mkdir -p /usr/local/lib/python3.10/site-packages/volatility3/symbols \ + && curl -o /usr/local/lib/python3.10/site-packages/volatility3/symbols/windows.zip \ + https://downloads.volatilityfoundation.org/volatility3/symbols/windows.zip + +WORKDIR /data + +CMD ["bash"] \ No newline at end of file diff --git a/Semaine_12/Jour_05/volatility/data/auto_dump.sh b/Semaine_12/Jour_05/volatility/data/auto_dump.sh new file mode 100644 index 0000000..a5028e4 --- /dev/null +++ b/Semaine_12/Jour_05/volatility/data/auto_dump.sh @@ -0,0 +1,7 @@ +#!/usr/bin/env bash + +read -p "Entrez le PID voulu : " PID + +vol -o dump/ -f WinDump.mem windows.vadinfo --dump --pid $PID > ./results/WinDump_vadinfo_$PID.log + +vol -o dump/ -f WinDump.mem windows.dumpfiles --pid $PID > ./results/WinDump_dumpfiles_$PID.log \ No newline at end of file diff --git a/Semaine_12/Jour_05/volatility/data/auto_scan.sh b/Semaine_12/Jour_05/volatility/data/auto_scan.sh new file mode 100644 index 0000000..f7bf258 --- /dev/null +++ b/Semaine_12/Jour_05/volatility/data/auto_scan.sh @@ -0,0 +1,68 @@ +#!/usr/bin/env bash + +RESULTS_DIR="./results" + +EXTENSIONS=("*.vmem" "*.dmp" "*.raw" "*.mem" "*.img") + +COMMANDS=( + "info" + "pslist" + "pstree" + "psscan" + "netscan" + "malfind" + "ldrmodules" +) + +RED='\033[0;31m' +GREEN='\033[0;32m' +BLUE='\033[0;34m' +YELLOW='\033[1;33m' +NC='\033[0m' + +mkdir -p "$RESULTS_DIR" + +FIND_ARGS=() +for ext in "${EXTENSIONS[@]}"; do + if [[ ${#FIND_ARGS[@]} -gt 0 ]]; then + FIND_ARGS+=("-o") + fi + FIND_ARGS+=("-name" "$ext") +done + +echo -e "${BLUE}====================================================${NC}" +echo -e "${BLUE} Automated Volatility 3 Analysis Engine ${NC}" +echo -e "${BLUE}====================================================${NC}" + +FOUND_FILES=0 + +while IFS= read -r -d '' SOURCE; do + FOUND_FILES=1 + FILENAME=$(basename "$SOURCE") + + echo -e "\n${YELLOW}[*] Analyse du dump : ${FILENAME}${NC}" + echo -e " Chemin : $SOURCE" + echo -e " ------------------------------------------------" + + for CMD in "${COMMANDS[@]}"; do + PLUGIN="windows.${CMD}" + LOG_FILE="${RESULTS_DIR}/${FILENAME}_${PLUGIN}.log" + + echo -ne " [+] Exécution de ${BLUE}${PLUGIN}${NC} ... " + + if vol -f "$SOURCE" "$PLUGIN" > "$LOG_FILE" 2>&1; then + echo -e "${GREEN}[OK]${NC} -> Log: ${LOG_FILE}" + else + echo -e "${RED}[ÉCHEC]${NC} -> Log: ${LOG_FILE}" + fi + done + +done < <(find . -type f \( "${FIND_ARGS[@]}" \) -print0) + +echo -e "\n${BLUE}====================================================${NC}" +if [[ $FOUND_FILES -eq 0 ]]; then + echo -e "${YELLOW}[X] Aucun fichier de dump mémoire trouvé dans ce dossier.${NC}" +else + echo -e "${GREEN}[V] Analyse terminée ! Logs enregistrés dans '${RESULTS_DIR}/'${NC}" +fi +echo -e "${BLUE}====================================================${NC}" \ No newline at end of file diff --git a/Semaine_12/Jour_05/volatility/data/results/MacDump.dmp_windows.info.log b/Semaine_12/Jour_05/volatility/data/results/MacDump.dmp_windows.info.log new file mode 100644 index 0000000..d32a499 --- /dev/null +++ b/Semaine_12/Jour_05/volatility/data/results/MacDump.dmp_windows.info.log @@ -0,0 +1,17 @@ + Progress: 0.00 Scanning FileLayer using PageMapScanner Progress: 15.11 Scanning FileLayer using PageMapScanner Progress: 64.75 Scanning FileLayer using PageMapScanner Progress: 0.00 Scanning FileLayer using PageMapScanner Progress: 100.00 Stacking attempts finished Progress: 100.00 PDB scanning finished Unable to validate the plugin requirements: ['plugins.Info.kernel.layer_name', 'plugins.Info.kernel.symbol_table_name'] +Volatility 3 Framework 2.28.0 + +Unsatisfied requirement plugins.Info.kernel.layer_name: +Unsatisfied requirement plugins.Info.kernel.symbol_table_name: + +A translation layer requirement was not fulfilled. Please verify that: + A file was provided to create this layer (by -f, --single-location or by config) + The file exists and is readable + The file is a valid memory image and was acquired cleanly + +A symbol table requirement was not fulfilled. Please verify that: + The associated translation layer requirement was fulfilled + You have the correct symbol file for the requirement + The symbol file is under the correct directory or zip file + The symbol file is named appropriately or contains the correct banner + diff --git a/Semaine_12/Jour_05/volatility/data/results/MacDump.dmp_windows.ldrmodules.log b/Semaine_12/Jour_05/volatility/data/results/MacDump.dmp_windows.ldrmodules.log new file mode 100644 index 0000000..e664947 --- /dev/null +++ b/Semaine_12/Jour_05/volatility/data/results/MacDump.dmp_windows.ldrmodules.log @@ -0,0 +1,17 @@ + Progress: 0.00 Scanning FileLayer using PageMapScanner Progress: 15.11 Scanning FileLayer using PageMapScanner Progress: 64.75 Scanning FileLayer using PageMapScanner Progress: 0.00 Scanning FileLayer using PageMapScanner Progress: 100.00 Stacking attempts finished Progress: 100.00 PDB scanning finished Unable to validate the plugin requirements: ['plugins.LdrModules.kernel.layer_name', 'plugins.LdrModules.kernel.symbol_table_name'] +Volatility 3 Framework 2.28.0 + +Unsatisfied requirement plugins.LdrModules.kernel.layer_name: +Unsatisfied requirement plugins.LdrModules.kernel.symbol_table_name: + +A translation layer requirement was not fulfilled. Please verify that: + A file was provided to create this layer (by -f, --single-location or by config) + The file exists and is readable + The file is a valid memory image and was acquired cleanly + +A symbol table requirement was not fulfilled. Please verify that: + The associated translation layer requirement was fulfilled + You have the correct symbol file for the requirement + The symbol file is under the correct directory or zip file + The symbol file is named appropriately or contains the correct banner + diff --git a/Semaine_12/Jour_05/volatility/data/results/MacDump.dmp_windows.malfind.log b/Semaine_12/Jour_05/volatility/data/results/MacDump.dmp_windows.malfind.log new file mode 100644 index 0000000..3977b8b --- /dev/null +++ b/Semaine_12/Jour_05/volatility/data/results/MacDump.dmp_windows.malfind.log @@ -0,0 +1,17 @@ + Progress: 0.00 Scanning FileLayer using PageMapScanner Progress: 15.11 Scanning FileLayer using PageMapScanner Progress: 64.75 Scanning FileLayer using PageMapScanner Progress: 0.00 Scanning FileLayer using PageMapScanner Progress: 100.00 Stacking attempts finished Progress: 100.00 PDB scanning finished Unable to validate the plugin requirements: ['plugins.Malfind.kernel.layer_name', 'plugins.Malfind.kernel.symbol_table_name'] +Volatility 3 Framework 2.28.0 + +Unsatisfied requirement plugins.Malfind.kernel.layer_name: +Unsatisfied requirement plugins.Malfind.kernel.symbol_table_name: + +A translation layer requirement was not fulfilled. Please verify that: + A file was provided to create this layer (by -f, --single-location or by config) + The file exists and is readable + The file is a valid memory image and was acquired cleanly + +A symbol table requirement was not fulfilled. Please verify that: + The associated translation layer requirement was fulfilled + You have the correct symbol file for the requirement + The symbol file is under the correct directory or zip file + The symbol file is named appropriately or contains the correct banner + diff --git a/Semaine_12/Jour_05/volatility/data/results/MacDump.dmp_windows.netscan.log b/Semaine_12/Jour_05/volatility/data/results/MacDump.dmp_windows.netscan.log new file mode 100644 index 0000000..675e991 --- /dev/null +++ b/Semaine_12/Jour_05/volatility/data/results/MacDump.dmp_windows.netscan.log @@ -0,0 +1,17 @@ + Progress: 0.00 Scanning FileLayer using PageMapScanner Progress: 15.11 Scanning FileLayer using PageMapScanner Progress: 64.75 Scanning FileLayer using PageMapScanner Progress: 0.00 Scanning FileLayer using PageMapScanner Progress: 100.00 Stacking attempts finished Progress: 100.00 PDB scanning finished Unable to validate the plugin requirements: ['plugins.NetScan.kernel.layer_name', 'plugins.NetScan.kernel.symbol_table_name'] +Volatility 3 Framework 2.28.0 + +Unsatisfied requirement plugins.NetScan.kernel.layer_name: +Unsatisfied requirement plugins.NetScan.kernel.symbol_table_name: + +A translation layer requirement was not fulfilled. Please verify that: + A file was provided to create this layer (by -f, --single-location or by config) + The file exists and is readable + The file is a valid memory image and was acquired cleanly + +A symbol table requirement was not fulfilled. Please verify that: + The associated translation layer requirement was fulfilled + You have the correct symbol file for the requirement + The symbol file is under the correct directory or zip file + The symbol file is named appropriately or contains the correct banner + diff --git a/Semaine_12/Jour_05/volatility/data/results/MacDump.dmp_windows.pslist.log b/Semaine_12/Jour_05/volatility/data/results/MacDump.dmp_windows.pslist.log new file mode 100644 index 0000000..87af28b --- /dev/null +++ b/Semaine_12/Jour_05/volatility/data/results/MacDump.dmp_windows.pslist.log @@ -0,0 +1,17 @@ + Progress: 0.00 Scanning FileLayer using PageMapScanner Progress: 15.11 Scanning FileLayer using PageMapScanner Progress: 64.75 Scanning FileLayer using PageMapScanner Progress: 0.00 Scanning FileLayer using PageMapScanner Progress: 100.00 Stacking attempts finished Progress: 100.00 PDB scanning finished Unable to validate the plugin requirements: ['plugins.PsList.kernel.layer_name', 'plugins.PsList.kernel.symbol_table_name'] +Volatility 3 Framework 2.28.0 + +Unsatisfied requirement plugins.PsList.kernel.layer_name: +Unsatisfied requirement plugins.PsList.kernel.symbol_table_name: + +A translation layer requirement was not fulfilled. Please verify that: + A file was provided to create this layer (by -f, --single-location or by config) + The file exists and is readable + The file is a valid memory image and was acquired cleanly + +A symbol table requirement was not fulfilled. Please verify that: + The associated translation layer requirement was fulfilled + You have the correct symbol file for the requirement + The symbol file is under the correct directory or zip file + The symbol file is named appropriately or contains the correct banner + diff --git a/Semaine_12/Jour_05/volatility/data/results/MacDump.dmp_windows.psscan.log b/Semaine_12/Jour_05/volatility/data/results/MacDump.dmp_windows.psscan.log new file mode 100644 index 0000000..64e5219 --- /dev/null +++ b/Semaine_12/Jour_05/volatility/data/results/MacDump.dmp_windows.psscan.log @@ -0,0 +1,17 @@ + Progress: 0.00 Scanning FileLayer using PageMapScanner Progress: 15.11 Scanning FileLayer using PageMapScanner Progress: 64.75 Scanning FileLayer using PageMapScanner Progress: 0.00 Scanning FileLayer using PageMapScanner Progress: 100.00 Stacking attempts finished Progress: 100.00 PDB scanning finished Unable to validate the plugin requirements: ['plugins.PsScan.kernel.layer_name', 'plugins.PsScan.kernel.symbol_table_name'] +Volatility 3 Framework 2.28.0 + +Unsatisfied requirement plugins.PsScan.kernel.layer_name: +Unsatisfied requirement plugins.PsScan.kernel.symbol_table_name: + +A translation layer requirement was not fulfilled. Please verify that: + A file was provided to create this layer (by -f, --single-location or by config) + The file exists and is readable + The file is a valid memory image and was acquired cleanly + +A symbol table requirement was not fulfilled. Please verify that: + The associated translation layer requirement was fulfilled + You have the correct symbol file for the requirement + The symbol file is under the correct directory or zip file + The symbol file is named appropriately or contains the correct banner + diff --git a/Semaine_12/Jour_05/volatility/data/results/MacDump.dmp_windows.pstree.log b/Semaine_12/Jour_05/volatility/data/results/MacDump.dmp_windows.pstree.log new file mode 100644 index 0000000..8703f6e --- /dev/null +++ b/Semaine_12/Jour_05/volatility/data/results/MacDump.dmp_windows.pstree.log @@ -0,0 +1,17 @@ + Progress: 0.00 Scanning FileLayer using PageMapScanner Progress: 15.11 Scanning FileLayer using PageMapScanner Progress: 64.75 Scanning FileLayer using PageMapScanner Progress: 0.00 Scanning FileLayer using PageMapScanner Progress: 100.00 Stacking attempts finished Progress: 100.00 PDB scanning finished Unable to validate the plugin requirements: ['plugins.PsTree.kernel.layer_name', 'plugins.PsTree.kernel.symbol_table_name'] +Volatility 3 Framework 2.28.0 + +Unsatisfied requirement plugins.PsTree.kernel.layer_name: +Unsatisfied requirement plugins.PsTree.kernel.symbol_table_name: + +A translation layer requirement was not fulfilled. Please verify that: + A file was provided to create this layer (by -f, --single-location or by config) + The file exists and is readable + The file is a valid memory image and was acquired cleanly + +A symbol table requirement was not fulfilled. Please verify that: + The associated translation layer requirement was fulfilled + You have the correct symbol file for the requirement + The symbol file is under the correct directory or zip file + The symbol file is named appropriately or contains the correct banner + diff --git a/Semaine_12/Jour_05/volatility/data/results/WinDump.mem_windows.info.log b/Semaine_12/Jour_05/volatility/data/results/WinDump.mem_windows.info.log new file mode 100644 index 0000000..3ff28e4 --- /dev/null +++ b/Semaine_12/Jour_05/volatility/data/results/WinDump.mem_windows.info.log @@ -0,0 +1,24 @@ + Progress: 0.00 Scanning FileLayer using PageMapScanner Progress: 15.11 Scanning FileLayer using PageMapScanner Progress: 64.75 Scanning FileLayer using PageMapScanner Progress: 100.00 Stacking attempts finished Progress: 0.00 Scanning layer_name using PdbSignatureScanner Progress: 0.00 Scanning layer_name using PdbSignatureScanner Progress: 34.47 Scanning layer_name using PdbSignatureScanner Progress: 34.57 Scanning layer_name using PdbSignatureScanner Progress: 34.67 Scanning layer_name using PdbSignatureScanner Progress: 34.77 Scanning layer_name using PdbSignatureScanner Progress: 34.86 Scanning layer_name using PdbSignatureScanner Progress: 34.96 Scanning layer_name using PdbSignatureScanner Progress: 35.06 Scanning layer_name using PdbSignatureScanner Progress: 0.00 Scanning layer_name using PdbSignatureScanner Progress: 0.00 Scanning layer_name using PdbSignatureScanner Progress: 100.00 PDB scanning finished Volatility 3 Framework 2.28.0 + +Variable Value + +Kernel Base 0xf8021ec0f000 +DTB 0x1aa000 +Symbols jar:file:/usr/local/lib/python3.10/site-packages/volatility3/symbols/windows.zip!windows/ntkrnlmp.pdb/0C9CC659210046EC84231597DADFDB3B-1.json.xz +Is64Bit True +IsPAE False +layer_name 0 WindowsIntel32e +memory_layer 1 FileLayer +KdVersionBlock 0xf8021ef510a0 +Major/Minor 15.15063 +MachineType 34404 +KeNumberProcessors 4 +SystemTime 2018-06-21 06:50:50+00:00 +NtSystemRoot C:\WINDOWS +NtProductType NtProductWinNt +NtMajorVersion 10 +NtMinorVersion 0 +PE MajorOperatingSystemVersion 10 +PE MinorOperatingSystemVersion 0 +PE Machine 34404 +PE TimeDateStamp Sat Apr 28 04:13:12 2018 diff --git a/Semaine_12/Jour_05/volatility/data/results/WinDump.mem_windows.ldrmodules.log b/Semaine_12/Jour_05/volatility/data/results/WinDump.mem_windows.ldrmodules.log new file mode 100644 index 0000000..1f0e3bd --- /dev/null +++ b/Semaine_12/Jour_05/volatility/data/results/WinDump.mem_windows.ldrmodules.log @@ -0,0 +1,5942 @@ + Progress: 0.00 Scanning FileLayer using PageMapScanner Progress: 15.11 Scanning FileLayer using PageMapScanner Progress: 64.75 Scanning FileLayer using PageMapScanner Progress: 100.00 Stacking attempts finished Progress: 0.00 Scanning layer_name using PdbSignatureScanner Progress: 0.00 Scanning layer_name using PdbSignatureScanner Progress: 34.47 Scanning layer_name using PdbSignatureScanner Progress: 34.57 Scanning layer_name using PdbSignatureScanner Progress: 34.67 Scanning layer_name using PdbSignatureScanner Progress: 34.77 Scanning layer_name using PdbSignatureScanner Progress: 34.86 Scanning layer_name using PdbSignatureScanner Progress: 34.96 Scanning layer_name using PdbSignatureScanner Progress: 35.06 Scanning layer_name using PdbSignatureScanner Progress: 0.00 Scanning layer_name using PdbSignatureScanner Progress: 0.00 Scanning layer_name using PdbSignatureScanner Progress: 100.00 PDB scanning finished /usr/local/lib/python3.10/site-packages/volatility3/framework/deprecation.py:28: FutureWarning: This API (volatility3.plugins.windows.malware.ldrmodules.LdrModules.run) will be removed in the first release after 2026-06-07. This plugin has been renamed, please call volatility3.plugins.windows.malware.ldrmodules.LdrModules rather than volatility3.plugins.windows.ldrmodules.LdrModules. + warnings.warn( +Volatility 3 Framework 2.28.0 + +Pid Process Base InLoad InInit InMem MappedPath + +356 smss.exe 0x7ff6abfc0000 True False True \Windows\System32\smss.exe +468 csrss.exe 0x7ff655c90000 True False True \Windows\System32\csrss.exe +468 csrss.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +468 csrss.exe 0x7ff9a5d40000 True True True \Windows\System32\csrsrv.dll +468 csrss.exe 0x7ff9a5d00000 True True True \Windows\System32\winsrv.dll +468 csrss.exe 0x7ff9a5cd0000 True True True \Windows\System32\sxssrv.dll +468 csrss.exe 0x7ff9a5b90000 True True True \Windows\System32\sxs.dll +468 csrss.exe 0x7ff9a5ce0000 True True True \Windows\System32\winsrvext.dll +468 csrss.exe 0x7ff9a5d20000 True True True \Windows\System32\basesrv.dll +468 csrss.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +468 csrss.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +468 csrss.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +468 csrss.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +468 csrss.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +468 csrss.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +468 csrss.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +468 csrss.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +468 csrss.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +468 csrss.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +468 csrss.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +468 csrss.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +568 wininit.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +568 wininit.exe 0x7ff9a4fb0000 True True True \Windows\System32\profext.dll +568 wininit.exe 0x7ff9a2ca0000 False False False \Windows\System32\wtsapi32.dll +568 wininit.exe 0x7ff6fe140000 True False True \Windows\System32\wininit.exe +568 wininit.exe 0x7ff9a4c90000 True True True \Windows\System32\FirewallAPI.dll +568 wininit.exe 0x7ff9a4c30000 True True True \Windows\System32\fwbase.dll +568 wininit.exe 0x7ff9a4f70000 True True True \Windows\System32\ntmarta.dll +568 wininit.exe 0x7ff9a5cc0000 True True True \Windows\System32\wininitext.dll +568 wininit.exe 0x7ff9a5c60000 True True True \Windows\System32\userenv.dll +568 wininit.exe 0x7ff9a5850000 False False False \Windows\System32\winsta.dll +568 wininit.exe 0x7ff9a5610000 True True True \Windows\System32\mswsock.dll +568 wininit.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +568 wininit.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +568 wininit.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +568 wininit.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +568 wininit.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +568 wininit.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +568 wininit.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +568 wininit.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +568 wininit.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +568 wininit.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +568 wininit.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +568 wininit.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +568 wininit.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +568 wininit.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +568 wininit.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +568 wininit.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +568 wininit.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +568 wininit.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +716 services.exe 0x1f55fde0000 False False False \Windows\System32\en-US\services.exe.mui +716 services.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +716 services.exe 0x7ff9a5030000 True True True \Windows\System32\authz.dll +716 services.exe 0x7ff7164d0000 True False True \Windows\System32\services.exe +716 services.exe 0x7ff9a4410000 True True True \Windows\System32\apphelp.dll +716 services.exe 0x7ff99ef40000 True True True \Windows\System32\spinf.dll +716 services.exe 0x7ff99b650000 True True True \Windows\System32\srvcli.dll +716 services.exe 0x7ff9a1a80000 True True True \Windows\System32\usermgrcli.dll +716 services.exe 0x7ff9a5b70000 True True True \Windows\System32\EventAggregation.dll +716 services.exe 0x7ff9a5080000 True True True \Windows\System32\scesrv.dll +716 services.exe 0x7ff9a5610000 True True True \Windows\System32\mswsock.dll +716 services.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +716 services.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +716 services.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +716 services.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +716 services.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +716 services.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +716 services.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +716 services.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +716 services.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +716 services.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +716 services.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +716 services.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +716 services.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +744 lsass.exe 0x2bbb4e30000 True True True \Windows\System32\msprivs.dll +744 lsass.exe 0x7ff9a5690000 True True True \Windows\System32\KerbClientShared.dll +744 lsass.exe 0x7ff9a2b00000 True True True \Windows\System32\wevtapi.dll +744 lsass.exe 0x7ff998120000 True True True \Windows\System32\ncryptprov.dll +744 lsass.exe 0x7ff628030000 True False True \Windows\System32\lsass.exe +744 lsass.exe 0x7ff998070000 True True True \Windows\System32\cryptnet.dll +744 lsass.exe 0x7ff979900000 True True True \Windows\System32\PCPKsp.dll +744 lsass.exe 0x7ff9907f0000 True True True ㅲ˸ +744 lsass.exe 0x7ff9980d0000 True True True \Windows\System32\mskeyprotect.dll +744 lsass.exe 0x7ff9980a0000 True True True \Windows\System32\SecureTimeAggregator.dll +744 lsass.exe 0x7ff9980f0000 True True True \Windows\System32\dssenh.dll +744 lsass.exe 0x7ff9a2290000 True True True \Windows\System32\keyiso.dll +744 lsass.exe 0x7ff998180000 True True True \Windows\System32\ncryptsslp.dll +744 lsass.exe 0x7ff99eb40000 True True True \Windows\System32\dsparse.dll +744 lsass.exe 0x7ff9a2120000 True True True \Windows\System32\dhcpcsvc6.dll +744 lsass.exe 0x7ff9a27f0000 True True True \Windows\System32\dsrole.dll +744 lsass.exe 0x7ff9a25a0000 True True True \Windows\System32\dhcpcsvc.dll +744 lsass.exe 0x7ff9a2990000 True True True \Windows\System32\CertPolEng.dll +744 lsass.exe 0x7ff9a52d0000 True True True \Windows\System32\cloudAP.dll +744 lsass.exe 0x7ff9a5150000 True True True \Windows\System32\efslsaext.dll +744 lsass.exe 0x7ff9a4fe0000 True True True \Windows\System32\scecli.dll +744 lsass.exe 0x7ff9a4c60000 True True True \Windows\System32\gpapi.dll +744 lsass.exe 0x7ff9a4f70000 True True True \Windows\System32\ntmarta.dll +744 lsass.exe 0x7ff9a5100000 True True True \Windows\System32\sspisrv.dll +744 lsass.exe 0x7ff9a5030000 True True True \Windows\System32\authz.dll +744 lsass.exe 0x7ff9a5110000 True True True \Windows\System32\dpapisrv.dll +744 lsass.exe 0x7ff9a51f0000 True True True \Windows\System32\wdigest.dll +744 lsass.exe 0x7ff9a5170000 True True True \Windows\System32\schannel.dll +744 lsass.exe 0x7ff9a5270000 True True True \Windows\System32\dpapi.dll +744 lsass.exe 0x7ff9a5230000 True True True \Windows\System32\rsaenh.dll +744 lsass.exe 0x7ff9a5280000 True True True \Windows\System32\MicrosoftAccountCloudAP.dll +744 lsass.exe 0x7ff9a54b0000 True True True \Windows\System32\gmsaclient.dll +744 lsass.exe 0x7ff9a5380000 True True True \Windows\System32\TSpkg.dll +744 lsass.exe 0x7ff9a5330000 True True True \Windows\System32\pku2u.dll +744 lsass.exe 0x7ff9a53f0000 True True True +744 lsass.exe 0x7ff9a53b0000 True True True \Windows\System32\IPHLPAPI.DLL +744 lsass.exe 0x7ff9a54a0000 True True True \Windows\System32\netutils.dll +744 lsass.exe 0x7ff9a5590000 True True True \Windows\System32\NtlmShared.dll +744 lsass.exe 0x7ff9a54c0000 True True True \Windows\System32\netlogon.dll +744 lsass.exe 0x7ff9a5610000 True True True \Windows\System32\mswsock.dll +744 lsass.exe 0x7ff9a55a0000 True True True \Windows\System32\msv1_0.dll +744 lsass.exe 0x7ff9a5670000 True True True \Windows\System32\cryptdll.dll +744 lsass.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +744 lsass.exe 0x7ff9a5830000 True True True \Windows\System32\netprovfw.dll +744 lsass.exe 0x7ff9a57b0000 True True True \Windows\System32\cryptsp.dll +744 lsass.exe 0x7ff9a56c0000 True True True \Windows\System32\kerberos.dll +744 lsass.exe 0x7ff9a57e0000 True True True \Windows\System32\negoexts.dll +744 lsass.exe 0x7ff9a57d0000 True True True \Windows\System32\cryptbase.dll +744 lsass.exe 0x7ff9a5810000 True True True \Windows\System32\joinutil.dll +744 lsass.exe 0x7ff9a5a00000 True True True \Windows\System32\lsasrv.dll +744 lsass.exe 0x7ff9a58f0000 True True True \Windows\System32\ncrypt.dll +744 lsass.exe 0x7ff9a58b0000 True True True N/A +744 lsass.exe 0x7ff9a5850000 True True True \Windows\System32\winsta.dll +744 lsass.exe 0x7ff9a5920000 True True True \Windows\System32\samsrv.dll +744 lsass.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +744 lsass.exe 0x7ff9a5c60000 True True True \Windows\System32\userenv.dll +744 lsass.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +744 lsass.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +744 lsass.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +744 lsass.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +744 lsass.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +744 lsass.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +744 lsass.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +744 lsass.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +744 lsass.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +744 lsass.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +744 lsass.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +744 lsass.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +744 lsass.exe 0x7ff9a78b0000 True True True \Windows\System32\nsi.dll +744 lsass.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +744 lsass.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +744 lsass.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +744 lsass.exe 0x7ff9a9880000 True True True \Windows\System32\Wldap32.dll +744 lsass.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +744 lsass.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +844 svchost.exe 0x7ff9a6d50000 False False False l-TimeZones.Resources" version +844 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +844 svchost.exe 0x7ff9a5e10000 False False False \Windows\System32\KernelBase.dll +844 svchost.exe 0x7ff9a4f40000 False False False \Windows\System32\umpnpmgr.dll +844 svchost.exe 0x7ff9a4f20000 False False False \Windows\System32\wldp.dll +844 svchost.exe 0x7ff9a5df0000 False False False \Windows\System32\msasn1.dll +844 svchost.exe 0x7ff9a6180000 False False False \Windows\System32\crypt32.dll +844 svchost.exe 0x7ff9a6100000 False False False \Windows\System32\wintrust.dll +844 svchost.exe 0x7ff9a6400000 False False False \Windows\System32\bcryptprimitives.dll +844 svchost.exe 0x7ff9a78c0000 False False False \Windows\System32\kernel32.dll +844 svchost.exe 0x7ff9a6e70000 False False False \Windows\System32\rpcrt4.dll +844 svchost.exe 0x7ff9a7090000 False False False \Windows\System32\msvcrt.dll +844 svchost.exe 0x7ff9a9130000 False False False \Windows\System32\combase.dll +844 svchost.exe 0x7ff9a9070000 False False False \Windows\System32\sechost.dll +844 svchost.exe 0x7ff9a9600000 False False False \Windows\System32\advapi32.dll +868 svchost.exe 0x1e9b6d00000 False False False \Windows\System32\en-US\KernelBase.dll.mui +868 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +868 svchost.exe 0x7ff9a1a80000 True True True \Windows\System32\usermgrcli.dll +868 svchost.exe 0x7ff991c90000 True True True \Windows\System32\ACPBackgroundManagerPolicy.dll +868 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +868 svchost.exe 0x7ff991c10000 True True True \Windows\System32\execmodelproxy.dll +868 svchost.exe 0x7ff991bc0000 True True True \Windows\System32\ExecModelClient.dll +868 svchost.exe 0x7ff990bc0000 True True True \Windows\System32\capauthz.dll +868 svchost.exe 0x7ff991c50000 True True True \Windows\System32\Windows.Networking.BackgroundTransfer.BackgroundManagerPolicy.dll +868 svchost.exe 0x7ff991c30000 True True True \Windows\System32\SebBackgroundManagerPolicy.dll +868 svchost.exe 0x7ff991c70000 True True True \Windows\System32\SmartCardBackgroundPolicy.dll +868 svchost.exe 0x7ff99aa30000 True True True \Windows\System32\OneCoreUAPCommonProxyStub.dll +868 svchost.exe 0x7ff998430000 True True True \Windows\System32\OneCoreCommonProxyStub.dll +868 svchost.exe 0x7ff991cd0000 True True True \Windows\System32\BackgroundMediaPolicy.dll +868 svchost.exe 0x7ff9986a0000 True True True \Windows\System32\srumapi.dll +868 svchost.exe 0x7ff9a0cd0000 True True True \Windows\System32\StateRepository.Core.dll +868 svchost.exe 0x7ff99b7e0000 True True True \Windows\System32\VEEventDispatcher.dll +868 svchost.exe 0x7ff9a18b0000 True True True \Windows\System32\msvcp110_win.dll +868 svchost.exe 0x7ff9a0d80000 True True True \Windows\System32\Windows.StateRepository.dll +868 svchost.exe 0x7ff9a1940000 True True True \Windows\System32\policymanager.dll +868 svchost.exe 0x7ff9a48a0000 True True True \Windows\System32\psmsrv.dll +868 svchost.exe 0x7ff9a44e0000 True True True \Windows\System32\BrokerLib.dll +868 svchost.exe 0x7ff9a3800000 True True True \Windows\System32\LicenseManagerApi.dll +868 svchost.exe 0x7ff9a32f0000 True True True \Windows\System32\bi.dll +868 svchost.exe 0x7ff9a2ca0000 True True True \Windows\System32\wtsapi32.dll +868 svchost.exe 0x7ff9a44a0000 True True True \Windows\System32\rmclient.dll +868 svchost.exe 0x7ff9a3920000 True True True \Windows\System32\CoreMessaging.dll +868 svchost.exe 0x7ff9a4410000 True True True \Windows\System32\apphelp.dll +868 svchost.exe 0x7ff9a45a0000 True True True 秇氜뀭鉻綯మ싵卉䈟잰宛쇧켷©ےꖄḭ橨栢嵯俿뀚ꇟ꾌䊅�᥯訛�︟퓒槉賀拉绊⚯䆱䳹݅ +868 svchost.exe 0x7ff9a4530000 True True True \Windows\System32\SystemEventsBrokerServer.dll +868 svchost.exe 0x7ff9a4640000 True True True \Windows\System32\embeddedmodesvcapi.dll +868 svchost.exe 0x7ff9a45e0000 True True True \Windows\System32\PsmServiceExtHost.dll +868 svchost.exe 0x7ff9a4660000 True True True \Windows\System32\twinapi.appcore.dll +868 svchost.exe 0x7ff9a4c60000 True True True \Windows\System32\gpapi.dll +868 svchost.exe 0x7ff9a49c0000 True True True \Windows\System32\devobj.dll +868 svchost.exe 0x7ff9a49a0000 True True True \Windows\System32\ResourcePolicyClient.dll +868 svchost.exe 0x7ff9a4b10000 True True True \Windows\System32\rpcss.dll +868 svchost.exe 0x7ff9a49f0000 True True True \Windows\System32\bisrv.dll +868 svchost.exe 0x7ff9a4c20000 True True True \Windows\System32\hid.dll +868 svchost.exe 0x7ff9a4dd0000 True True True \Windows\System32\mintdh.dll +868 svchost.exe 0x7ff9a4d20000 True True True \Windows\System32\dxgi.dll +868 svchost.exe 0x7ff9a4ed0000 True True True \Windows\System32\umpoext.dll +868 svchost.exe 0x7ff9a4e20000 True True True \Windows\System32\tdh.dll +868 svchost.exe 0x7ff9a4ef0000 True True True \Windows\System32\umpo.dll +868 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +868 svchost.exe 0x7ff9a5b70000 True True True \Windows\System32\EventAggregation.dll +868 svchost.exe 0x7ff9a57b0000 True True True \Windows\System32\cryptsp.dll +868 svchost.exe 0x7ff9a4f70000 True True True \Windows\System32\ntmarta.dll +868 svchost.exe 0x7ff9a5230000 True True True \Windows\System32\rsaenh.dll +868 svchost.exe 0x7ff9a57d0000 True True True \Windows\System32\cryptbase.dll +868 svchost.exe 0x7ff9a5850000 True True True \Windows\System32\winsta.dll +868 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +868 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +868 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +868 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +868 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +868 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +868 svchost.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +868 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +868 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +868 svchost.exe 0x7ff9a64c0000 True True True \Windows\System32\windows.storage.dll +868 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +868 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +868 svchost.exe 0x7ff9a6fa0000 True True True \Windows\System32\coml2.dll +868 svchost.exe 0x7ff9a7280000 True True True \Windows\System32\ole32.dll +868 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +868 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +868 svchost.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +868 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +868 svchost.exe 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +868 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +868 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +868 svchost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +868 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +868 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +920 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +920 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +920 svchost.exe 0x7ff9a0930000 True True True \Windows\System32\FWPUCLNT.DLL +920 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +920 svchost.exe 0x7ff99b8d0000 True True True \Windows\System32\wshhyperv.dll +920 svchost.exe 0x7ff990bc0000 True True True \Windows\System32\capauthz.dll +920 svchost.exe 0x7ff9a4af0000 True True True \Windows\System32\RpcEpMap.dll +920 svchost.exe 0x7ff9a2ca0000 True True True \Windows\System32\wtsapi32.dll +920 svchost.exe 0x7ff9a1a80000 True True True \Windows\System32\usermgrcli.dll +920 svchost.exe 0x7ff9a4ad0000 True True True \Windows\System32\RpcRtRemote.dll +920 svchost.exe 0x7ff9a4c30000 True True True \Windows\System32\fwbase.dll +920 svchost.exe 0x7ff9a4b10000 True True True \Windows\System32\rpcss.dll +920 svchost.exe 0x7ff9a4c90000 True True True \Windows\System32\FirewallAPI.dll +920 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +920 svchost.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +920 svchost.exe 0x7ff9a5850000 True True True \Windows\System32\winsta.dll +920 svchost.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +920 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +920 svchost.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +920 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +920 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +920 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +920 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +920 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +920 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +920 svchost.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +920 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +920 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +920 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +920 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +920 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +920 svchost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +920 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +920 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +944 fontdrvhost.ex 0x1f150eb0000 False False False \Windows\Fonts\vgaoem.fon +944 fontdrvhost.ex 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +944 fontdrvhost.ex 0x7ff643ff0000 True False True \Windows\System32\fontdrvhost.exe +944 fontdrvhost.ex 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +944 fontdrvhost.ex 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +944 fontdrvhost.ex 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +944 fontdrvhost.ex 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +944 fontdrvhost.ex 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +944 fontdrvhost.ex 0x7ff9a7130000 True True True \Windows\System32\user32.dll +944 fontdrvhost.ex 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +72 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +72 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +72 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +72 svchost.exe 0x7ff9a48e0000 True True True \Windows\System32\lsm.dll +72 svchost.exe 0x7ff9a3310000 True True True \Windows\System32\wmsgapi.dll +72 svchost.exe 0x7ff9a4890000 True True True \Windows\System32\sysntfy.dll +72 svchost.exe 0x7ff9a49c0000 True True True \Windows\System32\devobj.dll +72 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +72 svchost.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +72 svchost.exe 0x7ff9a5c60000 True True True \Windows\System32\userenv.dll +72 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +72 svchost.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +72 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +72 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +72 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +72 svchost.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +72 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +72 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +72 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +72 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +72 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +72 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +72 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +804 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +804 svchost.exe 0x7ff9a40f0000 True True True \Windows\System32\ncbservice.dll +804 svchost.exe 0x7ff9a2000000 True True True \Windows\System32\npmproxy.dll +804 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +804 svchost.exe 0x7ff9a0100000 True True True \Windows\System32\TimeBrokerClient.dll +804 svchost.exe 0x7ff998430000 True True True \Windows\System32\OneCoreCommonProxyStub.dll +804 svchost.exe 0x7ff991c10000 True True True \Windows\System32\execmodelproxy.dll +804 svchost.exe 0x7ff9a1a80000 True True True \Windows\System32\usermgrcli.dll +804 svchost.exe 0x7ff9a32f0000 True True True \Windows\System32\bi.dll +804 svchost.exe 0x7ff9a32b0000 True True True \Windows\System32\netprofm.dll +804 svchost.exe 0x7ff9a40a0000 True True True \Windows\System32\Windows.Devices.Radios.dll +804 svchost.exe 0x7ff9a3730000 True True True \Windows\System32\httpprxc.dll +804 svchost.exe 0x7ff9a40e0000 True True True \Windows\System32\SystemEventsBrokerClient.dll +804 svchost.exe 0x7ff9a53b0000 True True True \Windows\System32\IPHLPAPI.DLL +804 svchost.exe 0x7ff9a4660000 True True True \Windows\System32\twinapi.appcore.dll +804 svchost.exe 0x7ff9a44e0000 True True True \Windows\System32\BrokerLib.dll +804 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +804 svchost.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +804 svchost.exe 0x7ff9a5b70000 True True True \Windows\System32\EventAggregation.dll +804 svchost.exe 0x7ff9a5610000 True True True \Windows\System32\mswsock.dll +804 svchost.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +804 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +804 svchost.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +804 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +804 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +804 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +804 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +804 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +804 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +804 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +804 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +804 svchost.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +804 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +804 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +804 svchost.exe 0x7ff9a6fa0000 True True True \Windows\System32\coml2.dll +804 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +804 svchost.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +804 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +804 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +804 svchost.exe 0x7ff9a7280000 True True True \Windows\System32\ole32.dll +804 svchost.exe 0x7ff9a78b0000 True True True \Windows\System32\nsi.dll +804 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +804 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +804 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +804 svchost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +804 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +804 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +1056 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +1056 svchost.exe 0x7ff9a44e0000 True True True \Windows\System32\BrokerLib.dll +1056 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +1056 svchost.exe 0x7ff9a1a80000 True True True \Windows\System32\usermgrcli.dll +1056 svchost.exe 0x7ff998430000 True True True \Windows\System32\OneCoreCommonProxyStub.dll +1056 svchost.exe 0x7ff991c10000 True True True \Windows\System32\execmodelproxy.dll +1056 svchost.exe 0x7ff99aa30000 True True True \Windows\System32\OneCoreUAPCommonProxyStub.dll +1056 svchost.exe 0x7ff9a32f0000 True True True \Windows\System32\bi.dll +1056 svchost.exe 0x7ff9a38f0000 True True True \Windows\System32\TimeBrokerServer.dll +1056 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +1056 svchost.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +1056 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +1056 svchost.exe 0x7ff9a4660000 True True True \Windows\System32\twinapi.appcore.dll +1056 svchost.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +1056 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +1056 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +1056 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +1056 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +1056 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +1056 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +1056 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +1056 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +1056 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +1056 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +1056 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +1056 svchost.exe 0x7ff9a6fa0000 True True True \Windows\System32\coml2.dll +1056 svchost.exe 0x7ff9a7280000 True True True \Windows\System32\ole32.dll +1056 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +1056 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +1056 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +1056 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +1056 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +1056 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +1056 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +1140 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +1140 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +1140 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +1140 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +1140 svchost.exe 0x7ff9a49c0000 True True True \Windows\System32\devobj.dll +1140 svchost.exe 0x7ff9a38e0000 True True True \Windows\System32\hidserv.dll +1140 svchost.exe 0x7ff9a4c20000 True True True \Windows\System32\hid.dll +1140 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +1140 svchost.exe 0x7ff9a5850000 True True True \Windows\System32\winsta.dll +1140 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +1140 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +1140 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +1140 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +1140 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +1140 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +1140 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +1140 svchost.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +1140 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +1140 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +1140 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +1140 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +1140 svchost.exe 0x7ff9a7470000 True True True \Windows\System32\setupapi.dll +1140 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +1140 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +1140 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +1140 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +1260 svchost.exe 0x175c02c0000 False False False \Windows\System32\wevtapi.dll +1260 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +1260 svchost.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +1260 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +1260 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +1260 svchost.exe 0x7ff9a2cc0000 True True True \Windows\System32\wevtsvc.dll +1260 svchost.exe 0x7ff9a4c60000 True True True \Windows\System32\gpapi.dll +1260 svchost.exe 0x7ff9a5610000 True True True \Windows\System32\mswsock.dll +1260 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +1260 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +1260 svchost.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +1260 svchost.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +1260 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +1260 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +1260 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +1260 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +1260 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +1260 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +1260 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +1260 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +1260 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +1260 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +1260 svchost.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +1260 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +1260 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +1260 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +1260 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +1260 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +1260 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +1288 atiesrxx.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +1288 atiesrxx.exe 0x7ff9a4410000 True True True \Windows\System32\apphelp.dll +1288 atiesrxx.exe 0x7ff9a2ac0000 True True True \Windows\System32\dwmapi.dll +1288 atiesrxx.exe 0x7ff68ebf0000 True False True \Windows\System32\atiesrxx.exe +1288 atiesrxx.exe 0x7ff9a2ca0000 True True True \Windows\System32\wtsapi32.dll +1288 atiesrxx.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +1288 atiesrxx.exe 0x7ff9a5850000 True True True \Windows\System32\winsta.dll +1288 atiesrxx.exe 0x7ff9a49c0000 True True True \Windows\System32\devobj.dll +1288 atiesrxx.exe 0x7ff9a5c60000 True True True \Windows\System32\userenv.dll +1288 atiesrxx.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +1288 atiesrxx.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +1288 atiesrxx.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +1288 atiesrxx.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +1288 atiesrxx.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +1288 atiesrxx.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +1288 atiesrxx.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +1288 atiesrxx.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +1288 atiesrxx.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +1288 atiesrxx.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +1288 atiesrxx.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +1288 atiesrxx.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +1288 atiesrxx.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +1288 atiesrxx.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +1288 atiesrxx.exe 0x7ff9a7470000 True True True \Windows\System32\setupapi.dll +1288 atiesrxx.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +1288 atiesrxx.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +1288 atiesrxx.exe 0x7ff9a8db0000 True True True \Windows\System32\psapi.dll +1288 atiesrxx.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +1288 atiesrxx.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +1288 atiesrxx.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +1316 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +1316 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +1316 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +1316 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +1316 svchost.exe 0x7ff9a2af0000 True True True \Windows\System32\nsisvc.dll +1316 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +1316 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +1316 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +1316 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +1316 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +1316 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +1316 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +1316 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +1316 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +1316 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +1316 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +1316 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +1316 svchost.exe 0x7ff9a78b0000 True True True \Windows\System32\nsi.dll +1316 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +1316 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +1316 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +1316 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +1368 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +1368 svchost.exe 0x7ff9a53b0000 True True True \Windows\System32\IPHLPAPI.DLL +1368 svchost.exe 0x7ff9a2800000 True True True \Windows\System32\winnsi.dll +1368 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +1368 svchost.exe 0x7ff9a2120000 True True True \Windows\System32\dhcpcsvc6.dll +1368 svchost.exe 0x7ff9a25a0000 True True True \Windows\System32\dhcpcsvc.dll +1368 svchost.exe 0x7ff9a2a60000 True True True \Windows\System32\dhcpcore.dll +1368 svchost.exe 0x7ff9a2a10000 True True True \Windows\System32\dhcpcore6.dll +1368 svchost.exe 0x7ff9a4c90000 True True True \Windows\System32\FirewallAPI.dll +1368 svchost.exe 0x7ff9a4c30000 True True True \Windows\System32\fwbase.dll +1368 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +1368 svchost.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +1368 svchost.exe 0x7ff9a5610000 True True True \Windows\System32\mswsock.dll +1368 svchost.exe 0x7ff9a53f0000 True True True +1368 svchost.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +1368 svchost.exe 0x7ff9a57d0000 True True True \Windows\System32\cryptbase.dll +1368 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +1368 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +1368 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +1368 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +1368 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +1368 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +1368 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +1368 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +1368 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +1368 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +1368 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +1368 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +1368 svchost.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +1368 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +1368 svchost.exe 0x7ff9a78b0000 True True True \Windows\System32\nsi.dll +1368 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +1368 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +1368 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +1368 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +1412 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +1412 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +1412 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +1412 svchost.exe 0x7ff9a5850000 True True True \Windows\System32\winsta.dll +1412 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +1412 svchost.exe 0x7ff9a28b0000 True True True \Windows\System32\themeservice.dll +1412 svchost.exe 0x7ff9a4f70000 True True True \Windows\System32\ntmarta.dll +1412 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +1412 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +1412 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +1412 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +1412 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +1412 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +1412 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +1412 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +1412 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +1412 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +1412 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +1412 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +1412 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +1412 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +1412 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +1412 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +1412 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +1420 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +1420 svchost.exe 0x7ff9a4890000 True True True \Windows\System32\sysntfy.dll +1420 svchost.exe 0x7ff9a1f50000 True True True \Windows\System32\logoncli.dll +1420 svchost.exe 0x7ff992310000 True True True \Windows\System32\shacctprofile.dll +1420 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +1420 svchost.exe 0x7ff992280000 True True True \Windows\System32\SettingSync.dll +1420 svchost.exe 0x7ff991fb0000 True True True +1420 svchost.exe 0x7ff99d8b0000 True True True \Windows\System32\CredentialMigrationHandler.dll +1420 svchost.exe 0x7ff99c880000 True True True \Windows\System32\samlib.dll +1420 svchost.exe 0x7ff997370000 True True True \Windows\System32\cscapi.dll +1420 svchost.exe 0x7ff9a05c0000 True True True \Windows\System32\cscobj.dll +1420 svchost.exe 0x7ff9a2b00000 True True True \Windows\System32\wevtapi.dll +1420 svchost.exe 0x7ff9a2610000 True True True \Windows\System32\profsvcext.dll +1420 svchost.exe 0x7ff9a1f90000 True True True \Windows\System32\wkscli.dll +1420 svchost.exe 0x7ff9a26c0000 True True True \Windows\System32\profsvc.dll +1420 svchost.exe 0x7ff9a27f0000 True True True \Windows\System32\dsrole.dll +1420 svchost.exe 0x7ff9a2ca0000 True True True \Windows\System32\wtsapi32.dll +1420 svchost.exe 0x7ff9a2b60000 True True True \Windows\System32\WinTypes.dll +1420 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +1420 svchost.exe 0x7ff9a5c60000 True True True \Windows\System32\userenv.dll +1420 svchost.exe 0x7ff9a54a0000 True True True \Windows\System32\netutils.dll +1420 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +1420 svchost.exe 0x7ff9a4c60000 True True True \Windows\System32\gpapi.dll +1420 svchost.exe 0x7ff9a4f70000 True True True \Windows\System32\ntmarta.dll +1420 svchost.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +1420 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +1420 svchost.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +1420 svchost.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +1420 svchost.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +1420 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +1420 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +1420 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +1420 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +1420 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +1420 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +1420 svchost.exe 0x7ff9a64c0000 True True True \Windows\System32\windows.storage.dll +1420 svchost.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +1420 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +1420 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +1420 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +1420 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +1420 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +1420 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +1420 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +1420 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +1420 svchost.exe 0x7ff9a7970000 True True True \Windows\System32\shell32.dll +1420 svchost.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +1420 svchost.exe 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +1420 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +1420 svchost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +1420 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +1420 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +1420 svchost.exe 0x7ff9a9880000 True True True \Windows\System32\Wldap32.dll +1436 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +1436 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +1436 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +1436 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +1436 svchost.exe 0x7ff9a2810000 True True True \Windows\System32\es.dll +1436 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +1436 svchost.exe 0x7ff9a5b90000 True True True \Windows\System32\sxs.dll +1436 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +1436 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +1436 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +1436 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +1436 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +1436 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +1436 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +1436 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +1436 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +1436 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +1436 svchost.exe 0x7ff9a7280000 True True True \Windows\System32\ole32.dll +1436 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +1436 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +1436 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +1436 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +1436 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +1436 svchost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +1436 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +1532 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +1532 svchost.exe 0x7ff9a2660000 True True True \Windows\System32\nlasvc.dll +1532 svchost.exe 0x7ff9a1f90000 True True True \Windows\System32\wkscli.dll +1532 svchost.exe 0x7ff99d630000 True True True \Windows\System32\wship6.dll +1532 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +1532 svchost.exe 0x7ff99b740000 True True True \Windows\System32\webio.dll +1532 svchost.exe 0x7ff99c9d0000 True True True \Windows\System32\rasadhlp.dll +1532 svchost.exe 0x7ff99d900000 True True True \Windows\System32\wshqos.dll +1532 svchost.exe 0x7ff99d7a0000 True True True \Windows\System32\winhttp.dll +1532 svchost.exe 0x7ff99d640000 True True True \Windows\System32\WSHTCPIP.DLL +1532 svchost.exe 0x7ff9a1880000 True True True \Windows\System32\netjoin.dll +1532 svchost.exe 0x7ff9a0930000 True True True \Windows\System32\FWPUCLNT.DLL +1532 svchost.exe 0x7ff9a1ad0000 True True True \Windows\System32\wlanapi.dll +1532 svchost.exe 0x7ff9a2140000 True True True \Windows\System32\wmiclnt.dll +1532 svchost.exe 0x7ff9a2120000 True True True \Windows\System32\dhcpcsvc6.dll +1532 svchost.exe 0x7ff9a2450000 True True True \Windows\System32\ncsi.dll +1532 svchost.exe 0x7ff9a21d0000 True True True \Windows\System32\ssdpapi.dll +1532 svchost.exe 0x7ff9a25a0000 True True True \Windows\System32\dhcpcsvc.dll +1532 svchost.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +1532 svchost.exe 0x7ff9a53b0000 True True True \Windows\System32\IPHLPAPI.DLL +1532 svchost.exe 0x7ff9a2ca0000 True True True \Windows\System32\wtsapi32.dll +1532 svchost.exe 0x7ff9a2b00000 True True True \Windows\System32\wevtapi.dll +1532 svchost.exe 0x7ff9a2800000 True True True \Windows\System32\winnsi.dll +1532 svchost.exe 0x7ff9a4c60000 True True True \Windows\System32\gpapi.dll +1532 svchost.exe 0x7ff9a49c0000 True True True \Windows\System32\devobj.dll +1532 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +1532 svchost.exe 0x7ff9a5810000 True True True \Windows\System32\joinutil.dll +1532 svchost.exe 0x7ff9a54a0000 True True True \Windows\System32\netutils.dll +1532 svchost.exe 0x7ff9a53f0000 True True True +1532 svchost.exe 0x7ff9a5610000 True True True \Windows\System32\mswsock.dll +1532 svchost.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +1532 svchost.exe 0x7ff9a5850000 True True True \Windows\System32\winsta.dll +1532 svchost.exe 0x7ff9a5c60000 True True True \Windows\System32\userenv.dll +1532 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +1532 svchost.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +1532 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +1532 svchost.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +1532 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +1532 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +1532 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +1532 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +1532 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +1532 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +1532 svchost.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +1532 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +1532 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +1532 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +1532 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +1532 svchost.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +1532 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +1532 svchost.exe 0x7ff9a78b0000 True True True \Windows\System32\nsi.dll +1532 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +1532 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +1532 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +1532 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +1532 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +1548 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +1548 svchost.exe 0x7ff9a4890000 True True True \Windows\System32\sysntfy.dll +1548 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +1548 svchost.exe 0x7ff9a2640000 True True True \Windows\System32\Sens.dll +1548 svchost.exe 0x7ff9a0010000 True True True \Windows\System32\rasapi32.dll +1548 svchost.exe 0x7ff9a2140000 True True True \Windows\System32\wmiclnt.dll +1548 svchost.exe 0x7ff9a2ca0000 True True True \Windows\System32\wtsapi32.dll +1548 svchost.exe 0x7ff9a2810000 True True True \Windows\System32\es.dll +1548 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +1548 svchost.exe 0x7ff9a5850000 True True True \Windows\System32\winsta.dll +1548 svchost.exe 0x7ff9a4f70000 True True True \Windows\System32\ntmarta.dll +1548 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +1548 svchost.exe 0x7ff9a53b0000 True True True \Windows\System32\IPHLPAPI.DLL +1548 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +1548 svchost.exe 0x7ff9a5b90000 True True True \Windows\System32\sxs.dll +1548 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +1548 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +1548 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +1548 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +1548 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +1548 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +1548 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +1548 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +1548 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +1548 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +1548 svchost.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +1548 svchost.exe 0x7ff9a7280000 True True True \Windows\System32\ole32.dll +1548 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +1548 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +1548 svchost.exe 0x7ff9a78b0000 True True True \Windows\System32\nsi.dll +1548 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +1548 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +1548 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +1548 svchost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +1548 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +1548 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +1568 svchost.exe 0x7ff9a5b70000 True True True \Windows\System32\EventAggregation.dll +1568 svchost.exe 0x7ff9a24c0000 True True True \Windows\System32\schedsvc.dll +1568 svchost.exe 0x7ff9a1aa0000 True True True \Windows\System32\WPTaskScheduler.dll +1568 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +1568 svchost.exe 0x7ff9a1880000 True True True \Windows\System32\netjoin.dll +1568 svchost.exe 0x7ff9a0100000 True True True \Windows\System32\TimeBrokerClient.dll +1568 svchost.exe 0x7ff99eb00000 True True True \Windows\System32\xmllite.dll +1568 svchost.exe 0x7ff9a19c0000 True True True \Windows\System32\CSystemEventsBrokerClient.dll +1568 svchost.exe 0x7ff9a1a80000 True True True \Windows\System32\usermgrcli.dll +1568 svchost.exe 0x7ff9a2010000 True True True \Windows\System32\taskcomp.dll +1568 svchost.exe 0x7ff9a1f90000 True True True \Windows\System32\wkscli.dll +1568 svchost.exe 0x7ff9a1bd0000 True True True \Windows\System32\propsys.dll +1568 svchost.exe 0x7ff9a20d0000 True True True \Windows\System32\ubpm.dll +1568 svchost.exe 0x7ff9a2140000 True True True \Windows\System32\wmiclnt.dll +1568 svchost.exe 0x7ff9a5030000 True True True \Windows\System32\authz.dll +1568 svchost.exe 0x7ff9a2ca0000 True True True \Windows\System32\wtsapi32.dll +1568 svchost.exe 0x7ff9a2b00000 True True True \Windows\System32\wevtapi.dll +1568 svchost.exe 0x7ff9a4410000 True True True \Windows\System32\apphelp.dll +1568 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +1568 svchost.exe 0x7ff9a4f70000 True True True \Windows\System32\ntmarta.dll +1568 svchost.exe 0x7ff9a57b0000 True True True \Windows\System32\cryptsp.dll +1568 svchost.exe 0x7ff9a54a0000 True True True \Windows\System32\netutils.dll +1568 svchost.exe 0x7ff9a5610000 True True True \Windows\System32\mswsock.dll +1568 svchost.exe 0x7ff9a5810000 True True True \Windows\System32\joinutil.dll +1568 svchost.exe 0x7ff9a57d0000 True True True \Windows\System32\cryptbase.dll +1568 svchost.exe 0x7ff9a5850000 True True True \Windows\System32\winsta.dll +1568 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +1568 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +1568 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +1568 svchost.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +1568 svchost.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +1568 svchost.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +1568 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +1568 svchost.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +1568 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +1568 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +1568 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +1568 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +1568 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +1568 svchost.exe 0x7ff9a64c0000 True True True \Windows\System32\windows.storage.dll +1568 svchost.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +1568 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +1568 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +1568 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +1568 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +1568 svchost.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +1568 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +1568 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +1568 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +1568 svchost.exe 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +1568 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +1568 svchost.exe 0x7ff9a7970000 True True True \Windows\System32\shell32.dll +1568 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +1568 svchost.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +1568 svchost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +1568 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +1644 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +1644 svchost.exe 0x7ff9a23a0000 True True True \Windows\System32\AudioEndpointBuilder.dll +1644 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +1644 svchost.exe 0x7ff9a2160000 True True True \Windows\System32\MMDevAPI.dll +1644 svchost.exe 0x7ff9a1bd0000 True True True \Windows\System32\propsys.dll +1644 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +1644 svchost.exe 0x7ff9a49c0000 True True True \Windows\System32\devobj.dll +1644 svchost.exe 0x7ff9a2ca0000 True True True \Windows\System32\wtsapi32.dll +1644 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +1644 svchost.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +1644 svchost.exe 0x7ff9a5850000 True True True \Windows\System32\winsta.dll +1644 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +1644 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +1644 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +1644 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +1644 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +1644 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +1644 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +1644 svchost.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +1644 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +1644 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +1644 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +1644 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +1644 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +1644 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +1644 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +1644 svchost.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +1644 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +1644 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +1644 svchost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +1644 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +1652 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +1652 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +1652 svchost.exe 0x7ff9a1d70000 True True True \Windows\System32\FntCache.dll +1652 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +1652 svchost.exe 0x7ff9a18b0000 True True True \Windows\System32\msvcp110_win.dll +1652 svchost.exe 0x7ff9a1850000 True True True \Windows\System32\FontProvider.dll +1652 svchost.exe 0x7ff9a1940000 True True True \Windows\System32\policymanager.dll +1652 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +1652 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +1652 svchost.exe 0x7ff9a25c0000 True True True \Windows\System32\BitsProxy.dll +1652 svchost.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +1652 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +1652 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +1652 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +1652 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +1652 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +1652 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +1652 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +1652 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +1652 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +1652 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +1652 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +1652 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +1652 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +1652 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +1652 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +1652 svchost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +1652 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +1652 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +1724 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +1724 svchost.exe 0x7ff9a2890000 True True True \Windows\System32\nlaapi.dll +1724 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +1724 svchost.exe 0x7ff9a2000000 True True True \Windows\System32\npmproxy.dll +1724 svchost.exe 0x7ff9a1ad0000 True True True \Windows\System32\wlanapi.dll +1724 svchost.exe 0x7ff99e3b0000 True True True \Windows\System32\WlanRadioManager.dll +1724 svchost.exe 0x7ff9a1b40000 True True True \Windows\System32\netprofmsvc.dll +1724 svchost.exe 0x7ff9a2800000 True True True \Windows\System32\winnsi.dll +1724 svchost.exe 0x7ff9a53b0000 True True True \Windows\System32\IPHLPAPI.DLL +1724 svchost.exe 0x7ff9a4c60000 True True True \Windows\System32\gpapi.dll +1724 svchost.exe 0x7ff9a40a0000 True True True \Windows\System32\Windows.Devices.Radios.dll +1724 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +1724 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +1724 svchost.exe 0x7ff9a5610000 True True True \Windows\System32\mswsock.dll +1724 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +1724 svchost.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +1724 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +1724 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +1724 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +1724 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +1724 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +1724 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +1724 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +1724 svchost.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +1724 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +1724 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +1724 svchost.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +1724 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +1724 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +1724 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +1724 svchost.exe 0x7ff9a7280000 True True True \Windows\System32\ole32.dll +1724 svchost.exe 0x7ff9a78b0000 True True True \Windows\System32\nsi.dll +1724 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +1724 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +1724 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +1724 svchost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +1724 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +1824 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +1824 svchost.exe 0x7ff9a2160000 True True True \Windows\System32\MMDevAPI.dll +1824 svchost.exe 0x7ff9a16f0000 True True True \Windows\System32\audiosrv.dll +1824 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +1824 svchost.exe 0x7ff9a0110000 True True True \Windows\System32\Windows.ApplicationModel.dll +1824 svchost.exe 0x7ff99fda0000 True True True \Windows\System32\AppXDeploymentClient.dll +1824 svchost.exe 0x7ff99e820000 True True True \Windows\System32\deviceaccess.dll +1824 svchost.exe 0x7ff9a0d80000 True True True \Windows\System32\Windows.StateRepository.dll +1824 svchost.exe 0x7ff9a0cd0000 True True True \Windows\System32\StateRepository.Core.dll +1824 svchost.exe 0x7ff9a13c0000 True True True \Windows\System32\AudioSes.dll +1824 svchost.exe 0x7ff9a1a40000 True True True \Windows\System32\AudioSrvPolicyManager.dll +1824 svchost.exe 0x7ff9a1a30000 True True True \Windows\System32\coreaudiopolicymanagerext.dll +1824 svchost.exe 0x7ff9a1bd0000 True True True \Windows\System32\propsys.dll +1824 svchost.exe 0x7ff9a1fb0000 True True True \Windows\System32\avrt.dll +1824 svchost.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +1824 svchost.exe 0x7ff9a49c0000 True True True \Windows\System32\devobj.dll +1824 svchost.exe 0x7ff9a2ca0000 True True True \Windows\System32\wtsapi32.dll +1824 svchost.exe 0x7ff9a2b60000 True True True \Windows\System32\WinTypes.dll +1824 svchost.exe 0x7ff9a4660000 True True True \Windows\System32\twinapi.appcore.dll +1824 svchost.exe 0x7ff9a5850000 True True True \Windows\System32\winsta.dll +1824 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +1824 svchost.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +1824 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +1824 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +1824 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +1824 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +1824 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +1824 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +1824 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +1824 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +1824 svchost.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +1824 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +1824 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +1824 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +1824 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +1824 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +1824 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +1824 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +1824 svchost.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +1824 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +1824 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +1824 svchost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +1824 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +1824 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +1872 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +1872 svchost.exe 0x7ff9a5c60000 True True True \Windows\System32\userenv.dll +1872 svchost.exe 0x7ff9a2b60000 True True True \Windows\System32\WinTypes.dll +1872 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +1872 svchost.exe 0x7ff9a12e0000 True True True \Windows\System32\usermgr.dll +1872 svchost.exe 0x7ff9a08e0000 True True True \Windows\System32\UserMgrProxy.dll +1872 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +1872 svchost.exe 0x7ff9a2ca0000 True True True \Windows\System32\wtsapi32.dll +1872 svchost.exe 0x7ff9a4f70000 True True True \Windows\System32\ntmarta.dll +1872 svchost.exe 0x7ff9a5850000 True True True \Windows\System32\winsta.dll +1872 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +1872 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +1872 svchost.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +1872 svchost.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +1872 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +1872 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +1872 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +1872 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +1872 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +1872 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +1872 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +1872 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +1872 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +1872 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +1872 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +1872 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +1872 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +1872 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +1872 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +1872 svchost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +1872 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +1872 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +1940 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +1940 svchost.exe 0x7ff9a53f0000 True True True +1940 svchost.exe 0x7ff9a14f0000 True True True \Windows\System32\dnsrslvr.dll +1940 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +1940 svchost.exe 0x7ff9a0930000 True True True \Windows\System32\FWPUCLNT.DLL +1940 svchost.exe 0x7ff9a2800000 True True True \Windows\System32\winnsi.dll +1940 svchost.exe 0x7ff9a2120000 True True True \Windows\System32\dhcpcsvc6.dll +1940 svchost.exe 0x7ff9a19d0000 True True True \Windows\System32\dnsext.dll +1940 svchost.exe 0x7ff9a25a0000 True True True \Windows\System32\dhcpcsvc.dll +1940 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +1940 svchost.exe 0x7ff9a4c60000 True True True \Windows\System32\gpapi.dll +1940 svchost.exe 0x7ff9a53b0000 True True True \Windows\System32\IPHLPAPI.DLL +1940 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +1940 svchost.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +1940 svchost.exe 0x7ff9a5610000 True True True \Windows\System32\mswsock.dll +1940 svchost.exe 0x7ff9a57d0000 True True True \Windows\System32\cryptbase.dll +1940 svchost.exe 0x7ff9a5c60000 True True True \Windows\System32\userenv.dll +1940 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +1940 svchost.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +1940 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +1940 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +1940 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +1940 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +1940 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +1940 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +1940 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +1940 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +1940 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +1940 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +1940 svchost.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +1940 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +1940 svchost.exe 0x7ff9a78b0000 True True True \Windows\System32\nsi.dll +1940 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +1940 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +1940 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +1940 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +1948 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +1948 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +1948 svchost.exe 0x7ff9a2140000 True True True \Windows\System32\wmiclnt.dll +1948 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +1948 svchost.exe 0x7ff9a1290000 True True True \Windows\System32\dusmsvc.dll +1948 svchost.exe 0x7ff99e5f0000 True True True \Windows\System32\wwapi.dll +1948 svchost.exe 0x7ff9a1ad0000 True True True \Windows\System32\wlanapi.dll +1948 svchost.exe 0x7ff9a53b0000 True True True \Windows\System32\IPHLPAPI.DLL +1948 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +1948 svchost.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +1948 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +1948 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +1948 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +1948 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +1948 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +1948 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +1948 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +1948 svchost.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +1948 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +1948 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +1948 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +1948 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +1948 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +1948 svchost.exe 0x7ff9a78b0000 True True True \Windows\System32\nsi.dll +1948 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +1948 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +1948 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +1948 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +2036 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +2036 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +2036 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +2036 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +2036 svchost.exe 0x7ff9a0d80000 True True True \Windows\System32\Windows.StateRepository.dll +2036 svchost.exe 0x7ff9a0cd0000 True True True \Windows\System32\StateRepository.Core.dll +2036 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +2036 svchost.exe 0x7ff9a57d0000 True True True \Windows\System32\cryptbase.dll +2036 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +2036 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +2036 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +2036 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +2036 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +2036 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +2036 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +2036 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +2036 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +2036 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +2036 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +2036 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +2036 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +2036 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +2036 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +2036 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +2036 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +2068 svchost.exe 0x2849aa50000 True True True \Windows\System32\wlanhlp.dll +2068 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +2068 svchost.exe 0x7ff9a2800000 True True True \Windows\System32\winnsi.dll +2068 svchost.exe 0x7ff99ffa0000 True True True \Windows\System32\wcmcsp.dll +2068 svchost.exe 0x7ff99c9f0000 True True True \Windows\System32\rilproxy.dll +2068 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +2068 svchost.exe 0x7ff99b950000 True True True \Windows\System32\CellularAPI.dll +2068 svchost.exe 0x7ff998f20000 True True True +2068 svchost.exe 0x7ff99e5f0000 True True True \Windows\System32\wwapi.dll +2068 svchost.exe 0x7ff99e2d0000 True True True \Windows\System32\tetheringclient.dll +2068 svchost.exe 0x7ff99e240000 True True True \Windows\System32\netwphelper.dll +2068 svchost.exe 0x7ff99e3d0000 True True True \Windows\System32\wifinetworkmanager.dll +2068 svchost.exe 0x7ff99ff80000 True True True \Windows\System32\cmintegrator.dll +2068 svchost.exe 0x7ff99e820000 True True True \Windows\System32\deviceaccess.dll +2068 svchost.exe 0x7ff9a0810000 True True True \Windows\System32\wcmsvc.dll +2068 svchost.exe 0x7ff9a0010000 True True True \Windows\System32\rasapi32.dll +2068 svchost.exe 0x7ff9a1ad0000 True True True \Windows\System32\wlanapi.dll +2068 svchost.exe 0x7ff9a18b0000 True True True \Windows\System32\msvcp110_win.dll +2068 svchost.exe 0x7ff9a0c50000 True True True \Windows\System32\LocationFrameworkPS.dll +2068 svchost.exe 0x7ff9a1940000 True True True \Windows\System32\policymanager.dll +2068 svchost.exe 0x7ff9a2140000 True True True \Windows\System32\wmiclnt.dll +2068 svchost.exe 0x7ff9a2120000 True True True \Windows\System32\dhcpcsvc6.dll +2068 svchost.exe 0x7ff9a25a0000 True True True \Windows\System32\dhcpcsvc.dll +2068 svchost.exe 0x7ff9a53b0000 True True True \Windows\System32\IPHLPAPI.DLL +2068 svchost.exe 0x7ff9a40e0000 True True True \Windows\System32\SystemEventsBrokerClient.dll +2068 svchost.exe 0x7ff9a2ca0000 True True True \Windows\System32\wtsapi32.dll +2068 svchost.exe 0x7ff9a2890000 True True True \Windows\System32\nlaapi.dll +2068 svchost.exe 0x7ff9a2b60000 True True True \Windows\System32\WinTypes.dll +2068 svchost.exe 0x7ff9a4c60000 True True True \Windows\System32\gpapi.dll +2068 svchost.exe 0x7ff9a49c0000 True True True \Windows\System32\devobj.dll +2068 svchost.exe 0x7ff9a4660000 True True True \Windows\System32\twinapi.appcore.dll +2068 svchost.exe 0x7ff9a5230000 True True True \Windows\System32\rsaenh.dll +2068 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +2068 svchost.exe 0x7ff9a5270000 True True True \Windows\System32\dpapi.dll +2068 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +2068 svchost.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +2068 svchost.exe 0x7ff9a57d0000 True True True \Windows\System32\cryptbase.dll +2068 svchost.exe 0x7ff9a57b0000 True True True \Windows\System32\cryptsp.dll +2068 svchost.exe 0x7ff9a5850000 True True True \Windows\System32\winsta.dll +2068 svchost.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +2068 svchost.exe 0x7ff9a5c60000 True True True \Windows\System32\userenv.dll +2068 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +2068 svchost.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +2068 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +2068 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +2068 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +2068 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +2068 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +2068 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +2068 svchost.exe 0x7ff9a64c0000 True True True \Windows\System32\windows.storage.dll +2068 svchost.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +2068 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +2068 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +2068 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +2068 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +2068 svchost.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +2068 svchost.exe 0x7ff9a7280000 True True True \Windows\System32\ole32.dll +2068 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +2068 svchost.exe 0x7ff9a78b0000 True True True \Windows\System32\nsi.dll +2068 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +2068 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +2068 svchost.exe 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +2068 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +2068 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +2068 svchost.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +2068 svchost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +2068 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +2068 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +2260 svchost.exe 0x7ff9a49c0000 True True True \Windows\System32\devobj.dll +2260 svchost.exe 0x7ff99ff30000 True True True \Windows\System32\onex.dll +2260 svchost.exe 0x7ff99ec50000 True True True \Windows\System32\msxml6.dll +2260 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +2260 svchost.exe 0x7ff99e330000 True True True \Windows\System32\NetSetupShim.dll +2260 svchost.exe 0x7ff99e300000 True True True \Windows\System32\NetSetupApi.dll +2260 svchost.exe 0x7ff99e5a0000 True True True \Windows\System32\WiFiDisplay.dll +2260 svchost.exe 0x7ff99e530000 True True True \Windows\System32\wlgpclnt.dll +2260 svchost.exe 0x7ff99eaf0000 True True True \Windows\System32\TetheringIeProvider.dll +2260 svchost.exe 0x7ff99f1b0000 True True True \Windows\System32\wlansec.dll +2260 svchost.exe 0x7ff99f040000 True True True \Windows\System32\wlansvcpal.dll +2260 svchost.exe 0x7ff99f7e0000 True True True \Windows\System32\wlansvc.dll +2260 svchost.exe 0x7ff99f770000 True True True \Windows\System32\wlanmsm.dll +2260 svchost.exe 0x7ff99ff10000 True True True \Windows\System32\eappprxy.dll +2260 svchost.exe 0x7ff9a2b00000 True True True \Windows\System32\wevtapi.dll +2260 svchost.exe 0x7ff9a25a0000 True True True \Windows\System32\dhcpcsvc.dll +2260 svchost.exe 0x7ff9a1940000 True True True \Windows\System32\policymanager.dll +2260 svchost.exe 0x7ff9a18b0000 True True True \Windows\System32\msvcp110_win.dll +2260 svchost.exe 0x7ff9a2140000 True True True \Windows\System32\wmiclnt.dll +2260 svchost.exe 0x7ff9a27f0000 True True True \Windows\System32\dsrole.dll +2260 svchost.exe 0x7ff9a4890000 True True True \Windows\System32\sysntfy.dll +2260 svchost.exe 0x7ff9a2ca0000 True True True \Windows\System32\wtsapi32.dll +2260 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +2260 svchost.exe 0x7ff9a57d0000 True True True \Windows\System32\cryptbase.dll +2260 svchost.exe 0x7ff9a53b0000 True True True \Windows\System32\IPHLPAPI.DLL +2260 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +2260 svchost.exe 0x7ff9a4c60000 True True True \Windows\System32\gpapi.dll +2260 svchost.exe 0x7ff9a5230000 True True True \Windows\System32\rsaenh.dll +2260 svchost.exe 0x7ff9a5030000 True True True \Windows\System32\authz.dll +2260 svchost.exe 0x7ff9a5270000 True True True \Windows\System32\dpapi.dll +2260 svchost.exe 0x7ff9a5610000 True True True \Windows\System32\mswsock.dll +2260 svchost.exe 0x7ff9a53f0000 True True True +2260 svchost.exe 0x7ff9a57b0000 True True True \Windows\System32\cryptsp.dll +2260 svchost.exe 0x7ff9a56c0000 True True True \Windows\System32\kerberos.dll +2260 svchost.exe 0x7ff9a58f0000 True True True \Windows\System32\ncrypt.dll +2260 svchost.exe 0x7ff9a58b0000 True True True N/A +2260 svchost.exe 0x7ff9a5850000 True True True \Windows\System32\winsta.dll +2260 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +2260 svchost.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +2260 svchost.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +2260 svchost.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +2260 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +2260 svchost.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +2260 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +2260 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +2260 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +2260 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +2260 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +2260 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +2260 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +2260 svchost.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +2260 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +2260 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +2260 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +2260 svchost.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +2260 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +2260 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +2260 svchost.exe 0x7ff9a78b0000 True True True \Windows\System32\nsi.dll +2260 svchost.exe 0x7ff9a7470000 True True True \Windows\System32\setupapi.dll +2260 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +2260 svchost.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +2260 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +2260 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +2260 svchost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +2260 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +2304 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +2304 svchost.exe 0x7ff99f050000 True True True \Windows\System32\shsvcs.dll +2304 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +2304 svchost.exe 0x7ff99ebc0000 True True True \Windows\System32\ProximityCommonPal.dll +2304 svchost.exe 0x7ff99eba0000 True True True \Windows\System32\ProximityServicePal.dll +2304 svchost.exe 0x7ff99aa30000 True True True \Windows\System32\OneCoreUAPCommonProxyStub.dll +2304 svchost.exe 0x7ff99ec00000 True True True \Windows\System32\ProximityService.dll +2304 svchost.exe 0x7ff99ebd0000 True True True \Windows\System32\ProximityCommon.dll +2304 svchost.exe 0x7ff99ef60000 True True True \Windows\System32\fveapi.dll +2304 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +2304 svchost.exe 0x7ff9a4c30000 True True True \Windows\System32\fwbase.dll +2304 svchost.exe 0x7ff9a49c0000 True True True \Windows\System32\devobj.dll +2304 svchost.exe 0x7ff9a2ca0000 True True True \Windows\System32\wtsapi32.dll +2304 svchost.exe 0x7ff9a4c20000 True True True \Windows\System32\hid.dll +2304 svchost.exe 0x7ff9a4c90000 True True True \Windows\System32\FirewallAPI.dll +2304 svchost.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +2304 svchost.exe 0x7ff9a5610000 True True True \Windows\System32\mswsock.dll +2304 svchost.exe 0x7ff9a53b0000 True True True \Windows\System32\IPHLPAPI.DLL +2304 svchost.exe 0x7ff9a5850000 True True True \Windows\System32\winsta.dll +2304 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +2304 svchost.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +2304 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +2304 svchost.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +2304 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +2304 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +2304 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +2304 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +2304 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +2304 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +2304 svchost.exe 0x7ff9a64c0000 True True True \Windows\System32\windows.storage.dll +2304 svchost.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +2304 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +2304 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +2304 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +2304 svchost.exe 0x7ff9a6fa0000 True True True \Windows\System32\coml2.dll +2304 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +2304 svchost.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +2304 svchost.exe 0x7ff9a7280000 True True True \Windows\System32\ole32.dll +2304 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +2304 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +2304 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +2304 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +2304 svchost.exe 0x7ff9a7970000 True True True \Windows\System32\shell32.dll +2304 svchost.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +2304 svchost.exe 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +2304 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +2304 svchost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +2304 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +2304 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +2364 spoolsv.exe 0x7ff9a2ca0000 True True True \Windows\System32\wtsapi32.dll +2364 spoolsv.exe 0x7ff997a30000 True True True \Windows\System32\PrintIsolationProxy.dll +2364 spoolsv.exe 0x7ff98fa40000 True True True \Windows\System32\localspl.dll +2364 spoolsv.exe 0x7ff69b060000 True False True \Windows\System32\spoolsv.exe +2364 spoolsv.exe 0x7ff98f950000 True True True \Windows\System32\usbmon.dll +2364 spoolsv.exe 0x7ff98f5a0000 True True True \Windows\System32\drvstore.dll +2364 spoolsv.exe 0x7ff98f9b0000 True True True \Windows\System32\winspool.drv +2364 spoolsv.exe 0x7ff991ec0000 True True True \Windows\System32\IPPMon.dll +2364 spoolsv.exe 0x7ff9907a0000 True True True \Windows\System32\wsnmp32.dll +2364 spoolsv.exe 0x7ff990560000 True True True \Windows\System32\inetpp.dll +2364 spoolsv.exe 0x7ff990780000 True True True N/A +2364 spoolsv.exe 0x7ff990b40000 True True True \Windows\System32\tcpmon.dll +2364 spoolsv.exe 0x7ff997360000 True True True \Windows\System32\spool\prtprocs\x64\winprint.dll +2364 spoolsv.exe 0x7ff991f00000 True True True \Windows\System32\AppMon.dll +2364 spoolsv.exe 0x7ff997390000 True True True \Windows\System32\snmpapi.dll +2364 spoolsv.exe 0x7ff997370000 True True True \Windows\System32\cscapi.dll +2364 spoolsv.exe 0x7ff99d7a0000 True True True \Windows\System32\winhttp.dll +2364 spoolsv.exe 0x7ff99b650000 True True True \Windows\System32\srvcli.dll +2364 spoolsv.exe 0x7ff999700000 True True True \Windows\System32\FXSMON.dll +2364 spoolsv.exe 0x7ff9984c0000 True True True \Windows\System32\sfc_os.dll +2364 spoolsv.exe 0x7ff9984a0000 True True True \Windows\System32\spoolss.dll +2364 spoolsv.exe 0x7ff998730000 True True True \Windows\System32\OnDemandConnRouteHelper.dll +2364 spoolsv.exe 0x7ff998750000 True True True \Windows\System32\httpapi.dll +2364 spoolsv.exe 0x7ff99a830000 True True True \Windows\System32\webservices.dll +2364 spoolsv.exe 0x7ff99a980000 True True True \Windows\System32\WSDApi.dll +2364 spoolsv.exe 0x7ff99d670000 True True True \Windows\System32\atl.dll +2364 spoolsv.exe 0x7ff99c9d0000 True True True \Windows\System32\rasadhlp.dll +2364 spoolsv.exe 0x7ff99b740000 True True True \Windows\System32\webio.dll +2364 spoolsv.exe 0x7ff99d690000 True True True \Windows\System32\fdPnp.dll +2364 spoolsv.exe 0x7ff9a0930000 True True True \Windows\System32\FWPUCLNT.DLL +2364 spoolsv.exe 0x7ff99eb00000 True True True \Windows\System32\xmllite.dll +2364 spoolsv.exe 0x7ff99daa0000 True True True \Windows\System32\fundisc.dll +2364 spoolsv.exe 0x7ff99dad0000 True True True \Windows\System32\wsdchngr.dll +2364 spoolsv.exe 0x7ff99ec50000 True True True \Windows\System32\msxml6.dll +2364 spoolsv.exe 0x7ff9a2120000 True True True \Windows\System32\dhcpcsvc6.dll +2364 spoolsv.exe 0x7ff9a0c10000 True True True \Windows\System32\wshirda.dll +2364 spoolsv.exe 0x7ff9a09f0000 True True True \Windows\System32\secur32.dll +2364 spoolsv.exe 0x7ff9a19e0000 True True True \Windows\System32\deviceassociation.dll +2364 spoolsv.exe 0x7ff9a27f0000 True True True \Windows\System32\dsrole.dll +2364 spoolsv.exe 0x7ff9a25a0000 True True True \Windows\System32\dhcpcsvc.dll +2364 spoolsv.exe 0x7ff9a2800000 True True True \Windows\System32\winnsi.dll +2364 spoolsv.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +2364 spoolsv.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +2364 spoolsv.exe 0x7ff9a53f0000 True True True +2364 spoolsv.exe 0x7ff9a4c90000 True True True \Windows\System32\FirewallAPI.dll +2364 spoolsv.exe 0x7ff9a4c30000 True True True \Windows\System32\fwbase.dll +2364 spoolsv.exe 0x7ff9a49c0000 True True True \Windows\System32\devobj.dll +2364 spoolsv.exe 0x7ff9a4c60000 True True True \Windows\System32\gpapi.dll +2364 spoolsv.exe 0x7ff9a53b0000 True True True \Windows\System32\IPHLPAPI.DLL +2364 spoolsv.exe 0x7ff9a5230000 True True True \Windows\System32\rsaenh.dll +2364 spoolsv.exe 0x7ff9a5610000 True True True \Windows\System32\mswsock.dll +2364 spoolsv.exe 0x7ff9a54a0000 True True True \Windows\System32\netutils.dll +2364 spoolsv.exe 0x7ff9a57d0000 True True True \Windows\System32\cryptbase.dll +2364 spoolsv.exe 0x7ff9a57b0000 True True True \Windows\System32\cryptsp.dll +2364 spoolsv.exe 0x7ff9a5850000 True True True \Windows\System32\winsta.dll +2364 spoolsv.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +2364 spoolsv.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +2364 spoolsv.exe 0x7ff9a5c60000 True True True \Windows\System32\userenv.dll +2364 spoolsv.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +2364 spoolsv.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +2364 spoolsv.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +2364 spoolsv.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +2364 spoolsv.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +2364 spoolsv.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +2364 spoolsv.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +2364 spoolsv.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +2364 spoolsv.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +2364 spoolsv.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +2364 spoolsv.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +2364 spoolsv.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +2364 spoolsv.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +2364 spoolsv.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +2364 spoolsv.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +2364 spoolsv.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +2364 spoolsv.exe 0x7ff9a7470000 True True True \Windows\System32\setupapi.dll +2364 spoolsv.exe 0x7ff9a7280000 True True True \Windows\System32\ole32.dll +2364 spoolsv.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +2364 spoolsv.exe 0x7ff9a78b0000 True True True \Windows\System32\nsi.dll +2364 spoolsv.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +2364 spoolsv.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +2364 spoolsv.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +2364 spoolsv.exe 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +2364 spoolsv.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +2364 spoolsv.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +2364 spoolsv.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +2424 svchost.exe 0x7ff9a2b00000 True True True \Windows\System32\wevtapi.dll +2424 svchost.exe 0x7ff99ea20000 True True True \Windows\System32\BFE.DLL +2424 svchost.exe 0x7ff99d630000 True True True \Windows\System32\wship6.dll +2424 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +2424 svchost.exe 0x7ff99caf0000 True True True \Windows\System32\wfapigp.dll +2424 svchost.exe 0x7ff99b010000 True True True \Windows\System32\MrmCoreR.dll +2424 svchost.exe 0x7ff99bb50000 True True True \Windows\System32\iertutil.dll +2424 svchost.exe 0x7ff99cbf0000 True True True \Windows\System32\urlmon.dll +2424 svchost.exe 0x7ff99d900000 True True True \Windows\System32\wshqos.dll +2424 svchost.exe 0x7ff99d640000 True True True \Windows\System32\WSHTCPIP.DLL +2424 svchost.exe 0x7ff99e560000 True True True \Windows\System32\fwpolicyiomgr.dll +2424 svchost.exe 0x7ff99e230000 True True True \Windows\System32\adhapi.dll +2424 svchost.exe 0x7ff99e610000 True True True \Windows\System32\MPSSVC.dll +2424 svchost.exe 0x7ff9a1940000 True True True \Windows\System32\policymanager.dll +2424 svchost.exe 0x7ff9a0930000 True True True \Windows\System32\FWPUCLNT.DLL +2424 svchost.exe 0x7ff9a18b0000 True True True \Windows\System32\msvcp110_win.dll +2424 svchost.exe 0x7ff9a2120000 True True True \Windows\System32\dhcpcsvc6.dll +2424 svchost.exe 0x7ff9a1f90000 True True True \Windows\System32\wkscli.dll +2424 svchost.exe 0x7ff9a2000000 True True True \Windows\System32\npmproxy.dll +2424 svchost.exe 0x7ff9a25a0000 True True True \Windows\System32\dhcpcsvc.dll +2424 svchost.exe 0x7ff9a2800000 True True True \Windows\System32\winnsi.dll +2424 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +2424 svchost.exe 0x7ff9a5030000 True True True \Windows\System32\authz.dll +2424 svchost.exe 0x7ff9a4c30000 True True True \Windows\System32\fwbase.dll +2424 svchost.exe 0x7ff9a3920000 True True True \Windows\System32\CoreMessaging.dll +2424 svchost.exe 0x7ff9a3730000 True True True \Windows\System32\httpprxc.dll +2424 svchost.exe 0x7ff9a32b0000 True True True \Windows\System32\netprofm.dll +2424 svchost.exe 0x7ff9a4640000 True True True \Windows\System32\embeddedmodesvcapi.dll +2424 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +2424 svchost.exe 0x7ff9a4c60000 True True True \Windows\System32\gpapi.dll +2424 svchost.exe 0x7ff9a4f70000 True True True \Windows\System32\ntmarta.dll +2424 svchost.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +2424 svchost.exe 0x7ff9a53f0000 True True True +2424 svchost.exe 0x7ff9a53b0000 True True True \Windows\System32\IPHLPAPI.DLL +2424 svchost.exe 0x7ff9a5610000 True True True \Windows\System32\mswsock.dll +2424 svchost.exe 0x7ff9a54a0000 True True True \Windows\System32\netutils.dll +2424 svchost.exe 0x7ff9a57d0000 True True True \Windows\System32\cryptbase.dll +2424 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +2424 svchost.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +2424 svchost.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +2424 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +2424 svchost.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +2424 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +2424 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +2424 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +2424 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +2424 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +2424 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +2424 svchost.exe 0x7ff9a64c0000 True True True \Windows\System32\windows.storage.dll +2424 svchost.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +2424 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +2424 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +2424 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +2424 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +2424 svchost.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +2424 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +2424 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +2424 svchost.exe 0x7ff9a78b0000 True True True \Windows\System32\nsi.dll +2424 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +2424 svchost.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +2424 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +2424 svchost.exe 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +2424 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +2424 svchost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +2424 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +2424 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +2504 svchost.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +2504 svchost.exe 0x7ff99eb50000 True True True \Windows\System32\wkssvc.dll +2504 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +2504 svchost.exe 0x7ff99eb40000 True True True \Windows\System32\dsparse.dll +2504 svchost.exe 0x7ff9a4c60000 True True True \Windows\System32\gpapi.dll +2504 svchost.exe 0x7ff9a18b0000 True True True \Windows\System32\msvcp110_win.dll +2504 svchost.exe 0x7ff99eeb0000 True True True \Windows\System32\dsreg.dll +2504 svchost.exe 0x7ff9a1880000 True True True \Windows\System32\netjoin.dll +2504 svchost.exe 0x7ff9a2800000 True True True \Windows\System32\winnsi.dll +2504 svchost.exe 0x7ff9a2730000 True True True \Windows\System32\taskschd.dll +2504 svchost.exe 0x7ff9a53b0000 True True True \Windows\System32\IPHLPAPI.DLL +2504 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +2504 svchost.exe 0x7ff9a57b0000 True True True \Windows\System32\cryptsp.dll +2504 svchost.exe 0x7ff9a54a0000 True True True \Windows\System32\netutils.dll +2504 svchost.exe 0x7ff9a5810000 True True True \Windows\System32\joinutil.dll +2504 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +2504 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +2504 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +2504 svchost.exe 0x7ff9a5c60000 True True True \Windows\System32\userenv.dll +2504 svchost.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +2504 svchost.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +2504 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +2504 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +2504 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +2504 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +2504 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +2504 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +2504 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +2504 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +2504 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +2504 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +2504 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +2504 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +2504 svchost.exe 0x7ff9a78b0000 True True True \Windows\System32\nsi.dll +2504 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +2504 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +2504 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +2504 svchost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +2504 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +2656 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +2656 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +2656 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +2656 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +2656 svchost.exe 0x7ff99dd60000 True True True \Windows\System32\das.dll +2656 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +2656 svchost.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +2656 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +2656 svchost.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +2656 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +2656 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +2656 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +2656 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +2656 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +2656 svchost.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +2656 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +2656 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +2656 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +2656 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +2656 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +2656 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +2656 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +2656 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +2656 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +2664 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +2664 svchost.exe 0x7ff9a4410000 True True True \Windows\System32\apphelp.dll +2664 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +2664 svchost.exe 0x7ff99d910000 True True True \Windows\System32\pcasvc.dll +2664 svchost.exe 0x7ff989010000 True True True \Windows\System32\aeinv.dll +2664 svchost.exe 0x7ff99eb00000 True True True \Windows\System32\xmllite.dll +2664 svchost.exe 0x7ff9a2ca0000 True True True \Windows\System32\wtsapi32.dll +2664 svchost.exe 0x7ff9a5850000 True True True \Windows\System32\winsta.dll +2664 svchost.exe 0x7ff9a5230000 True True True \Windows\System32\rsaenh.dll +2664 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +2664 svchost.exe 0x7ff9a4f70000 True True True \Windows\System32\ntmarta.dll +2664 svchost.exe 0x7ff9a57b0000 True True True \Windows\System32\cryptsp.dll +2664 svchost.exe 0x7ff9a57d0000 True True True \Windows\System32\cryptbase.dll +2664 svchost.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +2664 svchost.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +2664 svchost.exe 0x7ff9a5c60000 True True True \Windows\System32\userenv.dll +2664 svchost.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +2664 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +2664 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +2664 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +2664 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +2664 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +2664 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +2664 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +2664 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +2664 svchost.exe 0x7ff9a64c0000 True True True \Windows\System32\windows.storage.dll +2664 svchost.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +2664 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +2664 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +2664 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +2664 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +2664 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +2664 svchost.exe 0x7ff9a7280000 True True True \Windows\System32\ole32.dll +2664 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +2664 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +2664 svchost.exe 0x7ff9a7970000 True True True \Windows\System32\shell32.dll +2664 svchost.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +2664 svchost.exe 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +2664 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +2664 svchost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +2664 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +2664 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +2672 SynTPEnhServic 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +2672 SynTPEnhServic 0x7ff9a4410000 True True True \Windows\System32\apphelp.dll +2672 SynTPEnhServic 0x7ff668c90000 True False True \Program Files\Synaptics\SynTP\SynTPEnhService.exe +2672 SynTPEnhServic 0x7ff9a2ca0000 True True True \Windows\System32\wtsapi32.dll +2672 SynTPEnhServic 0x7ff9a5c60000 True True True \Windows\System32\userenv.dll +2672 SynTPEnhServic 0x7ff9a5850000 True True True \Windows\System32\winsta.dll +2672 SynTPEnhServic 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +2672 SynTPEnhServic 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +2672 SynTPEnhServic 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +2672 SynTPEnhServic 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +2672 SynTPEnhServic 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +2672 SynTPEnhServic 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +2672 SynTPEnhServic 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +2672 SynTPEnhServic 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +2672 SynTPEnhServic 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +2672 SynTPEnhServic 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +2672 SynTPEnhServic 0x7ff9a7130000 True True True \Windows\System32\user32.dll +2672 SynTPEnhServic 0x7ff9a7470000 True True True \Windows\System32\setupapi.dll +2672 SynTPEnhServic 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +2672 SynTPEnhServic 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +2672 SynTPEnhServic 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +2672 SynTPEnhServic 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +2688 MsMpEng.exe 0x7ff99daf0000 True True True \Windows\System32\slc.dll +2688 MsMpEng.exe 0x7ff99b6e0000 True True True \ProgramData\Microsoft\Windows Defender\Platform\4.16.17656.18052-0\MpCommu.dll +2688 MsMpEng.exe 0x7ff9907e0000 True True True \Windows\System32\amsiproxy.dll +2688 MsMpEng.exe 0x7ff799490000 True False True \ProgramData\Microsoft\Windows Defender\Platform\4.16.17656.18052-0\MsMpEng.exe +2688 MsMpEng.exe 0x7ff98dda0000 True True True \ProgramData\Microsoft\Windows Defender\Definition Updates\{436C9286-336A-4FBE-A693-D92D1C8CFE33}\mpengine.dll +2688 MsMpEng.exe 0x7ff9980d0000 True True True \Windows\System32\mskeyprotect.dll +2688 MsMpEng.exe 0x7ff9973d0000 True True True \Windows\System32\msIso.dll +2688 MsMpEng.exe 0x7ff995fe0000 True True True \Windows\System32\wininet.dll +2688 MsMpEng.exe 0x7ff998070000 True True True \Windows\System32\cryptnet.dll +2688 MsMpEng.exe 0x7ff998180000 True True True \Windows\System32\ncryptsslp.dll +2688 MsMpEng.exe 0x7ff998730000 True True True \Windows\System32\OnDemandConnRouteHelper.dll +2688 MsMpEng.exe 0x7ff99af70000 True True True \ProgramData\Microsoft\Windows Defender\Platform\4.16.17656.18052-0\MpRtp.dll +2688 MsMpEng.exe 0x7ff99cbf0000 True True True \Windows\System32\urlmon.dll +2688 MsMpEng.exe 0x7ff99b740000 True True True \Windows\System32\webio.dll +2688 MsMpEng.exe 0x7ff99bb50000 True True True \Windows\System32\iertutil.dll +2688 MsMpEng.exe 0x7ff99c9d0000 True True True \Windows\System32\rasadhlp.dll +2688 MsMpEng.exe 0x7ff99d880000 True True True \Windows\System32\sppc.dll +2688 MsMpEng.exe 0x7ff99d7a0000 True True True \Windows\System32\winhttp.dll +2688 MsMpEng.exe 0x7ff99d9c0000 True True True \ProgramData\Microsoft\Windows Defender\Platform\4.16.17656.18052-0\MpClient.dll +2688 MsMpEng.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +2688 MsMpEng.exe 0x7ff9a2ca0000 True True True \Windows\System32\wtsapi32.dll +2688 MsMpEng.exe 0x7ff99ff00000 True True True \Windows\System32\fltLib.dll +2688 MsMpEng.exe 0x7ff99df40000 True True True \ProgramData\Microsoft\Windows Defender\Platform\4.16.17656.18052-0\MpSvc.dll +2688 MsMpEng.exe 0x7ff99dba0000 True True True \Windows\System32\wbemcomn.dll +2688 MsMpEng.exe 0x7ff99e220000 True True True \Windows\System32\version.dll +2688 MsMpEng.exe 0x7ff9a18b0000 True True True \Windows\System32\msvcp110_win.dll +2688 MsMpEng.exe 0x7ff9a0930000 True True True \Windows\System32\FWPUCLNT.DLL +2688 MsMpEng.exe 0x7ff9a1fc0000 True True True \Windows\System32\wscapi.dll +2688 MsMpEng.exe 0x7ff9a2800000 True True True \Windows\System32\winnsi.dll +2688 MsMpEng.exe 0x7ff9a4e20000 True True True \Windows\System32\tdh.dll +2688 MsMpEng.exe 0x7ff9a4c60000 True True True \Windows\System32\gpapi.dll +2688 MsMpEng.exe 0x7ff9a37f0000 True True True \Windows\System32\WofUtil.dll +2688 MsMpEng.exe 0x7ff9a4dd0000 True True True \Windows\System32\mintdh.dll +2688 MsMpEng.exe 0x7ff9a5170000 True True True \Windows\System32\schannel.dll +2688 MsMpEng.exe 0x7ff9a4f70000 True True True \Windows\System32\ntmarta.dll +2688 MsMpEng.exe 0x7ff9a5230000 True True True \Windows\System32\rsaenh.dll +2688 MsMpEng.exe 0x7ff9a5270000 True True True \Windows\System32\dpapi.dll +2688 MsMpEng.exe 0x7ff9a57b0000 True True True \Windows\System32\cryptsp.dll +2688 MsMpEng.exe 0x7ff9a53f0000 True True True +2688 MsMpEng.exe 0x7ff9a5610000 True True True \Windows\System32\mswsock.dll +2688 MsMpEng.exe 0x7ff9a5850000 True True True \Windows\System32\winsta.dll +2688 MsMpEng.exe 0x7ff9a57d0000 True True True \Windows\System32\cryptbase.dll +2688 MsMpEng.exe 0x7ff9a58f0000 True True True \Windows\System32\ncrypt.dll +2688 MsMpEng.exe 0x7ff9a58b0000 True True True N/A +2688 MsMpEng.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +2688 MsMpEng.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +2688 MsMpEng.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +2688 MsMpEng.exe 0x7ff9a5c60000 True True True \Windows\System32\userenv.dll +2688 MsMpEng.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +2688 MsMpEng.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +2688 MsMpEng.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +2688 MsMpEng.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +2688 MsMpEng.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +2688 MsMpEng.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +2688 MsMpEng.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +2688 MsMpEng.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +2688 MsMpEng.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +2688 MsMpEng.exe 0x7ff9a64c0000 True True True \Windows\System32\windows.storage.dll +2688 MsMpEng.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +2688 MsMpEng.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +2688 MsMpEng.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +2688 MsMpEng.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +2688 MsMpEng.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +2688 MsMpEng.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +2688 MsMpEng.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +2688 MsMpEng.exe 0x7ff9a7280000 True True True \Windows\System32\ole32.dll +2688 MsMpEng.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +2688 MsMpEng.exe 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +2688 MsMpEng.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +2688 MsMpEng.exe 0x7ff9a8db0000 True True True \Windows\System32\psapi.dll +2688 MsMpEng.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +2688 MsMpEng.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +2688 MsMpEng.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +2688 MsMpEng.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +2688 MsMpEng.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +2696 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +2696 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +2696 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +2696 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +2696 svchost.exe 0x7ff99def0000 True True True \Windows\System32\trkwks.dll +2696 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +2696 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +2696 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +2696 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +2696 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +2696 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +2696 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +2696 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +2696 svchost.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +2696 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +2696 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +2696 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +2696 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +2696 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +2696 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +2696 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +2696 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +2704 svchost.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +2704 svchost.exe 0x7ff99e220000 True True True \Windows\System32\version.dll +2704 svchost.exe 0x7ff99d670000 True True True \Windows\System32\atl.dll +2704 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +2704 svchost.exe 0x7ff994ca0000 True True True \Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.15063.608_none_56f0266b425534e9\GdiPlus.dll +2704 svchost.exe 0x7ff998750000 True True True \Windows\System32\httpapi.dll +2704 svchost.exe 0x7ff998730000 True True True \Windows\System32\OnDemandConnRouteHelper.dll +2704 svchost.exe 0x7ff99a980000 True True True \Windows\System32\WSDApi.dll +2704 svchost.exe 0x7ff99a830000 True True True \Windows\System32\webservices.dll +2704 svchost.exe 0x7ff99b740000 True True True \Windows\System32\webio.dll +2704 svchost.exe 0x7ff99daa0000 True True True \Windows\System32\fundisc.dll +2704 svchost.exe 0x7ff99d690000 True True True \Windows\System32\fdPnp.dll +2704 svchost.exe 0x7ff99d7a0000 True True True \Windows\System32\winhttp.dll +2704 svchost.exe 0x7ff99db40000 True True True \Windows\System32\wiatrace.dll +2704 svchost.exe 0x7ff99dad0000 True True True \Windows\System32\wsdchngr.dll +2704 svchost.exe 0x7ff99dc30000 True True True \Windows\System32\wiaservc.dll +2704 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +2704 svchost.exe 0x7ff9a49c0000 True True True \Windows\System32\devobj.dll +2704 svchost.exe 0x7ff9a19e0000 True True True \Windows\System32\deviceassociation.dll +2704 svchost.exe 0x7ff99eb00000 True True True \Windows\System32\xmllite.dll +2704 svchost.exe 0x7ff9a25a0000 True True True \Windows\System32\dhcpcsvc.dll +2704 svchost.exe 0x7ff9a2120000 True True True \Windows\System32\dhcpcsvc6.dll +2704 svchost.exe 0x7ff9a2800000 True True True \Windows\System32\winnsi.dll +2704 svchost.exe 0x7ff9a4c30000 True True True \Windows\System32\fwbase.dll +2704 svchost.exe 0x7ff9a4c90000 True True True \Windows\System32\FirewallAPI.dll +2704 svchost.exe 0x7ff9a55a0000 True True True \Windows\System32\msv1_0.dll +2704 svchost.exe 0x7ff9a5590000 True True True \Windows\System32\NtlmShared.dll +2704 svchost.exe 0x7ff9a53b0000 True True True \Windows\System32\IPHLPAPI.DLL +2704 svchost.exe 0x7ff9a5670000 True True True \Windows\System32\cryptdll.dll +2704 svchost.exe 0x7ff9a5610000 True True True \Windows\System32\mswsock.dll +2704 svchost.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +2704 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +2704 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +2704 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +2704 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +2704 svchost.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +2704 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +2704 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +2704 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +2704 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +2704 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +2704 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +2704 svchost.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +2704 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +2704 svchost.exe 0x7ff9a7280000 True True True \Windows\System32\ole32.dll +2704 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +2704 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +2704 svchost.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +2704 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +2704 svchost.exe 0x7ff9a7470000 True True True \Windows\System32\setupapi.dll +2704 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +2704 svchost.exe 0x7ff9a78b0000 True True True \Windows\System32\nsi.dll +2704 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +2704 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +2704 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +2704 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +2704 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +2704 svchost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +2712 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +2712 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +2712 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +2712 svchost.exe 0x7ff9a2120000 True True True \Windows\System32\dhcpcsvc6.dll +2712 svchost.exe 0x7ff99c9d0000 True True True \Windows\System32\rasadhlp.dll +2712 svchost.exe 0x7ff998730000 True True True \Windows\System32\OnDemandConnRouteHelper.dll +2712 svchost.exe 0x7ff99d7a0000 True True True \Windows\System32\winhttp.dll +2712 svchost.exe 0x7ff9a2800000 True True True \Windows\System32\winnsi.dll +2712 svchost.exe 0x7ff9a25a0000 True True True \Windows\System32\dhcpcsvc.dll +2712 svchost.exe 0x7ff9a5610000 True True True \Windows\System32\mswsock.dll +2712 svchost.exe 0x7ff9a53b0000 True True True \Windows\System32\IPHLPAPI.DLL +2712 svchost.exe 0x7ff9a53f0000 True True True +2712 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +2712 svchost.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +2712 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +2712 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +2712 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +2712 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +2712 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +2712 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +2712 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +2712 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +2712 svchost.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +2712 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +2712 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +2712 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +2712 svchost.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +2712 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +2712 svchost.exe 0x7ff9a78b0000 True True True \Windows\System32\nsi.dll +2712 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +2712 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +2712 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +2712 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +2720 svchost.exe 0x7ff99d6b0000 True True True \Windows\System32\wpnservice.dll +2720 svchost.exe 0x7ff99b7e0000 True True True \Windows\System32\VEEventDispatcher.dll +2720 svchost.exe 0x7ff998180000 True True True \Windows\System32\ncryptsslp.dll +2720 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +2720 svchost.exe 0x7ff9980d0000 True True True \Windows\System32\mskeyprotect.dll +2720 svchost.exe 0x7ff9982f0000 True True True \Windows\System32\wpnprv.dll +2720 svchost.exe 0x7ff9981b0000 True True True \Windows\System32\Windows.Networking.Sockets.PushEnabledApplication.dll +2720 svchost.exe 0x7ff9996e0000 True True True \Windows\System32\keepaliveprovider.dll +2720 svchost.exe 0x7ff998380000 True True True \Windows\System32\Windows.Networking.Connectivity.dll +2720 svchost.exe 0x7ff99aa30000 True True True \Windows\System32\OneCoreUAPCommonProxyStub.dll +2720 svchost.exe 0x7ff99ca30000 True True True \Windows\System32\winsqlite3.dll +2720 svchost.exe 0x7ff99bee0000 True True True \Windows\System32\cdp.dll +2720 svchost.exe 0x7ff99bb50000 True True True \Windows\System32\iertutil.dll +2720 svchost.exe 0x7ff99c9d0000 True True True \Windows\System32\rasadhlp.dll +2720 svchost.exe 0x7ff99cbf0000 True True True \Windows\System32\urlmon.dll +2720 svchost.exe 0x7ff99cdc0000 True True True \Windows\System32\wpncore.dll +2720 svchost.exe 0x7ff9a58f0000 True True True \Windows\System32\ncrypt.dll +2720 svchost.exe 0x7ff9a2b60000 True True True \Windows\System32\WinTypes.dll +2720 svchost.exe 0x7ff9a18b0000 True True True \Windows\System32\msvcp110_win.dll +2720 svchost.exe 0x7ff99eb00000 True True True \Windows\System32\xmllite.dll +2720 svchost.exe 0x7ff99d7a0000 True True True \Windows\System32\winhttp.dll +2720 svchost.exe 0x7ff9a0930000 True True True \Windows\System32\FWPUCLNT.DLL +2720 svchost.exe 0x7ff9a2000000 True True True \Windows\System32\npmproxy.dll +2720 svchost.exe 0x7ff9a1ad0000 True True True \Windows\System32\wlanapi.dll +2720 svchost.exe 0x7ff9a1a80000 True True True \Windows\System32\usermgrcli.dll +2720 svchost.exe 0x7ff9a1f90000 True True True \Windows\System32\wkscli.dll +2720 svchost.exe 0x7ff9a2890000 True True True \Windows\System32\nlaapi.dll +2720 svchost.exe 0x7ff9a53b0000 True True True \Windows\System32\IPHLPAPI.DLL +2720 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +2720 svchost.exe 0x7ff9a32b0000 True True True \Windows\System32\netprofm.dll +2720 svchost.exe 0x7ff9a2ca0000 True True True \Windows\System32\wtsapi32.dll +2720 svchost.exe 0x7ff9a4660000 True True True \Windows\System32\twinapi.appcore.dll +2720 svchost.exe 0x7ff9a5230000 True True True \Windows\System32\rsaenh.dll +2720 svchost.exe 0x7ff9a5170000 True True True \Windows\System32\schannel.dll +2720 svchost.exe 0x7ff9a5270000 True True True \Windows\System32\dpapi.dll +2720 svchost.exe 0x7ff9a57d0000 True True True \Windows\System32\cryptbase.dll +2720 svchost.exe 0x7ff9a54a0000 True True True \Windows\System32\netutils.dll +2720 svchost.exe 0x7ff9a53f0000 True True True +2720 svchost.exe 0x7ff9a5610000 True True True \Windows\System32\mswsock.dll +2720 svchost.exe 0x7ff9a57b0000 True True True \Windows\System32\cryptsp.dll +2720 svchost.exe 0x7ff9a58b0000 True True True N/A +2720 svchost.exe 0x7ff9a5850000 True True True \Windows\System32\winsta.dll +2720 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +2720 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +2720 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +2720 svchost.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +2720 svchost.exe 0x7ff9a5b90000 True True True \Windows\System32\sxs.dll +2720 svchost.exe 0x7ff9a5b70000 True True True \Windows\System32\EventAggregation.dll +2720 svchost.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +2720 svchost.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +2720 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +2720 svchost.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +2720 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +2720 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +2720 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +2720 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +2720 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +2720 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +2720 svchost.exe 0x7ff9a64c0000 True True True \Windows\System32\windows.storage.dll +2720 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +2720 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +2720 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +2720 svchost.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +2720 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +2720 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +2720 svchost.exe 0x7ff9a7280000 True True True \Windows\System32\ole32.dll +2720 svchost.exe 0x7ff9a78b0000 True True True \Windows\System32\nsi.dll +2720 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +2720 svchost.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +2720 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +2720 svchost.exe 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +2720 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +2720 svchost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +2720 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +2720 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +2736 svchost.exe 0x1b6207e0000 False False False \Windows\System32\winnlsres.dll +2736 svchost.exe 0x1b6207f0000 False False False \Windows\System32\en-US\winnlsres.dll.mui +2736 svchost.exe 0x1b6209c0000 False False False \Windows\System32\en-US\mswsock.dll.mui +2736 svchost.exe 0x1b6209e0000 True True True \Windows\System32\sfc.dll +2736 svchost.exe 0x1b621200000 False False False \Windows\System32\en-US\KernelBase.dll.mui +2736 svchost.exe 0x7ff9a5c60000 True True True \Windows\System32\userenv.dll +2736 svchost.exe 0x7ff9a1540000 True True True \Windows\System32\dbghelp.dll +2736 svchost.exe 0x7ff9984e0000 True True True \Windows\System32\wpnapps.dll +2736 svchost.exe 0x7ff9980d0000 True True True \Windows\System32\mskeyprotect.dll +2736 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +2736 svchost.exe 0x7ff998020000 True True True \Windows\System32\CourtesyEngine.dll +2736 svchost.exe 0x7ff990e70000 True True True \Windows\System32\Windows.Security.Authentication.Web.Core.dll +2736 svchost.exe 0x7ff98f5a0000 True True True \Windows\System32\drvstore.dll +2736 svchost.exe 0x7ff997500000 True True True \Windows\System32\aepic.dll +2736 svchost.exe 0x7ff998070000 True True True \Windows\System32\cryptnet.dll +2736 svchost.exe 0x7ff9981e0000 True True True \Windows\System32\Windows.Security.Authentication.OnlineId.dll +2736 svchost.exe 0x7ff998180000 True True True \Windows\System32\ncryptsslp.dll +2736 svchost.exe 0x7ff998430000 True True True \Windows\System32\OneCoreCommonProxyStub.dll +2736 svchost.exe 0x7ff998380000 True True True \Windows\System32\Windows.Networking.Connectivity.dll +2736 svchost.exe 0x7ff9984c0000 True True True \Windows\System32\sfc_os.dll +2736 svchost.exe 0x7ff99c8b0000 True True True \Windows\System32\windowsperformancerecordercontrol.dll +2736 svchost.exe 0x7ff99a740000 True True True \Windows\System32\bcd.dll +2736 svchost.exe 0x7ff998a20000 True True True \Windows\System32\vaultcli.dll +2736 svchost.exe 0x7ff998730000 True True True \Windows\System32\OnDemandConnRouteHelper.dll +2736 svchost.exe 0x7ff9998d0000 True True True \Windows\System32\netapi32.dll +2736 svchost.exe 0x7ff99aa30000 True True True \Windows\System32\OneCoreUAPCommonProxyStub.dll +2736 svchost.exe 0x7ff99a760000 True True True \Windows\System32\FlightSettings.dll +2736 svchost.exe 0x7ff99a830000 True True True \Windows\System32\webservices.dll +2736 svchost.exe 0x7ff99b740000 True True True \Windows\System32\webio.dll +2736 svchost.exe 0x7ff99bb50000 True True True \Windows\System32\iertutil.dll +2736 svchost.exe 0x7ff99d7a0000 True True True \Windows\System32\winhttp.dll +2736 svchost.exe 0x7ff99cf60000 True True True \Windows\System32\diagtrack.dll +2736 svchost.exe 0x7ff99c9d0000 True True True \Windows\System32\rasadhlp.dll +2736 svchost.exe 0x7ff99eeb0000 True True True \Windows\System32\dsreg.dll +2736 svchost.exe 0x7ff99eb00000 True True True \Windows\System32\xmllite.dll +2736 svchost.exe 0x7ff9a0400000 True True True \Windows\System32\cryptxml.dll +2736 svchost.exe 0x7ff99f0f0000 True True True \Windows\System32\wer.dll +2736 svchost.exe 0x7ff9a4660000 True True True \Windows\System32\twinapi.appcore.dll +2736 svchost.exe 0x7ff9a1f50000 True True True \Windows\System32\logoncli.dll +2736 svchost.exe 0x7ff9a1a00000 True True True \Windows\System32\dbgcore.dll +2736 svchost.exe 0x7ff9a1940000 True True True \Windows\System32\policymanager.dll +2736 svchost.exe 0x7ff9a18b0000 True True True \Windows\System32\msvcp110_win.dll +2736 svchost.exe 0x7ff9a1a80000 True True True \Windows\System32\usermgrcli.dll +2736 svchost.exe 0x7ff9a1ad0000 True True True \Windows\System32\wlanapi.dll +2736 svchost.exe 0x7ff9a25a0000 True True True \Windows\System32\dhcpcsvc.dll +2736 svchost.exe 0x7ff9a2000000 True True True \Windows\System32\npmproxy.dll +2736 svchost.exe 0x7ff9a1f90000 True True True \Windows\System32\wkscli.dll +2736 svchost.exe 0x7ff9a2120000 True True True \Windows\System32\dhcpcsvc6.dll +2736 svchost.exe 0x7ff9a20b0000 True True True \Windows\System32\devrtl.dll +2736 svchost.exe 0x7ff9a2b60000 True True True \Windows\System32\WinTypes.dll +2736 svchost.exe 0x7ff9a2800000 True True True \Windows\System32\winnsi.dll +2736 svchost.exe 0x7ff9a2730000 True True True \Windows\System32\taskschd.dll +2736 svchost.exe 0x7ff9a2ca0000 True True True \Windows\System32\wtsapi32.dll +2736 svchost.exe 0x7ff9a53b0000 True True True \Windows\System32\IPHLPAPI.DLL +2736 svchost.exe 0x7ff9a4f70000 True True True \Windows\System32\ntmarta.dll +2736 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +2736 svchost.exe 0x7ff9a4c60000 True True True \Windows\System32\gpapi.dll +2736 svchost.exe 0x7ff9a5230000 True True True \Windows\System32\rsaenh.dll +2736 svchost.exe 0x7ff9a5170000 True True True \Windows\System32\schannel.dll +2736 svchost.exe 0x7ff9a5270000 True True True \Windows\System32\dpapi.dll +2736 svchost.exe 0x7ff9a57b0000 True True True \Windows\System32\cryptsp.dll +2736 svchost.exe 0x7ff9a54a0000 True True True \Windows\System32\netutils.dll +2736 svchost.exe 0x7ff9a53f0000 True True True +2736 svchost.exe 0x7ff9a5610000 True True True \Windows\System32\mswsock.dll +2736 svchost.exe 0x7ff9a5850000 True True True \Windows\System32\winsta.dll +2736 svchost.exe 0x7ff9a57d0000 True True True \Windows\System32\cryptbase.dll +2736 svchost.exe 0x7ff9a58f0000 True True True \Windows\System32\ncrypt.dll +2736 svchost.exe 0x7ff9a58b0000 True True True N/A +2736 svchost.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +2736 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +2736 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +2736 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +2736 svchost.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +2736 svchost.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +2736 svchost.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +2736 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +2736 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +2736 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +2736 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +2736 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +2736 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +2736 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +2736 svchost.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +2736 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +2736 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +2736 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +2736 svchost.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +2736 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +2736 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +2736 svchost.exe 0x7ff9a78b0000 True True True \Windows\System32\nsi.dll +2736 svchost.exe 0x7ff9a7470000 True True True \Windows\System32\setupapi.dll +2736 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +2736 svchost.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +2736 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +2736 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +2736 svchost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +2736 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +2736 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +2748 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +2748 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +2748 svchost.exe 0x7ff998060000 True True True \Windows\System32\pnpts.dll +2748 svchost.exe 0x7ff992260000 True True True \Windows\System32\radardt.dll +2748 svchost.exe 0x7ff9986a0000 True True True \Windows\System32\srumapi.dll +2748 svchost.exe 0x7ff99b5b0000 True True True \Windows\System32\appsruprov.dll +2748 svchost.exe 0x7ff99aa30000 True True True \Windows\System32\OneCoreUAPCommonProxyStub.dll +2748 svchost.exe 0x7ff99bb10000 True True True \Windows\System32\srumsvc.dll +2748 svchost.exe 0x7ff9a4c60000 True True True \Windows\System32\gpapi.dll +2748 svchost.exe 0x7ff9a2730000 True True True \Windows\System32\taskschd.dll +2748 svchost.exe 0x7ff99dd10000 True True True \Windows\System32\dps.dll +2748 svchost.exe 0x7ff99d1d0000 True True True \Windows\System32\esent.dll +2748 svchost.exe 0x7ff99db20000 True True True \Windows\System32\wdi.dll +2748 svchost.exe 0x7ff9a01c0000 True True True \Windows\System32\energy.dll +2748 svchost.exe 0x7ff9a2ca0000 True True True \Windows\System32\wtsapi32.dll +2748 svchost.exe 0x7ff9a49c0000 True True True \Windows\System32\devobj.dll +2748 svchost.exe 0x7ff9a53b0000 True True True \Windows\System32\IPHLPAPI.DLL +2748 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +2748 svchost.exe 0x7ff9a4e20000 True True True \Windows\System32\tdh.dll +2748 svchost.exe 0x7ff9a4dd0000 True True True \Windows\System32\mintdh.dll +2748 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +2748 svchost.exe 0x7ff9a5850000 True True True \Windows\System32\winsta.dll +2748 svchost.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +2748 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +2748 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +2748 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +2748 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +2748 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +2748 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +2748 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +2748 svchost.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +2748 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +2748 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +2748 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +2748 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +2748 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +2748 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +2748 svchost.exe 0x7ff9a7280000 True True True \Windows\System32\ole32.dll +2748 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +2748 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +2748 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +2748 svchost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +2748 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +2748 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +2764 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +2764 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +2764 svchost.exe 0x7ff99df20000 True True True \Windows\System32\osrss.dll +2764 svchost.exe 0x7ff998180000 True True True \Windows\System32\ncryptsslp.dll +2764 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +2764 svchost.exe 0x7ff9980d0000 True True True \Windows\System32\mskeyprotect.dll +2764 svchost.exe 0x7ff99b740000 True True True \Windows\System32\webio.dll +2764 svchost.exe 0x7ff998730000 True True True \Windows\System32\OnDemandConnRouteHelper.dll +2764 svchost.exe 0x7ff998890000 True True True \Windows\System32\cabinet.dll +2764 svchost.exe 0x7ff99d7a0000 True True True \Windows\System32\winhttp.dll +2764 svchost.exe 0x7ff99c9d0000 True True True \Windows\System32\rasadhlp.dll +2764 svchost.exe 0x7ff99dde0000 True True True \Windows\System32\ktmw32.dll +2764 svchost.exe 0x7ff9a2120000 True True True \Windows\System32\dhcpcsvc6.dll +2764 svchost.exe 0x7ff9a20b0000 False False False \Windows\System32\devrtl.dll +2764 svchost.exe 0x7ff9a2800000 True True True \Windows\System32\winnsi.dll +2764 svchost.exe 0x7ff9a25a0000 True True True \Windows\System32\dhcpcsvc.dll +2764 svchost.exe 0x7ff9a4c60000 True True True \Windows\System32\gpapi.dll +2764 svchost.exe 0x7ff9a57b0000 True True True \Windows\System32\cryptsp.dll +2764 svchost.exe 0x7ff9a53b0000 True True True \Windows\System32\IPHLPAPI.DLL +2764 svchost.exe 0x7ff9a5230000 True True True \Windows\System32\rsaenh.dll +2764 svchost.exe 0x7ff9a5170000 True True True \Windows\System32\schannel.dll +2764 svchost.exe 0x7ff9a5270000 True True True \Windows\System32\dpapi.dll +2764 svchost.exe 0x7ff9a5610000 True True True \Windows\System32\mswsock.dll +2764 svchost.exe 0x7ff9a53f0000 True True True +2764 svchost.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +2764 svchost.exe 0x7ff9a58b0000 True True True N/A +2764 svchost.exe 0x7ff9a57d0000 True True True \Windows\System32\cryptbase.dll +2764 svchost.exe 0x7ff9a58f0000 True True True \Windows\System32\ncrypt.dll +2764 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +2764 svchost.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +2764 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +2764 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +2764 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +2764 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +2764 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +2764 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +2764 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +2764 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +2764 svchost.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +2764 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +2764 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +2764 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +2764 svchost.exe 0x7ff9a6e50000 True True True \Windows\System32\imagehlp.dll +2764 svchost.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +2764 svchost.exe 0x7ff9a7280000 True True True \Windows\System32\ole32.dll +2764 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +2764 svchost.exe 0x7ff9a7470000 True True True \Windows\System32\setupapi.dll +2764 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +2764 svchost.exe 0x7ff9a78b0000 True True True \Windows\System32\nsi.dll +2764 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +2764 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +2764 svchost.exe 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +2764 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +2764 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +2764 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +2772 svchost.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +2772 svchost.exe 0x7ff99dcd0000 True True True \Windows\System32\wbem\WMIsvc.dll +2772 svchost.exe 0x7ff99b470000 True True True \Windows\System32\wbem\wbemcore.dll +2772 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +2772 svchost.exe 0x7ff99b1b0000 True True True \Windows\System32\wbem\WmiPrvSD.dll +2772 svchost.exe 0x7ff99b120000 True True True \Windows\System32\wbem\wbemess.dll +2772 svchost.exe 0x7ff999820000 True True True \Windows\System32\wbem\NCProv.dll +2772 svchost.exe 0x7ff99b300000 True True True \Windows\System32\wbem\fastprox.dll +2772 svchost.exe 0x7ff99b290000 True True True \Windows\System32\wbem\repdrvfs.dll +2772 svchost.exe 0x7ff99b3f0000 True True True \Windows\System32\wbem\esscli.dll +2772 svchost.exe 0x7ff99b880000 True True True \Windows\System32\wbem\wbemsvc.dll +2772 svchost.exe 0x7ff99b850000 True True True \Windows\System32\wbem\wmiutils.dll +2772 svchost.exe 0x7ff99b630000 True True True \Windows\System32\ncobjapi.dll +2772 svchost.exe 0x7ff99ca10000 True True True \Windows\System32\samcli.dll +2772 svchost.exe 0x7ff99c880000 True True True \Windows\System32\samlib.dll +2772 svchost.exe 0x7ff99dba0000 True True True \Windows\System32\wbemcomn.dll +2772 svchost.exe 0x7ff9a5030000 True True True \Windows\System32\authz.dll +2772 svchost.exe 0x7ff9a2140000 True True True \Windows\System32\wmiclnt.dll +2772 svchost.exe 0x7ff99f260000 True True True \Windows\System32\vssapi.dll +2772 svchost.exe 0x7ff99f240000 True True True \Windows\System32\vsstrace.dll +2772 svchost.exe 0x7ff9a1bd0000 True True True \Windows\System32\propsys.dll +2772 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +2772 svchost.exe 0x7ff9a54a0000 True True True \Windows\System32\netutils.dll +2772 svchost.exe 0x7ff9a5230000 True True True \Windows\System32\rsaenh.dll +2772 svchost.exe 0x7ff9a57b0000 True True True \Windows\System32\cryptsp.dll +2772 svchost.exe 0x7ff9a57d0000 True True True \Windows\System32\cryptbase.dll +2772 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +2772 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +2772 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +2772 svchost.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +2772 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +2772 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +2772 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +2772 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +2772 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +2772 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +2772 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +2772 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +2772 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +2772 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +2772 svchost.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +2772 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +2772 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +2772 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +2772 svchost.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +2772 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +2772 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +2772 svchost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +2772 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +2772 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +2780 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +2780 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +2780 svchost.exe 0x7ff99cbf0000 True True True \Windows\System32\urlmon.dll +2780 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +2780 svchost.exe 0x7ff99b010000 True True True \Windows\System32\MrmCoreR.dll +2780 svchost.exe 0x7ff99aa30000 True True True \Windows\System32\OneCoreUAPCommonProxyStub.dll +2780 svchost.exe 0x7ff99bb50000 True True True \Windows\System32\iertutil.dll +2780 svchost.exe 0x7ff9a57d0000 True True True \Windows\System32\cryptbase.dll +2780 svchost.exe 0x7ff9a18b0000 True True True \Windows\System32\msvcp110_win.dll +2780 svchost.exe 0x7ff99d700000 True True True \Windows\System32\tileobjserver.dll +2780 svchost.exe 0x7ff99d1d0000 True True True \Windows\System32\esent.dll +2780 svchost.exe 0x7ff9a0d80000 True True True \Windows\System32\Windows.StateRepository.dll +2780 svchost.exe 0x7ff9a0cd0000 True True True \Windows\System32\StateRepository.Core.dll +2780 svchost.exe 0x7ff9a3780000 True True True \Windows\System32\BCP47Langs.dll +2780 svchost.exe 0x7ff9a2ca0000 True True True \Windows\System32\wtsapi32.dll +2780 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +2780 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +2780 svchost.exe 0x7ff9a5c60000 True True True \Windows\System32\userenv.dll +2780 svchost.exe 0x7ff9a5850000 True True True \Windows\System32\winsta.dll +2780 svchost.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +2780 svchost.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +2780 svchost.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +2780 svchost.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +2780 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +2780 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +2780 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +2780 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +2780 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +2780 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +2780 svchost.exe 0x7ff9a64c0000 True True True \Windows\System32\windows.storage.dll +2780 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +2780 svchost.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +2780 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +2780 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +2780 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +2780 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +2780 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +2780 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +2780 svchost.exe 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +2780 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +2780 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +2780 svchost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +2780 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +2780 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +2792 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +2792 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +2792 svchost.exe 0x7ff99eb00000 True True True \Windows\System32\xmllite.dll +2792 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +2792 svchost.exe 0x7ff99aa30000 True True True \Windows\System32\OneCoreUAPCommonProxyStub.dll +2792 svchost.exe 0x7ff998430000 True True True \Windows\System32\OneCoreCommonProxyStub.dll +2792 svchost.exe 0x7ff99ddf0000 True True True \Windows\System32\sysmain.dll +2792 svchost.exe 0x7ff9a2ca0000 True True True \Windows\System32\wtsapi32.dll +2792 svchost.exe 0x7ff9a2730000 True True True \Windows\System32\taskschd.dll +2792 svchost.exe 0x7ff9a40e0000 True True True \Windows\System32\SystemEventsBrokerClient.dll +2792 svchost.exe 0x7ff9a32f0000 True True True \Windows\System32\bi.dll +2792 svchost.exe 0x7ff9a49c0000 True True True \Windows\System32\devobj.dll +2792 svchost.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +2792 svchost.exe 0x7ff9a5850000 True True True \Windows\System32\winsta.dll +2792 svchost.exe 0x7ff9a4f70000 True True True \Windows\System32\ntmarta.dll +2792 svchost.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +2792 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +2792 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +2792 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +2792 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +2792 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +2792 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +2792 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +2792 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +2792 svchost.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +2792 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +2792 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +2792 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +2792 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +2792 svchost.exe 0x7ff9a6fa0000 True True True \Windows\System32\coml2.dll +2792 svchost.exe 0x7ff9a7280000 True True True \Windows\System32\ole32.dll +2792 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +2792 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +2792 svchost.exe 0x7ff9a7470000 True True True \Windows\System32\setupapi.dll +2792 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +2792 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +2792 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +2792 svchost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +2792 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +2792 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +2800 SecurityHealth 0x7ff9909e0000 True True True \Windows\System32\smartscreenps.dll +2800 SecurityHealth 0x7ff6ef1e0000 True False True \Windows\System32\SecurityHealthService.exe +2800 SecurityHealth 0x7ff981b30000 True True True \Windows\System32\SecurityHealthProxyStub.dll +2800 SecurityHealth 0x7ff9a4c90000 True True True \Windows\System32\FirewallAPI.dll +2800 SecurityHealth 0x7ff99d9a0000 True True True \Windows\System32\updatepolicy.dll +2800 SecurityHealth 0x7ff99bb50000 True True True \Windows\System32\iertutil.dll +2800 SecurityHealth 0x7ff9973d0000 True True True \Windows\System32\msIso.dll +2800 SecurityHealth 0x7ff995fe0000 True True True \Windows\System32\wininet.dll +2800 SecurityHealth 0x7ff99b880000 True True True \Windows\System32\wbem\wbemsvc.dll +2800 SecurityHealth 0x7ff99b300000 True True True \Windows\System32\wbem\fastprox.dll +2800 SecurityHealth 0x7ff99b8a0000 True True True \Windows\System32\wbem\wbemprox.dll +2800 SecurityHealth 0x7ff99cb00000 True True True \Program Files\Windows Defender\MpClient.dll +2800 SecurityHealth 0x7ff99cbf0000 True True True \Windows\System32\urlmon.dll +2800 SecurityHealth 0x7ff9a2ca0000 True True True \Windows\System32\wtsapi32.dll +2800 SecurityHealth 0x7ff9a1940000 True True True \Windows\System32\policymanager.dll +2800 SecurityHealth 0x7ff9a18b0000 True True True \Windows\System32\msvcp110_win.dll +2800 SecurityHealth 0x7ff99dba0000 True True True \Windows\System32\wbemcomn.dll +2800 SecurityHealth 0x7ff9a1fc0000 True True True \Windows\System32\wscapi.dll +2800 SecurityHealth 0x7ff9a1f90000 True True True \Windows\System32\wkscli.dll +2800 SecurityHealth 0x7ff9a2730000 True True True \Windows\System32\taskschd.dll +2800 SecurityHealth 0x7ff9a4c30000 True True True \Windows\System32\fwbase.dll +2800 SecurityHealth 0x7ff9a32b0000 True True True \Windows\System32\netprofm.dll +2800 SecurityHealth 0x7ff9a49c0000 True True True \Windows\System32\devobj.dll +2800 SecurityHealth 0x7ff9a4c60000 True True True \Windows\System32\gpapi.dll +2800 SecurityHealth 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +2800 SecurityHealth 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +2800 SecurityHealth 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +2800 SecurityHealth 0x7ff9a54a0000 True True True \Windows\System32\netutils.dll +2800 SecurityHealth 0x7ff9a4f70000 True True True \Windows\System32\ntmarta.dll +2800 SecurityHealth 0x7ff9a5230000 True True True \Windows\System32\rsaenh.dll +2800 SecurityHealth 0x7ff9a57b0000 True True True \Windows\System32\cryptsp.dll +2800 SecurityHealth 0x7ff9a57d0000 True True True \Windows\System32\cryptbase.dll +2800 SecurityHealth 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +2800 SecurityHealth 0x7ff9a5c60000 True True True \Windows\System32\userenv.dll +2800 SecurityHealth 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +2800 SecurityHealth 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +2800 SecurityHealth 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +2800 SecurityHealth 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +2800 SecurityHealth 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +2800 SecurityHealth 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +2800 SecurityHealth 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +2800 SecurityHealth 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +2800 SecurityHealth 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +2800 SecurityHealth 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +2800 SecurityHealth 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +2800 SecurityHealth 0x7ff9a64c0000 True True True \Windows\System32\windows.storage.dll +2800 SecurityHealth 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +2800 SecurityHealth 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +2800 SecurityHealth 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +2800 SecurityHealth 0x7ff9a6e50000 True True True \Windows\System32\imagehlp.dll +2800 SecurityHealth 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +2800 SecurityHealth 0x7ff9a7280000 True True True \Windows\System32\ole32.dll +2800 SecurityHealth 0x7ff9a7130000 True True True \Windows\System32\user32.dll +2800 SecurityHealth 0x7ff9a7470000 True True True \Windows\System32\setupapi.dll +2800 SecurityHealth 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +2800 SecurityHealth 0x7ff9a9130000 True True True \Windows\System32\combase.dll +2800 SecurityHealth 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +2800 SecurityHealth 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +2800 SecurityHealth 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +2800 SecurityHealth 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +2800 SecurityHealth 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +2800 SecurityHealth 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +2800 SecurityHealth 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +2464 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +2464 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +2464 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +2464 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +2464 svchost.exe 0x7ff99db20000 True True True \Windows\System32\wdi.dll +2464 svchost.exe 0x7ff99d650000 True True True \Windows\System32\perftrack.dll +2464 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +2464 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +2464 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +2464 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +2464 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +2464 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +2464 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +2464 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +2464 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +2464 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +2464 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +2464 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +2464 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +2464 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +2464 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +2464 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +2980 dasHost.exe 0x7ff9a53b0000 True True True \Windows\System32\IPHLPAPI.DLL +2980 dasHost.exe 0x7ff99d7a0000 True True True \Windows\System32\winhttp.dll +2980 dasHost.exe 0x7ff99a980000 True True True \Windows\System32\WSDApi.dll +2980 dasHost.exe 0x7ff64b2b0000 True False True \Windows\System32\dasHost.exe +2980 dasHost.exe 0x7ff998730000 True True True \Windows\System32\OnDemandConnRouteHelper.dll +2980 dasHost.exe 0x7ff9986e0000 True True True \Windows\System32\DAFWSD.dll +2980 dasHost.exe 0x7ff9939a0000 True True True \Windows\System32\mlang.dll +2980 dasHost.exe 0x7ff99a830000 True True True \Windows\System32\webservices.dll +2980 dasHost.exe 0x7ff99d630000 True True True \Windows\System32\wship6.dll +2980 dasHost.exe 0x7ff99c7e0000 True True True \Windows\System32\dafupnp.dll +2980 dasHost.exe 0x7ff99b740000 True True True \Windows\System32\webio.dll +2980 dasHost.exe 0x7ff99d640000 True True True \Windows\System32\WSHTCPIP.DLL +2980 dasHost.exe 0x7ff9a21d0000 True True True \Windows\System32\ssdpapi.dll +2980 dasHost.exe 0x7ff9a19e0000 True True True \Windows\System32\deviceassociation.dll +2980 dasHost.exe 0x7ff99e560000 True True True \Windows\System32\fwpolicyiomgr.dll +2980 dasHost.exe 0x7ff99d900000 True True True \Windows\System32\wshqos.dll +2980 dasHost.exe 0x7ff99eb00000 True True True \Windows\System32\xmllite.dll +2980 dasHost.exe 0x7ff99ec50000 True True True \Windows\System32\msxml6.dll +2980 dasHost.exe 0x7ff9a2120000 True True True \Windows\System32\dhcpcsvc6.dll +2980 dasHost.exe 0x7ff9a2000000 True True True \Windows\System32\npmproxy.dll +2980 dasHost.exe 0x7ff9a4c30000 True True True \Windows\System32\fwbase.dll +2980 dasHost.exe 0x7ff9a2800000 True True True \Windows\System32\winnsi.dll +2980 dasHost.exe 0x7ff9a25a0000 True True True \Windows\System32\dhcpcsvc.dll +2980 dasHost.exe 0x7ff9a32b0000 True True True \Windows\System32\netprofm.dll +2980 dasHost.exe 0x7ff9a4c90000 True True True \Windows\System32\FirewallAPI.dll +2980 dasHost.exe 0x7ff9a5230000 True True True \Windows\System32\rsaenh.dll +2980 dasHost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +2980 dasHost.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +2980 dasHost.exe 0x7ff9a57b0000 True True True \Windows\System32\cryptsp.dll +2980 dasHost.exe 0x7ff9a5610000 True True True \Windows\System32\mswsock.dll +2980 dasHost.exe 0x7ff9a57d0000 True True True \Windows\System32\cryptbase.dll +2980 dasHost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +2980 dasHost.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +2980 dasHost.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +2980 dasHost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +2980 dasHost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +2980 dasHost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +2980 dasHost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +2980 dasHost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +2980 dasHost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +2980 dasHost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +2980 dasHost.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +2980 dasHost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +2980 dasHost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +2980 dasHost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +2980 dasHost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +2980 dasHost.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +2980 dasHost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +2980 dasHost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +2980 dasHost.exe 0x7ff9a78b0000 True True True \Windows\System32\nsi.dll +2980 dasHost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +2980 dasHost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +2980 dasHost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +2980 dasHost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +3188 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +3188 svchost.exe 0x7ff9a2800000 True True True \Windows\System32\winnsi.dll +3188 svchost.exe 0x7ff99c720000 True True True \Windows\System32\miutils.dll +3188 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +3188 svchost.exe 0x7ff99c650000 True True True \Windows\System32\resutils.dll +3188 svchost.exe 0x7ff99ba00000 True True True \Windows\System32\clusapi.dll +3188 svchost.exe 0x7ff99c6f0000 True True True \Windows\System32\wmidcom.dll +3188 svchost.exe 0x7ff99c820000 True True True \Windows\System32\srvsvc.dll +3188 svchost.exe 0x7ff99c7b0000 True True True \Windows\System32\sscoreext.dll +3188 svchost.exe 0x7ff99c780000 True True True \Windows\System32\mi.dll +3188 svchost.exe 0x7ff99c7c0000 True True True \Windows\System32\sscore.dll +3188 svchost.exe 0x7ff9a2140000 True True True \Windows\System32\wmiclnt.dll +3188 svchost.exe 0x7ff99e560000 True True True \Windows\System32\fwpolicyiomgr.dll +3188 svchost.exe 0x7ff99c9d0000 True True True \Windows\System32\rasadhlp.dll +3188 svchost.exe 0x7ff9a2120000 True True True \Windows\System32\dhcpcsvc6.dll +3188 svchost.exe 0x7ff9a27f0000 True True True \Windows\System32\dsrole.dll +3188 svchost.exe 0x7ff9a25a0000 True True True \Windows\System32\dhcpcsvc.dll +3188 svchost.exe 0x7ff9a54a0000 True True True \Windows\System32\netutils.dll +3188 svchost.exe 0x7ff9a5270000 True True True \Windows\System32\dpapi.dll +3188 svchost.exe 0x7ff9a4c90000 True True True \Windows\System32\FirewallAPI.dll +3188 svchost.exe 0x7ff9a4c30000 True True True \Windows\System32\fwbase.dll +3188 svchost.exe 0x7ff9a4c60000 True True True \Windows\System32\gpapi.dll +3188 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +3188 svchost.exe 0x7ff9a53b0000 True True True \Windows\System32\IPHLPAPI.DLL +3188 svchost.exe 0x7ff9a53f0000 True True True +3188 svchost.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +3188 svchost.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +3188 svchost.exe 0x7ff9a5610000 True True True \Windows\System32\mswsock.dll +3188 svchost.exe 0x7ff9a5c60000 True True True \Windows\System32\userenv.dll +3188 svchost.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +3188 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +3188 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +3188 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +3188 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +3188 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +3188 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +3188 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +3188 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +3188 svchost.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +3188 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +3188 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +3188 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +3188 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +3188 svchost.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +3188 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +3188 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +3188 svchost.exe 0x7ff9a78b0000 True True True \Windows\System32\nsi.dll +3188 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +3188 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +3188 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +3188 svchost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +3188 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +3288 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +3288 svchost.exe 0x7ff9a0930000 True True True \Windows\System32\FWPUCLNT.DLL +3288 svchost.exe 0x7ff99bde0000 True True True \Windows\System32\iphlpsvc.dll +3288 svchost.exe 0x7ff99b680000 True True True \Windows\System32\wdscore.dll +3288 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +3288 svchost.exe 0x7ff999860000 True True True \Windows\System32\nci.dll +3288 svchost.exe 0x7ff998850000 True True True \Windows\System32\tcpipcfg.dll +3288 svchost.exe 0x7ff99b300000 True True True \Windows\System32\wbem\fastprox.dll +3288 svchost.exe 0x7ff99b8a0000 True True True \Windows\System32\wbem\wbemprox.dll +3288 svchost.exe 0x7ff99b880000 True True True \Windows\System32\wbem\wbemsvc.dll +3288 svchost.exe 0x7ff99b930000 True True True \Windows\System32\adhsvc.dll +3288 svchost.exe 0x7ff99b8e0000 True True True \Windows\System32\HNetCfgClient.dll +3288 svchost.exe 0x7ff99baf0000 True True True \Windows\System32\rtutils.dll +3288 svchost.exe 0x7ff99e2f0000 True True True \Windows\System32\sqmapi.dll +3288 svchost.exe 0x7ff99dba0000 True True True \Windows\System32\wbemcomn.dll +3288 svchost.exe 0x7ff99d7a0000 True True True \Windows\System32\winhttp.dll +3288 svchost.exe 0x7ff99c9d0000 True True True \Windows\System32\rasadhlp.dll +3288 svchost.exe 0x7ff99e2a0000 True True True \Windows\System32\httpprxm.dll +3288 svchost.exe 0x7ff99e330000 True True True \Windows\System32\NetSetupShim.dll +3288 svchost.exe 0x7ff99e300000 True True True \Windows\System32\NetSetupApi.dll +3288 svchost.exe 0x7ff99e560000 True True True \Windows\System32\fwpolicyiomgr.dll +3288 svchost.exe 0x7ff9a53b0000 True True True \Windows\System32\IPHLPAPI.DLL +3288 svchost.exe 0x7ff9a2ca0000 True True True \Windows\System32\wtsapi32.dll +3288 svchost.exe 0x7ff9a2140000 True True True \Windows\System32\wmiclnt.dll +3288 svchost.exe 0x7ff9a1f90000 True True True \Windows\System32\wkscli.dll +3288 svchost.exe 0x7ff9a1f50000 True True True \Windows\System32\logoncli.dll +3288 svchost.exe 0x7ff9a2000000 True True True \Windows\System32\npmproxy.dll +3288 svchost.exe 0x7ff9a2120000 True True True \Windows\System32\dhcpcsvc6.dll +3288 svchost.exe 0x7ff9a2800000 True True True \Windows\System32\winnsi.dll +3288 svchost.exe 0x7ff9a25a0000 True True True \Windows\System32\dhcpcsvc.dll +3288 svchost.exe 0x7ff9a4c30000 True True True \Windows\System32\fwbase.dll +3288 svchost.exe 0x7ff9a3730000 True True True \Windows\System32\httpprxc.dll +3288 svchost.exe 0x7ff9a32b0000 True True True \Windows\System32\netprofm.dll +3288 svchost.exe 0x7ff9a49c0000 True True True \Windows\System32\devobj.dll +3288 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +3288 svchost.exe 0x7ff9a4c90000 True True True \Windows\System32\FirewallAPI.dll +3288 svchost.exe 0x7ff9a5230000 True True True \Windows\System32\rsaenh.dll +3288 svchost.exe 0x7ff9a5030000 True True True \Windows\System32\authz.dll +3288 svchost.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +3288 svchost.exe 0x7ff9a57b0000 True True True \Windows\System32\cryptsp.dll +3288 svchost.exe 0x7ff9a54a0000 True True True \Windows\System32\netutils.dll +3288 svchost.exe 0x7ff9a53f0000 True True True +3288 svchost.exe 0x7ff9a5610000 True True True \Windows\System32\mswsock.dll +3288 svchost.exe 0x7ff9a5850000 True True True \Windows\System32\winsta.dll +3288 svchost.exe 0x7ff9a57d0000 True True True \Windows\System32\cryptbase.dll +3288 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +3288 svchost.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +3288 svchost.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +3288 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +3288 svchost.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +3288 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +3288 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +3288 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +3288 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +3288 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +3288 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +3288 svchost.exe 0x7ff9a64c0000 True True True \Windows\System32\windows.storage.dll +3288 svchost.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +3288 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +3288 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +3288 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +3288 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +3288 svchost.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +3288 svchost.exe 0x7ff9a7470000 True True True \Windows\System32\setupapi.dll +3288 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +3288 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +3288 svchost.exe 0x7ff9a78b0000 True True True \Windows\System32\nsi.dll +3288 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +3288 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +3288 svchost.exe 0x7ff9a7970000 True True True \Windows\System32\shell32.dll +3288 svchost.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +3288 svchost.exe 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +3288 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +3288 svchost.exe 0x7ff9a9880000 True True True \Windows\System32\Wldap32.dll +3288 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +3288 svchost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +3288 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +3400 svchost.exe 0x7ff9a53b0000 True True True \Windows\System32\IPHLPAPI.DLL +3400 svchost.exe 0x7ff9a2120000 True True True \Windows\System32\dhcpcsvc6.dll +3400 svchost.exe 0x7ff99d630000 True True True \Windows\System32\wship6.dll +3400 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +3400 svchost.exe 0x7ff998750000 True True True \Windows\System32\httpapi.dll +3400 svchost.exe 0x7ff998730000 True True True \Windows\System32\OnDemandConnRouteHelper.dll +3400 svchost.exe 0x7ff99d900000 True True True \Windows\System32\wshqos.dll +3400 svchost.exe 0x7ff99d640000 True True True \Windows\System32\WSHTCPIP.DLL +3400 svchost.exe 0x7ff99d7a0000 True True True \Windows\System32\winhttp.dll +3400 svchost.exe 0x7ff99e250000 True True True \Windows\System32\ssdpsrv.dll +3400 svchost.exe 0x7ff99e560000 True True True \Windows\System32\fwpolicyiomgr.dll +3400 svchost.exe 0x7ff9a4c30000 True True True \Windows\System32\fwbase.dll +3400 svchost.exe 0x7ff9a25a0000 True True True \Windows\System32\dhcpcsvc.dll +3400 svchost.exe 0x7ff9a2800000 True True True \Windows\System32\winnsi.dll +3400 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +3400 svchost.exe 0x7ff9a4c90000 True True True \Windows\System32\FirewallAPI.dll +3400 svchost.exe 0x7ff9a5230000 True True True \Windows\System32\rsaenh.dll +3400 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +3400 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +3400 svchost.exe 0x7ff9a57d0000 True True True \Windows\System32\cryptbase.dll +3400 svchost.exe 0x7ff9a57b0000 True True True \Windows\System32\cryptsp.dll +3400 svchost.exe 0x7ff9a5610000 True True True \Windows\System32\mswsock.dll +3400 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +3400 svchost.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +3400 svchost.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +3400 svchost.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +3400 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +3400 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +3400 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +3400 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +3400 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +3400 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +3400 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +3400 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +3400 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +3400 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +3400 svchost.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +3400 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +3400 svchost.exe 0x7ff9a78b0000 True True True \Windows\System32\nsi.dll +3400 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +3400 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +3400 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +3400 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +3400 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +3880 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +3880 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +3880 svchost.exe 0x7ff9a19e0000 True True True \Windows\System32\deviceassociation.dll +3880 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +3880 svchost.exe 0x7ff99d640000 True True True \Windows\System32\WSHTCPIP.DLL +3880 svchost.exe 0x7ff99b6c0000 True True True \Windows\System32\NcdAutoSetup.dll +3880 svchost.exe 0x7ff9998c0000 True True True \Windows\System32\dtsh.dll +3880 svchost.exe 0x7ff99d630000 True True True \Windows\System32\wship6.dll +3880 svchost.exe 0x7ff99d900000 True True True \Windows\System32\wshqos.dll +3880 svchost.exe 0x7ff99e560000 True True True \Windows\System32\fwpolicyiomgr.dll +3880 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +3880 svchost.exe 0x7ff9a32b0000 True True True \Windows\System32\netprofm.dll +3880 svchost.exe 0x7ff9a25a0000 True True True \Windows\System32\dhcpcsvc.dll +3880 svchost.exe 0x7ff9a2000000 True True True \Windows\System32\npmproxy.dll +3880 svchost.exe 0x7ff9a4c90000 True True True \Windows\System32\FirewallAPI.dll +3880 svchost.exe 0x7ff9a4c30000 True True True \Windows\System32\fwbase.dll +3880 svchost.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +3880 svchost.exe 0x7ff9a53b0000 True True True \Windows\System32\IPHLPAPI.DLL +3880 svchost.exe 0x7ff9a5610000 True True True \Windows\System32\mswsock.dll +3880 svchost.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +3880 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +3880 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +3880 svchost.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +3880 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +3880 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +3880 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +3880 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +3880 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +3880 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +3880 svchost.exe 0x7ff9a64c0000 True True True \Windows\System32\windows.storage.dll +3880 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +3880 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +3880 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +3880 svchost.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +3880 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +3880 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +3880 svchost.exe 0x7ff9a78b0000 True True True \Windows\System32\nsi.dll +3880 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +3880 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +3880 svchost.exe 0x7ff9a7970000 True True True \Windows\System32\shell32.dll +3880 svchost.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +3880 svchost.exe 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +3880 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +3880 svchost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +3880 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +3880 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +3888 svchost.exe 0x7ff9a53b0000 True True True \Windows\System32\IPHLPAPI.DLL +3888 svchost.exe 0x7ff99d900000 True True True \Windows\System32\wshqos.dll +3888 svchost.exe 0x7ff99b8b0000 True True True \Windows\System32\FDResPub.dll +3888 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +3888 svchost.exe 0x7ff99a830000 True True True \Windows\System32\webservices.dll +3888 svchost.exe 0x7ff998750000 True True True \Windows\System32\httpapi.dll +3888 svchost.exe 0x7ff99a980000 True True True \Windows\System32\WSDApi.dll +3888 svchost.exe 0x7ff99d640000 True True True \Windows\System32\WSHTCPIP.DLL +3888 svchost.exe 0x7ff99d630000 True True True \Windows\System32\wship6.dll +3888 svchost.exe 0x7ff99d7a0000 True True True \Windows\System32\winhttp.dll +3888 svchost.exe 0x7ff9a2120000 True True True \Windows\System32\dhcpcsvc6.dll +3888 svchost.exe 0x7ff99e560000 True True True \Windows\System32\fwpolicyiomgr.dll +3888 svchost.exe 0x7ff99daa0000 True True True \Windows\System32\fundisc.dll +3888 svchost.exe 0x7ff9a1f90000 True True True \Windows\System32\wkscli.dll +3888 svchost.exe 0x7ff99eb00000 True True True \Windows\System32\xmllite.dll +3888 svchost.exe 0x7ff9a4c30000 True True True \Windows\System32\fwbase.dll +3888 svchost.exe 0x7ff9a25a0000 True True True \Windows\System32\dhcpcsvc.dll +3888 svchost.exe 0x7ff9a2800000 True True True \Windows\System32\winnsi.dll +3888 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +3888 svchost.exe 0x7ff9a4c90000 True True True \Windows\System32\FirewallAPI.dll +3888 svchost.exe 0x7ff9a5230000 True True True \Windows\System32\rsaenh.dll +3888 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +3888 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +3888 svchost.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +3888 svchost.exe 0x7ff9a5610000 True True True \Windows\System32\mswsock.dll +3888 svchost.exe 0x7ff9a54a0000 True True True \Windows\System32\netutils.dll +3888 svchost.exe 0x7ff9a57b0000 True True True \Windows\System32\cryptsp.dll +3888 svchost.exe 0x7ff9a57d0000 True True True \Windows\System32\cryptbase.dll +3888 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +3888 svchost.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +3888 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +3888 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +3888 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +3888 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +3888 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +3888 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +3888 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +3888 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +3888 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +3888 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +3888 svchost.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +3888 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +3888 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +3888 svchost.exe 0x7ff9a78b0000 True True True \Windows\System32\nsi.dll +3888 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +3888 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +3888 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +3888 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +3972 svchost.exe 0x1866e1e0000 False False False \Windows\System32\winnlsres.dll +3972 svchost.exe 0x1866e1f0000 False False False \Windows\System32\en-US\winnlsres.dll.mui +3972 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +3972 svchost.exe 0x7ff99d7a0000 True True True \Windows\System32\winhttp.dll +3972 svchost.exe 0x7ff99a820000 True True True \Windows\System32\fdPHost.dll +3972 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +3972 svchost.exe 0x7ff999870000 True True True \Windows\System32\fdSSDP.dll +3972 svchost.exe 0x7ff9986c0000 True True True \Windows\System32\fdProxy.dll +3972 svchost.exe 0x7ff998430000 True True True \Windows\System32\OneCoreCommonProxyStub.dll +3972 svchost.exe 0x7ff998730000 True True True \Windows\System32\OnDemandConnRouteHelper.dll +3972 svchost.exe 0x7ff999890000 True True True \Windows\System32\fdWSD.dll +3972 svchost.exe 0x7ff99a980000 True True True \Windows\System32\WSDApi.dll +3972 svchost.exe 0x7ff99a830000 True True True \Windows\System32\webservices.dll +3972 svchost.exe 0x7ff99d630000 True True True \Windows\System32\wship6.dll +3972 svchost.exe 0x7ff99b740000 True True True \Windows\System32\webio.dll +3972 svchost.exe 0x7ff99d640000 True True True \Windows\System32\WSHTCPIP.DLL +3972 svchost.exe 0x7ff9a21d0000 True True True \Windows\System32\ssdpapi.dll +3972 svchost.exe 0x7ff99e560000 True True True \Windows\System32\fwpolicyiomgr.dll +3972 svchost.exe 0x7ff99d900000 True True True \Windows\System32\wshqos.dll +3972 svchost.exe 0x7ff99daa0000 True True True \Windows\System32\fundisc.dll +3972 svchost.exe 0x7ff9a1bd0000 True True True \Windows\System32\propsys.dll +3972 svchost.exe 0x7ff99eb00000 True True True \Windows\System32\xmllite.dll +3972 svchost.exe 0x7ff99ec50000 True True True \Windows\System32\msxml6.dll +3972 svchost.exe 0x7ff9a2120000 True True True \Windows\System32\dhcpcsvc6.dll +3972 svchost.exe 0x7ff9a4c30000 True True True \Windows\System32\fwbase.dll +3972 svchost.exe 0x7ff9a25a0000 True True True \Windows\System32\dhcpcsvc.dll +3972 svchost.exe 0x7ff9a2800000 True True True \Windows\System32\winnsi.dll +3972 svchost.exe 0x7ff9a4c90000 True True True \Windows\System32\FirewallAPI.dll +3972 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +3972 svchost.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +3972 svchost.exe 0x7ff9a5610000 True True True \Windows\System32\mswsock.dll +3972 svchost.exe 0x7ff9a53b0000 True True True \Windows\System32\IPHLPAPI.DLL +3972 svchost.exe 0x7ff9a5230000 True True True \Windows\System32\rsaenh.dll +3972 svchost.exe 0x7ff9a57b0000 True True True \Windows\System32\cryptsp.dll +3972 svchost.exe 0x7ff9a57d0000 True True True \Windows\System32\cryptbase.dll +3972 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +3972 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +3972 svchost.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +3972 svchost.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +3972 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +3972 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +3972 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +3972 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +3972 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +3972 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +3972 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +3972 svchost.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +3972 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +3972 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +3972 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +3972 svchost.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +3972 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +3972 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +3972 svchost.exe 0x7ff9a78b0000 True True True \Windows\System32\nsi.dll +3972 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +3972 svchost.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +3972 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +3972 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +3972 svchost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +3972 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +3972 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +2828 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +2828 svchost.exe 0x7ff9a4c90000 True True True \Windows\System32\FirewallAPI.dll +2828 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +2828 svchost.exe 0x7ff99e560000 True True True \Windows\System32\fwpolicyiomgr.dll +2828 svchost.exe 0x7ff9987a0000 True True True \Windows\System32\browser.dll +2828 svchost.exe 0x7ff99b650000 True True True \Windows\System32\srvcli.dll +2828 svchost.exe 0x7ff9a4c30000 True True True \Windows\System32\fwbase.dll +2828 svchost.exe 0x7ff9a1f50000 True True True \Windows\System32\logoncli.dll +2828 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +2828 svchost.exe 0x7ff9a54a0000 True True True \Windows\System32\netutils.dll +2828 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +2828 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +2828 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +2828 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +2828 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +2828 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +2828 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +2828 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +2828 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +2828 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +2828 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +2828 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +2828 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +2828 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +2828 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +2828 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +2828 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +2828 svchost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +2828 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +2828 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +4108 svchost.exe 0x7ff9a5030000 True True True \Windows\System32\authz.dll +4108 svchost.exe 0x7ff9a0930000 True True True \Windows\System32\FWPUCLNT.DLL +4108 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +4108 svchost.exe 0x7ff999840000 True True True \Windows\System32\FwRemoteSvr.dll +4108 svchost.exe 0x7ff9987d0000 True True True \Windows\System32\IPSECSVC.DLL +4108 svchost.exe 0x7ff99e560000 True True True \Windows\System32\fwpolicyiomgr.dll +4108 svchost.exe 0x7ff9a4c90000 True True True \Windows\System32\FirewallAPI.dll +4108 svchost.exe 0x7ff9a25a0000 True True True \Windows\System32\dhcpcsvc.dll +4108 svchost.exe 0x7ff9a2120000 True True True \Windows\System32\dhcpcsvc6.dll +4108 svchost.exe 0x7ff9a4c30000 True True True \Windows\System32\fwbase.dll +4108 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +4108 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +4108 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +4108 svchost.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +4108 svchost.exe 0x7ff9a5610000 True True True \Windows\System32\mswsock.dll +4108 svchost.exe 0x7ff9a53b0000 True True True \Windows\System32\IPHLPAPI.DLL +4108 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +4108 svchost.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +4108 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +4108 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +4108 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +4108 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +4108 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +4108 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +4108 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +4108 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +4108 svchost.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +4108 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +4108 svchost.exe 0x7ff9a78b0000 True True True \Windows\System32\nsi.dll +4108 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +4108 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +4108 svchost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +4108 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +4264 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +4264 svchost.exe 0x7ff99daa0000 True True True \Windows\System32\fundisc.dll +4264 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +4264 svchost.exe 0x7ff998620000 True True True \Windows\System32\provsvc.dll +4264 svchost.exe 0x7ff998430000 True True True \Windows\System32\OneCoreCommonProxyStub.dll +4264 svchost.exe 0x7ff986e40000 True True True \Windows\System32\shacct.dll +4264 svchost.exe 0x7ff99aa30000 True True True \Windows\System32\OneCoreUAPCommonProxyStub.dll +4264 svchost.exe 0x7ff9986c0000 True True True \Windows\System32\fdProxy.dll +4264 svchost.exe 0x7ff99c880000 True True True \Windows\System32\samlib.dll +4264 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +4264 svchost.exe 0x7ff9a1bd0000 True True True \Windows\System32\propsys.dll +4264 svchost.exe 0x7ff99eb00000 True True True \Windows\System32\xmllite.dll +4264 svchost.exe 0x7ff99f400000 True True True \Windows\System32\IDStore.dll +4264 svchost.exe 0x7ff9a2000000 True True True \Windows\System32\npmproxy.dll +4264 svchost.exe 0x7ff9a2ca0000 True True True \Windows\System32\wtsapi32.dll +4264 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +4264 svchost.exe 0x7ff9a5850000 True True True \Windows\System32\winsta.dll +4264 svchost.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +4264 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +4264 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +4264 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +4264 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +4264 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +4264 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +4264 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +4264 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +4264 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +4264 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +4264 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +4264 svchost.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +4264 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +4264 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +4264 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +4264 svchost.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +4264 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +4264 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +4264 svchost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +4264 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +4264 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +4504 svchost.exe 0x21d69a00000 False False False \Windows\System32\en-US\KernelBase.dll.mui +4504 svchost.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +4504 svchost.exe 0x7ff9a2b60000 True True True \Windows\System32\WinTypes.dll +4504 svchost.exe 0x7ff99bee0000 True True True \Windows\System32\cdp.dll +4504 svchost.exe 0x7ff997600000 True True True \Windows\System32\CoreUIComponents.dll +4504 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +4504 svchost.exe 0x7ff997550000 True True True \Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.15063.1058_none_8f5d02a525b8dc20\comctl32.dll +4504 svchost.exe 0x7ff9973d0000 True True True \Windows\System32\msIso.dll +4504 svchost.exe 0x7ff997ff0000 True True True \Windows\System32\WpPortingLibrary.dll +4504 svchost.exe 0x7ff997d10000 True True True \Windows\System32\cdpsvc.dll +4504 svchost.exe 0x7ff9978e0000 True True True \Windows\System32\ShareHost.dll +4504 svchost.exe 0x7ff99b7e0000 True True True \Windows\System32\VEEventDispatcher.dll +4504 svchost.exe 0x7ff998380000 True True True \Windows\System32\Windows.Networking.Connectivity.dll +4504 svchost.exe 0x7ff998120000 True True True \Windows\System32\ncryptprov.dll +4504 svchost.exe 0x7ff99bb50000 True True True \Windows\System32\iertutil.dll +4504 svchost.exe 0x7ff9a1940000 True True True \Windows\System32\policymanager.dll +4504 svchost.exe 0x7ff99e3b0000 True True True \Windows\System32\WlanRadioManager.dll +4504 svchost.exe 0x7ff99d7a0000 True True True \Windows\System32\winhttp.dll +4504 svchost.exe 0x7ff99cbf0000 True True True \Windows\System32\urlmon.dll +4504 svchost.exe 0x7ff99e220000 True True True \Windows\System32\version.dll +4504 svchost.exe 0x7ff9a18b0000 True True True \Windows\System32\msvcp110_win.dll +4504 svchost.exe 0x7ff9a2120000 True True True \Windows\System32\dhcpcsvc6.dll +4504 svchost.exe 0x7ff9a1ad0000 True True True \Windows\System32\wlanapi.dll +4504 svchost.exe 0x7ff9a1a80000 True True True \Windows\System32\usermgrcli.dll +4504 svchost.exe 0x7ff9a2000000 True True True \Windows\System32\npmproxy.dll +4504 svchost.exe 0x7ff9a25a0000 True True True \Windows\System32\dhcpcsvc.dll +4504 svchost.exe 0x7ff9a21f0000 True True True \Windows\System32\wshbth.dll +4504 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +4504 svchost.exe 0x7ff9a40a0000 True True True \Windows\System32\Windows.Devices.Radios.dll +4504 svchost.exe 0x7ff9a3740000 True True True \Windows\System32\sbservicetrigger.dll +4504 svchost.exe 0x7ff9a2ca0000 True True True \Windows\System32\wtsapi32.dll +4504 svchost.exe 0x7ff9a3920000 True True True \Windows\System32\CoreMessaging.dll +4504 svchost.exe 0x7ff9a4660000 True True True \Windows\System32\twinapi.appcore.dll +4504 svchost.exe 0x7ff9a58f0000 True True True \Windows\System32\ncrypt.dll +4504 svchost.exe 0x7ff9a57d0000 True True True \Windows\System32\cryptbase.dll +4504 svchost.exe 0x7ff9a53b0000 True True True \Windows\System32\IPHLPAPI.DLL +4504 svchost.exe 0x7ff9a4f70000 True True True \Windows\System32\ntmarta.dll +4504 svchost.exe 0x7ff9a5610000 True True True \Windows\System32\mswsock.dll +4504 svchost.exe 0x7ff9a5850000 True True True \Windows\System32\winsta.dll +4504 svchost.exe 0x7ff9a58b0000 True True True N/A +4504 svchost.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +4504 svchost.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +4504 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +4504 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +4504 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +4504 svchost.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +4504 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +4504 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +4504 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +4504 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +4504 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +4504 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +4504 svchost.exe 0x7ff9a64c0000 True True True \Windows\System32\windows.storage.dll +4504 svchost.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +4504 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +4504 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +4504 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +4504 svchost.exe 0x7ff9a6fa0000 True True True \Windows\System32\coml2.dll +4504 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +4504 svchost.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +4504 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +4504 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +4504 svchost.exe 0x7ff9a7280000 True True True \Windows\System32\ole32.dll +4504 svchost.exe 0x7ff9a78b0000 True True True \Windows\System32\nsi.dll +4504 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +4504 svchost.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +4504 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +4504 svchost.exe 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +4504 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +4504 svchost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +4504 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +4504 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +5020 NisSrv.exe 0x7ff99e220000 True True True \Windows\System32\version.dll +5020 NisSrv.exe 0x7ff75f940000 True False True \ProgramData\Microsoft\Windows Defender\Platform\4.16.17656.18052-0\NisSrv.exe +5020 NisSrv.exe 0x7ff99d9c0000 True True True \ProgramData\Microsoft\Windows Defender\Platform\4.16.17656.18052-0\MpClient.dll +5020 NisSrv.exe 0x7ff99d880000 True True True \Windows\System32\sppc.dll +5020 NisSrv.exe 0x7ff9998d0000 True True True \Windows\System32\netapi32.dll +5020 NisSrv.exe 0x7ff99daf0000 True True True \Windows\System32\slc.dll +5020 NisSrv.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +5020 NisSrv.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +5020 NisSrv.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +5020 NisSrv.exe 0x7ff9a2b60000 True True True \Windows\System32\WinTypes.dll +5020 NisSrv.exe 0x7ff9a1f90000 True True True \Windows\System32\wkscli.dll +5020 NisSrv.exe 0x7ff9a54a0000 True True True \Windows\System32\netutils.dll +5020 NisSrv.exe 0x7ff9a4c60000 True True True \Windows\System32\gpapi.dll +5020 NisSrv.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +5020 NisSrv.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +5020 NisSrv.exe 0x7ff9a5c60000 True True True \Windows\System32\userenv.dll +5020 NisSrv.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +5020 NisSrv.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +5020 NisSrv.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +5020 NisSrv.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +5020 NisSrv.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +5020 NisSrv.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +5020 NisSrv.exe 0x7ff9a64c0000 True True True \Windows\System32\windows.storage.dll +5020 NisSrv.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +5020 NisSrv.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +5020 NisSrv.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +5020 NisSrv.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +5020 NisSrv.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +5020 NisSrv.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +5020 NisSrv.exe 0x7ff9a7280000 True True True \Windows\System32\ole32.dll +5020 NisSrv.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +5020 NisSrv.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +5020 NisSrv.exe 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +5020 NisSrv.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +5020 NisSrv.exe 0x7ff9a7970000 True True True \Windows\System32\shell32.dll +5020 NisSrv.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +5020 NisSrv.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +5020 NisSrv.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +5020 NisSrv.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +3448 svchost.exe 0x7ff9a5270000 True True True \Windows\System32\dpapi.dll +3448 svchost.exe 0x7ff99aa30000 True True True \Windows\System32\OneCoreUAPCommonProxyStub.dll +3448 svchost.exe 0x7ff9943b0000 True True True \Windows\System32\LicenseManager.dll +3448 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +3448 svchost.exe 0x7ff990db0000 True True True \Windows\System32\Windows.Web.dll +3448 svchost.exe 0x7ff990b80000 True True True \Windows\System32\msauserext.dll +3448 svchost.exe 0x7ff990af0000 True True True \Windows\System32\AuthBroker.dll +3448 svchost.exe 0x7ff993c60000 True True True \Windows\System32\wups.dll +3448 svchost.exe 0x7ff990e70000 True True True \Windows\System32\Windows.Security.Authentication.Web.Core.dll +3448 svchost.exe 0x7ff9941d0000 True True True \Windows\System32\wuapi.dll +3448 svchost.exe 0x7ff998380000 True True True \Windows\System32\Windows.Networking.Connectivity.dll +3448 svchost.exe 0x7ff998180000 True True True \Windows\System32\ncryptsslp.dll +3448 svchost.exe 0x7ff9980d0000 True True True \Windows\System32\mskeyprotect.dll +3448 svchost.exe 0x7ff9981e0000 True True True \Windows\System32\Windows.Security.Authentication.OnlineId.dll +3448 svchost.exe 0x7ff998730000 True True True \Windows\System32\OnDemandConnRouteHelper.dll +3448 svchost.exe 0x7ff998430000 True True True \Windows\System32\OneCoreCommonProxyStub.dll +3448 svchost.exe 0x7ff9998f0000 True True True \Windows\System32\LicenseManagerSvc.dll +3448 svchost.exe 0x7ff9a18b0000 True True True \Windows\System32\msvcp110_win.dll +3448 svchost.exe 0x7ff99d7a0000 True True True \Windows\System32\winhttp.dll +3448 svchost.exe 0x7ff99bb50000 True True True \Windows\System32\iertutil.dll +3448 svchost.exe 0x7ff99b740000 True True True \Windows\System32\webio.dll +3448 svchost.exe 0x7ff99c9d0000 True True True \Windows\System32\rasadhlp.dll +3448 svchost.exe 0x7ff9a03d0000 True True True \Windows\System32\Clipc.dll +3448 svchost.exe 0x7ff99ec50000 True True True \Windows\System32\msxml6.dll +3448 svchost.exe 0x7ff9a0cd0000 True True True \Windows\System32\StateRepository.Core.dll +3448 svchost.exe 0x7ff9a0d80000 True True True \Windows\System32\Windows.StateRepository.dll +3448 svchost.exe 0x7ff9a2b60000 True True True \Windows\System32\WinTypes.dll +3448 svchost.exe 0x7ff9a2000000 True True True \Windows\System32\npmproxy.dll +3448 svchost.exe 0x7ff9a1ad0000 True True True \Windows\System32\wlanapi.dll +3448 svchost.exe 0x7ff9a1a80000 True True True \Windows\System32\usermgrcli.dll +3448 svchost.exe 0x7ff9a1f90000 True True True \Windows\System32\wkscli.dll +3448 svchost.exe 0x7ff9a25a0000 True True True \Windows\System32\dhcpcsvc.dll +3448 svchost.exe 0x7ff9a2120000 True True True \Windows\System32\dhcpcsvc6.dll +3448 svchost.exe 0x7ff9a2800000 True True True \Windows\System32\winnsi.dll +3448 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +3448 svchost.exe 0x7ff9a4660000 True True True \Windows\System32\twinapi.appcore.dll +3448 svchost.exe 0x7ff9a5170000 True True True \Windows\System32\schannel.dll +3448 svchost.exe 0x7ff9a5230000 True True True \Windows\System32\rsaenh.dll +3448 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +3448 svchost.exe 0x7ff9a57b0000 True True True \Windows\System32\cryptsp.dll +3448 svchost.exe 0x7ff9a54a0000 True True True \Windows\System32\netutils.dll +3448 svchost.exe 0x7ff9a53b0000 True True True \Windows\System32\IPHLPAPI.DLL +3448 svchost.exe 0x7ff9a53f0000 True True True +3448 svchost.exe 0x7ff9a5610000 True True True \Windows\System32\mswsock.dll +3448 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +3448 svchost.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +3448 svchost.exe 0x7ff9a58b0000 True True True N/A +3448 svchost.exe 0x7ff9a57d0000 True True True \Windows\System32\cryptbase.dll +3448 svchost.exe 0x7ff9a58f0000 True True True \Windows\System32\ncrypt.dll +3448 svchost.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +3448 svchost.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +3448 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +3448 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +3448 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +3448 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +3448 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +3448 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +3448 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +3448 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +3448 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +3448 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +3448 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +3448 svchost.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +3448 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +3448 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +3448 svchost.exe 0x7ff9a78b0000 True True True \Windows\System32\nsi.dll +3448 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +3448 svchost.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +3448 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +3448 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +3448 svchost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +3448 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +3448 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +2988 svchost.exe 0x7ff99b740000 True True True \Windows\System32\webio.dll +2988 svchost.exe 0x2598b400000 False False False \Windows\System32\en-US\KernelBase.dll.mui +2988 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +2988 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +2988 svchost.exe 0x2598cd90000 False False False \Windows\System32\en-US\netmsg.dll.mui +2988 svchost.exe 0x7ff9a5230000 True True True \Windows\System32\rsaenh.dll +2988 svchost.exe 0x7ff9a57d0000 True True True \Windows\System32\cryptbase.dll +2988 svchost.exe 0x2598d200000 False False False \Windows\System32\en-US\kernel32.dll.mui +2988 svchost.exe 0x7ff9a57b0000 True True True \Windows\System32\cryptsp.dll +2988 svchost.exe 0x7ff99d7a0000 True True True \Windows\System32\winhttp.dll +2988 svchost.exe 0x7ff9980d0000 True True True \Windows\System32\mskeyprotect.dll +2988 svchost.exe 0x7ff993930000 True True True \Windows\System32\DmApiSetExtImplDesktop.dll +2988 svchost.exe 0x7ff97ec30000 True True True \Windows\System32\usocore.dll +2988 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +2988 svchost.exe 0x7ff978590000 True True True \Windows\System32\DDORes.dll +2988 svchost.exe 0x7ff97c800000 False False False \Windows\System32\vpnike.dll +2988 svchost.exe 0x7ff97c790000 False False False \Windows\System32\rascustom.dll +2988 svchost.exe 0x7ff97f190000 False False False \Windows\System32\eappcfg.dll +2988 svchost.exe 0x7ff97ed60000 False False False \Windows\System32\rastapi.dll +2988 svchost.exe 0x7ff97ed10000 False False False \Windows\System32\rasppp.dll +2988 svchost.exe 0x7ff9879d0000 False False False \Windows\System32\OpcServices.dll +2988 svchost.exe 0x7ff990db0000 True True True \Windows\System32\Windows.Web.dll +2988 svchost.exe 0x7ff9908c0000 True True True \Windows\System32\wcmapi.dll +2988 svchost.exe 0x7ff993860000 True True True \Windows\System32\MbaeApiPublic.dll +2988 svchost.exe 0x7ff993f70000 True True True \Windows\System32\wuaueng.dll +2988 svchost.exe 0x7ff993c80000 True True True \Windows\System32\wuuhosdeployment.dll +2988 svchost.exe 0x7ff993c60000 True True True \Windows\System32\wups.dll +2988 svchost.exe 0x7ff993ca0000 True True True \Windows\System32\wuuhext.dll +2988 svchost.exe 0x7ff997a60000 True True True \Windows\System32\dmcsps.dll +2988 svchost.exe 0x7ff9946f0000 True True True \Windows\System32\configmanager2.dll +2988 svchost.exe 0x7ff9946a0000 True True True \Windows\System32\dmxmlhelputils.dll +2988 svchost.exe 0x7ff9941d0000 True True True \Windows\System32\wuapi.dll +2988 svchost.exe 0x7ff9946c0000 True True True \Windows\System32\omadmapi.dll +2988 svchost.exe 0x7ff998000000 True True True \Windows\System32\dmcfgutils.dll +2988 svchost.exe 0x7ff997f40000 True True True \Windows\System32\dmenrollengine.dll +2988 svchost.exe 0x7ff998070000 True True True \Windows\System32\cryptnet.dll +2988 svchost.exe 0x7ff99a740000 True True True \Windows\System32\bcd.dll +2988 svchost.exe 0x7ff998730000 True True True \Windows\System32\OnDemandConnRouteHelper.dll +2988 svchost.exe 0x7ff998180000 True True True \Windows\System32\ncryptsslp.dll +2988 svchost.exe 0x7ff9980f0000 True True True \Windows\System32\dssenh.dll +2988 svchost.exe 0x7ff998380000 True True True \Windows\System32\Windows.Networking.Connectivity.dll +2988 svchost.exe 0x7ff998430000 True True True \Windows\System32\OneCoreCommonProxyStub.dll +2988 svchost.exe 0x7ff998f20000 True True True +2988 svchost.exe 0x7ff998a20000 True True True \Windows\System32\vaultcli.dll +2988 svchost.exe 0x7ff998890000 True True True \Windows\System32\cabinet.dll +2988 svchost.exe 0x7ff99b880000 True True True \Windows\System32\wbem\wbemsvc.dll +2988 svchost.exe 0x7ff99b300000 True True True \Windows\System32\wbem\fastprox.dll +2988 svchost.exe 0x7ff99a760000 True True True \Windows\System32\FlightSettings.dll +2988 svchost.exe 0x7ff99b680000 False False False \Windows\System32\wdscore.dll +2988 svchost.exe 0x7ff99bb50000 True True True \Windows\System32\iertutil.dll +2988 svchost.exe 0x7ff99baf0000 False False False \Windows\System32\rtutils.dll +2988 svchost.exe 0x7ff99b8a0000 True True True \Windows\System32\wbem\wbemprox.dll +2988 svchost.exe 0x7ff99c9d0000 True True True \Windows\System32\rasadhlp.dll +2988 svchost.exe 0x7ff99c880000 False False False \Windows\System32\samlib.dll +2988 svchost.exe 0x7ff99cbf0000 False False False \Windows\System32\urlmon.dll +2988 svchost.exe 0x7ff99d1d0000 True True True \Windows\System32\esent.dll +2988 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +2988 svchost.exe 0x7ff9a18b0000 True True True \Windows\System32\msvcp110_win.dll +2988 svchost.exe 0x7ff99e5f0000 True True True \Windows\System32\wwapi.dll +2988 svchost.exe 0x7ff99dba0000 True True True \Windows\System32\wbemcomn.dll +2988 svchost.exe 0x7ff99d9a0000 True True True \Windows\System32\updatepolicy.dll +2988 svchost.exe 0x7ff99e560000 False False False \Windows\System32\fwpolicyiomgr.dll +2988 svchost.exe 0x7ff99ec50000 True True True \Windows\System32\msxml6.dll +2988 svchost.exe 0x7ff99eb00000 True True True \Windows\System32\xmllite.dll +2988 svchost.exe 0x7ff99fd30000 True True True \Windows\System32\DefaultDeviceManager.dll +2988 svchost.exe 0x7ff99fa40000 True True True \Windows\System32\iri.dll +2988 svchost.exe 0x7ff9a0300000 True True True \Windows\System32\dmcmnutils.dll +2988 svchost.exe 0x7ff99ff10000 False False False \Windows\System32\eappprxy.dll +2988 svchost.exe 0x7ff99fe50000 True True True \Windows\System32\dmiso8601utils.dll +2988 svchost.exe 0x7ff9a0010000 False False False \Windows\System32\rasapi32.dll +2988 svchost.exe 0x7ff9a01a0000 True True True \Windows\System32\enterpriseresourcemanager.dll +2988 svchost.exe 0x7ff9a0930000 True True True \Windows\System32\FWPUCLNT.DLL +2988 svchost.exe 0x7ff9a0450000 False False False \Windows\System32\dpx.dll +2988 svchost.exe 0x7ff9a03a0000 True True True \Windows\System32\dmoleaututils.dll +2988 svchost.exe 0x7ff9a14d0000 True True True \Windows\servicing\CbsApi.dll +2988 svchost.exe 0x7ff9a0cd0000 False False False \Windows\System32\StateRepository.Core.dll +2988 svchost.exe 0x7ff9a0c70000 False False False \Windows\System32\AppxStreamingDataSourcePS.dll +2988 svchost.exe 0x7ff9a1540000 False False False \Windows\System32\dbghelp.dll +2988 svchost.exe 0x7ff9a2120000 True True True \Windows\System32\dhcpcsvc6.dll +2988 svchost.exe 0x7ff9a1bd0000 True True True \Windows\System32\propsys.dll +2988 svchost.exe 0x7ff9a19e0000 True True True \Windows\System32\deviceassociation.dll +2988 svchost.exe 0x7ff9a1940000 True True True \Windows\System32\policymanager.dll +2988 svchost.exe 0x7ff9a1ad0000 True True True \Windows\System32\wlanapi.dll +2988 svchost.exe 0x7ff9a1a00000 False False False \Windows\System32\dbgcore.dll +2988 svchost.exe 0x7ff9a2000000 True True True \Windows\System32\npmproxy.dll +2988 svchost.exe 0x7ff9a1f90000 False False False \Windows\System32\wkscli.dll +2988 svchost.exe 0x7ff9a1f50000 False False False \Windows\System32\logoncli.dll +2988 svchost.exe 0x7ff9a20a0000 True True True \Windows\System32\wups2.dll +2988 svchost.exe 0x7ff9a32b0000 True True True \Windows\System32\netprofm.dll +2988 svchost.exe 0x7ff9a2800000 True True True \Windows\System32\winnsi.dll +2988 svchost.exe 0x7ff9a25c0000 True True True \Windows\System32\BitsProxy.dll +2988 svchost.exe 0x7ff9a25a0000 True True True \Windows\System32\dhcpcsvc.dll +2988 svchost.exe 0x7ff9a2730000 True True True \Windows\System32\taskschd.dll +2988 svchost.exe 0x7ff9a27f0000 False False False \Windows\System32\dsrole.dll +2988 svchost.exe 0x7ff9a2b60000 True True True \Windows\System32\WinTypes.dll +2988 svchost.exe 0x7ff9a2b00000 True True True \Windows\System32\wevtapi.dll +2988 svchost.exe 0x7ff9a2ca0000 True True True \Windows\System32\wtsapi32.dll +2988 svchost.exe 0x7ff9a4660000 True True True \Windows\System32\twinapi.appcore.dll +2988 svchost.exe 0x7ff9a3780000 True True True \Windows\System32\BCP47Langs.dll +2988 svchost.exe 0x7ff9a44a0000 True True True \Windows\System32\rmclient.dll +2988 svchost.exe 0x7ff9a4c60000 True True True \Windows\System32\gpapi.dll +2988 svchost.exe 0x7ff9a49c0000 True True True \Windows\System32\devobj.dll +2988 svchost.exe 0x7ff9a49a0000 True True True \Windows\System32\ResourcePolicyClient.dll +2988 svchost.exe 0x7ff9a4c30000 False False False \Windows\System32\fwbase.dll +2988 svchost.exe 0x7ff9a4c90000 False False False \Windows\System32\FirewallAPI.dll +2988 svchost.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +2988 svchost.exe 0x7ff9a53b0000 True True True \Windows\System32\IPHLPAPI.DLL +2988 svchost.exe 0x7ff9a5170000 True True True \Windows\System32\schannel.dll +2988 svchost.exe 0x7ff9a4f70000 True True True \Windows\System32\ntmarta.dll +2988 svchost.exe 0x7ff9a5270000 True True True \Windows\System32\dpapi.dll +2988 svchost.exe 0x7ff9a5610000 True True True \Windows\System32\mswsock.dll +2988 svchost.exe 0x7ff9a53f0000 True True True +2988 svchost.exe 0x7ff9a54a0000 False False False \Windows\System32\netutils.dll +2988 svchost.exe 0x7ff9a56c0000 False False False \Windows\System32\kerberos.dll +2988 svchost.exe 0x7ff9a58f0000 True True True \Windows\System32\ncrypt.dll +2988 svchost.exe 0x7ff9a58b0000 True True True N/A +2988 svchost.exe 0x7ff9a5c60000 True True True \Windows\System32\userenv.dll +2988 svchost.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +2988 svchost.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +2988 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +2988 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +2988 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +2988 svchost.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +2988 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +2988 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +2988 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +2988 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +2988 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +2988 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +2988 svchost.exe 0x7ff9a64c0000 True True True \Windows\System32\windows.storage.dll +2988 svchost.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +2988 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +2988 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +2988 svchost.exe 0x7ff9a6e50000 True True True \Windows\System32\imagehlp.dll +2988 svchost.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +2988 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +2988 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +2988 svchost.exe 0x7ff9a7280000 True True True \Windows\System32\ole32.dll +2988 svchost.exe 0x7ff9a78b0000 True True True \Windows\System32\nsi.dll +2988 svchost.exe 0x7ff9a7470000 True True True \Windows\System32\setupapi.dll +2988 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +2988 svchost.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +2988 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +2988 svchost.exe 0x7ff9a7970000 True True True \Windows\System32\shell32.dll +2988 svchost.exe 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +2988 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +2988 svchost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +2988 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +2988 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +4660 svchost.exe 0x7ff9a2b60000 True True True \Windows\System32\WinTypes.dll +4660 svchost.exe 0x1d49f110000 False False False \Windows\System32\en-US\KernelBase.dll.mui +4660 svchost.exe 0x7ff99bb50000 True True True \Windows\System32\iertutil.dll +4660 svchost.exe 0x7ff997ad0000 True True True \Windows\System32\wlidprov.dll +4660 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +4660 svchost.exe 0x7ff991040000 True True True \Windows\System32\TokenBroker.dll +4660 svchost.exe 0x7ff990e70000 True True True \Windows\System32\Windows.Security.Authentication.Web.Core.dll +4660 svchost.exe 0x7ff998a20000 True True True \Windows\System32\vaultcli.dll +4660 svchost.exe 0x7ff997f30000 True True True \Windows\System32\tokenbinding.dll +4660 svchost.exe 0x7ff998430000 True True True \Windows\System32\OneCoreCommonProxyStub.dll +4660 svchost.exe 0x7ff99b010000 True True True \Windows\System32\MrmCoreR.dll +4660 svchost.exe 0x7ff99fda0000 True True True \Windows\System32\AppXDeploymentClient.dll +4660 svchost.exe 0x7ff99ca10000 True True True \Windows\System32\samcli.dll +4660 svchost.exe 0x7ff99c880000 True True True \Windows\System32\samlib.dll +4660 svchost.exe 0x7ff99f400000 True True True \Windows\System32\IDStore.dll +4660 svchost.exe 0x7ff99cbf0000 True True True \Windows\System32\urlmon.dll +4660 svchost.exe 0x7ff9a0cd0000 True True True \Windows\System32\StateRepository.Core.dll +4660 svchost.exe 0x7ff9a0110000 True True True \Windows\System32\Windows.ApplicationModel.dll +4660 svchost.exe 0x7ff9a1a80000 True True True \Windows\System32\usermgrcli.dll +4660 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +4660 svchost.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +4660 svchost.exe 0x7ff9a4660000 True True True \Windows\System32\twinapi.appcore.dll +4660 svchost.exe 0x7ff9a3780000 True True True \Windows\System32\BCP47Langs.dll +4660 svchost.exe 0x7ff9a2ca0000 True True True \Windows\System32\wtsapi32.dll +4660 svchost.exe 0x7ff9a57d0000 True True True \Windows\System32\cryptbase.dll +4660 svchost.exe 0x7ff9a4f70000 True True True \Windows\System32\ntmarta.dll +4660 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +4660 svchost.exe 0x7ff9a4fb0000 True True True \Windows\System32\profext.dll +4660 svchost.exe 0x7ff9a5850000 True True True \Windows\System32\winsta.dll +4660 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +4660 svchost.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +4660 svchost.exe 0x7ff9a5c60000 True True True \Windows\System32\userenv.dll +4660 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +4660 svchost.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +4660 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +4660 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +4660 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +4660 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +4660 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +4660 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +4660 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +4660 svchost.exe 0x7ff9a64c0000 True True True \Windows\System32\windows.storage.dll +4660 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +4660 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +4660 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +4660 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +4660 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +4660 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +4660 svchost.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +4660 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +4660 svchost.exe 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +4660 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +4660 svchost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +4660 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +4660 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +5648 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +5648 svchost.exe 0x7ff9a4410000 True True True \Windows\System32\apphelp.dll +5648 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +5648 svchost.exe 0x7ff9908f0000 True True True \Windows\System32\appinfo.dll +5648 svchost.exe 0x7ff997a20000 True True True \Windows\System32\appinfoext.dll +5648 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +5648 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +5648 svchost.exe 0x7ff9a5c60000 True True True \Windows\System32\userenv.dll +5648 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +5648 svchost.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +5648 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +5648 svchost.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +5648 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +5648 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +5648 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +5648 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +5648 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +5648 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +5648 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +5648 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +5648 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +5648 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +5648 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +5648 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +5648 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +5648 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +5648 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +5932 GoogleCrashHan 0xed0000 True False True \Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler.exe +5764 svchost.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +5764 svchost.exe 0x7ff9a1f50000 True True True \Windows\System32\logoncli.dll +5764 svchost.exe 0x7ff99b880000 True True True \Windows\System32\wbem\wbemsvc.dll +5764 svchost.exe 0x7ff9980d0000 True True True \Windows\System32\mskeyprotect.dll +5764 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +5764 svchost.exe 0x7ff98f380000 True True True \Windows\System32\dosvc.dll +5764 svchost.exe 0x7ff990db0000 True True True \Windows\System32\Windows.Web.dll +5764 svchost.exe 0x7ff998430000 True True True \Windows\System32\OneCoreCommonProxyStub.dll +5764 svchost.exe 0x7ff998180000 True True True \Windows\System32\ncryptsslp.dll +5764 svchost.exe 0x7ff99b300000 True True True \Windows\System32\wbem\fastprox.dll +5764 svchost.exe 0x7ff998730000 True True True \Windows\System32\OnDemandConnRouteHelper.dll +5764 svchost.exe 0x7ff99b740000 True True True \Windows\System32\webio.dll +5764 svchost.exe 0x7ff99d7a0000 True True True \Windows\System32\winhttp.dll +5764 svchost.exe 0x7ff99bb50000 True True True \Windows\System32\iertutil.dll +5764 svchost.exe 0x7ff99b8a0000 True True True \Windows\System32\wbem\wbemprox.dll +5764 svchost.exe 0x7ff99cbf0000 True True True \Windows\System32\urlmon.dll +5764 svchost.exe 0x7ff99c9d0000 True True True \Windows\System32\rasadhlp.dll +5764 svchost.exe 0x7ff9a18b0000 True True True \Windows\System32\msvcp110_win.dll +5764 svchost.exe 0x7ff99dba0000 True True True \Windows\System32\wbemcomn.dll +5764 svchost.exe 0x7ff9a0930000 True True True \Windows\System32\FWPUCLNT.DLL +5764 svchost.exe 0x7ff9a1940000 True True True \Windows\System32\policymanager.dll +5764 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +5764 svchost.exe 0x7ff9a2140000 True True True \Windows\System32\wmiclnt.dll +5764 svchost.exe 0x7ff9a2000000 True True True \Windows\System32\npmproxy.dll +5764 svchost.exe 0x7ff9a1f90000 True True True \Windows\System32\wkscli.dll +5764 svchost.exe 0x7ff9a2120000 True True True \Windows\System32\dhcpcsvc6.dll +5764 svchost.exe 0x7ff9a2800000 True True True \Windows\System32\winnsi.dll +5764 svchost.exe 0x7ff9a25c0000 True True True \Windows\System32\BitsProxy.dll +5764 svchost.exe 0x7ff9a25a0000 True True True \Windows\System32\dhcpcsvc.dll +5764 svchost.exe 0x7ff9a32b0000 True True True \Windows\System32\netprofm.dll +5764 svchost.exe 0x7ff9a54a0000 True True True \Windows\System32\netutils.dll +5764 svchost.exe 0x7ff9a53b0000 True True True \Windows\System32\IPHLPAPI.DLL +5764 svchost.exe 0x7ff9a5170000 True True True \Windows\System32\schannel.dll +5764 svchost.exe 0x7ff9a4f70000 True True True \Windows\System32\ntmarta.dll +5764 svchost.exe 0x7ff9a5270000 True True True \Windows\System32\dpapi.dll +5764 svchost.exe 0x7ff9a53f0000 True True True +5764 svchost.exe 0x7ff9a57d0000 True True True \Windows\System32\cryptbase.dll +5764 svchost.exe 0x7ff9a5610000 True True True \Windows\System32\mswsock.dll +5764 svchost.exe 0x7ff9a58f0000 True True True \Windows\System32\ncrypt.dll +5764 svchost.exe 0x7ff9a58b0000 True True True N/A +5764 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +5764 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +5764 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +5764 svchost.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +5764 svchost.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +5764 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +5764 svchost.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +5764 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +5764 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +5764 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +5764 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +5764 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +5764 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +5764 svchost.exe 0x7ff9a64c0000 True True True \Windows\System32\windows.storage.dll +5764 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +5764 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +5764 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +5764 svchost.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +5764 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +5764 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +5764 svchost.exe 0x7ff9a7280000 True True True \Windows\System32\ole32.dll +5764 svchost.exe 0x7ff9a78b0000 True True True \Windows\System32\nsi.dll +5764 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +5764 svchost.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +5764 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +5764 svchost.exe 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +5764 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +5764 svchost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +5764 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +5764 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +5940 GoogleCrashHan 0x7ff715ca0000 True False True \Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler64.exe +2872 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +2872 svchost.exe 0x7ff9a4c90000 True True True \Windows\System32\FirewallAPI.dll +2872 svchost.exe 0x7ff99b8a0000 True True True \Windows\System32\wbem\wbemprox.dll +2872 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +2872 svchost.exe 0x7ff99b300000 True True True \Windows\System32\wbem\fastprox.dll +2872 svchost.exe 0x7ff990ab0000 True True True \Windows\System32\wscsvc.dll +2872 svchost.exe 0x7ff99b880000 True True True \Windows\System32\wbem\wbemsvc.dll +2872 svchost.exe 0x7ff99dba0000 True True True \Windows\System32\wbemcomn.dll +2872 svchost.exe 0x7ff99d7a0000 True True True \Windows\System32\winhttp.dll +2872 svchost.exe 0x7ff9a4c30000 True True True \Windows\System32\fwbase.dll +2872 svchost.exe 0x7ff9a1f90000 True True True \Windows\System32\wkscli.dll +2872 svchost.exe 0x7ff9a4c60000 True True True \Windows\System32\gpapi.dll +2872 svchost.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +2872 svchost.exe 0x7ff9a54a0000 True True True \Windows\System32\netutils.dll +2872 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +2872 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +2872 svchost.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +2872 svchost.exe 0x7ff9a5c60000 True True True \Windows\System32\userenv.dll +2872 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +2872 svchost.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +2872 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +2872 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +2872 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +2872 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +2872 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +2872 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +2872 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +2872 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +2872 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +2872 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +2872 svchost.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +2872 svchost.exe 0x7ff9a7280000 True True True \Windows\System32\ole32.dll +2872 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +2872 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +2872 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +2872 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +2872 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +2872 svchost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +2872 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +2872 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +5380 SearchIndexer. 0x2e9f2dd0000 False False False \Windows\System32\prm0009.dll +5380 SearchIndexer. 0x2e9f44a0000 False False False N/A +5380 SearchIndexer. 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +5380 SearchIndexer. 0x7ff6756e0000 True False True \Windows\System32\SearchIndexer.exe +5380 SearchIndexer. 0x7ff9911e0000 True True True \Windows\System32\tquery.dll +5380 SearchIndexer. 0x7ff993950000 True True True \Windows\System32\MSWB7.dll +5380 SearchIndexer. 0x7ff9923b0000 True True True \Windows\System32\StructuredQuery.dll +5380 SearchIndexer. 0x7ff99c880000 True True True \Windows\System32\samlib.dll +5380 SearchIndexer. 0x7ff99aa30000 True True True \Windows\System32\OneCoreUAPCommonProxyStub.dll +5380 SearchIndexer. 0x7ff99ca10000 True True True \Windows\System32\samcli.dll +5380 SearchIndexer. 0x7ff99f260000 True True True \Windows\System32\vssapi.dll +5380 SearchIndexer. 0x7ff99f240000 True True True \Windows\System32\vsstrace.dll +5380 SearchIndexer. 0x7ff9a0cd0000 True True True \Windows\System32\StateRepository.Core.dll +5380 SearchIndexer. 0x7ff9a0a00000 True True True \Windows\System32\ELSCore.dll +5380 SearchIndexer. 0x7ff9a0d80000 True True True \Windows\System32\Windows.StateRepository.dll +5380 SearchIndexer. 0x7ff9a2ca0000 True True True \Windows\System32\wtsapi32.dll +5380 SearchIndexer. 0x7ff9a1bd0000 True True True \Windows\System32\propsys.dll +5380 SearchIndexer. 0x7ff9a2810000 True True True \Windows\System32\es.dll +5380 SearchIndexer. 0x7ff9a49c0000 True True True \Windows\System32\devobj.dll +5380 SearchIndexer. 0x7ff9a3780000 True True True \Windows\System32\BCP47Langs.dll +5380 SearchIndexer. 0x7ff9a54a0000 True True True \Windows\System32\netutils.dll +5380 SearchIndexer. 0x7ff9a5c60000 True True True \Windows\System32\userenv.dll +5380 SearchIndexer. 0x7ff9a5b90000 True True True \Windows\System32\sxs.dll +5380 SearchIndexer. 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +5380 SearchIndexer. 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +5380 SearchIndexer. 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +5380 SearchIndexer. 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +5380 SearchIndexer. 0x7ff9a64c0000 True True True \Windows\System32\windows.storage.dll +5380 SearchIndexer. 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +5380 SearchIndexer. 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +5380 SearchIndexer. 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +5380 SearchIndexer. 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +5380 SearchIndexer. 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +5380 SearchIndexer. 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +5380 SearchIndexer. 0x7ff9a7280000 True True True \Windows\System32\ole32.dll +5380 SearchIndexer. 0x7ff9a7130000 True True True \Windows\System32\user32.dll +5380 SearchIndexer. 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +5380 SearchIndexer. 0x7ff9a7970000 True True True \Windows\System32\shell32.dll +5380 SearchIndexer. 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +5380 SearchIndexer. 0x7ff9a9130000 True True True \Windows\System32\combase.dll +5380 SearchIndexer. 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +5380 SearchIndexer. 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +5380 SearchIndexer. 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +5380 SearchIndexer. 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +7324 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +7324 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +7324 svchost.exe 0x7ff9a49c0000 True True True \Windows\System32\devobj.dll +7324 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +7324 svchost.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +7324 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +7324 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +7324 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +7324 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +7324 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +7324 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +7324 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +7324 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +7324 svchost.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +7324 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +7324 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +7324 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +7324 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +7324 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +7324 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +7324 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +7324 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +7324 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +7324 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +7812 svchost.exe 0x7ff99eb00000 True True True \Windows\System32\xmllite.dll +7812 svchost.exe 0x7ff998730000 True True True \Windows\System32\OnDemandConnRouteHelper.dll +7812 svchost.exe 0x7ff98f6c0000 True True True \Windows\System32\LocationFramework.dll +7812 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +7812 svchost.exe 0x7ff98eb70000 True True True \Windows\System32\Windows.Networking.HostName.dll +7812 svchost.exe 0x7ff998180000 True True True \Windows\System32\ncryptsslp.dll +7812 svchost.exe 0x7ff9980d0000 True True True \Windows\System32\mskeyprotect.dll +7812 svchost.exe 0x7ff998380000 True True True \Windows\System32\Windows.Networking.Connectivity.dll +7812 svchost.exe 0x7ff99c9d0000 True True True \Windows\System32\rasadhlp.dll +7812 svchost.exe 0x7ff99b950000 True True True \Windows\System32\CellularAPI.dll +7812 svchost.exe 0x7ff99b740000 True True True \Windows\System32\webio.dll +7812 svchost.exe 0x7ff99ca10000 True True True \Windows\System32\samcli.dll +7812 svchost.exe 0x7ff99c9f0000 True True True \Windows\System32\rilproxy.dll +7812 svchost.exe 0x7ff99d7a0000 True True True \Windows\System32\winhttp.dll +7812 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +7812 svchost.exe 0x7ff9a3300000 True True True \Windows\System32\lfsvc.dll +7812 svchost.exe 0x7ff9a2120000 True True True \Windows\System32\dhcpcsvc6.dll +7812 svchost.exe 0x7ff9a1a80000 True True True \Windows\System32\usermgrcli.dll +7812 svchost.exe 0x7ff9a18b0000 True True True \Windows\System32\msvcp110_win.dll +7812 svchost.exe 0x7ff99fb80000 True True True \Windows\System32\LocationFrameworkInternalPS.dll +7812 svchost.exe 0x7ff9a0c50000 True True True \Windows\System32\LocationFrameworkPS.dll +7812 svchost.exe 0x7ff9a1940000 True True True \Windows\System32\policymanager.dll +7812 svchost.exe 0x7ff9a1bd0000 True True True \Windows\System32\propsys.dll +7812 svchost.exe 0x7ff9a1ad0000 True True True \Windows\System32\wlanapi.dll +7812 svchost.exe 0x7ff9a2000000 True True True \Windows\System32\npmproxy.dll +7812 svchost.exe 0x7ff9a2800000 True True True \Windows\System32\winnsi.dll +7812 svchost.exe 0x7ff9a25a0000 True True True \Windows\System32\dhcpcsvc.dll +7812 svchost.exe 0x7ff9a2ca0000 True True True \Windows\System32\wtsapi32.dll +7812 svchost.exe 0x7ff9a2b60000 True True True \Windows\System32\WinTypes.dll +7812 svchost.exe 0x7ff9a32f0000 True True True \Windows\System32\bi.dll +7812 svchost.exe 0x7ff9a54a0000 True True True \Windows\System32\netutils.dll +7812 svchost.exe 0x7ff9a5170000 True True True \Windows\System32\schannel.dll +7812 svchost.exe 0x7ff9a49c0000 True True True \Windows\System32\devobj.dll +7812 svchost.exe 0x7ff9a44e0000 True True True \Windows\System32\BrokerLib.dll +7812 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +7812 svchost.exe 0x7ff9a53b0000 True True True \Windows\System32\IPHLPAPI.DLL +7812 svchost.exe 0x7ff9a5270000 True True True \Windows\System32\dpapi.dll +7812 svchost.exe 0x7ff9a53f0000 True True True +7812 svchost.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +7812 svchost.exe 0x7ff9a5850000 True True True \Windows\System32\winsta.dll +7812 svchost.exe 0x7ff9a57d0000 True True True \Windows\System32\cryptbase.dll +7812 svchost.exe 0x7ff9a5610000 True True True \Windows\System32\mswsock.dll +7812 svchost.exe 0x7ff9a58f0000 True True True \Windows\System32\ncrypt.dll +7812 svchost.exe 0x7ff9a58b0000 True True True N/A +7812 svchost.exe 0x7ff9a5b90000 True True True \Windows\System32\sxs.dll +7812 svchost.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +7812 svchost.exe 0x7ff9a5c60000 True True True \Windows\System32\userenv.dll +7812 svchost.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +7812 svchost.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +7812 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +7812 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +7812 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +7812 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +7812 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +7812 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +7812 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +7812 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +7812 svchost.exe 0x7ff9a64c0000 True True True \Windows\System32\windows.storage.dll +7812 svchost.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +7812 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +7812 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +7812 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +7812 svchost.exe 0x7ff9a6fa0000 True True True \Windows\System32\coml2.dll +7812 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +7812 svchost.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +7812 svchost.exe 0x7ff9a7280000 True True True \Windows\System32\ole32.dll +7812 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +7812 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +7812 svchost.exe 0x7ff9a78b0000 True True True \Windows\System32\nsi.dll +7812 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +7812 svchost.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +7812 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +7812 svchost.exe 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +7812 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +7812 svchost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +7812 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +7812 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +7944 svchost.exe 0x2398c840000 True True True \Windows\System32\sfc.dll +7944 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +7944 svchost.exe 0x7ff9a4f70000 True True True \Windows\System32\ntmarta.dll +7944 svchost.exe 0x7ff99e760000 True True True \Windows\System32\StorSvc.dll +7944 svchost.exe 0x7ff9941d0000 True True True \Windows\System32\wuapi.dll +7944 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +7944 svchost.exe 0x7ff998890000 True True True \Windows\System32\cabinet.dll +7944 svchost.exe 0x7ff996d90000 True True True \Windows\System32\spp.dll +7944 svchost.exe 0x7ff9984c0000 True True True \Windows\System32\sfc_os.dll +7944 svchost.exe 0x7ff99a1c0000 True True True \Windows\System32\vss_ps.dll +7944 svchost.exe 0x7ff99a740000 True True True \Windows\System32\bcd.dll +7944 svchost.exe 0x7ff99ff00000 True True True \Windows\System32\fltLib.dll +7944 svchost.exe 0x7ff99f260000 True True True \Windows\System32\vssapi.dll +7944 svchost.exe 0x7ff99f0f0000 True True True \Windows\System32\wer.dll +7944 svchost.exe 0x7ff99f240000 True True True \Windows\System32\vsstrace.dll +7944 svchost.exe 0x7ff99fda0000 True True True \Windows\System32\AppXDeploymentClient.dll +7944 svchost.exe 0x7ff9a0cd0000 True True True \Windows\System32\StateRepository.Core.dll +7944 svchost.exe 0x7ff9a1bd0000 True True True \Windows\System32\propsys.dll +7944 svchost.exe 0x7ff9a49c0000 True True True \Windows\System32\devobj.dll +7944 svchost.exe 0x7ff9a2b00000 True True True \Windows\System32\wevtapi.dll +7944 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +7944 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +7944 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +7944 svchost.exe 0x7ff9a5c60000 True True True \Windows\System32\userenv.dll +7944 svchost.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +7944 svchost.exe 0x7ff9a5b90000 True True True \Windows\System32\sxs.dll +7944 svchost.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +7944 svchost.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +7944 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +7944 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +7944 svchost.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +7944 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +7944 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +7944 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +7944 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +7944 svchost.exe 0x7ff9a64c0000 True True True \Windows\System32\windows.storage.dll +7944 svchost.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +7944 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +7944 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +7944 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +7944 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +7944 svchost.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +7944 svchost.exe 0x7ff9a7280000 True True True \Windows\System32\ole32.dll +7944 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +7944 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +7944 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +7944 svchost.exe 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +7944 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +7944 svchost.exe 0x7ff9a7970000 True True True \Windows\System32\shell32.dll +7944 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +7944 svchost.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +7944 svchost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +7944 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +7944 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +9312 csrss.exe 0x7ff655c90000 True False True \Windows\System32\csrss.exe +9312 csrss.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +9312 csrss.exe 0x7ff9a5d40000 True True True \Windows\System32\csrsrv.dll +9312 csrss.exe 0x7ff9a5d00000 True True True \Windows\System32\winsrv.dll +9312 csrss.exe 0x7ff9a5cd0000 True True True \Windows\System32\sxssrv.dll +9312 csrss.exe 0x7ff9a5b90000 True True True \Windows\System32\sxs.dll +9312 csrss.exe 0x7ff9a5ce0000 True True True \Windows\System32\winsrvext.dll +9312 csrss.exe 0x7ff9a5d20000 True True True \Windows\System32\basesrv.dll +9312 csrss.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +9312 csrss.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +9312 csrss.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +9312 csrss.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +9312 csrss.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +9312 csrss.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +9312 csrss.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +9312 csrss.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +9312 csrss.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +9312 csrss.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +9312 csrss.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +3376 winlogon.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +3376 winlogon.exe 0x7ff9a4fb0000 True True True \Windows\System32\profext.dll +3376 winlogon.exe 0x7ff9a4580000 True True True \Windows\System32\dwminit.dll +3376 winlogon.exe 0x7ff65ec50000 True False True \Windows\System32\winlogon.exe +3376 winlogon.exe 0x7ff9a1a80000 True True True \Windows\System32\usermgrcli.dll +3376 winlogon.exe 0x7ff9a06d0000 True True True \Windows\System32\mpr.dll +3376 winlogon.exe 0x7ff9a4410000 True True True \Windows\System32\apphelp.dll +3376 winlogon.exe 0x7ff9a4870000 True True True \Windows\System32\UXInit.dll +3376 winlogon.exe 0x7ff9a47d0000 True True True \Windows\System32\uxtheme.dll +3376 winlogon.exe 0x7ff9a4c90000 True True True \Windows\System32\FirewallAPI.dll +3376 winlogon.exe 0x7ff9a4c30000 True True True \Windows\System32\fwbase.dll +3376 winlogon.exe 0x7ff9a4f70000 True True True \Windows\System32\ntmarta.dll +3376 winlogon.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +3376 winlogon.exe 0x7ff9a5850000 True True True \Windows\System32\winsta.dll +3376 winlogon.exe 0x7ff9a57d0000 True True True \Windows\System32\cryptbase.dll +3376 winlogon.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +3376 winlogon.exe 0x7ff9a5c60000 True True True \Windows\System32\userenv.dll +3376 winlogon.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +3376 winlogon.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +3376 winlogon.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +3376 winlogon.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +3376 winlogon.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +3376 winlogon.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +3376 winlogon.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +3376 winlogon.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +3376 winlogon.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +3376 winlogon.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +3376 winlogon.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +3376 winlogon.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +3376 winlogon.exe 0x7ff9a8df0000 True True True \Windows\System32\msctf.dll +3376 winlogon.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +3376 winlogon.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +3376 winlogon.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +3376 winlogon.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +3376 winlogon.exe 0x7ff9a9430000 True True True \Windows\System32\imm32.dll +3376 winlogon.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +3376 winlogon.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +2932 fontdrvhost.ex 0x13882660000 False False False \Windows\Fonts\sserife.fon +2932 fontdrvhost.ex 0x138827b0000 False False False \Windows\Fonts\coure.fon +2932 fontdrvhost.ex 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +2932 fontdrvhost.ex 0x7ff643ff0000 True False True \Windows\System32\fontdrvhost.exe +2932 fontdrvhost.ex 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +2932 fontdrvhost.ex 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +2932 fontdrvhost.ex 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +2932 fontdrvhost.ex 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +2932 fontdrvhost.ex 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +2932 fontdrvhost.ex 0x7ff9a7130000 True True True \Windows\System32\user32.dll +2932 fontdrvhost.ex 0x7ff9a9430000 True True True \Windows\System32\imm32.dll +2932 fontdrvhost.ex 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +2932 fontdrvhost.ex 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +6976 dwm.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +6976 dwm.exe 0x7ff9a2ac0000 True True True \Windows\System32\dwmapi.dll +6976 dwm.exe 0x7ff99eb00000 True True True \Windows\System32\xmllite.dll +6976 dwm.exe 0x7ff997080000 True True True \Windows\System32\dwmghost.dll +6976 dwm.exe 0x7ff6ddc80000 True False True \Windows\System32\dwm.exe +6976 dwm.exe 0x7ff996e70000 True True True \Windows\System32\WindowsCodecs.dll +6976 dwm.exe 0x7ff995480000 True True True \Windows\System32\atidxx64.dll +6976 dwm.exe 0x7ff998890000 True True True \Windows\System32\cabinet.dll +6976 dwm.exe 0x7ff997600000 True True True \Windows\System32\CoreUIComponents.dll +6976 dwm.exe 0x7ff9973a0000 True True True \Windows\System32\winmmbase.dll +6976 dwm.exe 0x7ff997fc0000 True True True \Windows\System32\winmm.dll +6976 dwm.exe 0x7ff99aa30000 True True True \Windows\System32\OneCoreUAPCommonProxyStub.dll +6976 dwm.exe 0x7ff99e220000 True True True \Windows\System32\version.dll +6976 dwm.exe 0x7ff9a1a80000 True True True \Windows\System32\usermgrcli.dll +6976 dwm.exe 0x7ff9a0a20000 True True True \Windows\System32\Windows.Gaming.Input.dll +6976 dwm.exe 0x7ff99f500000 True True True \Windows\System32\aticfx64.dll +6976 dwm.exe 0x7ff9a2240000 True True True \Windows\System32\UIAnimation.dll +6976 dwm.exe 0x7ff9a1fb0000 True True True \Windows\System32\avrt.dll +6976 dwm.exe 0x7ff9a2210000 True True True \Windows\System32\atiuxp64.dll +6976 dwm.exe 0x7ff9a22b0000 True True True \Windows\System32\ISM.dll +6976 dwm.exe 0x7ff9a4410000 True True True \Windows\System32\apphelp.dll +6976 dwm.exe 0x7ff9a3450000 True True True \Windows\System32\d3d11.dll +6976 dwm.exe 0x7ff9a2e70000 True True True \Windows\System32\D3DCompiler_47.dll +6976 dwm.exe 0x7ff9a2b60000 True True True \Windows\System32\WinTypes.dll +6976 dwm.exe 0x7ff9a3320000 True True True \Windows\System32\dcomp.dll +6976 dwm.exe 0x7ff9a3a10000 True True True \Windows\System32\uDWM.dll +6976 dwm.exe 0x7ff9a3920000 True True True \Windows\System32\CoreMessaging.dll +6976 dwm.exe 0x7ff9a4150000 True True True \Windows\System32\dwmcore.dll +6976 dwm.exe 0x7ff9a3af0000 True True True \Windows\System32\d2d1.dll +6976 dwm.exe 0x7ff9a43e0000 True True True \Windows\System32\dwmredir.dll +6976 dwm.exe 0x7ff9a57b0000 True True True \Windows\System32\cryptsp.dll +6976 dwm.exe 0x7ff9a4d20000 True True True \Windows\System32\dxgi.dll +6976 dwm.exe 0x7ff9a47d0000 True True True \Windows\System32\uxtheme.dll +6976 dwm.exe 0x7ff9a4660000 True True True \Windows\System32\twinapi.appcore.dll +6976 dwm.exe 0x7ff9a4c20000 True True True \Windows\System32\hid.dll +6976 dwm.exe 0x7ff9a4f70000 True True True \Windows\System32\ntmarta.dll +6976 dwm.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +6976 dwm.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +6976 dwm.exe 0x7ff9a5850000 True True True \Windows\System32\winsta.dll +6976 dwm.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +6976 dwm.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +6976 dwm.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +6976 dwm.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +6976 dwm.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +6976 dwm.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +6976 dwm.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +6976 dwm.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +6976 dwm.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +6976 dwm.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +6976 dwm.exe 0x7ff9a64c0000 True True True \Windows\System32\windows.storage.dll +6976 dwm.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +6976 dwm.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +6976 dwm.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +6976 dwm.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +6976 dwm.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +6976 dwm.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +6976 dwm.exe 0x7ff9a7970000 True True True \Windows\System32\shell32.dll +6976 dwm.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +6976 dwm.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +6976 dwm.exe 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +6976 dwm.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +6976 dwm.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +6976 dwm.exe 0x7ff9a9430000 True True True \Windows\System32\imm32.dll +6976 dwm.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +6976 dwm.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +9336 atieclxx.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +9336 atieclxx.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +9336 atieclxx.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +9336 atieclxx.exe 0x7ff9a2ca0000 True True True \Windows\System32\wtsapi32.dll +9336 atieclxx.exe 0x7ff9a1bd0000 True True True \Windows\System32\propsys.dll +9336 atieclxx.exe 0x7ff7bbc30000 True False True \Windows\System32\atieclxx.exe +9336 atieclxx.exe 0x7ff9a2ac0000 True True True \Windows\System32\dwmapi.dll +9336 atieclxx.exe 0x7ff9a2160000 True True True \Windows\System32\MMDevAPI.dll +9336 atieclxx.exe 0x7ff9a49c0000 True True True \Windows\System32\devobj.dll +9336 atieclxx.exe 0x7ff9a47d0000 True True True \Windows\System32\uxtheme.dll +9336 atieclxx.exe 0x7ff9a5c60000 True True True \Windows\System32\userenv.dll +9336 atieclxx.exe 0x7ff9a5850000 True True True \Windows\System32\winsta.dll +9336 atieclxx.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +9336 atieclxx.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +9336 atieclxx.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +9336 atieclxx.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +9336 atieclxx.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +9336 atieclxx.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +9336 atieclxx.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +9336 atieclxx.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +9336 atieclxx.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +9336 atieclxx.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +9336 atieclxx.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +9336 atieclxx.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +9336 atieclxx.exe 0x7ff9a64c0000 True True True \Windows\System32\windows.storage.dll +9336 atieclxx.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +9336 atieclxx.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +9336 atieclxx.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +9336 atieclxx.exe 0x7ff9a7470000 True True True \Windows\System32\setupapi.dll +9336 atieclxx.exe 0x7ff9a7280000 True True True \Windows\System32\ole32.dll +9336 atieclxx.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +9336 atieclxx.exe 0x7ff9a7970000 True True True \Windows\System32\shell32.dll +9336 atieclxx.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +9336 atieclxx.exe 0x7ff9a8db0000 True True True \Windows\System32\psapi.dll +9336 atieclxx.exe 0x7ff9a90d0000 True True True \Windows\System32\difxapi.dll +9336 atieclxx.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +9336 atieclxx.exe 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +9336 atieclxx.exe 0x7ff9a8df0000 True True True \Windows\System32\msctf.dll +9336 atieclxx.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +9336 atieclxx.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +9336 atieclxx.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +9336 atieclxx.exe 0x7ff9a9430000 True True True \Windows\System32\imm32.dll +9336 atieclxx.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +9336 atieclxx.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +9932 remsh.exe 0x7ff736d40000 True False True 据畬敤⁳⁡敬杮桴戠瑹⁥潦⁲桴⁥敫⁹慨摮敬ਮ†††灡畤慄慴敌⭮ +9200 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +9200 svchost.exe 0x7ff9a21f0000 True True True \Windows\System32\wshbth.dll +9200 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +9200 svchost.exe 0x7ff99c9d0000 True True True \Windows\System32\rasadhlp.dll +9200 svchost.exe 0x7ff99a540000 True True True \Windows\System32\pnrpnsp.dll +9200 svchost.exe 0x7ff99a520000 True True True \Windows\System32\NapiNSP.dll +9200 svchost.exe 0x7ff9a0cb0000 True True True +9200 svchost.exe 0x7ff9a0930000 True True True \Windows\System32\FWPUCLNT.DLL +9200 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +9200 svchost.exe 0x7ff9a3820000 True True True \Windows\System32\nrpsrv.dll +9200 svchost.exe 0x7ff9a2890000 True True True \Windows\System32\nlaapi.dll +9200 svchost.exe 0x7ff9a3840000 True True True \Windows\System32\lmhsvc.dll +9200 svchost.exe 0x7ff9a49c0000 True True True \Windows\System32\devobj.dll +9200 svchost.exe 0x7ff9a5610000 True True True \Windows\System32\mswsock.dll +9200 svchost.exe 0x7ff9a53f0000 True True True +9200 svchost.exe 0x7ff9a53b0000 True True True \Windows\System32\IPHLPAPI.DLL +9200 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +9200 svchost.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +9200 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +9200 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +9200 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +9200 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +9200 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +9200 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +9200 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +9200 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +9200 svchost.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +9200 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +9200 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +9200 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +9200 svchost.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +9200 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +9200 svchost.exe 0x7ff9a78b0000 True True True \Windows\System32\nsi.dll +9200 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +9200 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +9200 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +9200 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +9200 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +2192 SynTPEnh.exe 0x7ff99e220000 True True True \Windows\System32\version.dll +2192 SynTPEnh.exe 0x59c50000 False False False \Windows\System32\SynTPAPI.dll +2192 SynTPEnh.exe 0x7ff997fc0000 True False True \Windows\System32\winmm.dll +2192 SynTPEnh.exe 0x140000000 True False True \Program Files\Synaptics\SynTP\SynTPEnh.exe +2192 SynTPEnh.exe 0x7ff9973a0000 False False False \Windows\System32\winmmbase.dll +2192 SynTPEnh.exe 0x7ff997600000 False False False \Windows\System32\CoreUIComponents.dll +2192 SynTPEnh.exe 0x7ff9998d0000 True False True \Windows\System32\netapi32.dll +2192 SynTPEnh.exe 0x7ff99c880000 False False False \Windows\System32\samlib.dll +2192 SynTPEnh.exe 0x7ff99a350000 False False False \Windows\System32\SynCOM.dll +2192 SynTPEnh.exe 0x7ff99ca10000 False False False \Windows\System32\samcli.dll +2192 SynTPEnh.exe 0x7ff9a6e70000 True False True \Windows\System32\rpcrt4.dll +2192 SynTPEnh.exe 0x7ff9a54a0000 False False False \Windows\System32\netutils.dll +2192 SynTPEnh.exe 0x7ff9a1f90000 False False False \Windows\System32\wkscli.dll +2192 SynTPEnh.exe 0x7ff9a13c0000 False False False \Windows\System32\AudioSes.dll +2192 SynTPEnh.exe 0x7ff9a0610000 False False False \Windows\System32\TextInputFramework.dll +2192 SynTPEnh.exe 0x7ff9a1bd0000 False False False \Windows\System32\propsys.dll +2192 SynTPEnh.exe 0x7ff9a1a80000 False False False \Windows\System32\usermgrcli.dll +2192 SynTPEnh.exe 0x7ff9a2160000 False False False \Windows\System32\MMDevAPI.dll +2192 SynTPEnh.exe 0x7ff9a1fb0000 False False False \Windows\System32\avrt.dll +2192 SynTPEnh.exe 0x7ff9a47d0000 False False False \Windows\System32\uxtheme.dll +2192 SynTPEnh.exe 0x7ff9a3920000 False False False \Windows\System32\CoreMessaging.dll +2192 SynTPEnh.exe 0x7ff9a49c0000 False False False \Windows\System32\devobj.dll +2192 SynTPEnh.exe 0x7ff9a4f70000 False False False \Windows\System32\ntmarta.dll +2192 SynTPEnh.exe 0x7ff9a6160000 True False True \Windows\System32\win32u.dll +2192 SynTPEnh.exe 0x7ff9a5db0000 False False False \Windows\System32\kernel.appcore.dll +2192 SynTPEnh.exe 0x7ff9a5c90000 False False False \Windows\System32\sspicli.dll +2192 SynTPEnh.exe 0x7ff9a5850000 False False False \Windows\System32\winsta.dll +2192 SynTPEnh.exe 0x7ff9a57d0000 False False False \Windows\System32\cryptbase.dll +2192 SynTPEnh.exe 0x7ff9a5c30000 False False False \Windows\System32\bcrypt.dll +2192 SynTPEnh.exe 0x7ff9a5d60000 False False False \Windows\System32\powrprof.dll +2192 SynTPEnh.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +2192 SynTPEnh.exe 0x7ff9a5dd0000 False False False \Windows\System32\profapi.dll +2192 SynTPEnh.exe 0x7ff9a6060000 False False False \Windows\System32\msvcp_win.dll +2192 SynTPEnh.exe 0x7ff9a6bc0000 False False False \Windows\System32\gdi32full.dll +2192 SynTPEnh.exe 0x7ff9a6470000 False False False \Windows\System32\cfgmgr32.dll +2192 SynTPEnh.exe 0x7ff9a6400000 False False False \Windows\System32\bcryptprimitives.dll +2192 SynTPEnh.exe 0x7ff9a64c0000 False False False \Windows\System32\windows.storage.dll +2192 SynTPEnh.exe 0x7ff9a6d50000 False False False l-TimeZones.Resources" version +2192 SynTPEnh.exe 0x7ff9a8dc0000 False False False \Windows\System32\gdi32.dll +2192 SynTPEnh.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +2192 SynTPEnh.exe 0x7ff9a7130000 True False True \Windows\System32\user32.dll +2192 SynTPEnh.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +2192 SynTPEnh.exe 0x7ff9a7280000 False False False \Windows\System32\ole32.dll +2192 SynTPEnh.exe 0x7ff9a73d0000 False False False \Windows\System32\clbcatq.dll +2192 SynTPEnh.exe 0x7ff9a8db0000 True False True \Windows\System32\psapi.dll +2192 SynTPEnh.exe 0x7ff9a7970000 False False False \Windows\System32\shell32.dll +2192 SynTPEnh.exe 0x7ff9a9430000 True False True \Windows\System32\imm32.dll +2192 SynTPEnh.exe 0x7ff9a8fc0000 False False False \Windows\System32\SHCore.dll +2192 SynTPEnh.exe 0x7ff9a8f60000 False False False \Windows\System32\shlwapi.dll +2192 SynTPEnh.exe 0x7ff9a8df0000 False False False \Windows\System32\msctf.dll +2192 SynTPEnh.exe 0x7ff9a9130000 False False False \Windows\System32\combase.dll +2192 SynTPEnh.exe 0x7ff9a9070000 False False False \Windows\System32\sechost.dll +2192 SynTPEnh.exe 0x7ff9a96b0000 False False False \Windows\System32\comdlg32.dll +2192 SynTPEnh.exe 0x7ff9a9600000 False False False \Windows\System32\advapi32.dll +2192 SynTPEnh.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +2192 SynTPEnh.exe 0x7ff9a97c0000 False False False \Windows\System32\oleaut32.dll +3560 svchost.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +3560 svchost.exe 0x7ff99bee0000 True True True \Windows\System32\cdp.dll +3560 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +3560 svchost.exe 0x7ff99b7e0000 True True True \Windows\System32\VEEventDispatcher.dll +3560 svchost.exe 0x7ff998430000 True True True \Windows\System32\OneCoreCommonProxyStub.dll +3560 svchost.exe 0x7ff990e70000 True True True \Windows\System32\Windows.Security.Authentication.Web.Core.dll +3560 svchost.exe 0x7ff99bb50000 True True True \Windows\System32\iertutil.dll +3560 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +3560 svchost.exe 0x7ff9a2b60000 True True True \Windows\System32\WinTypes.dll +3560 svchost.exe 0x7ff9a18b0000 True True True \Windows\System32\msvcp110_win.dll +3560 svchost.exe 0x7ff99d7a0000 True True True \Windows\System32\winhttp.dll +3560 svchost.exe 0x7ff99e3b0000 True True True \Windows\System32\WlanRadioManager.dll +3560 svchost.exe 0x7ff9a1940000 True True True \Windows\System32\policymanager.dll +3560 svchost.exe 0x7ff9a1ad0000 True True True \Windows\System32\wlanapi.dll +3560 svchost.exe 0x7ff9a40a0000 True True True \Windows\System32\Windows.Devices.Radios.dll +3560 svchost.exe 0x7ff9a2ca0000 True True True \Windows\System32\wtsapi32.dll +3560 svchost.exe 0x7ff9a4660000 True True True \Windows\System32\twinapi.appcore.dll +3560 svchost.exe 0x7ff9a58f0000 True True True \Windows\System32\ncrypt.dll +3560 svchost.exe 0x7ff9a5850000 True True True \Windows\System32\winsta.dll +3560 svchost.exe 0x7ff9a53b0000 True True True \Windows\System32\IPHLPAPI.DLL +3560 svchost.exe 0x7ff9a58b0000 True True True N/A +3560 svchost.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +3560 svchost.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +3560 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +3560 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +3560 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +3560 svchost.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +3560 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +3560 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +3560 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +3560 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +3560 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +3560 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +3560 svchost.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +3560 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +3560 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +3560 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +3560 svchost.exe 0x7ff9a6fa0000 True True True \Windows\System32\coml2.dll +3560 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +3560 svchost.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +3560 svchost.exe 0x7ff9a7280000 True True True \Windows\System32\ole32.dll +3560 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +3560 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +3560 svchost.exe 0x7ff9a78b0000 True True True \Windows\System32\nsi.dll +3560 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +3560 svchost.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +3560 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +3560 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +3560 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +3560 svchost.exe 0x7ff9a9430000 True True True \Windows\System32\imm32.dll +3560 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +3560 svchost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +3752 sihost.exe 0x1a681500000 False False False \Windows\System32\en-US\KernelBase.dll.mui +3752 sihost.exe 0x7ff9a1a80000 True True True \Windows\System32\usermgrcli.dll +3752 sihost.exe 0x7ff999580000 True True True \Windows\System32\AppContracts.dll +3752 sihost.exe 0x7ff997600000 True True True \Windows\System32\CoreUIComponents.dll +3752 sihost.exe 0x7ff703780000 True False True \Windows\System32\sihost.exe +3752 sihost.exe 0x7ff991bc0000 True True True \Windows\System32\ExecModelClient.dll +3752 sihost.exe 0x7ff9911e0000 True True True \Windows\System32\tquery.dll +3752 sihost.exe 0x7ff990bc0000 True True True \Windows\System32\capauthz.dll +3752 sihost.exe 0x7ff991520000 True True True \Windows\System32\mssrch.dll +3752 sihost.exe 0x7ff991c10000 True True True \Windows\System32\execmodelproxy.dll +3752 sihost.exe 0x7ff997ff0000 True True True \Windows\System32\WpPortingLibrary.dll +3752 sihost.exe 0x7ff9978e0000 True True True \Windows\System32\ShareHost.dll +3752 sihost.exe 0x7ff997c00000 True True True \Windows\System32\twinui.appcore.dll +3752 sihost.exe 0x7ff999450000 True True True \Windows\System32\daxexec.dll +3752 sihost.exe 0x7ff998430000 True True True \Windows\System32\OneCoreCommonProxyStub.dll +3752 sihost.exe 0x7ff9994e0000 True True True \Windows\System32\Windows.System.Launcher.dll +3752 sihost.exe 0x7ff9a0380000 True True True \Windows\System32\Windows.Shell.ServiceHostBuilder.dll +3752 sihost.exe 0x7ff99aa30000 True True True \Windows\System32\OneCoreUAPCommonProxyStub.dll +3752 sihost.exe 0x7ff999fb0000 True True True \Windows\System32\ActivationManager.dll +3752 sihost.exe 0x7ff999640000 True True True \Windows\System32\WindowManagement.dll +3752 sihost.exe 0x7ff9997a0000 True True True \Windows\System32\container.dll +3752 sihost.exe 0x7ff99a020000 True True True \Windows\System32\modernexecserver.dll +3752 sihost.exe 0x7ff99ff00000 True True True \Windows\System32\fltLib.dll +3752 sihost.exe 0x7ff99f430000 True True True \Windows\System32\ClipboardServer.dll +3752 sihost.exe 0x7ff99d1d0000 True True True \Windows\System32\esent.dll +3752 sihost.exe 0x7ff99fda0000 True True True \Windows\System32\AppXDeploymentClient.dll +3752 sihost.exe 0x7ff9a0280000 True True True \Windows\System32\UiaManager.dll +3752 sihost.exe 0x7ff9a0350000 True True True \Windows\System32\AppointmentActivation.dll +3752 sihost.exe 0x7ff9a08e0000 True True True \Windows\System32\UserMgrProxy.dll +3752 sihost.exe 0x7ff9a06b0000 True True True \Windows\System32\DesktopShellExt.dll +3752 sihost.exe 0x7ff9a0d80000 True True True \Windows\System32\Windows.StateRepository.dll +3752 sihost.exe 0x7ff9a0cd0000 True True True \Windows\System32\StateRepository.Core.dll +3752 sihost.exe 0x7ff9a18b0000 True True True \Windows\System32\msvcp110_win.dll +3752 sihost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +3752 sihost.exe 0x7ff9a49a0000 True True True \Windows\System32\ResourcePolicyClient.dll +3752 sihost.exe 0x7ff9a3920000 True True True \Windows\System32\CoreMessaging.dll +3752 sihost.exe 0x7ff9a2ca0000 True True True \Windows\System32\wtsapi32.dll +3752 sihost.exe 0x7ff9a2b60000 True True True \Windows\System32\WinTypes.dll +3752 sihost.exe 0x7ff9a2ac0000 True True True \Windows\System32\dwmapi.dll +3752 sihost.exe 0x7ff9a3800000 True True True \Windows\System32\LicenseManagerApi.dll +3752 sihost.exe 0x7ff9a3750000 True True True \Windows\System32\dsclient.dll +3752 sihost.exe 0x7ff9a3830000 True True True \Windows\System32\notificationplatformcomponent.dll +3752 sihost.exe 0x7ff9a4660000 True True True \Windows\System32\twinapi.appcore.dll +3752 sihost.exe 0x7ff9a44a0000 True True True \Windows\System32\rmclient.dll +3752 sihost.exe 0x7ff9a47d0000 True True True \Windows\System32\uxtheme.dll +3752 sihost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +3752 sihost.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +3752 sihost.exe 0x7ff9a5850000 True True True \Windows\System32\winsta.dll +3752 sihost.exe 0x7ff9a53b0000 True True True \Windows\System32\IPHLPAPI.DLL +3752 sihost.exe 0x7ff9a4f70000 True True True \Windows\System32\ntmarta.dll +3752 sihost.exe 0x7ff9a5670000 True True True \Windows\System32\cryptdll.dll +3752 sihost.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +3752 sihost.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +3752 sihost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +3752 sihost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +3752 sihost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +3752 sihost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +3752 sihost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +3752 sihost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +3752 sihost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +3752 sihost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +3752 sihost.exe 0x7ff9a64c0000 True True True \Windows\System32\windows.storage.dll +3752 sihost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +3752 sihost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +3752 sihost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +3752 sihost.exe 0x7ff9a7280000 True True True \Windows\System32\ole32.dll +3752 sihost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +3752 sihost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +3752 sihost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +3752 sihost.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +3752 sihost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +3752 sihost.exe 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +3752 sihost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +3752 sihost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +3752 sihost.exe 0x7ff9a9430000 True True True \Windows\System32\imm32.dll +3752 sihost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +3752 sihost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +3540 svchost.exe 0x22525320000 False False False \Windows\System32\en-US\netmsg.dll.mui +3540 svchost.exe 0x22525310000 False False False \Windows\System32\netmsg.dll +3540 svchost.exe 0x22526ca0000 False False False \Windows\System32\en-US\KernelBase.dll.mui +3540 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +3540 svchost.exe 0x7ff99cdc0000 False False False \Windows\System32\wpncore.dll +3540 svchost.exe 0x7ff998380000 False False False \Windows\System32\Windows.Networking.Connectivity.dll +3540 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +3540 svchost.exe 0x7ff991c10000 False False False \Windows\System32\execmodelproxy.dll +3540 svchost.exe 0x7ff9908c0000 False False False \Windows\System32\wcmapi.dll +3540 svchost.exe 0x7ff9980d0000 False False False \Windows\System32\mskeyprotect.dll +3540 svchost.exe 0x7ff9974a0000 False False False \Windows\System32\NotificationObjFactory.dll +3540 svchost.exe 0x7ff998180000 False False False \Windows\System32\ncryptsslp.dll +3540 svchost.exe 0x7ff99b7e0000 False False False \Windows\System32\VEEventDispatcher.dll +3540 svchost.exe 0x7ff998b20000 False False False \Windows\System32\NotificationController.dll +3540 svchost.exe 0x7ff998430000 False False False \Windows\System32\OneCoreCommonProxyStub.dll +3540 svchost.exe 0x7ff998730000 False False False \Windows\System32\OnDemandConnRouteHelper.dll +3540 svchost.exe 0x7ff99aa30000 False False False \Windows\System32\OneCoreUAPCommonProxyStub.dll +3540 svchost.exe 0x7ff999940000 False False False \Windows\System32\dusmapi.dll +3540 svchost.exe 0x7ff99b740000 False False False \Windows\System32\webio.dll +3540 svchost.exe 0x7ff99bee0000 False False False \Windows\System32\cdp.dll +3540 svchost.exe 0x7ff99bb50000 True True True \Windows\System32\iertutil.dll +3540 svchost.exe 0x7ff99ca30000 False False False \Windows\System32\winsqlite3.dll +3540 svchost.exe 0x7ff99c9d0000 False False False \Windows\System32\rasadhlp.dll +3540 svchost.exe 0x7ff99cbf0000 False False False \Windows\System32\urlmon.dll +3540 svchost.exe 0x7ff9a1a80000 False False False \Windows\System32\usermgrcli.dll +3540 svchost.exe 0x7ff99eb00000 False False False \Windows\System32\xmllite.dll +3540 svchost.exe 0x7ff9a0cd0000 False False False \Windows\System32\StateRepository.Core.dll +3540 svchost.exe 0x7ff9a0ca0000 False False False \Windows\System32\NotificationControllerPS.dll +3540 svchost.exe 0x7ff9a0100000 False False False \Windows\System32\TimeBrokerClient.dll +3540 svchost.exe 0x7ff9a18b0000 False False False \Windows\System32\msvcp110_win.dll +3540 svchost.exe 0x7ff9a0d80000 False False False \Windows\System32\Windows.StateRepository.dll +3540 svchost.exe 0x7ff9a1940000 False False False \Windows\System32\policymanager.dll +3540 svchost.exe 0x7ff9a2b60000 False False False \Windows\System32\WinTypes.dll +3540 svchost.exe 0x7ff9a2000000 False False False \Windows\System32\npmproxy.dll +3540 svchost.exe 0x7ff9a1ad0000 False False False \Windows\System32\wlanapi.dll +3540 svchost.exe 0x7ff9a25a0000 False False False \Windows\System32\dhcpcsvc.dll +3540 svchost.exe 0x7ff9a2120000 False False False \Windows\System32\dhcpcsvc6.dll +3540 svchost.exe 0x7ff9a2800000 False False False \Windows\System32\winnsi.dll +3540 svchost.exe 0x7ff9a4660000 False False False \Windows\System32\twinapi.appcore.dll +3540 svchost.exe 0x7ff9a40e0000 False False False \Windows\System32\SystemEventsBrokerClient.dll +3540 svchost.exe 0x7ff9a2ca0000 False False False \Windows\System32\wtsapi32.dll +3540 svchost.exe 0x7ff9a44a0000 False False False \Windows\System32\rmclient.dll +3540 svchost.exe 0x7ff9a47d0000 False False False \Windows\System32\uxtheme.dll +3540 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +3540 svchost.exe 0x7ff9a5d60000 False False False \Windows\System32\powrprof.dll +3540 svchost.exe 0x7ff9a57d0000 False False False \Windows\System32\cryptbase.dll +3540 svchost.exe 0x7ff9a53f0000 False False False +3540 svchost.exe 0x7ff9a5270000 False False False \Windows\System32\dpapi.dll +3540 svchost.exe 0x7ff9a5170000 False False False \Windows\System32\schannel.dll +3540 svchost.exe 0x7ff9a53b0000 False False False \Windows\System32\IPHLPAPI.DLL +3540 svchost.exe 0x7ff9a5610000 False False False \Windows\System32\mswsock.dll +3540 svchost.exe 0x7ff9a58f0000 False False False \Windows\System32\ncrypt.dll +3540 svchost.exe 0x7ff9a58b0000 False False False N/A +3540 svchost.exe 0x7ff9a5850000 False False False \Windows\System32\winsta.dll +3540 svchost.exe 0x7ff9a5c30000 False False False \Windows\System32\bcrypt.dll +3540 svchost.exe 0x7ff9a5b70000 False False False \Windows\System32\EventAggregation.dll +3540 svchost.exe 0x7ff9a5c90000 False False False \Windows\System32\sspicli.dll +3540 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +3540 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +3540 svchost.exe 0x7ff9a5dd0000 False False False \Windows\System32\profapi.dll +3540 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +3540 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +3540 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +3540 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +3540 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +3540 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +3540 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +3540 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +3540 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +3540 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +3540 svchost.exe 0x7ff9a7020000 False False False \Windows\System32\ws2_32.dll +3540 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +3540 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +3540 svchost.exe 0x7ff9a78b0000 False False False \Windows\System32\nsi.dll +3540 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +3540 svchost.exe 0x7ff9a8df0000 False False False \Windows\System32\msctf.dll +3540 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +3540 svchost.exe 0x7ff9a7970000 False False False \Windows\System32\shell32.dll +3540 svchost.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +3540 svchost.exe 0x7ff9a8f60000 False False False \Windows\System32\shlwapi.dll +3540 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +3540 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +3540 svchost.exe 0x7ff9a9430000 True True True \Windows\System32\imm32.dll +3540 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +3540 svchost.exe 0x7ff9a97c0000 False False False \Windows\System32\oleaut32.dll +7048 taskhostw.exe 0x7ff9a2ac0000 True True True \Windows\System32\dwmapi.dll +7048 taskhostw.exe 0x7ff99bb50000 True True True \Windows\System32\iertutil.dll +7048 taskhostw.exe 0x7ff996370000 True True True \Windows\System32\InputService.dll +7048 taskhostw.exe 0x7ff66cfb0000 True False True \Windows\System32\taskhostw.exe +7048 taskhostw.exe 0x7ff995fe0000 True True True \Windows\System32\wininet.dll +7048 taskhostw.exe 0x7ff997fc0000 True True True \Windows\System32\winmm.dll +7048 taskhostw.exe 0x7ff9973a0000 True True True \Windows\System32\winmmbase.dll +7048 taskhostw.exe 0x7ff997600000 True True True \Windows\System32\CoreUIComponents.dll +7048 taskhostw.exe 0x7ff997e30000 True True True \Windows\System32\InputHost.dll +7048 taskhostw.exe 0x7ff998940000 True True True \Windows\System32\msutb.dll +7048 taskhostw.exe 0x7ff9a0610000 True True True \Windows\System32\TextInputFramework.dll +7048 taskhostw.exe 0x7ff99d8e0000 True True True \Windows\System32\PlaySndSrv.dll +7048 taskhostw.exe 0x7ff99d1d0000 True True True \Windows\System32\esent.dll +7048 taskhostw.exe 0x7ff99d8c0000 True True True \Windows\System32\EditBufferTestHook.dll +7048 taskhostw.exe 0x7ff99e960000 True True True \Windows\System32\MsCtfMonitor.dll +7048 taskhostw.exe 0x7ff99fc20000 True True True \Windows\System32\midimap.dll +7048 taskhostw.exe 0x7ff99fc60000 True True True \Windows\System32\wdmaud.drv +7048 taskhostw.exe 0x7ff9a0270000 True True True \Windows\System32\KBDUS.DLL +7048 taskhostw.exe 0x7ff9a1bd0000 True True True \Windows\System32\propsys.dll +7048 taskhostw.exe 0x7ff9a13c0000 True True True \Windows\System32\AudioSes.dll +7048 taskhostw.exe 0x7ff9a1a80000 True True True \Windows\System32\usermgrcli.dll +7048 taskhostw.exe 0x7ff9a2160000 True True True \Windows\System32\MMDevAPI.dll +7048 taskhostw.exe 0x7ff9a1fb0000 True True True \Windows\System32\avrt.dll +7048 taskhostw.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +7048 taskhostw.exe 0x7ff9a5850000 True True True \Windows\System32\winsta.dll +7048 taskhostw.exe 0x7ff9a47d0000 True True True \Windows\System32\uxtheme.dll +7048 taskhostw.exe 0x7ff9a3920000 True True True \Windows\System32\CoreMessaging.dll +7048 taskhostw.exe 0x7ff9a2b60000 True True True \Windows\System32\WinTypes.dll +7048 taskhostw.exe 0x7ff9a4fb0000 True True True \Windows\System32\profext.dll +7048 taskhostw.exe 0x7ff9a4f70000 True True True \Windows\System32\ntmarta.dll +7048 taskhostw.exe 0x7ff9a49c0000 True True True \Windows\System32\devobj.dll +7048 taskhostw.exe 0x7ff9a57d0000 True True True \Windows\System32\cryptbase.dll +7048 taskhostw.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +7048 taskhostw.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +7048 taskhostw.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +7048 taskhostw.exe 0x7ff9a5c60000 True True True \Windows\System32\userenv.dll +7048 taskhostw.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +7048 taskhostw.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +7048 taskhostw.exe 0x7ff9a64c0000 True True True \Windows\System32\windows.storage.dll +7048 taskhostw.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +7048 taskhostw.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +7048 taskhostw.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +7048 taskhostw.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +7048 taskhostw.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +7048 taskhostw.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +7048 taskhostw.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +7048 taskhostw.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +7048 taskhostw.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +7048 taskhostw.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +7048 taskhostw.exe 0x7ff9a7280000 True True True \Windows\System32\ole32.dll +7048 taskhostw.exe 0x7ff9a8df0000 True True True \Windows\System32\msctf.dll +7048 taskhostw.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +7048 taskhostw.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +7048 taskhostw.exe 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +7048 taskhostw.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +7048 taskhostw.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +7048 taskhostw.exe 0x7ff9a9430000 True True True \Windows\System32\imm32.dll +7048 taskhostw.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +7048 taskhostw.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +7688 explorer.exe 0x1090000 False False False \Windows\System32\en-US\dui70.dll.mui +7688 explorer.exe 0xdf0000 False False False \Windows\en-US\explorer.exe.mui +7688 explorer.exe 0x2b30000 False False False \Windows\System32\en-US\shell32.dll.mui +7688 explorer.exe 0x4c40000 False False False \Windows\System32\en-US\stobject.dll.mui +7688 explorer.exe 0x4db0000 False False False \Windows\System32\en-US\windows.storage.dll.mui +7688 explorer.exe 0x5c60000 True False True \Windows\System32\UIRibbonRes.dll +7688 explorer.exe 0x5d00000 False False False \Windows\System32\en-US\ieframe.dll.mui +7688 explorer.exe 0x7ff99b010000 True True True \Windows\System32\MrmCoreR.dll +7688 explorer.exe 0xa260000 False False False \Windows\System32\en-US\KernelBase.dll.mui +7688 explorer.exe 0xb870000 False False False \Windows\System32\en-US\imapi2.dll.mui +7688 explorer.exe 0xb930000 False False False \Windows\System32\prm0009.dll +7688 explorer.exe 0x7ff994830000 True True True \Windows\System32\oleacc.dll +7688 explorer.exe 0x7ff98fcb0000 True True True \Windows\System32\Speech_OneCore\common\sapi_onecore.dll +7688 explorer.exe 0x7ff98aa30000 True True True \Windows\System32\srchadmin.dll +7688 explorer.exe 0x7ff986600000 False False False +7688 explorer.exe 0x7ff7e7050000 True False True \Windows\explorer.exe +7688 explorer.exe 0x7ff7bc630000 True False True \Windows\System32\ntoskrnl.exe +7688 explorer.exe 0x7ff9814f0000 False False False \Windows\System32\Windows.Media.dll +7688 explorer.exe 0x7ff978590000 False False False \Windows\System32\DDORes.dll +7688 explorer.exe 0x7ff989db0000 True True True \Windows\System32\hgcpl.dll +7688 explorer.exe 0x7ff986770000 True True True \Windows\System32\msi.dll +7688 explorer.exe 0x7ff988510000 False False False \Windows\System32\werconcpl.dll +7688 explorer.exe 0x7ff989d10000 True True True \Windows\System32\duser.dll +7688 explorer.exe 0x7ff9890c0000 False False False \Windows\System32\ieframe.dll +7688 explorer.exe 0x7ff98a1e0000 True True True \Windows\System32\imapi2.dll +7688 explorer.exe 0x7ff98a0e0000 False False False \Windows\System32\zipfldr.dll +7688 explorer.exe 0x7ff98a590000 True True True \Windows\System32\SyncCenter.dll +7688 explorer.exe 0x7ff98acd0000 True True True \Windows\System32\pnidui.dll +7688 explorer.exe 0x7ff98ab50000 True True True \Windows\System32\BluetoothApis.dll +7688 explorer.exe 0x7ff98aa90000 True True True \Windows\System32\bthprops.cpl +7688 explorer.exe 0x7ff98abd0000 True True True \Windows\System32\WlanMediaManager.dll +7688 explorer.exe 0x7ff98ab90000 True True True \Windows\System32\TetheringStation.dll +7688 explorer.exe 0x7ff98ac70000 True True True \Windows\System32\NetworkUXBroker.dll +7688 explorer.exe 0x7ff98d600000 True True True \Windows\System32\twinui.dll +7688 explorer.exe 0x7ff98af40000 True True True \Windows\System32\Windows.Internal.Shell.Broker.dll +7688 explorer.exe 0x7ff98aea0000 True True True \Windows\System32\PortableDeviceApi.dll +7688 explorer.exe 0x7ff98b220000 True True True \Windows\System32\Windows.Shell.UnifiedTile.CuratedTileCollections.dll +7688 explorer.exe 0x7ff98b090000 False False False \Windows\System32\mfsensorgroup.dll +7688 explorer.exe 0x7ff98eef0000 True True True \Windows\System32\ExplorerFrame.dll +7688 explorer.exe 0x7ff98ebd0000 True True True \Windows\System32\ActionCenter.dll +7688 explorer.exe 0x7ff991950000 True True True \Windows\System32\twinui.pcshell.dll +7688 explorer.exe 0x7ff9909e0000 True True True \Windows\System32\smartscreenps.dll +7688 explorer.exe 0x7ff990840000 True True True \Windows\System32\DXP.dll +7688 explorer.exe 0x7ff9905b0000 True True True \Windows\System32\UIAutomationCore.dll +7688 explorer.exe 0x7ff990140000 True True True \Windows\System32\StartTileData.dll +7688 explorer.exe 0x7ff990800000 True True True \Windows\System32\EthernetMediaManager.dll +7688 explorer.exe 0x7ff990920000 True True True \Windows\System32\SettingMonitor.dll +7688 explorer.exe 0x7ff9908c0000 True True True \Windows\System32\wcmapi.dll +7688 explorer.exe 0x7ff990f60000 True True True \Windows\System32\shdocvw.dll +7688 explorer.exe 0x7ff990c70000 True True True \Windows\System32\stobject.dll +7688 explorer.exe 0x7ff990c30000 True True True \Windows\System32\PortableDeviceTypes.dll +7688 explorer.exe 0x7ff990ce0000 True True True \Windows\System32\cscui.dll +7688 explorer.exe 0x7ff990fa0000 True True True \Windows\System32\actxprxy.dll +7688 explorer.exe 0x7ff9917b0000 True True True \Users\passmark\AppData\Local\Microsoft\OneDrive\18.091.0506.0006\amd64\FileSyncShell64.dll +7688 explorer.exe 0x7ff993950000 True True True \Windows\System32\MSWB7.dll +7688 explorer.exe 0x7ff991fb0000 True True True +7688 explorer.exe 0x7ff991d80000 True True True \Windows\System32\TaskFlowDataEngine.dll +7688 explorer.exe 0x7ff991c10000 False False False \Windows\System32\execmodelproxy.dll +7688 explorer.exe 0x7ff991e20000 True True True \Windows\System32\mscms.dll +7688 explorer.exe 0x7ff992470000 True True True \Windows\System32\Windows.CloudStore.Schema.Shell.dll +7688 explorer.exe 0x7ff9923b0000 True True True \Windows\System32\StructuredQuery.dll +7688 explorer.exe 0x7ff992550000 False False False \Windows\System32\credprovhost.dll +7688 explorer.exe 0x7ff9927c0000 False False False \Windows\System32\Windows.UI.Xaml.dll +7688 explorer.exe 0x7ff994340000 True True True CAssemblyCacheItem::CreateCacheDir +7688 explorer.exe 0x7ff993d40000 True True True \Windows\System32\Windows.Shell.BlueLightReduction.dll +7688 explorer.exe 0x7ff993d20000 False False False \Windows\System32\DevDispItemProvider.dll +7688 explorer.exe 0x7ff9939a0000 False False False \Windows\System32\mlang.dll +7688 explorer.exe 0x7ff993dd0000 True True True \Windows\System32\ntshrui.dll +7688 explorer.exe 0x7ff994520000 True True True \Windows\System32\ApplicationFrame.dll +7688 explorer.exe 0x7ff9944d0000 True True True \Windows\System32\AboveLockAppHost.dll +7688 explorer.exe 0x7ff994650000 True True True \Windows\System32\edputil.dll +7688 explorer.exe 0x7ff9947c0000 True True True \Windows\System32\windows.immersiveshell.serviceprovider.dll +7688 explorer.exe 0x7ff997fc0000 True True True \Windows\System32\winmm.dll +7688 explorer.exe 0x7ff9970a0000 True True True \Windows\System32\twinapi.dll +7688 explorer.exe 0x7ff995fe0000 True True True \Windows\System32\wininet.dll +7688 explorer.exe 0x7ff994b80000 True True True \Windows\System32\SettingSyncCore.dll +7688 explorer.exe 0x7ff994940000 True True True \Windows\System32\Windows.Globalization.dll +7688 explorer.exe 0x7ff9948a0000 True True True \Windows\System32\SndVolSSO.dll +7688 explorer.exe 0x7ff994ad0000 True True True \Windows\System32\AppResolver.dll +7688 explorer.exe 0x7ff994f50000 True True True \Windows\System32\networkexplorer.dll +7688 explorer.exe 0x7ff994ca0000 True True True \Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.15063.608_none_56f0266b425534e9\GdiPlus.dll +7688 explorer.exe 0x7ff9950f0000 False False False \Windows\System32\CredProvDataModel.dll +7688 explorer.exe 0x7ff995480000 True True True \Windows\System32\atidxx64.dll +7688 explorer.exe 0x7ff996b60000 False False False \Windows\System32\SearchFolder.dll +7688 explorer.exe 0x7ff996650000 True True True \Windows\System32\dui70.dll +7688 explorer.exe 0x7ff996310000 True True True \Windows\System32\thumbcache.dll +7688 explorer.exe 0x7ff996800000 False False False \Windows\System32\msftedit.dll +7688 explorer.exe 0x7ff996e70000 True True True \Windows\System32\WindowsCodecs.dll +7688 explorer.exe 0x7ff996bd0000 False False False \Windows\System32\wincredui.dll +7688 explorer.exe 0x7ff996cb0000 False False False \Windows\System32\Windows.UI.CredDialogController.dll +7688 explorer.exe 0x7ff997030000 True True True \Windows\System32\DataExchange.dll +7688 explorer.exe 0x7ff997600000 True True True \Windows\System32\CoreUIComponents.dll +7688 explorer.exe 0x7ff997370000 True True True \Windows\System32\cscapi.dll +7688 explorer.exe 0x7ff9971b0000 True True True \Windows\System32\mfplat.dll +7688 explorer.exe 0x7ff997130000 False False False \Windows\System32\WorkFoldersShell.dll +7688 explorer.exe 0x7ff9973d0000 True True True \Windows\System32\msIso.dll +7688 explorer.exe 0x7ff9973a0000 True True True \Windows\System32\winmmbase.dll +7688 explorer.exe 0x7ff9974a0000 True True True \Windows\System32\NotificationObjFactory.dll +7688 explorer.exe 0x7ff997c00000 True True True \Windows\System32\twinui.appcore.dll +7688 explorer.exe 0x7ff997ad0000 True True True \Windows\System32\wlidprov.dll +7688 explorer.exe 0x7ff997a90000 True True True \Windows\System32\EhStorShell.dll +7688 explorer.exe 0x7ff997ec0000 True True True \Windows\System32\PhotoMetadataHandler.dll +7688 explorer.exe 0x7ff997e60000 True True True \Windows\System32\ninput.dll +7688 explorer.exe 0x7ff998cb0000 True True True \Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.15063.1058_none_40c74ded29a7bebd\comctl32.dll +7688 explorer.exe 0x7ff998620000 True True True \Windows\System32\provsvc.dll +7688 explorer.exe 0x7ff998430000 True True True \Windows\System32\OneCoreCommonProxyStub.dll +7688 explorer.exe 0x7ff998380000 True True True \Windows\System32\Windows.Networking.Connectivity.dll +7688 explorer.exe 0x7ff997ff0000 False False False \Windows\System32\WpPortingLibrary.dll +7688 explorer.exe 0x7ff9984c0000 True True True \Windows\System32\sfc_os.dll +7688 explorer.exe 0x7ff9984e0000 False False False \Windows\System32\wpnapps.dll +7688 explorer.exe 0x7ff998920000 True True True \Windows\System32\WPDShServiceObj.dll +7688 explorer.exe 0x7ff9986c0000 False False False \Windows\System32\fdProxy.dll +7688 explorer.exe 0x7ff998a90000 False False False \Windows\System32\Windows.Devices.Enumeration.dll +7688 explorer.exe 0x7ff998a70000 True True True \Windows\System32\Syncreg.dll +7688 explorer.exe 0x7ff999900000 True True True \Windows\System32\SettingSyncPolicy.dll +7688 explorer.exe 0x7ff9993e0000 True True True \Windows\System32\PlayToDevice.dll +7688 explorer.exe 0x7ff999050000 False False False \Windows\System32\FontGlyphAnimator.dll +7688 explorer.exe 0x7ff998fb0000 False False False \Windows\System32\wscinterop.dll +7688 explorer.exe 0x7ff998f20000 False False False +7688 explorer.exe 0x7ff998ff0000 False False False \Windows\System32\chartv.dll +7688 explorer.exe 0x7ff9990d0000 False False False \Windows\System32\DWrite.dll +7688 explorer.exe 0x7ff999090000 False False False \Windows\System32\Windows.Internal.UI.Logon.ProxyStub.dll +7688 explorer.exe 0x7ff999390000 True True True \Windows\System32\NPSM.dll +7688 explorer.exe 0x7ff999730000 True True True \Windows\System32\RTWorkQ.dll +7688 explorer.exe 0x7ff9994e0000 False False False \Windows\System32\Windows.System.Launcher.dll +7688 explorer.exe 0x7ff9998c0000 False False False \Windows\System32\dtsh.dll +7688 explorer.exe 0x7ff9998d0000 False False False \Windows\System32\netapi32.dll +7688 explorer.exe 0x7ff999b60000 True True True \Windows\System32\Windows.UI.Immersive.dll +7688 explorer.exe 0x7ff9999c0000 True True True \Windows\System32\batmeter.dll +7688 explorer.exe 0x7ff999940000 True True True \Windows\System32\dusmapi.dll +7688 explorer.exe 0x7ff99a4b0000 False False False \Windows\System32\WcnApi.dll +7688 explorer.exe 0x7ff99a220000 True True True \Windows\System32\Windows.Storage.Search.dll +7688 explorer.exe 0x7ff999f40000 False False False \Windows\System32\Windows.UI.XamlHost.dll +7688 explorer.exe 0x7ff99a490000 False False False \Windows\System32\browcli.dll +7688 explorer.exe 0x7ff99aa30000 True True True \Windows\System32\OneCoreUAPCommonProxyStub.dll +7688 explorer.exe 0x7ff9a2ac0000 True True True \Windows\System32\dwmapi.dll +7688 explorer.exe 0x7ff9a0610000 True True True \Windows\System32\TextInputFramework.dll +7688 explorer.exe 0x7ff99f400000 True True True \Windows\System32\IDStore.dll +7688 explorer.exe 0x7ff99d880000 True True True \Windows\System32\sppc.dll +7688 explorer.exe 0x7ff99c880000 True True True \Windows\System32\samlib.dll +7688 explorer.exe 0x7ff99b7e0000 True True True \Windows\System32\VEEventDispatcher.dll +7688 explorer.exe 0x7ff99b650000 True True True \Windows\System32\srvcli.dll +7688 explorer.exe 0x7ff99bb50000 True True True \Windows\System32\iertutil.dll +7688 explorer.exe 0x7ff99bee0000 True True True \Windows\System32\cdp.dll +7688 explorer.exe 0x7ff99cbf0000 True True True \Windows\System32\urlmon.dll +7688 explorer.exe 0x7ff99ca10000 True True True \Windows\System32\samcli.dll +7688 explorer.exe 0x7ff99c9d0000 False False False \Windows\System32\rasadhlp.dll +7688 explorer.exe 0x7ff99d7a0000 True True True \Windows\System32\winhttp.dll +7688 explorer.exe 0x7ff99d670000 False False False \Windows\System32\atl.dll +7688 explorer.exe 0x7ff99eb00000 True True True \Windows\System32\xmllite.dll +7688 explorer.exe 0x7ff99dde0000 True True True \Windows\System32\ktmw32.dll +7688 explorer.exe 0x7ff99daf0000 True True True \Windows\System32\slc.dll +7688 explorer.exe 0x7ff99daa0000 False False False \Windows\System32\fundisc.dll +7688 explorer.exe 0x7ff99e560000 False False False \Windows\System32\fwpolicyiomgr.dll +7688 explorer.exe 0x7ff99e220000 True True True \Windows\System32\version.dll +7688 explorer.exe 0x7ff99e710000 True True True \Windows\System32\dlnashext.dll +7688 explorer.exe 0x7ff99eeb0000 True True True \Windows\System32\dsreg.dll +7688 explorer.exe 0x7ff99ec50000 True True True \Windows\System32\msxml6.dll +7688 explorer.exe 0x7ff99f0f0000 False False False \Windows\System32\wer.dll +7688 explorer.exe 0x7ff9a0110000 True True True \Windows\System32\Windows.ApplicationModel.dll +7688 explorer.exe 0x7ff99fc00000 False False False \Windows\System32\fdWCN.dll +7688 explorer.exe 0x7ff99fab0000 True True True \Windows\System32\cryptngc.dll +7688 explorer.exe 0x7ff99f500000 True True True \Windows\System32\aticfx64.dll +7688 explorer.exe 0x7ff99f470000 False False False \Windows\System32\directmanipulation.dll +7688 explorer.exe 0x7ff99f670000 True True True \Windows\System32\atlthunk.dll +7688 explorer.exe 0x7ff99fbb0000 False False False 䧀廬�뿸骐ꄥ͊≒ꕼ멨瓑縓낭㏔㴧ᘇ຋嘎烼徢隈慴⏊⛌⹐ꂶ +7688 explorer.exe 0x7ff99fb30000 False False False \Windows\System32\IconCodecService.dll +7688 explorer.exe 0x7ff99fda0000 True True True \Windows\System32\AppXDeploymentClient.dll +7688 explorer.exe 0x7ff99fd30000 False False False \Windows\System32\DefaultDeviceManager.dll +7688 explorer.exe 0x7ff99fe70000 False False False \Windows\System32\networkitemfactory.dll +7688 explorer.exe 0x7ff99fe60000 False False False \Windows\System32\credui.dll +7688 explorer.exe 0x7ff9a0500000 True True True \Windows\System32\Windows.UI.Shell.dll +7688 explorer.exe 0x7ff9a03d0000 True True True \Windows\System32\Clipc.dll +7688 explorer.exe 0x7ff9a0320000 True True True \Windows\System32\mssprxy.dll +7688 explorer.exe 0x7ff9a02a0000 True True True \Windows\System32\wincorlib.dll +7688 explorer.exe 0x7ff9a0380000 False False False \Windows\System32\Windows.Shell.ServiceHostBuilder.dll +7688 explorer.exe 0x7ff9a0430000 True True True \Windows\System32\davclnt.dll +7688 explorer.exe 0x7ff9a04e0000 False False False \Windows\System32\threadpoolwinrt.dll +7688 explorer.exe 0x7ff9a0550000 True True True \Windows\System32\InputSwitch.dll +7688 explorer.exe 0x7ff9a05c0000 True True True \Windows\System32\cscobj.dll +7688 explorer.exe 0x7ff9a1a80000 True True True \Windows\System32\usermgrcli.dll +7688 explorer.exe 0x7ff9a0d80000 True True True \Windows\System32\Windows.StateRepository.dll +7688 explorer.exe 0x7ff9a09a0000 True True True \Windows\System32\globinputhost.dll +7688 explorer.exe 0x7ff9a06f0000 False False False \Windows\System32\EhStorAPI.dll +7688 explorer.exe 0x7ff9a06d0000 True True True \Windows\System32\mpr.dll +7688 explorer.exe 0x7ff9a0760000 False False False \Windows\System32\ksuser.dll +7688 explorer.exe 0x7ff9a0930000 False False False \Windows\System32\FWPUCLNT.DLL +7688 explorer.exe 0x7ff9a09f0000 False False False \Windows\System32\secur32.dll +7688 explorer.exe 0x7ff9a09d0000 True True True \Windows\System32\ntlanman.dll +7688 explorer.exe 0x7ff9a0a00000 True True True \Windows\System32\ELSCore.dll +7688 explorer.exe 0x7ff9a18b0000 True True True \Windows\System32\msvcp110_win.dll +7688 explorer.exe 0x7ff9a14e0000 True True True \Windows\System32\linkinfo.dll +7688 explorer.exe 0x7ff9a13c0000 True True True \Windows\System32\AudioSes.dll +7688 explorer.exe 0x7ff9a1940000 True True True \Windows\System32\policymanager.dll +7688 explorer.exe 0x7ff9a19e0000 False False False \Windows\System32\deviceassociation.dll +7688 explorer.exe 0x7ff9a2160000 True True True \Windows\System32\MMDevAPI.dll +7688 explorer.exe 0x7ff9a1f90000 True True True \Windows\System32\wkscli.dll +7688 explorer.exe 0x7ff9a1bd0000 True True True \Windows\System32\propsys.dll +7688 explorer.exe 0x7ff9a1ad0000 True True True \Windows\System32\wlanapi.dll +7688 explorer.exe 0x7ff9a2090000 True True True \Windows\System32\pcacli.dll +7688 explorer.exe 0x7ff9a1fc0000 False False False \Windows\System32\wscapi.dll +7688 explorer.exe 0x7ff9a1fb0000 True True True \Windows\System32\avrt.dll +7688 explorer.exe 0x7ff9a2000000 True True True \Windows\System32\npmproxy.dll +7688 explorer.exe 0x7ff9a2120000 True True True \Windows\System32\dhcpcsvc6.dll +7688 explorer.exe 0x7ff9a20b0000 True True True \Windows\System32\devrtl.dll +7688 explorer.exe 0x7ff9a2140000 True True True \Windows\System32\wmiclnt.dll +7688 explorer.exe 0x7ff9a2810000 True True True \Windows\System32\es.dll +7688 explorer.exe 0x7ff9a25a0000 True True True \Windows\System32\dhcpcsvc.dll +7688 explorer.exe 0x7ff9a28d0000 True True True \Windows\System32\davhlpr.dll +7688 explorer.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +7688 explorer.exe 0x7ff9a47d0000 True True True \Windows\System32\uxtheme.dll +7688 explorer.exe 0x7ff9a3780000 True True True \Windows\System32\BCP47Langs.dll +7688 explorer.exe 0x7ff9a2ca0000 True True True \Windows\System32\wtsapi32.dll +7688 explorer.exe 0x7ff9a2b60000 True True True \Windows\System32\WinTypes.dll +7688 explorer.exe 0x7ff9a2b00000 True True True \Windows\System32\wevtapi.dll +7688 explorer.exe 0x7ff9a3320000 True True True \Windows\System32\dcomp.dll +7688 explorer.exe 0x7ff9a32b0000 True True True \Windows\System32\netprofm.dll +7688 explorer.exe 0x7ff9a3750000 False False False \Windows\System32\dsclient.dll +7688 explorer.exe 0x7ff9a3450000 True True True \Windows\System32\d3d11.dll +7688 explorer.exe 0x7ff9a3af0000 True True True \Windows\System32\d2d1.dll +7688 explorer.exe 0x7ff9a3920000 True True True \Windows\System32\CoreMessaging.dll +7688 explorer.exe 0x7ff9a44a0000 True True True \Windows\System32\rmclient.dll +7688 explorer.exe 0x7ff9a4410000 True True True \Windows\System32\apphelp.dll +7688 explorer.exe 0x7ff9a4660000 True True True \Windows\System32\twinapi.appcore.dll +7688 explorer.exe 0x7ff9a57b0000 True True True \Windows\System32\cryptsp.dll +7688 explorer.exe 0x7ff9a4d20000 True True True \Windows\System32\dxgi.dll +7688 explorer.exe 0x7ff9a49c0000 True True True \Windows\System32\devobj.dll +7688 explorer.exe 0x7ff9a49a0000 True True True \Windows\System32\ResourcePolicyClient.dll +7688 explorer.exe 0x7ff9a4c90000 False False False \Windows\System32\FirewallAPI.dll +7688 explorer.exe 0x7ff9a4c30000 False False False \Windows\System32\fwbase.dll +7688 explorer.exe 0x7ff9a5270000 True True True \Windows\System32\dpapi.dll +7688 explorer.exe 0x7ff9a4f70000 True True True \Windows\System32\ntmarta.dll +7688 explorer.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +7688 explorer.exe 0x7ff9a5230000 True True True \Windows\System32\rsaenh.dll +7688 explorer.exe 0x7ff9a4fb0000 False False False \Windows\System32\profext.dll +7688 explorer.exe 0x7ff9a54a0000 True True True \Windows\System32\netutils.dll +7688 explorer.exe 0x7ff9a53b0000 True True True \Windows\System32\IPHLPAPI.DLL +7688 explorer.exe 0x7ff9a53f0000 False False False +7688 explorer.exe 0x7ff9a5610000 False False False \Windows\System32\mswsock.dll +7688 explorer.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +7688 explorer.exe 0x7ff9a5850000 True True True \Windows\System32\winsta.dll +7688 explorer.exe 0x7ff9a57d0000 True True True \Windows\System32\cryptbase.dll +7688 explorer.exe 0x7ff9a58f0000 True True True \Windows\System32\ncrypt.dll +7688 explorer.exe 0x7ff9a58b0000 True True True N/A +7688 explorer.exe 0x7ff9a5b90000 True True True \Windows\System32\sxs.dll +7688 explorer.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +7688 explorer.exe 0x7ff9a5c60000 True True True \Windows\System32\userenv.dll +7688 explorer.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +7688 explorer.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +7688 explorer.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +7688 explorer.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +7688 explorer.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +7688 explorer.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +7688 explorer.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +7688 explorer.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +7688 explorer.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +7688 explorer.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +7688 explorer.exe 0x7ff9a64c0000 True True True \Windows\System32\windows.storage.dll +7688 explorer.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +7688 explorer.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +7688 explorer.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +7688 explorer.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +7688 explorer.exe 0x7ff9a6fa0000 True True True \Windows\System32\coml2.dll +7688 explorer.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +7688 explorer.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +7688 explorer.exe 0x7ff9a7280000 True True True \Windows\System32\ole32.dll +7688 explorer.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +7688 explorer.exe 0x7ff9a7470000 True True True \Windows\System32\setupapi.dll +7688 explorer.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +7688 explorer.exe 0x7ff9a78b0000 True True True \Windows\System32\nsi.dll +7688 explorer.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +7688 explorer.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +7688 explorer.exe 0x7ff9a7970000 True True True \Windows\System32\shell32.dll +7688 explorer.exe 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +7688 explorer.exe 0x7ff9a8df0000 True True True \Windows\System32\msctf.dll +7688 explorer.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +7688 explorer.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +7688 explorer.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +7688 explorer.exe 0x7ff9a9430000 True True True \Windows\System32\imm32.dll +7688 explorer.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +7688 explorer.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +7736 SynTPHelper.ex 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +7736 SynTPHelper.ex 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +7736 SynTPHelper.ex 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +7736 SynTPHelper.ex 0x7ff9a47d0000 True True True \Windows\System32\uxtheme.dll +7736 SynTPHelper.ex 0x7ff7782e0000 True False True \Program Files\Synaptics\SynTP\SynTPHelper.exe +7736 SynTPHelper.ex 0x7ff9a57d0000 True True True \Windows\System32\cryptbase.dll +7736 SynTPHelper.ex 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +7736 SynTPHelper.ex 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +7736 SynTPHelper.ex 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +7736 SynTPHelper.ex 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +7736 SynTPHelper.ex 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +7736 SynTPHelper.ex 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +7736 SynTPHelper.ex 0x7ff9a7130000 True True True \Windows\System32\user32.dll +7736 SynTPHelper.ex 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +7736 SynTPHelper.ex 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +7736 SynTPHelper.ex 0x7ff9a8db0000 True True True \Windows\System32\psapi.dll +7736 SynTPHelper.ex 0x7ff9a8df0000 True True True \Windows\System32\msctf.dll +7736 SynTPHelper.ex 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +7736 SynTPHelper.ex 0x7ff9a9430000 True True True \Windows\System32\imm32.dll +7736 SynTPHelper.ex 0x7ff9a9130000 True True True \Windows\System32\combase.dll +7736 SynTPHelper.ex 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +7736 SynTPHelper.ex 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +5368 SearchUI.exe 0x241dfba0000 False False False \Windows\System32\Windows.UI.Xaml.Resources.dll +5368 SearchUI.exe 0x249e5f80000 False False False \Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Internal.Search.winmd +5368 SearchUI.exe 0x249e5fe0000 False False False \Windows\System32\WinMetadata\Windows.Foundation.winmd +5368 SearchUI.exe 0x249e6670000 False False False \Windows\System32\WinMetadata\Windows.Storage.winmd +5368 SearchUI.exe 0x249e6610000 False False False \Windows\System32\WinMetadata\Windows.Security.winmd +5368 SearchUI.exe 0x249e6660000 False False False \Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Tips.winmd +5368 SearchUI.exe 0x249e66d0000 False False False \Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.SPA.winmd +5368 SearchUI.exe 0x249f7920000 False False False \Windows\System32\WinMetadata\Windows.Web.winmd +5368 SearchUI.exe 0x249f7d00000 False False False \Windows\System32\WinMetadata\Windows.UI.winmd +5368 SearchUI.exe 0x7ff9a18b0000 False False False \Windows\System32\msvcp110_win.dll +5368 SearchUI.exe 0x7ff999710000 False False False \Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\BingConfigurationClient.dll +5368 SearchUI.exe 0x7ff9927c0000 False False False \Windows\System32\Windows.UI.Xaml.dll +5368 SearchUI.exe 0x7ff98ed40000 False False False \Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll +5368 SearchUI.exe 0x7ff98c7b0000 False False False \Windows\System32\SpeechPal.dll +5368 SearchUI.exe 0x7ff77dcf0000 True False True \Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe +5368 SearchUI.exe 0x7ff982b50000 False False False \Windows\System32\edgehtml.dll +5368 SearchUI.exe 0x7ff98c340000 False False False \Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll +5368 SearchUI.exe 0x7ff9872f0000 False False False \Windows\System32\ieapfltr.dll +5368 SearchUI.exe 0x7ff98cb00000 False False False \Windows\System32\ConstraintIndex.Search.dll +5368 SearchUI.exe 0x7ff98c940000 False False False \Windows\System32\Windows.Media.Speech.dll +5368 SearchUI.exe 0x7ff98cce0000 False False False \Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll +5368 SearchUI.exe 0x7ff98ec30000 False False False \Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll +5368 SearchUI.exe 0x7ff9905b0000 False False False \Windows\System32\UIAutomationCore.dll +5368 SearchUI.exe 0x7ff98fcb0000 False False False \Windows\System32\Speech_OneCore\common\sapi_onecore.dll +5368 SearchUI.exe 0x7ff98fb60000 False False False \Windows\System32\Windows.Web.Http.dll +5368 SearchUI.exe 0x7ff991f30000 False False False \Windows\System32\Windows.Cortana.ProxyStub.dll +5368 SearchUI.exe 0x7ff990db0000 False False False \Windows\System32\Windows.Web.dll +5368 SearchUI.exe 0x7ff9909e0000 False False False \Windows\System32\smartscreenps.dll +5368 SearchUI.exe 0x7ff991d20000 False False False \Windows\System32\Windows.Graphics.dll +5368 SearchUI.exe 0x7ff992330000 False False False \Windows\System32\Windows.UI.Core.TextInput.dll +5368 SearchUI.exe 0x7ff9973a0000 False False False \Windows\System32\winmmbase.dll +5368 SearchUI.exe 0x7ff994940000 False False False \Windows\System32\Windows.Globalization.dll +5368 SearchUI.exe 0x7ff9942e0000 False False False \Windows\System32\Windows.Storage.ApplicationData.dll +5368 SearchUI.exe 0x7ff9939f0000 False False False \Windows\System32\PersonaX.dll +5368 SearchUI.exe 0x7ff9939a0000 False False False \Windows\System32\mlang.dll +5368 SearchUI.exe 0x7ff994790000 False False False \Windows\System32\Windows.Cortana.PAL.Desktop.dll +5368 SearchUI.exe 0x7ff996800000 False False False \Windows\System32\msftedit.dll +5368 SearchUI.exe 0x7ff995fe0000 False False False \Windows\System32\wininet.dll +5368 SearchUI.exe 0x7ff995480000 False False False \Windows\System32\atidxx64.dll +5368 SearchUI.exe 0x7ff997030000 False False False \Windows\System32\DataExchange.dll +5368 SearchUI.exe 0x7ff996e70000 False False False \Windows\System32\WindowsCodecs.dll +5368 SearchUI.exe 0x7ff9970a0000 False False False \Windows\System32\twinapi.dll +5368 SearchUI.exe 0x7ff997fc0000 False False False \Windows\System32\winmm.dll +5368 SearchUI.exe 0x7ff997600000 False False False \Windows\System32\CoreUIComponents.dll +5368 SearchUI.exe 0x7ff9973d0000 False False False \Windows\System32\msIso.dll +5368 SearchUI.exe 0x7ff997f30000 False False False \Windows\System32\tokenbinding.dll +5368 SearchUI.exe 0x7ff997e60000 False False False \Windows\System32\ninput.dll +5368 SearchUI.exe 0x7ff998890000 False False False \Windows\System32\cabinet.dll +5368 SearchUI.exe 0x7ff998180000 False False False \Windows\System32\ncryptsslp.dll +5368 SearchUI.exe 0x7ff9980d0000 False False False \Windows\System32\mskeyprotect.dll +5368 SearchUI.exe 0x7ff998070000 False False False \Windows\System32\cryptnet.dll +5368 SearchUI.exe 0x7ff998120000 False False False \Windows\System32\ncryptprov.dll +5368 SearchUI.exe 0x7ff998430000 False False False \Windows\System32\OneCoreCommonProxyStub.dll +5368 SearchUI.exe 0x7ff9981e0000 False False False \Windows\System32\Windows.Security.Authentication.OnlineId.dll +5368 SearchUI.exe 0x7ff998730000 False False False \Windows\System32\OnDemandConnRouteHelper.dll +5368 SearchUI.exe 0x7ff998f20000 False False False +5368 SearchUI.exe 0x7ff998c70000 False False False \Windows\System32\rometadata.dll +5368 SearchUI.exe 0x7ff9990d0000 False False False \Windows\System32\DWrite.dll +5368 SearchUI.exe 0x7ff99eb00000 False False False \Windows\System32\xmllite.dll +5368 SearchUI.exe 0x7ff99bb50000 False False False \Windows\System32\iertutil.dll +5368 SearchUI.exe 0x7ff99a310000 False False False \Windows\System32\UserDataTypeHelperUtil.dll +5368 SearchUI.exe 0x7ff99a1e0000 False False False \Windows\System32\EdgeManager.dll +5368 SearchUI.exe 0x7ff999b60000 False False False \Windows\System32\Windows.UI.Immersive.dll +5368 SearchUI.exe 0x7ff99a2f0000 False False False \Windows\System32\Windows.ApplicationModel.Background.SystemEventsBroker.dll +5368 SearchUI.exe 0x7ff99aa30000 False False False \Windows\System32\OneCoreUAPCommonProxyStub.dll +5368 SearchUI.exe 0x7ff99a330000 False False False \Windows\System32\Windows.Globalization.Fontgroups.dll +5368 SearchUI.exe 0x7ff99b010000 False False False \Windows\System32\MrmCoreR.dll +5368 SearchUI.exe 0x7ff99d7a0000 False False False \Windows\System32\winhttp.dll +5368 SearchUI.exe 0x7ff99c9d0000 False False False \Windows\System32\rasadhlp.dll +5368 SearchUI.exe 0x7ff99c9c0000 False False False \Windows\System32\msimtf.dll +5368 SearchUI.exe 0x7ff99cbf0000 False False False \Windows\System32\urlmon.dll +5368 SearchUI.exe 0x7ff99daf0000 False False False \Windows\System32\slc.dll +5368 SearchUI.exe 0x7ff99d880000 False False False \Windows\System32\sppc.dll +5368 SearchUI.exe 0x7ff99e220000 False False False \Windows\System32\version.dll +5368 SearchUI.exe 0x7ff9a03d0000 False False False \Windows\System32\Clipc.dll +5368 SearchUI.exe 0x7ff9a0110000 False False False \Windows\System32\Windows.ApplicationModel.dll +5368 SearchUI.exe 0x7ff99f500000 False False False \Windows\System32\aticfx64.dll +5368 SearchUI.exe 0x7ff99f470000 False False False \Windows\System32\directmanipulation.dll +5368 SearchUI.exe 0x7ff9a02a0000 False False False \Windows\System32\wincorlib.dll +5368 SearchUI.exe 0x7ff9a0280000 False False False \Windows\System32\UiaManager.dll +5368 SearchUI.exe 0x7ff9a09a0000 False False False \Windows\System32\globinputhost.dll +5368 SearchUI.exe 0x7ff9a0610000 False False False \Windows\System32\TextInputFramework.dll +5368 SearchUI.exe 0x7ff9a04e0000 False False False \Windows\System32\threadpoolwinrt.dll +5368 SearchUI.exe 0x7ff9a06a0000 False False False \Windows\System32\Windows.ApplicationModel.Background.TimeBroker.dll +5368 SearchUI.exe 0x7ff9a0930000 False False False \Windows\System32\FWPUCLNT.DLL +5368 SearchUI.exe 0x7ff9a0c00000 False False False \Windows\System32\fontgroupsoverride.dll +5368 SearchUI.exe 0x7ff9a0c60000 False False False \Windows\System32\Windows.Internal.SecurityMitigationsBroker.dll +5368 SearchUI.exe 0x7ff9a53f0000 False False False +5368 SearchUI.exe 0x7ff9a2b60000 False False False \Windows\System32\WinTypes.dll +5368 SearchUI.exe 0x7ff9a2160000 False False False \Windows\System32\MMDevAPI.dll +5368 SearchUI.exe 0x7ff9a1a80000 False False False \Windows\System32\usermgrcli.dll +5368 SearchUI.exe 0x7ff9a1940000 False False False \Windows\System32\policymanager.dll +5368 SearchUI.exe 0x7ff9a1bd0000 False False False \Windows\System32\propsys.dll +5368 SearchUI.exe 0x7ff9a1f50000 False False False \Windows\System32\logoncli.dll +5368 SearchUI.exe 0x7ff9a2800000 False False False \Windows\System32\winnsi.dll +5368 SearchUI.exe 0x7ff9a2210000 False False False \Windows\System32\atiuxp64.dll +5368 SearchUI.exe 0x7ff9a2ac0000 False False False \Windows\System32\dwmapi.dll +5368 SearchUI.exe 0x7ff9a4410000 True True True \Windows\System32\apphelp.dll +5368 SearchUI.exe 0x7ff9a3780000 False False False \Windows\System32\BCP47Langs.dll +5368 SearchUI.exe 0x7ff9a3450000 False False False \Windows\System32\d3d11.dll +5368 SearchUI.exe 0x7ff9a3320000 False False False \Windows\System32\dcomp.dll +5368 SearchUI.exe 0x7ff9a3920000 False False False \Windows\System32\CoreMessaging.dll +5368 SearchUI.exe 0x7ff9a3af0000 False False False \Windows\System32\d2d1.dll +5368 SearchUI.exe 0x7ff9a4fb0000 False False False \Windows\System32\profext.dll +5368 SearchUI.exe 0x7ff9a49c0000 False False False \Windows\System32\devobj.dll +5368 SearchUI.exe 0x7ff9a4660000 False False False \Windows\System32\twinapi.appcore.dll +5368 SearchUI.exe 0x7ff9a44a0000 False False False \Windows\System32\rmclient.dll +5368 SearchUI.exe 0x7ff9a47d0000 False False False \Windows\System32\uxtheme.dll +5368 SearchUI.exe 0x7ff9a4f70000 False False False \Windows\System32\ntmarta.dll +5368 SearchUI.exe 0x7ff9a4d20000 False False False \Windows\System32\dxgi.dll +5368 SearchUI.exe 0x7ff9a5270000 False False False \Windows\System32\dpapi.dll +5368 SearchUI.exe 0x7ff9a5230000 False False False \Windows\System32\rsaenh.dll +5368 SearchUI.exe 0x7ff9a53b0000 False False False \Windows\System32\IPHLPAPI.DLL +5368 SearchUI.exe 0x7ff9a6e70000 False False False \Windows\System32\rpcrt4.dll +5368 SearchUI.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +5368 SearchUI.exe 0x7ff9a5c30000 False False False \Windows\System32\bcrypt.dll +5368 SearchUI.exe 0x7ff9a57b0000 False False False \Windows\System32\cryptsp.dll +5368 SearchUI.exe 0x7ff9a5610000 False False False \Windows\System32\mswsock.dll +5368 SearchUI.exe 0x7ff9a58b0000 False False False N/A +5368 SearchUI.exe 0x7ff9a57d0000 False False False \Windows\System32\cryptbase.dll +5368 SearchUI.exe 0x7ff9a58f0000 False False False \Windows\System32\ncrypt.dll +5368 SearchUI.exe 0x7ff9a5d60000 False False False \Windows\System32\powrprof.dll +5368 SearchUI.exe 0x7ff9a5c90000 False False False \Windows\System32\sspicli.dll +5368 SearchUI.exe 0x7ff9a5c60000 False False False \Windows\System32\userenv.dll +5368 SearchUI.exe 0x7ff9a5dd0000 False False False \Windows\System32\profapi.dll +5368 SearchUI.exe 0x7ff9a5db0000 False False False \Windows\System32\kernel.appcore.dll +5368 SearchUI.exe 0x7ff9a5df0000 False False False \Windows\System32\msasn1.dll +5368 SearchUI.exe 0x7ff9a6400000 False False False \Windows\System32\bcryptprimitives.dll +5368 SearchUI.exe 0x7ff9a6160000 False False False \Windows\System32\win32u.dll +5368 SearchUI.exe 0x7ff9a6060000 False False False \Windows\System32\msvcp_win.dll +5368 SearchUI.exe 0x7ff9a6100000 False False False \Windows\System32\wintrust.dll +5368 SearchUI.exe 0x7ff9a6180000 False False False \Windows\System32\crypt32.dll +5368 SearchUI.exe 0x7ff9a6bc0000 False False False \Windows\System32\gdi32full.dll +5368 SearchUI.exe 0x7ff9a64c0000 False False False \Windows\System32\windows.storage.dll +5368 SearchUI.exe 0x7ff9a6470000 False False False \Windows\System32\cfgmgr32.dll +5368 SearchUI.exe 0x7ff9a6d50000 False False False l-TimeZones.Resources" version +5368 SearchUI.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +5368 SearchUI.exe 0x7ff9a7090000 False False False \Windows\System32\msvcrt.dll +5368 SearchUI.exe 0x7ff9a7020000 False False False \Windows\System32\ws2_32.dll +5368 SearchUI.exe 0x7ff9a7280000 False False False \Windows\System32\ole32.dll +5368 SearchUI.exe 0x7ff9a7130000 False False False \Windows\System32\user32.dll +5368 SearchUI.exe 0x7ff9a78b0000 False False False \Windows\System32\nsi.dll +5368 SearchUI.exe 0x7ff9a9130000 False False False \Windows\System32\combase.dll +5368 SearchUI.exe 0x7ff9a8df0000 False False False \Windows\System32\msctf.dll +5368 SearchUI.exe 0x7ff9a8dc0000 False False False \Windows\System32\gdi32.dll +5368 SearchUI.exe 0x7ff9a7970000 False False False \Windows\System32\shell32.dll +5368 SearchUI.exe 0x7ff9a8fc0000 False False False \Windows\System32\SHCore.dll +5368 SearchUI.exe 0x7ff9a8f60000 False False False \Windows\System32\shlwapi.dll +5368 SearchUI.exe 0x7ff9a9070000 False False False \Windows\System32\sechost.dll +5368 SearchUI.exe 0x7ff9a97c0000 False False False \Windows\System32\oleaut32.dll +5368 SearchUI.exe 0x7ff9a9430000 False False False \Windows\System32\imm32.dll +5368 SearchUI.exe 0x7ff9a9600000 False False False \Windows\System32\advapi32.dll +5368 SearchUI.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +7004 ShellExperienc 0x2b82bfa0000 False False False \Windows\System32\Windows.UI.Xaml.Resources.dll +7004 ShellExperienc 0x2b82d0a0000 False False False N/A +7004 ShellExperienc 0x2b82fd00000 False False False \Windows\System32\en-US\KernelBase.dll.mui +7004 ShellExperienc 0x7ff9a02a0000 True True True \Windows\System32\wincorlib.dll +7004 ShellExperienc 0x7ff997600000 True True True \Windows\System32\CoreUIComponents.dll +7004 ShellExperienc 0x7ff990140000 True True True \Windows\System32\StartTileData.dll +7004 ShellExperienc 0x7ff7a3640000 True False True \Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe +7004 ShellExperienc 0x7ff981be0000 True True True \Windows\ShellExperiences\NetworkUX.dll +7004 ShellExperienc 0x7ff985d20000 False False False \Windows\System32\mfcore.dll +7004 ShellExperienc 0x7ff9927c0000 True True True \Windows\System32\Windows.UI.Xaml.dll +7004 ShellExperienc 0x7ff991fb0000 True True True +7004 ShellExperienc 0x7ff991cf0000 True True True \Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll +7004 ShellExperienc 0x7ff991190000 True True True \Windows\System32\QuickActionsDataModel.dll +7004 ShellExperienc 0x7ff991d20000 True True True \Windows\System32\Windows.Graphics.dll +7004 ShellExperienc 0x7ff992330000 True True True \Windows\System32\Windows.UI.Core.TextInput.dll +7004 ShellExperienc 0x7ff992470000 True True True \Windows\System32\Windows.CloudStore.Schema.Shell.dll +7004 ShellExperienc 0x7ff994ad0000 True True True \Windows\System32\AppResolver.dll +7004 ShellExperienc 0x7ff9942e0000 True True True \Windows\System32\Windows.Storage.ApplicationData.dll +7004 ShellExperienc 0x7ff9939f0000 True True True \Windows\System32\PersonaX.dll +7004 ShellExperienc 0x7ff994940000 True True True \Windows\System32\Windows.Globalization.dll +7004 ShellExperienc 0x7ff995480000 True True True \Windows\System32\atidxx64.dll +7004 ShellExperienc 0x7ff996e70000 True True True \Windows\System32\WindowsCodecs.dll +7004 ShellExperienc 0x7ff9a3920000 True True True \Windows\System32\CoreMessaging.dll +7004 ShellExperienc 0x7ff9a18b0000 True True True \Windows\System32\msvcp110_win.dll +7004 ShellExperienc 0x7ff9a0a00000 True True True \Windows\System32\ELSCore.dll +7004 ShellExperienc 0x7ff9a04e0000 True True True \Windows\System32\threadpoolwinrt.dll +7004 ShellExperienc 0x7ff9a03d0000 True True True \Windows\System32\Clipc.dll +7004 ShellExperienc 0x7ff9a0610000 True True True \Windows\System32\TextInputFramework.dll +7004 ShellExperienc 0x7ff9a0cd0000 True True True \Windows\System32\StateRepository.Core.dll +7004 ShellExperienc 0x7ff9a0c00000 True True True \Windows\System32\fontgroupsoverride.dll +7004 ShellExperienc 0x7ff9a0ca0000 True True True \Windows\System32\NotificationControllerPS.dll +7004 ShellExperienc 0x7ff9a0d80000 True True True \Windows\System32\Windows.StateRepository.dll +7004 ShellExperienc 0x7ff9a2210000 True True True \Windows\System32\atiuxp64.dll +7004 ShellExperienc 0x7ff9a1f50000 True True True \Windows\System32\logoncli.dll +7004 ShellExperienc 0x7ff9a1a80000 True True True \Windows\System32\usermgrcli.dll +7004 ShellExperienc 0x7ff9a1940000 True True True \Windows\System32\policymanager.dll +7004 ShellExperienc 0x7ff9a1bd0000 True True True \Windows\System32\propsys.dll +7004 ShellExperienc 0x7ff9a2b60000 True True True \Windows\System32\WinTypes.dll +7004 ShellExperienc 0x7ff9a2ac0000 True True True \Windows\System32\dwmapi.dll +7004 ShellExperienc 0x7ff9a3450000 True True True \Windows\System32\d3d11.dll +7004 ShellExperienc 0x7ff9a3320000 True True True \Windows\System32\dcomp.dll +7004 ShellExperienc 0x7ff9a3780000 True True True \Windows\System32\BCP47Langs.dll +7004 ShellExperienc 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +7004 ShellExperienc 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +7004 ShellExperienc 0x7ff9a4d20000 True True True \Windows\System32\dxgi.dll +7004 ShellExperienc 0x7ff9a4660000 True True True \Windows\System32\twinapi.appcore.dll +7004 ShellExperienc 0x7ff9a3af0000 True True True \Windows\System32\d2d1.dll +7004 ShellExperienc 0x7ff9a44a0000 True True True \Windows\System32\rmclient.dll +7004 ShellExperienc 0x7ff9a47d0000 True True True \Windows\System32\uxtheme.dll +7004 ShellExperienc 0x7ff9a49c0000 False False False \Windows\System32\devobj.dll +7004 ShellExperienc 0x7ff9a57b0000 True True True \Windows\System32\cryptsp.dll +7004 ShellExperienc 0x7ff9a4f70000 True True True \Windows\System32\ntmarta.dll +7004 ShellExperienc 0x7ff9a57d0000 True True True \Windows\System32\cryptbase.dll +7004 ShellExperienc 0x7ff9a5850000 True True True \Windows\System32\winsta.dll +7004 ShellExperienc 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +7004 ShellExperienc 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +7004 ShellExperienc 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +7004 ShellExperienc 0x7ff9a5c60000 True True True \Windows\System32\userenv.dll +7004 ShellExperienc 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +7004 ShellExperienc 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +7004 ShellExperienc 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +7004 ShellExperienc 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +7004 ShellExperienc 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +7004 ShellExperienc 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +7004 ShellExperienc 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +7004 ShellExperienc 0x7ff9a64c0000 True True True \Windows\System32\windows.storage.dll +7004 ShellExperienc 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +7004 ShellExperienc 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +7004 ShellExperienc 0x7ff9a9130000 True True True \Windows\System32\combase.dll +7004 ShellExperienc 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +7004 ShellExperienc 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +7004 ShellExperienc 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +7004 ShellExperienc 0x7ff9a7130000 True True True \Windows\System32\user32.dll +7004 ShellExperienc 0x7ff9a7280000 True True True \Windows\System32\ole32.dll +7004 ShellExperienc 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +7004 ShellExperienc 0x7ff9a8df0000 True True True \Windows\System32\msctf.dll +7004 ShellExperienc 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +7004 ShellExperienc 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +7004 ShellExperienc 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +7004 ShellExperienc 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +7004 ShellExperienc 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +7004 ShellExperienc 0x7ff9a9430000 True True True \Windows\System32\imm32.dll +7004 ShellExperienc 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +7220 RuntimeBroker. 0x207a0600000 False False False \Windows\System32\en-US\KernelBase.dll.mui +7220 RuntimeBroker. 0x207a0850000 False False False \Windows\System32\en-US\windows.storage.dll.mui +7220 RuntimeBroker. 0x207a07f0000 False False False \Windows\System32\en-US\shell32.dll.mui +7220 RuntimeBroker. 0x207a1250000 False False False \Windows\System32\en-US\ieframe.dll.mui +7220 RuntimeBroker. 0x7ff9a18b0000 True True True \Windows\System32\msvcp110_win.dll +7220 RuntimeBroker. 0x7ff99a220000 True True True \Windows\System32\Windows.Storage.Search.dll +7220 RuntimeBroker. 0x7ff991f60000 True True True \Windows\System32\Windows.Cortana.OneCore.dll +7220 RuntimeBroker. 0x7ff98ab50000 True True True \Windows\System32\BluetoothApis.dll +7220 RuntimeBroker. 0x7ff75a1d0000 True False True \Windows\System32\RuntimeBroker.exe +7220 RuntimeBroker. 0x7ff97f0b0000 True True True \Windows\System32\SettingsEnvironment.Desktop.dll +7220 RuntimeBroker. 0x7ff7bc630000 True False True \Windows\System32\ntoskrnl.exe +7220 RuntimeBroker. 0x7ff97f110000 True True True \Windows\System32\RasMediaManager.dll +7220 RuntimeBroker. 0x7ff9890c0000 True True True \Windows\System32\ieframe.dll +7220 RuntimeBroker. 0x7ff990800000 True True True \Windows\System32\EthernetMediaManager.dll +7220 RuntimeBroker. 0x7ff98ac70000 True True True \Windows\System32\NetworkUXBroker.dll +7220 RuntimeBroker. 0x7ff98ab90000 True True True \Windows\System32\TetheringStation.dll +7220 RuntimeBroker. 0x7ff98abd0000 True True True \Windows\System32\WlanMediaManager.dll +7220 RuntimeBroker. 0x7ff98af40000 True True True \Windows\System32\Windows.Internal.Shell.Broker.dll +7220 RuntimeBroker. 0x7ff996e70000 True True True \Windows\System32\WindowsCodecs.dll +7220 RuntimeBroker. 0x7ff994650000 True True True \Windows\System32\edputil.dll +7220 RuntimeBroker. 0x7ff996650000 True True True \Windows\System32\dui70.dll +7220 RuntimeBroker. 0x7ff995fe0000 True True True \Windows\System32\wininet.dll +7220 RuntimeBroker. 0x7ff994f50000 True True True \Windows\System32\networkexplorer.dll +7220 RuntimeBroker. 0x7ff996310000 True True True \Windows\System32\thumbcache.dll +7220 RuntimeBroker. 0x7ff996e00000 True True True \Windows\System32\DeviceCenter.dll +7220 RuntimeBroker. 0x7ff998380000 True True True \Windows\System32\Windows.Networking.Connectivity.dll +7220 RuntimeBroker. 0x7ff997370000 True True True \Windows\System32\cscapi.dll +7220 RuntimeBroker. 0x7ff997180000 True True True \Windows\System32\ShellCommonCommonProxyStub.dll +7220 RuntimeBroker. 0x7ff997600000 True True True \Windows\System32\CoreUIComponents.dll +7220 RuntimeBroker. 0x7ff998cb0000 True True True \Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.15063.1058_none_40c74ded29a7bebd\comctl32.dll +7220 RuntimeBroker. 0x7ff99cbf0000 True True True \Windows\System32\urlmon.dll +7220 RuntimeBroker. 0x7ff99b7e0000 True True True \Windows\System32\VEEventDispatcher.dll +7220 RuntimeBroker. 0x7ff99b010000 True True True \Windows\System32\MrmCoreR.dll +7220 RuntimeBroker. 0x7ff99aa30000 True True True \Windows\System32\OneCoreUAPCommonProxyStub.dll +7220 RuntimeBroker. 0x7ff99b650000 True True True \Windows\System32\srvcli.dll +7220 RuntimeBroker. 0x7ff99bb50000 True True True \Windows\System32\iertutil.dll +7220 RuntimeBroker. 0x7ff99baf0000 True True True \Windows\System32\rtutils.dll +7220 RuntimeBroker. 0x7ff99d880000 True True True \Windows\System32\sppc.dll +7220 RuntimeBroker. 0x7ff99d7a0000 True True True \Windows\System32\winhttp.dll +7220 RuntimeBroker. 0x7ff99e220000 True True True \Windows\System32\version.dll +7220 RuntimeBroker. 0x7ff99daf0000 True True True \Windows\System32\slc.dll +7220 RuntimeBroker. 0x7ff99eb00000 True True True \Windows\System32\xmllite.dll +7220 RuntimeBroker. 0x7ff9a06d0000 True True True \Windows\System32\mpr.dll +7220 RuntimeBroker. 0x7ff9a0320000 True True True \Windows\System32\mssprxy.dll +7220 RuntimeBroker. 0x7ff9a0010000 True True True \Windows\System32\rasapi32.dll +7220 RuntimeBroker. 0x7ff9a0430000 True True True \Windows\System32\davclnt.dll +7220 RuntimeBroker. 0x7ff9a0610000 True True True \Windows\System32\TextInputFramework.dll +7220 RuntimeBroker. 0x7ff9a0c50000 True True True \Windows\System32\LocationFrameworkPS.dll +7220 RuntimeBroker. 0x7ff9a0af0000 True True True \Windows\System32\Windows.UI.dll +7220 RuntimeBroker. 0x7ff9a09d0000 True True True \Windows\System32\ntlanman.dll +7220 RuntimeBroker. 0x7ff9a0d80000 True True True \Windows\System32\Windows.StateRepository.dll +7220 RuntimeBroker. 0x7ff9a0cd0000 True True True \Windows\System32\StateRepository.Core.dll +7220 RuntimeBroker. 0x7ff9a14e0000 True True True \Windows\System32\linkinfo.dll +7220 RuntimeBroker. 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +7220 RuntimeBroker. 0x7ff9a4660000 True True True \Windows\System32\twinapi.appcore.dll +7220 RuntimeBroker. 0x7ff9a2900000 True True True \Windows\System32\FamilySafetyExt.dll +7220 RuntimeBroker. 0x7ff9a1bd0000 True True True \Windows\System32\propsys.dll +7220 RuntimeBroker. 0x7ff9a1a80000 True True True \Windows\System32\usermgrcli.dll +7220 RuntimeBroker. 0x7ff9a1940000 True True True \Windows\System32\policymanager.dll +7220 RuntimeBroker. 0x7ff9a1ad0000 True True True \Windows\System32\wlanapi.dll +7220 RuntimeBroker. 0x7ff9a21f0000 True True True \Windows\System32\wshbth.dll +7220 RuntimeBroker. 0x7ff9a2000000 True True True \Windows\System32\npmproxy.dll +7220 RuntimeBroker. 0x7ff9a1f90000 True True True \Windows\System32\wkscli.dll +7220 RuntimeBroker. 0x7ff9a28d0000 True True True \Windows\System32\davhlpr.dll +7220 RuntimeBroker. 0x7ff9a27f0000 True True True \Windows\System32\dsrole.dll +7220 RuntimeBroker. 0x7ff9a28e0000 True True True \Windows\System32\drprov.dll +7220 RuntimeBroker. 0x7ff9a3780000 True True True \Windows\System32\BCP47Langs.dll +7220 RuntimeBroker. 0x7ff9a2b60000 True True True \Windows\System32\WinTypes.dll +7220 RuntimeBroker. 0x7ff9a2ac0000 True True True \Windows\System32\dwmapi.dll +7220 RuntimeBroker. 0x7ff9a32b0000 True True True \Windows\System32\netprofm.dll +7220 RuntimeBroker. 0x7ff9a4410000 True True True \Windows\System32\apphelp.dll +7220 RuntimeBroker. 0x7ff9a3920000 True True True \Windows\System32\CoreMessaging.dll +7220 RuntimeBroker. 0x7ff9a44a0000 True True True \Windows\System32\rmclient.dll +7220 RuntimeBroker. 0x7ff9a57d0000 True True True \Windows\System32\cryptbase.dll +7220 RuntimeBroker. 0x7ff9a5230000 True True True \Windows\System32\rsaenh.dll +7220 RuntimeBroker. 0x7ff9a49c0000 True True True \Windows\System32\devobj.dll +7220 RuntimeBroker. 0x7ff9a47d0000 True True True \Windows\System32\uxtheme.dll +7220 RuntimeBroker. 0x7ff9a4f70000 True True True \Windows\System32\ntmarta.dll +7220 RuntimeBroker. 0x7ff9a54a0000 True True True \Windows\System32\netutils.dll +7220 RuntimeBroker. 0x7ff9a53b0000 True True True \Windows\System32\IPHLPAPI.DLL +7220 RuntimeBroker. 0x7ff9a57b0000 True True True \Windows\System32\cryptsp.dll +7220 RuntimeBroker. 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +7220 RuntimeBroker. 0x7ff9a5850000 True True True \Windows\System32\winsta.dll +7220 RuntimeBroker. 0x7ff9a5c60000 True True True \Windows\System32\userenv.dll +7220 RuntimeBroker. 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +7220 RuntimeBroker. 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +7220 RuntimeBroker. 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +7220 RuntimeBroker. 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +7220 RuntimeBroker. 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +7220 RuntimeBroker. 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +7220 RuntimeBroker. 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +7220 RuntimeBroker. 0x7ff9a64c0000 True True True \Windows\System32\windows.storage.dll +7220 RuntimeBroker. 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +7220 RuntimeBroker. 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +7220 RuntimeBroker. 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +7220 RuntimeBroker. 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +7220 RuntimeBroker. 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +7220 RuntimeBroker. 0x7ff9a6fa0000 True True True \Windows\System32\coml2.dll +7220 RuntimeBroker. 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +7220 RuntimeBroker. 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +7220 RuntimeBroker. 0x7ff9a7280000 True True True \Windows\System32\ole32.dll +7220 RuntimeBroker. 0x7ff9a7130000 True True True \Windows\System32\user32.dll +7220 RuntimeBroker. 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +7220 RuntimeBroker. 0x7ff9a78b0000 True True True \Windows\System32\nsi.dll +7220 RuntimeBroker. 0x7ff9a9130000 True True True \Windows\System32\combase.dll +7220 RuntimeBroker. 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +7220 RuntimeBroker. 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +7220 RuntimeBroker. 0x7ff9a7970000 True True True \Windows\System32\shell32.dll +7220 RuntimeBroker. 0x7ff9a8df0000 True True True \Windows\System32\msctf.dll +7220 RuntimeBroker. 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +7220 RuntimeBroker. 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +7220 RuntimeBroker. 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +7220 RuntimeBroker. 0x7ff9a9430000 True True True \Windows\System32\imm32.dll +7220 RuntimeBroker. 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +7220 RuntimeBroker. 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +9788 SkypeHost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +9788 SkypeHost.exe 0x7ff998f20000 False False False +9788 SkypeHost.exe 0x7ff9942e0000 False False False \Windows\System32\Windows.Storage.ApplicationData.dll +9788 SkypeHost.exe 0x7ff98eb70000 False False False \Windows\System32\Windows.Networking.HostName.dll +9788 SkypeHost.exe 0x7ff9971b0000 False False False \Windows\System32\mfplat.dll +9788 SkypeHost.exe 0x7ff998380000 False False False \Windows\System32\Windows.Networking.Connectivity.dll +9788 SkypeHost.exe 0x7ff99aa30000 False False False \Windows\System32\OneCoreUAPCommonProxyStub.dll +9788 SkypeHost.exe 0x7ff99a2f0000 False False False \Windows\System32\Windows.ApplicationModel.Background.SystemEventsBroker.dll +9788 SkypeHost.exe 0x7ff999730000 False False False \Windows\System32\RTWorkQ.dll +9788 SkypeHost.exe 0x7ff99a600000 False False False \Windows\System32\Windows.Networking.dll +9788 SkypeHost.exe 0x7ff99b010000 False False False \Windows\System32\MrmCoreR.dll +9788 SkypeHost.exe 0x7ff99e980000 False False False \Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.25426.0_x64__8wekyb3d8bbwe\msvcp140_app.dll +9788 SkypeHost.exe 0x7ff9a4660000 False False False \Windows\System32\twinapi.appcore.dll +9788 SkypeHost.exe 0x7ff9a0510000 False False False \Program Files\WindowsApps\Microsoft.SkypeApp_12.1815.209.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll +9788 SkypeHost.exe 0x7ff9a03d0000 False False False \Windows\System32\Clipc.dll +9788 SkypeHost.exe 0x7ff9a1bd0000 False False False \Windows\System32\propsys.dll +9788 SkypeHost.exe 0x7ff9a06a0000 False False False \Windows\System32\Windows.ApplicationModel.Background.TimeBroker.dll +9788 SkypeHost.exe 0x7ff9a2b60000 False False False \Windows\System32\WinTypes.dll +9788 SkypeHost.exe 0x7ff9a57b0000 False False False \Windows\System32\cryptsp.dll +9788 SkypeHost.exe 0x7ff9a4c90000 False False False \Windows\System32\FirewallAPI.dll +9788 SkypeHost.exe 0x7ff9a4c30000 False False False \Windows\System32\fwbase.dll +9788 SkypeHost.exe 0x7ff9a4fb0000 False False False \Windows\System32\profext.dll +9788 SkypeHost.exe 0x7ff9a4f70000 False False False \Windows\System32\ntmarta.dll +9788 SkypeHost.exe 0x7ff9a53b0000 False False False \Windows\System32\IPHLPAPI.DLL +9788 SkypeHost.exe 0x7ff9a5d60000 False False False \Windows\System32\powrprof.dll +9788 SkypeHost.exe 0x7ff9a5c30000 False False False \Windows\System32\bcrypt.dll +9788 SkypeHost.exe 0x7ff9a5c60000 False False False \Windows\System32\userenv.dll +9788 SkypeHost.exe 0x7ff9a5dd0000 False False False \Windows\System32\profapi.dll +9788 SkypeHost.exe 0x7ff9a5db0000 False False False \Windows\System32\kernel.appcore.dll +9788 SkypeHost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +9788 SkypeHost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +9788 SkypeHost.exe 0x7ff9a6160000 False False False \Windows\System32\win32u.dll +9788 SkypeHost.exe 0x7ff9a6180000 False False False \Windows\System32\crypt32.dll +9788 SkypeHost.exe 0x7ff9a64c0000 False False False \Windows\System32\windows.storage.dll +9788 SkypeHost.exe 0x7ff9a6470000 False False False \Windows\System32\cfgmgr32.dll +9788 SkypeHost.exe 0x7ff9a6bc0000 False False False \Windows\System32\gdi32full.dll +9788 SkypeHost.exe 0x7ff9a7090000 False False False \Windows\System32\msvcrt.dll +9788 SkypeHost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +9788 SkypeHost.exe 0x7ff9a7020000 False False False \Windows\System32\ws2_32.dll +9788 SkypeHost.exe 0x7ff9a7130000 False False False \Windows\System32\user32.dll +9788 SkypeHost.exe 0x7ff9a9130000 True False True \Windows\System32\combase.dll +9788 SkypeHost.exe 0x7ff9a8fc0000 False False False \Windows\System32\SHCore.dll +9788 SkypeHost.exe 0x7ff9a8f60000 False False False \Windows\System32\shlwapi.dll +9788 SkypeHost.exe 0x7ff9a8dc0000 False False False \Windows\System32\gdi32.dll +9788 SkypeHost.exe 0x7ff9a9070000 False False False \Windows\System32\sechost.dll +9788 SkypeHost.exe 0x7ff9a9430000 False False False \Windows\System32\imm32.dll +9788 SkypeHost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +2820 MSASCuiL.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +2820 MSASCuiL.exe 0x7ff9a5c60000 True True True \Windows\System32\userenv.dll +2820 MSASCuiL.exe 0x7ff99cb00000 True True True \Program Files\Windows Defender\MpClient.dll +2820 MSASCuiL.exe 0x7ff981b30000 True True True \Windows\System32\SecurityHealthProxyStub.dll +2820 MSASCuiL.exe 0x7ff994ca0000 True True True \Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.15063.608_none_56f0266b425534e9\GdiPlus.dll +2820 MSASCuiL.exe 0x7ff9a2ca0000 True True True \Windows\System32\wtsapi32.dll +2820 MSASCuiL.exe 0x7ff99f670000 True True True \Windows\System32\atlthunk.dll +2820 MSASCuiL.exe 0x7ff9a47d0000 True True True \Windows\System32\uxtheme.dll +2820 MSASCuiL.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +2820 MSASCuiL.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +2820 MSASCuiL.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +2820 MSASCuiL.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +2820 MSASCuiL.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +2820 MSASCuiL.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +2820 MSASCuiL.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +2820 MSASCuiL.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +2820 MSASCuiL.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +2820 MSASCuiL.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +2820 MSASCuiL.exe 0x7ff9a64c0000 True True True \Windows\System32\windows.storage.dll +2820 MSASCuiL.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +2820 MSASCuiL.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +2820 MSASCuiL.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +2820 MSASCuiL.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +2820 MSASCuiL.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +2820 MSASCuiL.exe 0x7ff9a7280000 True True True \Windows\System32\ole32.dll +2820 MSASCuiL.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +2820 MSASCuiL.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +2820 MSASCuiL.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +2820 MSASCuiL.exe 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +2820 MSASCuiL.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +2820 MSASCuiL.exe 0x7ff9a7970000 True True True \Windows\System32\shell32.dll +2820 MSASCuiL.exe 0x7ff9a8df0000 True True True \Windows\System32\msctf.dll +2820 MSASCuiL.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +2820 MSASCuiL.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +2820 MSASCuiL.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +2820 MSASCuiL.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +2820 MSASCuiL.exe 0x7ff9a9430000 True True True \Windows\System32\imm32.dll +2820 MSASCuiL.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +4444 MOM.exe 0x23ac4700000 True False True \Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe +4444 MOM.exe 0x7ff9a7130000 False False False \Windows\System32\user32.dll +4444 MOM.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +880 CCC.exe 0x2bb03cd0000 True False True \Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe +880 CCC.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +880 CCC.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +880 CCC.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +880 CCC.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +880 CCC.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +7764 svchost.exe 0x7ff9a5e10000 False False False \Windows\System32\KernelBase.dll +7764 svchost.exe 0x7ff998430000 False False False \Windows\System32\OneCoreCommonProxyStub.dll +7764 svchost.exe 0x7ff791320000 False False False \Windows\System32\svchost.exe +7764 svchost.exe 0x7ff990590000 False False False \Windows\System32\NfcRadioMedia.dll +7764 svchost.exe 0x7ff98ebb0000 False False False \Windows\System32\BthRadioMedia.dll +7764 svchost.exe 0x7ff98ab50000 False False False \Windows\System32\BluetoothApis.dll +7764 svchost.exe 0x7ff9907c0000 False False False \Windows\System32\XboxGipRadioManager.dll +7764 svchost.exe 0x7ff9a4c20000 False False False \Windows\System32\hid.dll +7764 svchost.exe 0x7ff99e5f0000 False False False \Windows\System32\wwapi.dll +7764 svchost.exe 0x7ff9988f0000 False False False \Windows\System32\RMapi.dll +7764 svchost.exe 0x7ff9988d0000 False False False \Windows\System32\WwanRadioManager.dll +7764 svchost.exe 0x7ff99e3b0000 False False False \Windows\System32\WlanRadioManager.dll +7764 svchost.exe 0x7ff9a49c0000 False False False \Windows\System32\devobj.dll +7764 svchost.exe 0x7ff9a1ad0000 False False False \Windows\System32\wlanapi.dll +7764 svchost.exe 0x7ff9a5db0000 False False False \Windows\System32\kernel.appcore.dll +7764 svchost.exe 0x7ff9a4f20000 False False False \Windows\System32\wldp.dll +7764 svchost.exe 0x7ff9a53b0000 False False False \Windows\System32\IPHLPAPI.DLL +7764 svchost.exe 0x7ff9a5df0000 False False False \Windows\System32\msasn1.dll +7764 svchost.exe 0x7ff9a5dd0000 False False False \Windows\System32\profapi.dll +7764 svchost.exe 0x7ff9a6d50000 False False False l-TimeZones.Resources" version +7764 svchost.exe 0x7ff9a6400000 False False False \Windows\System32\bcryptprimitives.dll +7764 svchost.exe 0x7ff9a6160000 False False False \Windows\System32\win32u.dll +7764 svchost.exe 0x7ff9a6060000 False False False \Windows\System32\msvcp_win.dll +7764 svchost.exe 0x7ff9a6100000 False False False \Windows\System32\wintrust.dll +7764 svchost.exe 0x7ff9a6180000 False False False \Windows\System32\crypt32.dll +7764 svchost.exe 0x7ff9a6470000 False False False \Windows\System32\cfgmgr32.dll +7764 svchost.exe 0x7ff9a6bc0000 False False False \Windows\System32\gdi32full.dll +7764 svchost.exe 0x7ff9a78c0000 False False False \Windows\System32\kernel32.dll +7764 svchost.exe 0x7ff9a7280000 False False False \Windows\System32\ole32.dll +7764 svchost.exe 0x7ff9a7090000 False False False \Windows\System32\msvcrt.dll +7764 svchost.exe 0x7ff9a6e70000 False False False \Windows\System32\rpcrt4.dll +7764 svchost.exe 0x7ff9a7130000 False False False \Windows\System32\user32.dll +7764 svchost.exe 0x7ff9a73d0000 False False False \Windows\System32\clbcatq.dll +7764 svchost.exe 0x7ff9a78b0000 False False False \Windows\System32\nsi.dll +7764 svchost.exe 0x7ff9a9130000 False False False \Windows\System32\combase.dll +7764 svchost.exe 0x7ff9a9070000 False False False \Windows\System32\sechost.dll +7764 svchost.exe 0x7ff9a8dc0000 False False False \Windows\System32\gdi32.dll +7764 svchost.exe 0x7ff9a97c0000 False False False \Windows\System32\oleaut32.dll +7764 svchost.exe 0x7ff9a9600000 False False False \Windows\System32\advapi32.dll +7764 svchost.exe 0x7ff9a98f0000 False False False \Windows\System32\ntdll.dll +5520 svchost.exe 0x7ff791320000 False False False \Windows\System32\svchost.exe +7496 svchost.exe 0x7ff9a38d0000 True True True \Windows\System32\MCCSPal.dll +7496 svchost.exe 0x7ff99fcc0000 True False True \Windows\System32\syncutil.dll +7496 svchost.exe 0x7ff994e70000 True False True \Windows\System32\APHostService.dll +7496 svchost.exe 0x7ff989f10000 False False False \Windows\System32\accountaccessor.dll +7496 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +7496 svchost.exe 0x7ff989e50000 False False False \Windows\System32\cemapi.dll +7496 svchost.exe 0x7ff98a260000 False False False \Windows\System32\SyncController.dll +7496 svchost.exe 0x7ff991c10000 False False False \Windows\System32\execmodelproxy.dll +7496 svchost.exe 0x7ff998a20000 False False False \Windows\System32\vaultcli.dll +7496 svchost.exe 0x7ff998380000 False False False \Windows\System32\Windows.Networking.Connectivity.dll +7496 svchost.exe 0x7ff998430000 False False False \Windows\System32\OneCoreCommonProxyStub.dll +7496 svchost.exe 0x7ff99a760000 False False False \Windows\System32\FlightSettings.dll +7496 svchost.exe 0x7ff99a310000 False False False \Windows\System32\UserDataTypeHelperUtil.dll +7496 svchost.exe 0x7ff998c10000 False False False \Windows\System32\APHostClient.dll +7496 svchost.exe 0x7ff99a740000 False False False \Windows\System32\bcd.dll +7496 svchost.exe 0x7ff99d7a0000 False False False \Windows\System32\winhttp.dll +7496 svchost.exe 0x7ff99bb50000 False False False \Windows\System32\iertutil.dll +7496 svchost.exe 0x7ff99fcb0000 False False False \Windows\System32\UserDataLanguageUtil.dll +7496 svchost.exe 0x7ff9a1940000 False False False \Windows\System32\policymanager.dll +7496 svchost.exe 0x7ff9a0c80000 False False False \Windows\System32\InprocLogger.dll +7496 svchost.exe 0x7ff9a18b0000 False False False \Windows\System32\msvcp110_win.dll +7496 svchost.exe 0x7ff9a2930000 True False True \Windows\System32\networkhelper.dll +7496 svchost.exe 0x7ff9a2000000 False False False \Windows\System32\npmproxy.dll +7496 svchost.exe 0x7ff9a1ad0000 False False False \Windows\System32\wlanapi.dll +7496 svchost.exe 0x7ff9a2910000 True False True \Windows\System32\UserDataPlatformHelperUtil.dll +7496 svchost.exe 0x7ff9a2b60000 False True False \Windows\System32\WinTypes.dll +7496 svchost.exe 0x7ff9a3750000 False False False \Windows\System32\dsclient.dll +7496 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +7496 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +7496 svchost.exe 0x7ff9a57b0000 False False False \Windows\System32\cryptsp.dll +7496 svchost.exe 0x7ff9a53b0000 False False False \Windows\System32\IPHLPAPI.DLL +7496 svchost.exe 0x7ff9a4f20000 False False False \Windows\System32\wldp.dll +7496 svchost.exe 0x7ff9a40e0000 False False False \Windows\System32\SystemEventsBrokerClient.dll +7496 svchost.exe 0x7ff9a55a0000 False False False \Windows\System32\msv1_0.dll +7496 svchost.exe 0x7ff9a5590000 False False False \Windows\System32\NtlmShared.dll +7496 svchost.exe 0x7ff9a5670000 False False False \Windows\System32\cryptdll.dll +7496 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +7496 svchost.exe 0x7ff9a5c90000 False False False \Windows\System32\sspicli.dll +7496 svchost.exe 0x7ff9a5c30000 False True False \Windows\System32\bcrypt.dll +7496 svchost.exe 0x7ff9a5d60000 False False False \Windows\System32\powrprof.dll +7496 svchost.exe 0x7ff9a5dd0000 False False False \Windows\System32\profapi.dll +7496 svchost.exe 0x7ff9a5df0000 False False False \Windows\System32\msasn1.dll +7496 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +7496 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +7496 svchost.exe 0x7ff9a6100000 False False False \Windows\System32\wintrust.dll +7496 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +7496 svchost.exe 0x7ff9a6180000 False False False \Windows\System32\crypt32.dll +7496 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +7496 svchost.exe 0x7ff9a6470000 False False False \Windows\System32\cfgmgr32.dll +7496 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +7496 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +7496 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +7496 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +7496 svchost.exe 0x7ff9a73d0000 False False False \Windows\System32\clbcatq.dll +7496 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +7496 svchost.exe 0x7ff9a78b0000 False False False \Windows\System32\nsi.dll +7496 svchost.exe 0x7ff9a8fc0000 True False True \Windows\System32\SHCore.dll +7496 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +7496 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +7496 svchost.exe 0x7ff9a97c0000 True False True \Windows\System32\oleaut32.dll +7496 svchost.exe 0x7ff9a9430000 True True True \Windows\System32\imm32.dll +7496 svchost.exe 0x7ff9a9600000 False False False \Windows\System32\advapi32.dll +7496 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +4428 OneDrive.exe 0x59ca0000 True True True \Windows\System32\wow64cpu.dll +4428 OneDrive.exe 0x5120000 False False False \Users\passmark\AppData\Local\Microsoft\OneDrive\18.091.0506.0007\FileSync.LocalizedResources.dll +4428 OneDrive.exe 0x40000 True False True \Users\passmark\AppData\Local\Microsoft\OneDrive\OneDrive.exe +4428 OneDrive.exe 0x5d60000 False False False \Windows\SysWOW64\WinMetadata\Windows.Security.winmd +4428 OneDrive.exe 0x73870000 True True True \Windows\SysWOW64\ktmw32.dll +4428 OneDrive.exe 0x6fe40000 True True True \Windows\SysWOW64\winmm.dll +4428 OneDrive.exe 0x6f580000 True True True \Windows\SysWOW64\WinTypes.dll +4428 OneDrive.exe 0x6f0e0000 True True True \Windows\SysWOW64\Windows.Services.TargetedContent.dll +4428 OneDrive.exe 0x59d30000 True True True \Windows\System32\wow64.dll +4428 OneDrive.exe 0x59cb0000 True True True \Windows\System32\wow64win.dll +4428 OneDrive.exe 0x6f050000 False False False \Windows\SysWOW64\Windows.Networking.Connectivity.dll +4428 OneDrive.exe 0x6ef10000 False False False \Windows\SysWOW64\twinapi.appcore.dll +4428 OneDrive.exe 0x6f190000 True True True \Windows\SysWOW64\OneCoreUAPCommonProxyStub.dll +4428 OneDrive.exe 0x6f460000 True True True \Windows\SysWOW64\AppXDeploymentClient.dll +4428 OneDrive.exe 0x6faf0000 True True True \Windows\SysWOW64\dnsapi.dll +4428 OneDrive.exe 0x6f920000 True True True \Windows\SysWOW64\mlang.dll +4428 OneDrive.exe 0x6f7b0000 True True True \Users\passmark\AppData\Local\Microsoft\OneDrive\18.091.0506.0007\FileSyncFAL.dll +4428 OneDrive.exe 0x6f810000 True True True \Users\passmark\AppData\Local\Microsoft\OneDrive\18.091.0506.0007\platforms\qwindows.dll +4428 OneDrive.exe 0x6f960000 True True True \Users\passmark\AppData\Local\Microsoft\OneDrive\18.091.0506.0007\ssleay32.dll +4428 OneDrive.exe 0x6fdc0000 True True True \Windows\SysWOW64\ntasn1.dll +4428 OneDrive.exe 0x6fd60000 True True True \Windows\SysWOW64\mswsock.dll +4428 OneDrive.exe 0x6fb70000 True True True \Windows\SysWOW64\msxml6.dll +4428 OneDrive.exe 0x6fdb0000 True True True \Windows\SysWOW64\wkscli.dll +4428 OneDrive.exe 0x6fdf0000 True True True \Windows\SysWOW64\winmmbase.dll +4428 OneDrive.exe 0x6fe20000 True True True \Windows\SysWOW64\ncrypt.dll +4428 OneDrive.exe 0x6fec0000 True True True \Users\passmark\AppData\Local\Microsoft\OneDrive\18.091.0506.0007\WnsClientApi.dll +4428 OneDrive.exe 0x6ff30000 True True True \Users\passmark\AppData\Local\Microsoft\OneDrive\18.091.0506.0007\Qt5Network.dll +4428 OneDrive.exe 0x705f0000 True True True \Users\passmark\AppData\Local\Microsoft\OneDrive\18.091.0506.0007\Qt5Quick.dll +4428 OneDrive.exe 0x714b0000 True True True \Windows\SysWOW64\winhttp.dll +4428 OneDrive.exe 0x722b0000 True True True \Windows\SysWOW64\urlmon.dll +4428 OneDrive.exe 0x71f90000 True True True \Users\passmark\AppData\Local\Microsoft\OneDrive\18.091.0506.0007\FileSyncViews.dll +4428 OneDrive.exe 0x71bb0000 True True True \Users\passmark\AppData\Local\Microsoft\OneDrive\18.091.0506.0007\FileSyncSessions.dll +4428 OneDrive.exe 0x71610000 True True True \Users\passmark\AppData\Local\Microsoft\OneDrive\18.091.0506.0007\SyncEngine.dll +4428 OneDrive.exe 0x71d60000 True True True \Windows\SysWOW64\iertutil.dll +4428 OneDrive.exe 0x71f80000 False False False \Windows\SysWOW64\FamilySafetyExt.dll +4428 OneDrive.exe 0x720a0000 True True True \Windows\SysWOW64\wer.dll +4428 OneDrive.exe 0x72140000 True True True \Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.15063.608_none_9e9d5d4256d15def\GdiPlus.dll +4428 OneDrive.exe 0x724a0000 True True True \Windows\SysWOW64\dwmapi.dll +4428 OneDrive.exe 0x72470000 True True True \Windows\SysWOW64\xmllite.dll +4428 OneDrive.exe 0x728a0000 True True True \Users\passmark\AppData\Local\Microsoft\OneDrive\18.091.0506.0007\LoggingPlatform.dll +4428 OneDrive.exe 0x731d0000 True True True \Windows\SysWOW64\rsaenh.dll +4428 OneDrive.exe 0x72c50000 True True True \Users\passmark\AppData\Local\Microsoft\OneDrive\18.091.0506.0007\UpdateRingSettings.dll +4428 OneDrive.exe 0x72f90000 False False False \Windows\SysWOW64\Wpc.dll +4428 OneDrive.exe 0x72c80000 True True True \Windows\SysWOW64\StateRepository.Core.dll +4428 OneDrive.exe 0x73160000 True True True \Users\passmark\AppData\Local\Microsoft\OneDrive\18.091.0506.0007\Telemetry.dll +4428 OneDrive.exe 0x73130000 True True True \Windows\SysWOW64\credui.dll +4428 OneDrive.exe 0x73150000 True True True \Windows\SysWOW64\secur32.dll +4428 OneDrive.exe 0x73190000 True True True \Windows\SysWOW64\dhcpcsvc.dll +4428 OneDrive.exe 0x731b0000 True True True \Windows\SysWOW64\bcrypt.dll +4428 OneDrive.exe 0x734c0000 True True True \Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.15063.1058_none_887484c43e23e7c3\comctl32.dll +4428 OneDrive.exe 0x73220000 True True True \Users\passmark\AppData\Local\Microsoft\OneDrive\18.091.0506.0007\vcruntime140.dll +4428 OneDrive.exe 0x73200000 True True True \Windows\SysWOW64\cryptsp.dll +4428 OneDrive.exe 0x73330000 False False False \Windows\SysWOW64\samcli.dll +4428 OneDrive.exe 0x73260000 True True True \Windows\SysWOW64\mpr.dll +4428 OneDrive.exe 0x73350000 True True True \Windows\SysWOW64\propsys.dll +4428 OneDrive.exe 0x73700000 True True True \Windows\SysWOW64\version.dll +4428 OneDrive.exe 0x736d0000 True True True \Windows\SysWOW64\userenv.dll +4428 OneDrive.exe 0x737c0000 True True True \Windows\SysWOW64\IPHLPAPI.DLL +4428 OneDrive.exe 0x737f0000 True True True \Windows\SysWOW64\uxtheme.dll +4428 OneDrive.exe 0x744b0000 True True True 8 +4428 OneDrive.exe 0x73d10000 True True True \Windows\SysWOW64\cryptbase.dll +4428 OneDrive.exe 0x73b50000 True True True \Windows\SysWOW64\dbgcore.dll +4428 OneDrive.exe 0x73880000 True True True \Windows\SysWOW64\wininet.dll +4428 OneDrive.exe 0x73b80000 True True True \Windows\SysWOW64\dbghelp.dll +4428 OneDrive.exe 0x73d40000 True True True \Windows\SysWOW64\SHCore.dll +4428 OneDrive.exe 0x74200000 True True True \Windows\SysWOW64\msvcrt.dll +4428 OneDrive.exe 0x740d0000 True True True \Windows\SysWOW64\cfgmgr32.dll +4428 OneDrive.exe 0x74020000 True True True \Windows\SysWOW64\bcryptprimitives.dll +4428 OneDrive.exe 0x73f90000 True True True \Windows\SysWOW64\imm32.dll +4428 OneDrive.exe 0x74080000 True True True \Windows\SysWOW64\sechost.dll +4428 OneDrive.exe 0x741b0000 True True True \Windows\SysWOW64\shlwapi.dll +4428 OneDrive.exe 0x74110000 True True True \Windows\SysWOW64\oleaut32.dll +4428 OneDrive.exe 0x742e0000 True True True \Windows\SysWOW64\clbcatq.dll +4428 OneDrive.exe 0x742c0000 True True True \Windows\SysWOW64\nsi.dll +4428 OneDrive.exe 0x742d0000 True True True \Windows\SysWOW64\msasn1.dll +4428 OneDrive.exe 0x74370000 True True True \Windows\SysWOW64\user32.dll +4428 OneDrive.exe 0x77250000 True True True \Windows\SysWOW64\ntdll.dll +4428 OneDrive.exe 0x74b90000 True True True semblyIdentity name="Microsoft- +4428 OneDrive.exe 0x747a0000 True True True \Windows\SysWOW64\kernel.appcore.dll +4428 OneDrive.exe 0x74680000 True True True \Windows\SysWOW64\ucrtbase.dll +4428 OneDrive.exe 0x74950000 True True True \Windows\SysWOW64\KernelBase.dll +4428 OneDrive.exe 0x74900000 True True True d64" language="neutral" buildT +4428 OneDrive.exe 0x747b0000 True True True \Windows\SysWOW64\msctf.dll +4428 OneDrive.exe 0x74b40000 True True True \Windows\SysWOW64\powrprof.dll +4428 OneDrive.exe 0x75bf0000 True True True \Windows\SysWOW64\shell32.dll +4428 OneDrive.exe 0x75820000 True True True \Windows\SysWOW64\crypt32.dll +4428 OneDrive.exe 0x75710000 True True True \Windows\SysWOW64\profapi.dll +4428 OneDrive.exe 0x74cf0000 True True True \Windows\SysWOW64\windows.storage.dll +4428 OneDrive.exe 0x75720000 True True True \Windows\SysWOW64\ole32.dll +4428 OneDrive.exe 0x759b0000 True True True \Windows\SysWOW64\combase.dll +4428 OneDrive.exe 0x76fb0000 True True True \Windows\SysWOW64\gdi32.dll +4428 OneDrive.exe 0x76f40000 True True True \Windows\SysWOW64\ws2_32.dll +4428 OneDrive.exe 0x771d0000 True True True \Windows\SysWOW64\advapi32.dll +4428 OneDrive.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +6624 software_repor 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +6624 software_repor 0x7ff9a53b0000 True True True \Windows\System32\IPHLPAPI.DLL +6624 software_repor 0x7ff997fc0000 True True True \Windows\System32\winmm.dll +6624 software_repor 0x7ff7a0b70000 True False True \Users\passmark\AppData\Local\Google\Chrome\User Data\SwReporter\25.141.202\software_reporter_tool.exe +6624 software_repor 0x7ff995fe0000 True True True \Windows\System32\wininet.dll +6624 software_repor 0x7ff9973a0000 True True True \Windows\System32\winmmbase.dll +6624 software_repor 0x7ff99e220000 True True True \Windows\System32\version.dll +6624 software_repor 0x7ff99d7a0000 True True True \Windows\System32\winhttp.dll +6624 software_repor 0x7ff9a09f0000 True True True \Windows\System32\secur32.dll +6624 software_repor 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +6624 software_repor 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +6624 software_repor 0x7ff9a57d0000 True True True \Windows\System32\cryptbase.dll +6624 software_repor 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +6624 software_repor 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +6624 software_repor 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +6624 software_repor 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +6624 software_repor 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +6624 software_repor 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +6624 software_repor 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +6624 software_repor 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +6624 software_repor 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +6624 software_repor 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +6624 software_repor 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +6624 software_repor 0x7ff9a64c0000 True True True \Windows\System32\windows.storage.dll +6624 software_repor 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +6624 software_repor 0x7ff9a7130000 True True True \Windows\System32\user32.dll +6624 software_repor 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +6624 software_repor 0x7ff9a7280000 True True True \Windows\System32\ole32.dll +6624 software_repor 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +6624 software_repor 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +6624 software_repor 0x7ff9a8db0000 True True True \Windows\System32\psapi.dll +6624 software_repor 0x7ff9a7970000 True True True \Windows\System32\shell32.dll +6624 software_repor 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +6624 software_repor 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +6624 software_repor 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +6624 software_repor 0x7ff9a9130000 True True True \Windows\System32\combase.dll +6624 software_repor 0x7ff9a9430000 True True True \Windows\System32\imm32.dll +6624 software_repor 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +6624 software_repor 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +6620 software_repor 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +6620 software_repor 0x7ff9a53b0000 True True True \Windows\System32\IPHLPAPI.DLL +6620 software_repor 0x7ff997fc0000 True True True \Windows\System32\winmm.dll +6620 software_repor 0x7ff7a0b70000 True False True \Users\passmark\AppData\Local\Google\Chrome\User Data\SwReporter\25.141.202\software_reporter_tool.exe +6620 software_repor 0x7ff995fe0000 True True True \Windows\System32\wininet.dll +6620 software_repor 0x7ff9973a0000 True True True \Windows\System32\winmmbase.dll +6620 software_repor 0x7ff99e220000 True True True \Windows\System32\version.dll +6620 software_repor 0x7ff99d7a0000 True True True \Windows\System32\winhttp.dll +6620 software_repor 0x7ff9a2ac0000 True True True \Windows\System32\dwmapi.dll +6620 software_repor 0x7ff9a09f0000 True True True \Windows\System32\secur32.dll +6620 software_repor 0x7ff9a47d0000 True True True \Windows\System32\uxtheme.dll +6620 software_repor 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +6620 software_repor 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +6620 software_repor 0x7ff9a57d0000 True True True \Windows\System32\cryptbase.dll +6620 software_repor 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +6620 software_repor 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +6620 software_repor 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +6620 software_repor 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +6620 software_repor 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +6620 software_repor 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +6620 software_repor 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +6620 software_repor 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +6620 software_repor 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +6620 software_repor 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +6620 software_repor 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +6620 software_repor 0x7ff9a64c0000 True True True \Windows\System32\windows.storage.dll +6620 software_repor 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +6620 software_repor 0x7ff9a7130000 True True True \Windows\System32\user32.dll +6620 software_repor 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +6620 software_repor 0x7ff9a7280000 True True True \Windows\System32\ole32.dll +6620 software_repor 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +6620 software_repor 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +6620 software_repor 0x7ff9a8db0000 True True True \Windows\System32\psapi.dll +6620 software_repor 0x7ff9a7970000 True True True \Windows\System32\shell32.dll +6620 software_repor 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +6620 software_repor 0x7ff9a8df0000 True True True \Windows\System32\msctf.dll +6620 software_repor 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +6620 software_repor 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +6620 software_repor 0x7ff9a9130000 True True True \Windows\System32\combase.dll +6620 software_repor 0x7ff9a9430000 True True True \Windows\System32\imm32.dll +6620 software_repor 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +6620 software_repor 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +6512 InstallAgent.e 0x1fd6bc90000 False False False \Windows\System32\en-US\KernelBase.dll.mui +6512 InstallAgent.e 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +6512 InstallAgent.e 0x7ff9a44a0000 True True True \Windows\System32\rmclient.dll +6512 InstallAgent.e 0x7ff9984e0000 True True True \Windows\System32\wpnapps.dll +6512 InstallAgent.e 0x7ff78a750000 True False True \Windows\System32\InstallAgent.exe +6512 InstallAgent.e 0x7ff9941d0000 True True True \Windows\System32\wuapi.dll +6512 InstallAgent.e 0x7ff993c60000 True True True \Windows\System32\wups.dll +6512 InstallAgent.e 0x7ff990db0000 True True True \Windows\System32\Windows.Web.dll +6512 InstallAgent.e 0x7ff995370000 True True True \Windows\System32\StoreAgent.dll +6512 InstallAgent.e 0x7ff99eb00000 True True True \Windows\System32\xmllite.dll +6512 InstallAgent.e 0x7ff99aa30000 True True True \Windows\System32\OneCoreUAPCommonProxyStub.dll +6512 InstallAgent.e 0x7ff99a580000 True True True \Windows\System32\VEStoreEventHandlers.dll +6512 InstallAgent.e 0x7ff99bb50000 True True True \Windows\System32\iertutil.dll +6512 InstallAgent.e 0x7ff9a18b0000 True True True \Windows\System32\msvcp110_win.dll +6512 InstallAgent.e 0x7ff9a0740000 True True True \Windows\System32\EAMProgressHandler.dll +6512 InstallAgent.e 0x7ff99ec50000 True True True \Windows\System32\msxml6.dll +6512 InstallAgent.e 0x7ff9a1a80000 True True True \Windows\System32\usermgrcli.dll +6512 InstallAgent.e 0x7ff9a1940000 True True True \Windows\System32\policymanager.dll +6512 InstallAgent.e 0x7ff9a2b60000 True True True \Windows\System32\WinTypes.dll +6512 InstallAgent.e 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +6512 InstallAgent.e 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +6512 InstallAgent.e 0x7ff9a57b0000 True True True \Windows\System32\cryptsp.dll +6512 InstallAgent.e 0x7ff9a4660000 True True True \Windows\System32\twinapi.appcore.dll +6512 InstallAgent.e 0x7ff9a47d0000 True True True \Windows\System32\uxtheme.dll +6512 InstallAgent.e 0x7ff9a5b90000 True True True \Windows\System32\sxs.dll +6512 InstallAgent.e 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +6512 InstallAgent.e 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +6512 InstallAgent.e 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +6512 InstallAgent.e 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +6512 InstallAgent.e 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +6512 InstallAgent.e 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +6512 InstallAgent.e 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +6512 InstallAgent.e 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +6512 InstallAgent.e 0x7ff9a64c0000 True True True \Windows\System32\windows.storage.dll +6512 InstallAgent.e 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +6512 InstallAgent.e 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +6512 InstallAgent.e 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +6512 InstallAgent.e 0x7ff9a9130000 True True True \Windows\System32\combase.dll +6512 InstallAgent.e 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +6512 InstallAgent.e 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +6512 InstallAgent.e 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +6512 InstallAgent.e 0x7ff9a9430000 True True True \Windows\System32\imm32.dll +6512 InstallAgent.e 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +6512 InstallAgent.e 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +7876 InstallAgentUs 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +7876 InstallAgentUs 0x7ff9a57b0000 True True True \Windows\System32\cryptsp.dll +7876 InstallAgentUs 0x7ff995370000 True True True \Windows\System32\StoreAgent.dll +7876 InstallAgentUs 0x7ff7e53d0000 True False True \Windows\System32\InstallAgentUserBroker.exe +7876 InstallAgentUs 0x7ff993c60000 True True True \Windows\System32\wups.dll +7876 InstallAgentUs 0x7ff990db0000 True True True \Windows\System32\Windows.Web.dll +7876 InstallAgentUs 0x7ff9941d0000 True True True \Windows\System32\wuapi.dll +7876 InstallAgentUs 0x7ff994940000 True True True \Windows\System32\Windows.Globalization.dll +7876 InstallAgentUs 0x7ff9a2000000 True True True \Windows\System32\npmproxy.dll +7876 InstallAgentUs 0x7ff9a18b0000 True True True \Windows\System32\msvcp110_win.dll +7876 InstallAgentUs 0x7ff99bb50000 True True True \Windows\System32\iertutil.dll +7876 InstallAgentUs 0x7ff99aa30000 True True True \Windows\System32\OneCoreUAPCommonProxyStub.dll +7876 InstallAgentUs 0x7ff99d9a0000 True True True \Windows\System32\updatepolicy.dll +7876 InstallAgentUs 0x7ff9a1940000 True True True \Windows\System32\policymanager.dll +7876 InstallAgentUs 0x7ff9a3780000 True True True \Windows\System32\BCP47Langs.dll +7876 InstallAgentUs 0x7ff9a32b0000 True True True \Windows\System32\netprofm.dll +7876 InstallAgentUs 0x7ff9a2b60000 True True True \Windows\System32\WinTypes.dll +7876 InstallAgentUs 0x7ff9a47d0000 True True True \Windows\System32\uxtheme.dll +7876 InstallAgentUs 0x7ff9a4660000 True True True \Windows\System32\twinapi.appcore.dll +7876 InstallAgentUs 0x7ff9a5230000 True True True \Windows\System32\rsaenh.dll +7876 InstallAgentUs 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +7876 InstallAgentUs 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +7876 InstallAgentUs 0x7ff9a5b90000 True True True \Windows\System32\sxs.dll +7876 InstallAgentUs 0x7ff9a57d0000 True True True \Windows\System32\cryptbase.dll +7876 InstallAgentUs 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +7876 InstallAgentUs 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +7876 InstallAgentUs 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +7876 InstallAgentUs 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +7876 InstallAgentUs 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +7876 InstallAgentUs 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +7876 InstallAgentUs 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +7876 InstallAgentUs 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +7876 InstallAgentUs 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +7876 InstallAgentUs 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +7876 InstallAgentUs 0x7ff9a7280000 True True True \Windows\System32\ole32.dll +7876 InstallAgentUs 0x7ff9a7130000 True True True \Windows\System32\user32.dll +7876 InstallAgentUs 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +7876 InstallAgentUs 0x7ff9a9130000 True True True \Windows\System32\combase.dll +7876 InstallAgentUs 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +7876 InstallAgentUs 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +7876 InstallAgentUs 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +7876 InstallAgentUs 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +7876 InstallAgentUs 0x7ff9a9430000 True True True \Windows\System32\imm32.dll +7876 InstallAgentUs 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +7876 InstallAgentUs 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +7380 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +7380 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +7380 svchost.exe 0x7ff9a0720000 True True True \Windows\System32\pcadm.dll +7380 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +7380 svchost.exe 0x7ff99db20000 True True True \Windows\System32\wdi.dll +7380 svchost.exe 0x7ff9a06d0000 True True True \Windows\System32\mpr.dll +7380 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +7380 svchost.exe 0x7ff9a2090000 True True True \Windows\System32\pcacli.dll +7380 svchost.exe 0x7ff9a2ca0000 True True True \Windows\System32\wtsapi32.dll +7380 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +7380 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +7380 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +7380 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +7380 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +7380 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +7380 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +7380 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +7380 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +7380 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +7380 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +7380 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +7380 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +7380 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +7380 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +7380 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +7380 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +7252 taskhostw.exe 0x7ff9a0730000 False False False \Windows\System32\regidle.dll +7252 taskhostw.exe 0x7ff986c60000 False False False \Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll +7252 taskhostw.exe 0x7ff66cfb0000 False False False \Windows\System32\taskhostw.exe +7252 taskhostw.exe 0x7ff9842a0000 False False False \Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll +7252 taskhostw.exe 0x7ff99e220000 False False False \Windows\System32\version.dll +7252 taskhostw.exe 0x7ff9925d0000 False False False \Windows\System32\DeviceDirectoryClient.dll +7252 taskhostw.exe 0x7ff986d00000 False False False \Windows\System32\mscoree.dll +7252 taskhostw.exe 0x7ff996d00000 False False False \Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll +7252 taskhostw.exe 0x7ff997ad0000 False False False \Windows\System32\wlidprov.dll +7252 taskhostw.exe 0x7ff99ca10000 False False False \Windows\System32\samcli.dll +7252 taskhostw.exe 0x7ff99bb50000 False False False \Windows\System32\iertutil.dll +7252 taskhostw.exe 0x7ff99c880000 False False False \Windows\System32\samlib.dll +7252 taskhostw.exe 0x7ff99d7a0000 False False False \Windows\System32\winhttp.dll +7252 taskhostw.exe 0x7ff99f740000 False False False \Windows\System32\MdmCommon.dll +7252 taskhostw.exe 0x7ff99f400000 False False False \Windows\System32\IDStore.dll +7252 taskhostw.exe 0x7ff99ef60000 False False False \Windows\System32\fveapi.dll +7252 taskhostw.exe 0x7ff99fba0000 False False False \Windows\System32\pstask.dll +7252 taskhostw.exe 0x7ff9a6e70000 False False False \Windows\System32\rpcrt4.dll +7252 taskhostw.exe 0x7ff9a5b90000 False False False \Windows\System32\sxs.dll +7252 taskhostw.exe 0x7ff9a2140000 False False False \Windows\System32\wmiclnt.dll +7252 taskhostw.exe 0x7ff9a0c50000 False False False \Windows\System32\LocationFrameworkPS.dll +7252 taskhostw.exe 0x7ff9a1bd0000 False False False \Windows\System32\propsys.dll +7252 taskhostw.exe 0x7ff9a49c0000 False False False \Windows\System32\devobj.dll +7252 taskhostw.exe 0x7ff9a25f0000 False False False \Windows\System32\StorageUsage.dll +7252 taskhostw.exe 0x7ff9a2730000 False False False \Windows\System32\taskschd.dll +7252 taskhostw.exe 0x7ff9a54a0000 False False False \Windows\System32\netutils.dll +7252 taskhostw.exe 0x7ff9a4f20000 False False False \Windows\System32\wldp.dll +7252 taskhostw.exe 0x7ff9a57b0000 False False False \Windows\System32\cryptsp.dll +7252 taskhostw.exe 0x7ff9a6060000 False False False \Windows\System32\msvcp_win.dll +7252 taskhostw.exe 0x7ff9a5d60000 False False False \Windows\System32\powrprof.dll +7252 taskhostw.exe 0x7ff9a5df0000 False False False \Windows\System32\msasn1.dll +7252 taskhostw.exe 0x7ff9a5db0000 False False False \Windows\System32\kernel.appcore.dll +7252 taskhostw.exe 0x7ff9a5e10000 False False False \Windows\System32\KernelBase.dll +7252 taskhostw.exe 0x7ff9a6400000 False False False \Windows\System32\bcryptprimitives.dll +7252 taskhostw.exe 0x7ff9a6160000 False False False \Windows\System32\win32u.dll +7252 taskhostw.exe 0x7ff9a6100000 False False False \Windows\System32\wintrust.dll +7252 taskhostw.exe 0x7ff9a6180000 False False False \Windows\System32\crypt32.dll +7252 taskhostw.exe 0x7ff9a6bc0000 False False False \Windows\System32\gdi32full.dll +7252 taskhostw.exe 0x7ff9a6470000 False False False \Windows\System32\cfgmgr32.dll +7252 taskhostw.exe 0x7ff9a6d50000 False False False l-TimeZones.Resources" version +7252 taskhostw.exe 0x7ff9a9130000 False False False \Windows\System32\combase.dll +7252 taskhostw.exe 0x7ff9a78c0000 False False False \Windows\System32\kernel32.dll +7252 taskhostw.exe 0x7ff9a7130000 False False False \Windows\System32\user32.dll +7252 taskhostw.exe 0x7ff9a7090000 False False False \Windows\System32\msvcrt.dll +7252 taskhostw.exe 0x7ff9a73d0000 False False False \Windows\System32\clbcatq.dll +7252 taskhostw.exe 0x7ff9a7280000 False False False \Windows\System32\ole32.dll +7252 taskhostw.exe 0x7ff9a8f60000 False False False \Windows\System32\shlwapi.dll +7252 taskhostw.exe 0x7ff9a8dc0000 False False False \Windows\System32\gdi32.dll +7252 taskhostw.exe 0x7ff9a9070000 False False False \Windows\System32\sechost.dll +7252 taskhostw.exe 0x7ff9a8fc0000 False False False \Windows\System32\SHCore.dll +7252 taskhostw.exe 0x7ff9a97c0000 False False False \Windows\System32\oleaut32.dll +7252 taskhostw.exe 0x7ff9a9430000 False False False \Windows\System32\imm32.dll +7252 taskhostw.exe 0x7ff9a9600000 False False False \Windows\System32\advapi32.dll +7252 taskhostw.exe 0x7ff9a98f0000 False False False \Windows\System32\ntdll.dll +1048 mcbuilder.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +1048 mcbuilder.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +3156 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +3156 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +3156 svchost.exe 0x7ff9a4f70000 True True True \Windows\System32\ntmarta.dll +3156 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +3156 svchost.exe 0x7ff99d1d0000 True True True \Windows\System32\esent.dll +3156 svchost.exe 0x7ff995090000 True True True \Windows\System32\dssvc.dll +3156 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +3156 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +3156 svchost.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +3156 svchost.exe 0x7ff9a57d0000 True True True \Windows\System32\cryptbase.dll +3156 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +3156 svchost.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +3156 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +3156 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +3156 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +3156 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +3156 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +3156 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +3156 svchost.exe 0x7ff9a64c0000 True True True \Windows\System32\windows.storage.dll +3156 svchost.exe 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +3156 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +3156 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +3156 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +3156 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +3156 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +3156 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +3156 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +3156 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +3156 svchost.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +3156 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +3156 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +6492 ngentask.exe 0x59d30000 True True True \Windows\System32\wow64.dll +6492 ngentask.exe 0xa10000 True False True \Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe +6492 ngentask.exe 0x4000000 False False False \Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll +6492 ngentask.exe 0x59ca0000 True True True \Windows\System32\wow64cpu.dll +6492 ngentask.exe 0x59cb0000 True True True \Windows\System32\wow64win.dll +6492 ngentask.exe 0x74200000 True True True \Windows\SysWOW64\msvcrt.dll +6492 ngentask.exe 0x732d0000 True True True \Windows\SysWOW64\mscoree.dll +6492 ngentask.exe 0x6e820000 True True True \Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll +6492 ngentask.exe 0x6ca80000 True True True \Windows\assembly\NativeImages_v4.0.30319_32\System\97580b3d0e99860f7e38ced66c5d3fca\System.ni.dll +6492 ngentask.exe 0x6c2d0000 True True True \Windows\assembly\NativeImages_v4.0.30319_32\System.Core\b5db7f83b5e571c246d261ddcd73403c\System.Core.ni.dll +6492 ngentask.exe 0x6d490000 True True True \Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\f124f0255cf85003f7d8c0c47dea0616\mscorlib.ni.dll +6492 ngentask.exe 0x72e10000 True True True \Windows\SysWOW64\msvcr120_clr0400.dll +6492 ngentask.exe 0x72d90000 True True True \Windows\Microsoft.NET\Framework\v4.0.30319\clrjit.dll +6492 ngentask.exe 0x72d20000 True True True \Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll +6492 ngentask.exe 0x72f10000 True True True \Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll +6492 ngentask.exe 0x732b0000 True True True \Windows\Microsoft.NET\Framework\v4.0.30319\fusion.dll +6492 ngentask.exe 0x73d10000 True True True \Windows\SysWOW64\cryptbase.dll +6492 ngentask.exe 0x73700000 True True True \Windows\SysWOW64\version.dll +6492 ngentask.exe 0x73d40000 True True True \Windows\SysWOW64\SHCore.dll +6492 ngentask.exe 0x74080000 True True True \Windows\SysWOW64\sechost.dll +6492 ngentask.exe 0x74020000 True True True \Windows\SysWOW64\bcryptprimitives.dll +6492 ngentask.exe 0x74110000 True True True \Windows\SysWOW64\oleaut32.dll +6492 ngentask.exe 0x740d0000 True True True \Windows\SysWOW64\cfgmgr32.dll +6492 ngentask.exe 0x741b0000 True True True \Windows\SysWOW64\shlwapi.dll +6492 ngentask.exe 0x76fb0000 True True True \Windows\SysWOW64\gdi32.dll +6492 ngentask.exe 0x74950000 True True True \Windows\SysWOW64\KernelBase.dll +6492 ngentask.exe 0x74370000 True True True \Windows\SysWOW64\user32.dll +6492 ngentask.exe 0x744b0000 True True True 8 +6492 ngentask.exe 0x74680000 True True True \Windows\SysWOW64\ucrtbase.dll +6492 ngentask.exe 0x747a0000 True True True \Windows\SysWOW64\kernel.appcore.dll +6492 ngentask.exe 0x75720000 True True True \Windows\SysWOW64\ole32.dll +6492 ngentask.exe 0x74b90000 True True True semblyIdentity name="Microsoft- +6492 ngentask.exe 0x74b40000 True True True \Windows\SysWOW64\powrprof.dll +6492 ngentask.exe 0x74cf0000 True True True \Windows\SysWOW64\windows.storage.dll +6492 ngentask.exe 0x75710000 True True True \Windows\SysWOW64\profapi.dll +6492 ngentask.exe 0x759b0000 True True True \Windows\SysWOW64\combase.dll +6492 ngentask.exe 0x75bf0000 True True True \Windows\SysWOW64\shell32.dll +6492 ngentask.exe 0x77250000 True True True \Windows\SysWOW64\ntdll.dll +6492 ngentask.exe 0x771d0000 True True True \Windows\SysWOW64\advapi32.dll +6492 ngentask.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +1336 ngentask.exe 0x7ff986d00000 True True True \Windows\System32\mscoree.dll +1336 ngentask.exe 0x7ff9842a0000 True True True \Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll +1336 ngentask.exe 0x7ff986c60000 True True True \Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll +1336 ngentask.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +1336 ngentask.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +1336 ngentask.exe 0x7ff996d00000 True True True \Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll +1336 ngentask.exe 0x7ff988d70000 True True True \Windows\assembly\NativeImages_v4.0.30319_64\System.Management\e99e5d650945c805a6c96189b2fe7341\System.Management.ni.dll +1336 ngentask.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +1336 ngentask.exe 0x7ff99e220000 True True True \Windows\System32\version.dll +1336 ngentask.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +1336 ngentask.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +1336 ngentask.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +1336 ngentask.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +1336 ngentask.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +1336 ngentask.exe 0x7ff9a64c0000 True True True \Windows\System32\windows.storage.dll +1336 ngentask.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +1336 ngentask.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +1336 ngentask.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +1336 ngentask.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +1336 ngentask.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +1336 ngentask.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +1336 ngentask.exe 0x7ff9a7280000 True True True \Windows\System32\ole32.dll +1336 ngentask.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +1336 ngentask.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +1336 ngentask.exe 0x7ff9a7970000 True True True \Windows\System32\shell32.dll +1336 ngentask.exe 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +1336 ngentask.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +1336 ngentask.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +1336 ngentask.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +1336 ngentask.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +1336 ngentask.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +8648 conhost.exe 0x2ba76200000 False False False \Windows\System32\en-US\KernelBase.dll.mui +8648 conhost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +8648 conhost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +8648 conhost.exe 0x7ff71acb0000 True False True \Windows\System32\conhost.exe +8648 conhost.exe 0x7ff9a1bd0000 True True True \Windows\System32\propsys.dll +8648 conhost.exe 0x7ff999960000 True True True \Windows\System32\ConhostV2.dll +8648 conhost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +8648 conhost.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +8648 conhost.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +8648 conhost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +8648 conhost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +8648 conhost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +8648 conhost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +8648 conhost.exe 0x7ff9a64c0000 True True True \Windows\System32\windows.storage.dll +8648 conhost.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +8648 conhost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +8648 conhost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +8648 conhost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +8648 conhost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +8648 conhost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +8648 conhost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +8648 conhost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +8648 conhost.exe 0x7ff9a7970000 True True True \Windows\System32\shell32.dll +8648 conhost.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +8648 conhost.exe 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +8648 conhost.exe 0x7ff9a8df0000 True True True \Windows\System32\msctf.dll +8648 conhost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +8648 conhost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +8648 conhost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +8648 conhost.exe 0x7ff9a9430000 True True True \Windows\System32\imm32.dll +8648 conhost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +2120 conhost.exe 0x2e6a3ae0000 False False False \Windows\System32\en-US\KernelBase.dll.mui +2120 conhost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +2120 conhost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +2120 conhost.exe 0x7ff71acb0000 True False True \Windows\System32\conhost.exe +2120 conhost.exe 0x7ff9a1bd0000 True True True \Windows\System32\propsys.dll +2120 conhost.exe 0x7ff999960000 True True True \Windows\System32\ConhostV2.dll +2120 conhost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +2120 conhost.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +2120 conhost.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +2120 conhost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +2120 conhost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +2120 conhost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +2120 conhost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +2120 conhost.exe 0x7ff9a64c0000 True True True \Windows\System32\windows.storage.dll +2120 conhost.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +2120 conhost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +2120 conhost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +2120 conhost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +2120 conhost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +2120 conhost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +2120 conhost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +2120 conhost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +2120 conhost.exe 0x7ff9a7970000 True True True \Windows\System32\shell32.dll +2120 conhost.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +2120 conhost.exe 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +2120 conhost.exe 0x7ff9a8df0000 True True True \Windows\System32\msctf.dll +2120 conhost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +2120 conhost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +2120 conhost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +2120 conhost.exe 0x7ff9a9430000 True True True \Windows\System32\imm32.dll +2120 conhost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +9756 ngen.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +9756 ngen.exe 0x7ff986d00000 True True True \Windows\System32\mscoree.dll +9756 ngen.exe 0x7ff7206d0000 True False True \Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe +9756 ngen.exe 0x7ff986c60000 True True True \Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll +9756 ngen.exe 0x7ff99e220000 True True True \Windows\System32\version.dll +9756 ngen.exe 0x7ff996d00000 True True True \Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvc.dll +9756 ngen.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +9756 ngen.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +9756 ngen.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +9756 ngen.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +9756 ngen.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +9756 ngen.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +9756 ngen.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +9756 ngen.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +9756 ngen.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +9756 ngen.exe 0x7ff9a7280000 True True True \Windows\System32\ole32.dll +9756 ngen.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +9756 ngen.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +9756 ngen.exe 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +9756 ngen.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +9756 ngen.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +9756 ngen.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +9756 ngen.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +9756 ngen.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +5684 ngen.exe 0x59cb0000 True True True \Windows\System32\wow64win.dll +5684 ngen.exe 0x10c0000 True False True \Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe +5684 ngen.exe 0x59ca0000 True True True \Windows\System32\wow64cpu.dll +5684 ngen.exe 0x732d0000 True True True \Windows\SysWOW64\mscoree.dll +5684 ngen.exe 0x72e10000 True True True \Windows\SysWOW64\msvcr120_clr0400.dll +5684 ngen.exe 0x59d30000 True True True \Windows\System32\wow64.dll +5684 ngen.exe 0x72d20000 True True True \Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll +5684 ngen.exe 0x72f10000 True True True \Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll +5684 ngen.exe 0x732b0000 True True True \Windows\Microsoft.NET\Framework\v4.0.30319\fusion.dll +5684 ngen.exe 0x73d10000 True True True \Windows\SysWOW64\cryptbase.dll +5684 ngen.exe 0x73700000 True True True \Windows\SysWOW64\version.dll +5684 ngen.exe 0x74110000 True True True \Windows\SysWOW64\oleaut32.dll +5684 ngen.exe 0x74080000 True True True \Windows\SysWOW64\sechost.dll +5684 ngen.exe 0x74020000 True True True \Windows\SysWOW64\bcryptprimitives.dll +5684 ngen.exe 0x74370000 True True True \Windows\SysWOW64\user32.dll +5684 ngen.exe 0x74200000 True True True \Windows\SysWOW64\msvcrt.dll +5684 ngen.exe 0x741b0000 True True True \Windows\SysWOW64\shlwapi.dll +5684 ngen.exe 0x744b0000 True True True 8 +5684 ngen.exe 0x759b0000 True True True \Windows\SysWOW64\combase.dll +5684 ngen.exe 0x74950000 True True True \Windows\SysWOW64\KernelBase.dll +5684 ngen.exe 0x74680000 True True True \Windows\SysWOW64\ucrtbase.dll +5684 ngen.exe 0x747a0000 True True True \Windows\SysWOW64\kernel.appcore.dll +5684 ngen.exe 0x74b90000 True True True semblyIdentity name="Microsoft- +5684 ngen.exe 0x75720000 True True True \Windows\SysWOW64\ole32.dll +5684 ngen.exe 0x76fb0000 True True True \Windows\SysWOW64\gdi32.dll +5684 ngen.exe 0x77250000 True True True \Windows\SysWOW64\ntdll.dll +5684 ngen.exe 0x771d0000 True True True \Windows\SysWOW64\advapi32.dll +5684 ngen.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +428 svchost.exe 0x7ff9a6d50000 False False False l-TimeZones.Resources" version +428 svchost.exe 0x7ff9a4f20000 False False False \Windows\System32\wldp.dll +428 svchost.exe 0x7ff9a2890000 False False False \Windows\System32\nlaapi.dll +428 svchost.exe 0x7ff791320000 False False False \Windows\System32\svchost.exe +428 svchost.exe 0x7ff99c880000 False False False \Windows\System32\samlib.dll +428 svchost.exe 0x7ff995230000 False False False \Windows\System32\gpsvc.dll +428 svchost.exe 0x7ff9a27f0000 False False False \Windows\System32\dsrole.dll +428 svchost.exe 0x7ff9a4890000 False False False \Windows\System32\sysntfy.dll +428 svchost.exe 0x7ff9a2ca0000 False False False \Windows\System32\wtsapi32.dll +428 svchost.exe 0x7ff9a5e10000 False False False \Windows\System32\KernelBase.dll +428 svchost.exe 0x7ff9a5db0000 False False False \Windows\System32\kernel.appcore.dll +428 svchost.exe 0x7ff9a5850000 False False False \Windows\System32\winsta.dll +428 svchost.exe 0x7ff9a5c90000 False False False \Windows\System32\sspicli.dll +428 svchost.exe 0x7ff9a5df0000 False False False \Windows\System32\msasn1.dll +428 svchost.exe 0x7ff9a6160000 False False False \Windows\System32\win32u.dll +428 svchost.exe 0x7ff9a6060000 False False False \Windows\System32\msvcp_win.dll +428 svchost.exe 0x7ff9a6100000 False False False \Windows\System32\wintrust.dll +428 svchost.exe 0x7ff9a6400000 False False False \Windows\System32\bcryptprimitives.dll +428 svchost.exe 0x7ff9a6180000 False False False \Windows\System32\crypt32.dll +428 svchost.exe 0x7ff9a6bc0000 False False False \Windows\System32\gdi32full.dll +428 svchost.exe 0x7ff9a78c0000 False False False \Windows\System32\kernel32.dll +428 svchost.exe 0x7ff9a7090000 False False False \Windows\System32\msvcrt.dll +428 svchost.exe 0x7ff9a6e70000 False False False \Windows\System32\rpcrt4.dll +428 svchost.exe 0x7ff9a7130000 False False False \Windows\System32\user32.dll +428 svchost.exe 0x7ff9a9130000 False False False \Windows\System32\combase.dll +428 svchost.exe 0x7ff9a9070000 False False False \Windows\System32\sechost.dll +428 svchost.exe 0x7ff9a8dc0000 False False False \Windows\System32\gdi32.dll +428 svchost.exe 0x7ff9a97c0000 False False False \Windows\System32\oleaut32.dll +428 svchost.exe 0x7ff9a9600000 False False False \Windows\System32\advapi32.dll +428 svchost.exe 0x7ff9a98f0000 False False False \Windows\System32\ntdll.dll +9888 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +9888 svchost.exe 0x7ff9a49c0000 False False False \Windows\System32\devobj.dll +9888 svchost.exe 0x7ff996c10000 False False False \Windows\System32\wcncsvc.dll +9888 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +9888 svchost.exe 0x7ff98b020000 False False False \Windows\System32\upnp.dll +9888 svchost.exe 0x7ff995fe0000 False False False \Windows\System32\wininet.dll +9888 svchost.exe 0x7ff99d7a0000 False False False \Windows\System32\winhttp.dll +9888 svchost.exe 0x7ff99cbf0000 False False False \Windows\System32\urlmon.dll +9888 svchost.exe 0x7ff99b740000 False False False \Windows\System32\webio.dll +9888 svchost.exe 0x7ff998730000 False False False \Windows\System32\OnDemandConnRouteHelper.dll +9888 svchost.exe 0x7ff99bb50000 False False False \Windows\System32\iertutil.dll +9888 svchost.exe 0x7ff99d630000 False False False \Windows\System32\wship6.dll +9888 svchost.exe 0x7ff99d640000 False False False \Windows\System32\WSHTCPIP.DLL +9888 svchost.exe 0x7ff9a1ad0000 False False False \Windows\System32\wlanapi.dll +9888 svchost.exe 0x7ff99d900000 False False False \Windows\System32\wshqos.dll +9888 svchost.exe 0x7ff99ec50000 False False False \Windows\System32\msxml6.dll +9888 svchost.exe 0x7ff9a25a0000 False False False \Windows\System32\dhcpcsvc.dll +9888 svchost.exe 0x7ff9a21d0000 False False False \Windows\System32\ssdpapi.dll +9888 svchost.exe 0x7ff9a2800000 False False False \Windows\System32\winnsi.dll +9888 svchost.exe 0x7ff9a5c30000 False False False \Windows\System32\bcrypt.dll +9888 svchost.exe 0x7ff9a5610000 False False False \Windows\System32\mswsock.dll +9888 svchost.exe 0x7ff9a5030000 False False False \Windows\System32\authz.dll +9888 svchost.exe 0x7ff9a4f20000 False False False \Windows\System32\wldp.dll +9888 svchost.exe 0x7ff9a53b0000 False False False \Windows\System32\IPHLPAPI.DLL +9888 svchost.exe 0x7ff9a5b90000 False False False \Windows\System32\sxs.dll +9888 svchost.exe 0x7ff9a57d0000 False False False \Windows\System32\cryptbase.dll +9888 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +9888 svchost.exe 0x7ff9a5c90000 False False False \Windows\System32\sspicli.dll +9888 svchost.exe 0x7ff9a5d60000 False False False \Windows\System32\powrprof.dll +9888 svchost.exe 0x7ff9a5df0000 False False False \Windows\System32\msasn1.dll +9888 svchost.exe 0x7ff9a5dd0000 False False False \Windows\System32\profapi.dll +9888 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +9888 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +9888 svchost.exe 0x7ff9a6160000 False False False \Windows\System32\win32u.dll +9888 svchost.exe 0x7ff9a6060000 False False False \Windows\System32\msvcp_win.dll +9888 svchost.exe 0x7ff9a6100000 False False False \Windows\System32\wintrust.dll +9888 svchost.exe 0x7ff9a6180000 False False False \Windows\System32\crypt32.dll +9888 svchost.exe 0x7ff9a64c0000 False False False \Windows\System32\windows.storage.dll +9888 svchost.exe 0x7ff9a6470000 False False False \Windows\System32\cfgmgr32.dll +9888 svchost.exe 0x7ff9a6bc0000 False False False \Windows\System32\gdi32full.dll +9888 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +9888 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +9888 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +9888 svchost.exe 0x7ff9a7020000 False False False \Windows\System32\ws2_32.dll +9888 svchost.exe 0x7ff9a7280000 False False False \Windows\System32\ole32.dll +9888 svchost.exe 0x7ff9a7130000 False False False \Windows\System32\user32.dll +9888 svchost.exe 0x7ff9a73d0000 False False False \Windows\System32\clbcatq.dll +9888 svchost.exe 0x7ff9a78b0000 False False False \Windows\System32\nsi.dll +9888 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +9888 svchost.exe 0x7ff9a8fc0000 False False False \Windows\System32\SHCore.dll +9888 svchost.exe 0x7ff9a8dc0000 False False False \Windows\System32\gdi32.dll +9888 svchost.exe 0x7ff9a8f60000 False False False \Windows\System32\shlwapi.dll +9888 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +9888 svchost.exe 0x7ff9a97c0000 False False False \Windows\System32\oleaut32.dll +9888 svchost.exe 0x7ff9a9600000 False False False \Windows\System32\advapi32.dll +9888 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +4596 audiodg.exe 0x7ff9a2160000 True True True \Windows\System32\MMDevAPI.dll +4596 audiodg.exe 0x7ff98b0d0000 True True True \Windows\System32\AudioEng.dll +4596 audiodg.exe 0x7ff6aedc0000 True False True \Windows\System32\audiodg.exe +4596 audiodg.exe 0x7ff988800000 True True True \Windows\System32\WMALFXGFXDSP.dll +4596 audiodg.exe 0x7ff9a13c0000 True True True \Windows\System32\AudioSes.dll +4596 audiodg.exe 0x7ff9951c0000 True True True \Windows\System32\AUDIOKSE.dll +4596 audiodg.exe 0x7ff99a4e0000 True True True \Windows\System32\Windows.Media.Devices.dll +4596 audiodg.exe 0x7ff9a1bd0000 True True True \Windows\System32\propsys.dll +4596 audiodg.exe 0x7ff9a1fb0000 True True True \Windows\System32\avrt.dll +4596 audiodg.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +4596 audiodg.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +4596 audiodg.exe 0x7ff9a49c0000 True True True \Windows\System32\devobj.dll +4596 audiodg.exe 0x7ff9a2b60000 True True True \Windows\System32\WinTypes.dll +4596 audiodg.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +4596 audiodg.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +4596 audiodg.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +4596 audiodg.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +4596 audiodg.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +4596 audiodg.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +9660 svchost.exe 0x20262ad0000 False False False \Windows\System32\msxml6r.dll +9660 svchost.exe 0x20262af0000 False False False \Windows\System32\en-US\msxml6r.dll.mui +9660 svchost.exe 0x20263c00000 False False False \Windows\System32\en-US\KernelBase.dll.mui +9660 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +9660 svchost.exe 0x7ff9a0cd0000 True True True \Windows\System32\StateRepository.Core.dll +9660 svchost.exe 0x7ff999df0000 True True True \Windows\System32\AppxPackaging.dll +9660 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +9660 svchost.exe 0x7ff9879d0000 True True True \Windows\System32\OpcServices.dll +9660 svchost.exe 0x7ff9857b0000 True True True \Windows\System32\AppXDeploymentServer.dll +9660 svchost.exe 0x7ff9926c0000 True True True \Windows\System32\AppxAllUserStore.dll +9660 svchost.exe 0x7ff99cbf0000 True True True \Windows\System32\urlmon.dll +9660 svchost.exe 0x7ff99a830000 True True True \Windows\System32\webservices.dll +9660 svchost.exe 0x7ff99bb50000 True True True \Windows\System32\iertutil.dll +9660 svchost.exe 0x7ff99aa30000 True True True \Windows\System32\OneCoreUAPCommonProxyStub.dll +9660 svchost.exe 0x7ff99f0f0000 True True True \Windows\System32\wer.dll +9660 svchost.exe 0x7ff99eb00000 True True True \Windows\System32\xmllite.dll +9660 svchost.exe 0x7ff99ec50000 True True True \Windows\System32\msxml6.dll +9660 svchost.exe 0x7ff9a0400000 True True True \Windows\System32\cryptxml.dll +9660 svchost.exe 0x7ff99ff00000 True True True \Windows\System32\fltLib.dll +9660 svchost.exe 0x7ff9a4f70000 True True True \Windows\System32\ntmarta.dll +9660 svchost.exe 0x7ff9a4dd0000 True True True \Windows\System32\mintdh.dll +9660 svchost.exe 0x7ff9a2b00000 True True True \Windows\System32\wevtapi.dll +9660 svchost.exe 0x7ff9a2ca0000 True True True \Windows\System32\wtsapi32.dll +9660 svchost.exe 0x7ff9a4c60000 True True True \Windows\System32\gpapi.dll +9660 svchost.exe 0x7ff9a4e20000 True True True \Windows\System32\tdh.dll +9660 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +9660 svchost.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +9660 svchost.exe 0x7ff9a57d0000 True True True \Windows\System32\cryptbase.dll +9660 svchost.exe 0x7ff9a57b0000 True True True \Windows\System32\cryptsp.dll +9660 svchost.exe 0x7ff9a5230000 True True True \Windows\System32\rsaenh.dll +9660 svchost.exe 0x7ff9a5850000 True True True \Windows\System32\winsta.dll +9660 svchost.exe 0x7ff9a5c60000 True True True \Windows\System32\userenv.dll +9660 svchost.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +9660 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +9660 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +9660 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +9660 svchost.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +9660 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +9660 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +9660 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +9660 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +9660 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +9660 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +9660 svchost.exe 0x7ff9a64c0000 True True True \Windows\System32\windows.storage.dll +9660 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +9660 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +9660 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +9660 svchost.exe 0x7ff9a7280000 True True True \Windows\System32\ole32.dll +9660 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +9660 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +9660 svchost.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +9660 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +9660 svchost.exe 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +9660 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +9660 svchost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +9660 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +9660 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +1168 SearchProtocol 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +1168 SearchProtocol 0x7ff9a5670000 True True True \Windows\System32\cryptdll.dll +1168 SearchProtocol 0x7ff6e12b0000 True False True \Windows\System32\SearchProtocolHost.exe +1168 SearchProtocol 0x7ff997e20000 True True True \Windows\System32\msidle.dll +1168 SearchProtocol 0x7ff9911e0000 True True True \Windows\System32\tquery.dll +1168 SearchProtocol 0x7ff9a14e0000 False False False \Windows\System32\linkinfo.dll +1168 SearchProtocol 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +1168 SearchProtocol 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +1168 SearchProtocol 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +1168 SearchProtocol 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +1168 SearchProtocol 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +1168 SearchProtocol 0x7ff9a64c0000 True True True \Windows\System32\windows.storage.dll +1168 SearchProtocol 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +1168 SearchProtocol 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +1168 SearchProtocol 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +1168 SearchProtocol 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +1168 SearchProtocol 0x7ff9a7130000 True True True \Windows\System32\user32.dll +1168 SearchProtocol 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +1168 SearchProtocol 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +1168 SearchProtocol 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +1168 SearchProtocol 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +1168 SearchProtocol 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +1168 SearchProtocol 0x7ff9a9130000 True True True \Windows\System32\combase.dll +1168 SearchProtocol 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +1168 SearchProtocol 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +1168 SearchProtocol 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +1168 SearchProtocol 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +1168 SearchProtocol 0x7ff9a9430000 True True True \Windows\System32\imm32.dll +1168 SearchProtocol 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +8892 osf64.exe 0x6bf0000 False False False \Windows\System32\en-US\user32.dll.mui +8892 osf64.exe 0x830000 False False False \Windows\System32\en-US\crypt32.dll.mui +8892 osf64.exe 0x5990000 False False False \Windows\System32\en-US\comdlg32.dll.mui +8892 osf64.exe 0x59b0000 False False False \Windows\System32\en-US\shell32.dll.mui +8892 osf64.exe 0x59a0000 False False False \Windows\System32\en-US\imageres.dll.mui +8892 osf64.exe 0x5a30000 False False False \Windows\System32\en-US\explorerframe.dll.mui +8892 osf64.exe 0xde40000 False False False \Windows\System32\en-US\ieframe.dll.mui +8892 osf64.exe 0xe780000 False False False \Windows\System32\en-US\propsys.dll.mui +8892 osf64.exe 0xe7b0000 False False False \Windows\System32\oleaccrc.dll +8892 osf64.exe 0xe820000 False False False \Windows\System32\en-US\mpr.dll.mui +8892 osf64.exe 0xe800000 False False False \Windows\System32\en-US\oleaccrc.dll.mui +8892 osf64.exe 0xe830000 False False False \Windows\System32\en-US\windows.storage.dll.mui +8892 osf64.exe 0xf170000 False False False \Windows\System32\en-US\dui70.dll.mui +8892 osf64.exe 0x10b20000 False False False \Windows\System32\msxml6r.dll +8892 osf64.exe 0x10c80000 False False False \Windows\System32\en-US\FunDisc.dll.mui +8892 osf64.exe 0x10d00000 False False False \Windows\System32\en-US\Windows.UI.CredDialogController.dll.mui +8892 osf64.exe 0x10ce0000 False False False \Windows\System32\en-US\NetworkItemFactory.dll.mui +8892 osf64.exe 0x10cb0000 False False False \Windows\System32\en-US\windows.ui.xaml.dll.mui +8892 osf64.exe 0x10cf0000 False False False \Windows\System32\en-US\ntlanman.dll.mui +8892 osf64.exe 0x127c0000 False False False \Windows\System32\netmsg.dll +8892 osf64.exe 0x10d90000 False False False \Windows\System32\Windows.UI.Xaml.Resources.dll +8892 osf64.exe 0x127d0000 False False False \Windows\System32\en-US\netmsg.dll.mui +8892 osf64.exe 0x19860000 False False False \Windows\System32\prm0009.dll +8892 osf64.exe 0x1c9e0000 False False False \Windows\System32\imageres.dll +8892 osf64.exe 0x7ff99f720000 True True True 헀螀ⴣᚎ㯞館樎譣⛀慼陥껝Ɱ䁳맒療魾麾ቃ壮뗁 +8892 osf64.exe 0x7ff998cb0000 True True True \Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.15063.1058_none_40c74ded29a7bebd\comctl32.dll +8892 osf64.exe 0x7ff992620000 True True True \Windows\System32\cryptui.dll +8892 osf64.exe 0x7ff989d10000 True True True \Windows\System32\duser.dll +8892 osf64.exe 0x140000000 True False True 㘰⸳弰桴琭彨ㄲ挷昹㥥㔸〱挲㤸 +8892 osf64.exe 0x7ff9814f0000 True True True \Windows\System32\Windows.Media.dll +8892 osf64.exe 0x7ff978590000 True True True \Windows\System32\DDORes.dll +8892 osf64.exe 0x7ff9890c0000 True True True \Windows\System32\ieframe.dll +8892 osf64.exe 0x7ff986600000 True True True +8892 osf64.exe 0x7ff98eef0000 True True True \Windows\System32\ExplorerFrame.dll +8892 osf64.exe 0x7ff98aea0000 True True True \Windows\System32\PortableDeviceApi.dll +8892 osf64.exe 0x7ff98b090000 True True True \Windows\System32\mfsensorgroup.dll +8892 osf64.exe 0x7ff9923b0000 True True True \Windows\System32\StructuredQuery.dll +8892 osf64.exe 0x7ff9905b0000 True True True \Windows\System32\UIAutomationCore.dll +8892 osf64.exe 0x7ff98f9b0000 True True True \Windows\System32\winspool.drv +8892 osf64.exe 0x7ff990ce0000 True True True \Windows\System32\cscui.dll +8892 osf64.exe 0x7ff992550000 True True True \Windows\System32\credprovhost.dll +8892 osf64.exe 0x7ff995fe0000 True True True \Windows\System32\wininet.dll +8892 osf64.exe 0x7ff994650000 True True True \Windows\System32\edputil.dll +8892 osf64.exe 0x7ff9939a0000 True True True \Windows\System32\mlang.dll +8892 osf64.exe 0x7ff9927c0000 True True True \Windows\System32\Windows.UI.Xaml.dll +8892 osf64.exe 0x7ff992710000 True True True \Program Files\Common Files\microsoft shared\ink\tiptsf.dll +8892 osf64.exe 0x7ff993950000 True True True \Windows\System32\MSWB7.dll +8892 osf64.exe 0x7ff993d20000 True True True \Windows\System32\DevDispItemProvider.dll +8892 osf64.exe 0x7ff993dd0000 True True True \Windows\System32\ntshrui.dll +8892 osf64.exe 0x7ff994f50000 True True True \Windows\System32\networkexplorer.dll +8892 osf64.exe 0x7ff994940000 True True True \Windows\System32\Windows.Globalization.dll +8892 osf64.exe 0x7ff994830000 True True True \Windows\System32\oleacc.dll +8892 osf64.exe 0x7ff994ca0000 True True True \Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.15063.608_none_56f0266b425534e9\GdiPlus.dll +8892 osf64.exe 0x7ff9950f0000 True True True \Windows\System32\CredProvDataModel.dll +8892 osf64.exe 0x7ff9973a0000 True True True \Windows\System32\winmmbase.dll +8892 osf64.exe 0x7ff996e70000 True True True \Windows\System32\WindowsCodecs.dll +8892 osf64.exe 0x7ff996bd0000 True True True \Windows\System32\wincredui.dll +8892 osf64.exe 0x7ff996650000 True True True \Windows\System32\dui70.dll +8892 osf64.exe 0x7ff996310000 True True True \Windows\System32\thumbcache.dll +8892 osf64.exe 0x7ff996800000 True True True \Windows\System32\msftedit.dll +8892 osf64.exe 0x7ff996cb0000 True True True \Windows\System32\Windows.UI.CredDialogController.dll +8892 osf64.exe 0x7ff9970a0000 True True True \Windows\System32\twinapi.dll +8892 osf64.exe 0x7ff997030000 True True True \Windows\System32\DataExchange.dll +8892 osf64.exe 0x7ff997370000 True True True \Windows\System32\cscapi.dll +8892 osf64.exe 0x7ff9971b0000 True True True \Windows\System32\mfplat.dll +8892 osf64.exe 0x7ff997fc0000 True True True \Windows\System32\winmm.dll +8892 osf64.exe 0x7ff997a90000 True True True \Windows\System32\EhStorShell.dll +8892 osf64.exe 0x7ff997600000 True True True \Windows\System32\CoreUIComponents.dll +8892 osf64.exe 0x7ff997c00000 True True True \Windows\System32\twinui.appcore.dll +8892 osf64.exe 0x7ff997e60000 True True True \Windows\System32\ninput.dll +8892 osf64.exe 0x7ff998430000 True True True \Windows\System32\OneCoreCommonProxyStub.dll +8892 osf64.exe 0x7ff998070000 True True True \Windows\System32\cryptnet.dll +8892 osf64.exe 0x7ff9986c0000 True True True \Windows\System32\fdProxy.dll +8892 osf64.exe 0x7ff998a90000 True True True \Windows\System32\Windows.Devices.Enumeration.dll +8892 osf64.exe 0x7ff99b8a0000 True True True \Windows\System32\wbem\wbemprox.dll +8892 osf64.exe 0x7ff99a4b0000 True True True \Windows\System32\WcnApi.dll +8892 osf64.exe 0x7ff9998c0000 True True True \Windows\System32\dtsh.dll +8892 osf64.exe 0x7ff9990d0000 True True True \Windows\System32\DWrite.dll +8892 osf64.exe 0x7ff999050000 True True True \Windows\System32\FontGlyphAnimator.dll +8892 osf64.exe 0x7ff998f20000 True True True +8892 osf64.exe 0x7ff999090000 True True True \Windows\System32\Windows.Internal.UI.Logon.ProxyStub.dll +8892 osf64.exe 0x7ff9993e0000 True True True \Windows\System32\PlayToDevice.dll +8892 osf64.exe 0x7ff999730000 True True True \Windows\System32\RTWorkQ.dll +8892 osf64.exe 0x7ff999f40000 True True True \Windows\System32\Windows.UI.XamlHost.dll +8892 osf64.exe 0x7ff999b60000 True True True \Windows\System32\Windows.UI.Immersive.dll +8892 osf64.exe 0x7ff9998d0000 True True True \Windows\System32\netapi32.dll +8892 osf64.exe 0x7ff99a490000 True True True \Windows\System32\browcli.dll +8892 osf64.exe 0x7ff99a220000 True True True \Windows\System32\Windows.Storage.Search.dll +8892 osf64.exe 0x7ff99b300000 True True True \Windows\System32\wbem\fastprox.dll +8892 osf64.exe 0x7ff99aa30000 True True True \Windows\System32\OneCoreUAPCommonProxyStub.dll +8892 osf64.exe 0x7ff99b010000 True True True \Windows\System32\MrmCoreR.dll +8892 osf64.exe 0x7ff99b880000 True True True \Windows\System32\wbem\wbemsvc.dll +8892 osf64.exe 0x7ff99b650000 True True True \Windows\System32\srvcli.dll +8892 osf64.exe 0x7ff99e220000 True True True \Windows\System32\version.dll +8892 osf64.exe 0x7ff99cbf0000 True True True \Windows\System32\urlmon.dll +8892 osf64.exe 0x7ff99c880000 True True True \Windows\System32\samlib.dll +8892 osf64.exe 0x7ff99bb50000 True True True \Windows\System32\iertutil.dll +8892 osf64.exe 0x7ff99ca10000 True True True \Windows\System32\samcli.dll +8892 osf64.exe 0x7ff99c9d0000 True True True \Windows\System32\rasadhlp.dll +8892 osf64.exe 0x7ff99daa0000 True True True \Windows\System32\fundisc.dll +8892 osf64.exe 0x7ff99d670000 True True True \Windows\System32\atl.dll +8892 osf64.exe 0x7ff99dba0000 True True True \Windows\System32\wbemcomn.dll +8892 osf64.exe 0x7ff99eb00000 True True True \Windows\System32\xmllite.dll +8892 osf64.exe 0x7ff99e710000 True True True \Windows\System32\dlnashext.dll +8892 osf64.exe 0x7ff99e560000 True True True \Windows\System32\fwpolicyiomgr.dll +8892 osf64.exe 0x7ff99f670000 True True True \Windows\System32\atlthunk.dll +8892 osf64.exe 0x7ff99f470000 True True True \Windows\System32\directmanipulation.dll +8892 osf64.exe 0x7ff99ec50000 True True True \Windows\System32\msxml6.dll +8892 osf64.exe 0x7ff99f700000 True True True \Program Files\OSForensics\amd_ags_x64.dll +8892 osf64.exe 0x7ff9a4410000 True True True \Windows\System32\apphelp.dll +8892 osf64.exe 0x7ff9a1540000 True True True \Windows\System32\dbghelp.dll +8892 osf64.exe 0x7ff9a0320000 True True True \Windows\System32\mssprxy.dll +8892 osf64.exe 0x7ff99fc00000 True True True \Windows\System32\fdWCN.dll +8892 osf64.exe 0x7ff99fbb0000 True True True 䧀廬�뿸骐ꄥ͊≒ꕼ멨瓑縓낭㏔㴧ᘇ຋嘎烼徢隈慴⏊⛌⹐ꂶ +8892 osf64.exe 0x7ff99fbd0000 True True True \Windows\System32\msimg32.dll +8892 osf64.exe 0x7ff99fe70000 True True True \Windows\System32\networkitemfactory.dll +8892 osf64.exe 0x7ff99fe60000 True True True \Windows\System32\credui.dll +8892 osf64.exe 0x7ff99fd30000 True True True \Windows\System32\DefaultDeviceManager.dll +8892 osf64.exe 0x7ff9a02a0000 True True True \Windows\System32\wincorlib.dll +8892 osf64.exe 0x7ff9a09a0000 True True True \Windows\System32\globinputhost.dll +8892 osf64.exe 0x7ff9a0610000 True True True \Windows\System32\TextInputFramework.dll +8892 osf64.exe 0x7ff9a0430000 True True True \Windows\System32\davclnt.dll +8892 osf64.exe 0x7ff9a0380000 True True True \Windows\System32\Windows.Shell.ServiceHostBuilder.dll +8892 osf64.exe 0x7ff9a04e0000 True True True \Windows\System32\threadpoolwinrt.dll +8892 osf64.exe 0x7ff9a05c0000 True True True \Windows\System32\cscobj.dll +8892 osf64.exe 0x7ff9a06f0000 True True True \Windows\System32\EhStorAPI.dll +8892 osf64.exe 0x7ff9a06d0000 True True True \Windows\System32\mpr.dll +8892 osf64.exe 0x7ff9a0930000 True True True \Windows\System32\FWPUCLNT.DLL +8892 osf64.exe 0x7ff9a0cd0000 True True True \Windows\System32\StateRepository.Core.dll +8892 osf64.exe 0x7ff9a09f0000 True True True \Windows\System32\secur32.dll +8892 osf64.exe 0x7ff9a09d0000 True True True \Windows\System32\ntlanman.dll +8892 osf64.exe 0x7ff9a0af0000 True True True \Windows\System32\Windows.UI.dll +8892 osf64.exe 0x7ff9a0d80000 True True True \Windows\System32\Windows.StateRepository.dll +8892 osf64.exe 0x7ff9a14e0000 True True True \Windows\System32\linkinfo.dll +8892 osf64.exe 0x7ff9a2800000 True True True \Windows\System32\winnsi.dll +8892 osf64.exe 0x7ff9a1bd0000 True True True \Windows\System32\propsys.dll +8892 osf64.exe 0x7ff9a19e0000 True True True \Windows\System32\deviceassociation.dll +8892 osf64.exe 0x7ff9a1940000 True True True \Windows\System32\policymanager.dll +8892 osf64.exe 0x7ff9a18b0000 True True True \Windows\System32\msvcp110_win.dll +8892 osf64.exe 0x7ff9a1a80000 True True True \Windows\System32\usermgrcli.dll +8892 osf64.exe 0x7ff9a2160000 True True True \Windows\System32\MMDevAPI.dll +8892 osf64.exe 0x7ff9a2000000 True True True \Windows\System32\npmproxy.dll +8892 osf64.exe 0x7ff9a1f90000 True True True \Windows\System32\wkscli.dll +8892 osf64.exe 0x7ff9a2120000 True True True \Windows\System32\dhcpcsvc6.dll +8892 osf64.exe 0x7ff9a25a0000 True True True \Windows\System32\dhcpcsvc.dll +8892 osf64.exe 0x7ff9a2b60000 True True True \Windows\System32\WinTypes.dll +8892 osf64.exe 0x7ff9a28e0000 True True True \Windows\System32\drprov.dll +8892 osf64.exe 0x7ff9a28d0000 True True True \Windows\System32\davhlpr.dll +8892 osf64.exe 0x7ff9a2ac0000 True True True \Windows\System32\dwmapi.dll +8892 osf64.exe 0x7ff9a28f0000 True True True \Windows\System32\fdWNet.dll +8892 osf64.exe 0x7ff9a3450000 True True True \Windows\System32\d3d11.dll +8892 osf64.exe 0x7ff9a3320000 True True True \Windows\System32\dcomp.dll +8892 osf64.exe 0x7ff9a2ca0000 True True True \Windows\System32\wtsapi32.dll +8892 osf64.exe 0x7ff9a3920000 True True True \Windows\System32\CoreMessaging.dll +8892 osf64.exe 0x7ff9a3780000 True True True \Windows\System32\BCP47Langs.dll +8892 osf64.exe 0x7ff9a3af0000 True True True \Windows\System32\d2d1.dll +8892 osf64.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +8892 osf64.exe 0x7ff9a57b0000 True True True \Windows\System32\cryptsp.dll +8892 osf64.exe 0x7ff9a4c60000 True True True \Windows\System32\gpapi.dll +8892 osf64.exe 0x7ff9a47d0000 True True True \Windows\System32\uxtheme.dll +8892 osf64.exe 0x7ff9a4660000 True True True \Windows\System32\twinapi.appcore.dll +8892 osf64.exe 0x7ff9a49c0000 True True True \Windows\System32\devobj.dll +8892 osf64.exe 0x7ff9a4c30000 True True True \Windows\System32\fwbase.dll +8892 osf64.exe 0x7ff9a4f70000 True True True \Windows\System32\ntmarta.dll +8892 osf64.exe 0x7ff9a4d20000 True True True \Windows\System32\dxgi.dll +8892 osf64.exe 0x7ff9a4c90000 True True True \Windows\System32\FirewallAPI.dll +8892 osf64.exe 0x7ff9a53b0000 True True True \Windows\System32\IPHLPAPI.DLL +8892 osf64.exe 0x7ff9a5230000 True True True \Windows\System32\rsaenh.dll +8892 osf64.exe 0x7ff9a5270000 True True True \Windows\System32\dpapi.dll +8892 osf64.exe 0x7ff9a54a0000 True True True \Windows\System32\netutils.dll +8892 osf64.exe 0x7ff9a53f0000 True True True +8892 osf64.exe 0x7ff9a5610000 True True True \Windows\System32\mswsock.dll +8892 osf64.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +8892 osf64.exe 0x7ff9a5850000 True True True \Windows\System32\winsta.dll +8892 osf64.exe 0x7ff9a57d0000 True True True \Windows\System32\cryptbase.dll +8892 osf64.exe 0x7ff9a5b90000 True True True \Windows\System32\sxs.dll +8892 osf64.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +8892 osf64.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +8892 osf64.exe 0x7ff9a5c60000 True True True \Windows\System32\userenv.dll +8892 osf64.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +8892 osf64.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +8892 osf64.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +8892 osf64.exe 0x7ff9a7470000 True True True \Windows\System32\setupapi.dll +8892 osf64.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +8892 osf64.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +8892 osf64.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +8892 osf64.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +8892 osf64.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +8892 osf64.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +8892 osf64.exe 0x7ff9a64c0000 True True True \Windows\System32\windows.storage.dll +8892 osf64.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +8892 osf64.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +8892 osf64.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +8892 osf64.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +8892 osf64.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +8892 osf64.exe 0x7ff9a6e50000 True True True \Windows\System32\imagehlp.dll +8892 osf64.exe 0x7ff9a6fa0000 True True True \Windows\System32\coml2.dll +8892 osf64.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +8892 osf64.exe 0x7ff9a7280000 True True True \Windows\System32\ole32.dll +8892 osf64.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +8892 osf64.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +8892 osf64.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +8892 osf64.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +8892 osf64.exe 0x7ff9a78b0000 True True True \Windows\System32\nsi.dll +8892 osf64.exe 0x7ff9a7970000 True True True \Windows\System32\shell32.dll +8892 osf64.exe 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +8892 osf64.exe 0x7ff9a8df0000 True True True \Windows\System32\msctf.dll +8892 osf64.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +8892 osf64.exe 0x7ff9a96b0000 True True True \Windows\System32\comdlg32.dll +8892 osf64.exe 0x7ff9a9430000 True True True \Windows\System32\imm32.dll +8892 osf64.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +8892 osf64.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +8892 osf64.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +8892 osf64.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +7080 WmiPrvSE.exe 0x281889b0000 False False False \Windows\System32\en-US\user32.dll.mui +7080 WmiPrvSE.exe 0x28188cb0000 False False False \Windows\System32\wbem\en-US\cimwin32.dll.mui +7080 WmiPrvSE.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +7080 WmiPrvSE.exe 0x7ff99dba0000 True False True \Windows\System32\wbemcomn.dll +7080 WmiPrvSE.exe 0x7ff99b300000 True False True \Windows\System32\wbem\fastprox.dll +7080 WmiPrvSE.exe 0x7ff786ce0000 True False True \Windows\System32\wbem\WmiPrvSE.exe +7080 WmiPrvSE.exe 0x7ff9889c0000 False False False \Windows\System32\wbem\cimwin32.dll +7080 WmiPrvSE.exe 0x7ff99b850000 False False False \Windows\System32\wbem\wmiutils.dll +7080 WmiPrvSE.exe 0x7ff99b630000 True False True \Windows\System32\ncobjapi.dll +7080 WmiPrvSE.exe 0x7ff99b880000 False False False \Windows\System32\wbem\wbemsvc.dll +7080 WmiPrvSE.exe 0x7ff9a49c0000 False False False \Windows\System32\devobj.dll +7080 WmiPrvSE.exe 0x7ff9a29c0000 False False False \Windows\System32\framedynos.dll +7080 WmiPrvSE.exe 0x7ff9a2ca0000 False False False \Windows\System32\wtsapi32.dll +7080 WmiPrvSE.exe 0x7ff9a5c30000 False False False \Windows\System32\bcrypt.dll +7080 WmiPrvSE.exe 0x7ff9a5850000 False False False \Windows\System32\winsta.dll +7080 WmiPrvSE.exe 0x7ff9a5d60000 False False False \Windows\System32\powrprof.dll +7080 WmiPrvSE.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +7080 WmiPrvSE.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +7080 WmiPrvSE.exe 0x7ff9a6400000 False True False \Windows\System32\bcryptprimitives.dll +7080 WmiPrvSE.exe 0x7ff9a6160000 False False False \Windows\System32\win32u.dll +7080 WmiPrvSE.exe 0x7ff9a6060000 False False False \Windows\System32\msvcp_win.dll +7080 WmiPrvSE.exe 0x7ff9a6bc0000 False False False \Windows\System32\gdi32full.dll +7080 WmiPrvSE.exe 0x7ff9a6470000 False False False \Windows\System32\cfgmgr32.dll +7080 WmiPrvSE.exe 0x7ff9a6e70000 False True False \Windows\System32\rpcrt4.dll +7080 WmiPrvSE.exe 0x7ff9a73d0000 False False False \Windows\System32\clbcatq.dll +7080 WmiPrvSE.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +7080 WmiPrvSE.exe 0x7ff9a9070000 False False False \Windows\System32\sechost.dll +7080 WmiPrvSE.exe 0x7ff9a8dc0000 False False False \Windows\System32\gdi32.dll +7080 WmiPrvSE.exe 0x7ff9a97c0000 False False False \Windows\System32\oleaut32.dll +7080 WmiPrvSE.exe 0x7ff9a9600000 False False False \Windows\System32\advapi32.dll +3672 CompatTelRunne 0x172a1f00000 False False False \Windows\System32\en-US\KernelBase.dll.mui +3672 CompatTelRunne 0x172a2030000 False False False \Windows\System32\msxml6r.dll +3672 CompatTelRunne 0x172a2060000 False False False \Windows\System32\en-US\msxml6r.dll.mui +3672 CompatTelRunne 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +3672 CompatTelRunne 0x7ff9a2b00000 True True True \Windows\System32\wevtapi.dll +3672 CompatTelRunne 0x7ff69b410000 True False True N/A +3672 CompatTelRunne 0x7ff9879d0000 True True True \Windows\System32\OpcServices.dll +3672 CompatTelRunne 0x7ff99bb50000 True True True \Windows\System32\iertutil.dll +3672 CompatTelRunne 0x7ff999df0000 True True True \Windows\System32\AppxPackaging.dll +3672 CompatTelRunne 0x7ff997600000 True True True \Windows\System32\CoreUIComponents.dll +3672 CompatTelRunne 0x7ff99cbf0000 True True True \Windows\System32\urlmon.dll +3672 CompatTelRunne 0x7ff99fda0000 True True True \Windows\System32\AppXDeploymentClient.dll +3672 CompatTelRunne 0x7ff9a0af0000 True True True \Windows\System32\Windows.UI.dll +3672 CompatTelRunne 0x7ff9a0610000 True True True \Windows\System32\TextInputFramework.dll +3672 CompatTelRunne 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +3672 CompatTelRunne 0x7ff9a3920000 True True True \Windows\System32\CoreMessaging.dll +3672 CompatTelRunne 0x7ff9a4f70000 True True True \Windows\System32\ntmarta.dll +3672 CompatTelRunne 0x7ff9a4660000 True True True \Windows\System32\twinapi.appcore.dll +3672 CompatTelRunne 0x7ff9a57d0000 True True True \Windows\System32\cryptbase.dll +3672 CompatTelRunne 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +3672 CompatTelRunne 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +3672 CompatTelRunne 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +3672 CompatTelRunne 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +3672 CompatTelRunne 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +3672 CompatTelRunne 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +3672 CompatTelRunne 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +3672 CompatTelRunne 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +3672 CompatTelRunne 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +3672 CompatTelRunne 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +3672 CompatTelRunne 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +3672 CompatTelRunne 0x7ff9a64c0000 True True True \Windows\System32\windows.storage.dll +3672 CompatTelRunne 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +3672 CompatTelRunne 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +3672 CompatTelRunne 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +3672 CompatTelRunne 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +3672 CompatTelRunne 0x7ff9a7280000 True True True \Windows\System32\ole32.dll +3672 CompatTelRunne 0x7ff9a7130000 True True True \Windows\System32\user32.dll +3672 CompatTelRunne 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +3672 CompatTelRunne 0x7ff9a9130000 True True True \Windows\System32\combase.dll +3672 CompatTelRunne 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +3672 CompatTelRunne 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +3672 CompatTelRunne 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +3672 CompatTelRunne 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +3672 CompatTelRunne 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +1612 conhost.exe 0x2131a670000 False False False \Windows\System32\en-US\user32.dll.mui +1612 conhost.exe 0x2131a680000 False False False \Windows\System32\en-US\ConhostV2.dll.mui +1612 conhost.exe 0x2131aea0000 False False False \Windows\System32\en-US\KernelBase.dll.mui +1612 conhost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +1612 conhost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +1612 conhost.exe 0x7ff71acb0000 True False True \Windows\System32\conhost.exe +1612 conhost.exe 0x7ff9a1bd0000 True True True \Windows\System32\propsys.dll +1612 conhost.exe 0x7ff999960000 True True True \Windows\System32\ConhostV2.dll +1612 conhost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +1612 conhost.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +1612 conhost.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +1612 conhost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +1612 conhost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +1612 conhost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +1612 conhost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +1612 conhost.exe 0x7ff9a64c0000 True True True \Windows\System32\windows.storage.dll +1612 conhost.exe 0x7ff9a6470000 True True True \Windows\System32\cfgmgr32.dll +1612 conhost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +1612 conhost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +1612 conhost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +1612 conhost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +1612 conhost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +1612 conhost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +1612 conhost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +1612 conhost.exe 0x7ff9a7970000 True True True \Windows\System32\shell32.dll +1612 conhost.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +1612 conhost.exe 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +1612 conhost.exe 0x7ff9a8df0000 True True True \Windows\System32\msctf.dll +1612 conhost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +1612 conhost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +1612 conhost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +1612 conhost.exe 0x7ff9a9430000 True True True \Windows\System32\imm32.dll +1612 conhost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll +8704 svchost.exe 0x20ca6f90000 False False False \Windows\System32\en-US\svchost.exe.mui +8704 svchost.exe 0x20ca70f0000 False False False \Windows\System32\winnlsres.dll +8704 svchost.exe 0x20ca77d0000 False False False \Windows\System32\en-US\winnlsres.dll.mui +8704 svchost.exe 0x20ca77c0000 False False False \Windows\System32\msxml6r.dll +8704 svchost.exe 0x20ca7800000 False False False \Windows\System32\en-US\crypt32.dll.mui +8704 svchost.exe 0x20ca77e0000 False False False \Windows\System32\en-US\mswsock.dll.mui +8704 svchost.exe 0x20ca7810000 False False False \Windows\System32\en-US\SHCore.dll.mui +8704 svchost.exe 0x20ca7d40000 False False False \Windows\System32\en-US\KernelBase.dll.mui +8704 svchost.exe 0x7ff9a5e10000 True True True \Windows\System32\KernelBase.dll +8704 svchost.exe 0x7ff9a5270000 True True True \Windows\System32\dpapi.dll +8704 svchost.exe 0x7ff9a03d0000 True True True \Windows\System32\Clipc.dll +8704 svchost.exe 0x7ff990b80000 True True True \Windows\System32\msauserext.dll +8704 svchost.exe 0x7ff791320000 True False True \Windows\System32\svchost.exe +8704 svchost.exe 0x7ff9877b0000 True True True \Windows\System32\wlidsvc.dll +8704 svchost.exe 0x7ff9907f0000 True True True ㅲ˸ +8704 svchost.exe 0x7ff99d7a0000 True True True \Windows\System32\winhttp.dll +8704 svchost.exe 0x7ff998730000 True True True \Windows\System32\OnDemandConnRouteHelper.dll +8704 svchost.exe 0x7ff9980d0000 True True True \Windows\System32\mskeyprotect.dll +8704 svchost.exe 0x7ff998070000 True True True \Windows\System32\cryptnet.dll +8704 svchost.exe 0x7ff998180000 True True True \Windows\System32\ncryptsslp.dll +8704 svchost.exe 0x7ff99b740000 True True True \Windows\System32\webio.dll +8704 svchost.exe 0x7ff99c9d0000 True True True \Windows\System32\rasadhlp.dll +8704 svchost.exe 0x7ff99ec50000 True True True \Windows\System32\msxml6.dll +8704 svchost.exe 0x7ff99fab0000 True True True \Windows\System32\cryptngc.dll +8704 svchost.exe 0x7ff9a2120000 True True True \Windows\System32\dhcpcsvc6.dll +8704 svchost.exe 0x7ff9a0a00000 True True True \Windows\System32\ELSCore.dll +8704 svchost.exe 0x7ff9a0930000 True True True \Windows\System32\FWPUCLNT.DLL +8704 svchost.exe 0x7ff9a1940000 True True True \Windows\System32\policymanager.dll +8704 svchost.exe 0x7ff9a18b0000 True True True \Windows\System32\msvcp110_win.dll +8704 svchost.exe 0x7ff9a2000000 True True True \Windows\System32\npmproxy.dll +8704 svchost.exe 0x7ff9a32b0000 True True True \Windows\System32\netprofm.dll +8704 svchost.exe 0x7ff9a2800000 True True True \Windows\System32\winnsi.dll +8704 svchost.exe 0x7ff9a25a0000 True True True \Windows\System32\dhcpcsvc.dll +8704 svchost.exe 0x7ff9a2ca0000 True True True \Windows\System32\wtsapi32.dll +8704 svchost.exe 0x7ff9a5170000 True True True \Windows\System32\schannel.dll +8704 svchost.exe 0x7ff9a4f20000 True True True \Windows\System32\wldp.dll +8704 svchost.exe 0x7ff9a5230000 True True True \Windows\System32\rsaenh.dll +8704 svchost.exe 0x7ff9a58f0000 True True True \Windows\System32\ncrypt.dll +8704 svchost.exe 0x7ff9a57d0000 True True True \Windows\System32\cryptbase.dll +8704 svchost.exe 0x7ff9a5610000 True True True \Windows\System32\mswsock.dll +8704 svchost.exe 0x7ff9a53b0000 True True True \Windows\System32\IPHLPAPI.DLL +8704 svchost.exe 0x7ff9a53f0000 True True True +8704 svchost.exe 0x7ff9a57b0000 True True True \Windows\System32\cryptsp.dll +8704 svchost.exe 0x7ff9a58b0000 True True True N/A +8704 svchost.exe 0x7ff9a5850000 True True True \Windows\System32\winsta.dll +8704 svchost.exe 0x7ff9a5db0000 True True True \Windows\System32\kernel.appcore.dll +8704 svchost.exe 0x7ff9a5c90000 True True True \Windows\System32\sspicli.dll +8704 svchost.exe 0x7ff9a5c30000 True True True \Windows\System32\bcrypt.dll +8704 svchost.exe 0x7ff9a5d60000 True True True \Windows\System32\powrprof.dll +8704 svchost.exe 0x7ff9a5df0000 True True True \Windows\System32\msasn1.dll +8704 svchost.exe 0x7ff9a5dd0000 True True True \Windows\System32\profapi.dll +8704 svchost.exe 0x7ff9a6d50000 True True True l-TimeZones.Resources" version +8704 svchost.exe 0x7ff9a6160000 True True True \Windows\System32\win32u.dll +8704 svchost.exe 0x7ff9a6060000 True True True \Windows\System32\msvcp_win.dll +8704 svchost.exe 0x7ff9a6100000 True True True \Windows\System32\wintrust.dll +8704 svchost.exe 0x7ff9a6400000 True True True \Windows\System32\bcryptprimitives.dll +8704 svchost.exe 0x7ff9a6180000 True True True \Windows\System32\crypt32.dll +8704 svchost.exe 0x7ff9a6bc0000 True True True \Windows\System32\gdi32full.dll +8704 svchost.exe 0x7ff9a64c0000 True True True \Windows\System32\windows.storage.dll +8704 svchost.exe 0x7ff9a8f60000 True True True \Windows\System32\shlwapi.dll +8704 svchost.exe 0x7ff9a7130000 True True True \Windows\System32\user32.dll +8704 svchost.exe 0x7ff9a7020000 True True True \Windows\System32\ws2_32.dll +8704 svchost.exe 0x7ff9a6e70000 True True True \Windows\System32\rpcrt4.dll +8704 svchost.exe 0x7ff9a7090000 True True True \Windows\System32\msvcrt.dll +8704 svchost.exe 0x7ff9a78c0000 True True True \Windows\System32\kernel32.dll +8704 svchost.exe 0x7ff9a73d0000 True True True \Windows\System32\clbcatq.dll +8704 svchost.exe 0x7ff9a78b0000 True True True \Windows\System32\nsi.dll +8704 svchost.exe 0x7ff9a8dc0000 True True True \Windows\System32\gdi32.dll +8704 svchost.exe 0x7ff9a9130000 True True True \Windows\System32\combase.dll +8704 svchost.exe 0x7ff9a9070000 True True True \Windows\System32\sechost.dll +8704 svchost.exe 0x7ff9a8fc0000 True True True \Windows\System32\SHCore.dll +8704 svchost.exe 0x7ff9a97c0000 True True True \Windows\System32\oleaut32.dll +8704 svchost.exe 0x7ff9a9600000 True True True \Windows\System32\advapi32.dll +8704 svchost.exe 0x7ff9a98f0000 True True True \Windows\System32\ntdll.dll diff --git a/Semaine_12/Jour_05/volatility/data/results/WinDump.mem_windows.malfind.log b/Semaine_12/Jour_05/volatility/data/results/WinDump.mem_windows.malfind.log new file mode 100644 index 0000000..3bca5f1 --- /dev/null +++ b/Semaine_12/Jour_05/volatility/data/results/WinDump.mem_windows.malfind.log @@ -0,0 +1,455 @@ + Progress: 0.00 Scanning FileLayer using PageMapScanner Progress: 15.11 Scanning FileLayer using PageMapScanner Progress: 64.75 Scanning FileLayer using PageMapScanner Progress: 100.00 Stacking attempts finished Progress: 0.00 Scanning layer_name using PdbSignatureScanner Progress: 0.00 Scanning layer_name using PdbSignatureScanner Progress: 34.47 Scanning layer_name using PdbSignatureScanner Progress: 34.57 Scanning layer_name using PdbSignatureScanner Progress: 34.67 Scanning layer_name using PdbSignatureScanner Progress: 34.77 Scanning layer_name using PdbSignatureScanner Progress: 34.86 Scanning layer_name using PdbSignatureScanner Progress: 34.96 Scanning layer_name using PdbSignatureScanner Progress: 35.06 Scanning layer_name using PdbSignatureScanner Progress: 0.00 Scanning layer_name using PdbSignatureScanner Progress: 0.00 Scanning layer_name using PdbSignatureScanner Progress: 100.00 PDB scanning finished /usr/local/lib/python3.10/site-packages/volatility3/framework/deprecation.py:28: FutureWarning: This API (volatility3.plugins.windows.malware.malfind.Malfind.run) will be removed in the first release after 2026-06-07. This plugin has been renamed, please call volatility3.plugins.windows.malware.malfind.Malfind rather than volatility3.plugins.windows.malfind.Malfind. + warnings.warn( +/usr/local/lib/python3.10/site-packages/volatility3/framework/deprecation.py:105: FutureWarning: This plugin (volatility3.plugins.windows.malfind.Malfind) has been renamed and will be removed in the first release after 2026-06-07. Please ensure all method calls to this plugin are replaced with calls to volatility3.plugins.windows.malware.malfind.Malfind + warnings.warn( +Volatility 3 Framework 2.28.0 + +PID Process Start VPN End VPN Tag Protection CommitCharge PrivateMemory File output Notes Hexdump Disasm + +2688 MsMpEng.exe 0x1ef80550000 0x1ef8065cfff VadS PAGE_EXECUTE_READWRITE 269 1 Disabled N/A +56 57 53 55 41 54 41 55 48 83 ec 28 48 8b e9 48 VWSUATAUH..(H..H +8d b1 88 38 00 00 ff e2 48 83 c4 28 41 5d 41 5c ...8....H..(A]A\ +5d 5b 5f 5e c3 00 00 00 00 00 00 00 00 00 00 00 ][_^............ +00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ +0x1ef80550000: push rsi +0x1ef80550001: push rdi +0x1ef80550002: push rbx +0x1ef80550003: push rbp +0x1ef80550004: push r12 +0x1ef80550006: push r13 +0x1ef80550008: sub rsp, 0x28 +0x1ef8055000c: mov rbp, rcx +0x1ef8055000f: lea rsi, [rcx + 0x3888] +0x1ef80550016: jmp rdx +0x1ef80550018: add rsp, 0x28 +0x1ef8055001c: pop r13 +0x1ef8055001e: pop r12 +0x1ef80550020: pop rbp +0x1ef80550021: pop rbx +0x1ef80550022: pop rdi +0x1ef80550023: pop rsi +0x1ef80550024: ret +0x1ef80550025: add byte ptr [rax], al +0x1ef80550027: add byte ptr [rax], al +0x1ef80550029: add byte ptr [rax], al +0x1ef8055002b: add byte ptr [rax], al +0x1ef8055002d: add byte ptr [rax], al +0x1ef8055002f: add byte ptr [rax], al +0x1ef80550031: add byte ptr [rax], al +0x1ef80550033: add byte ptr [rax], al +0x1ef80550035: add byte ptr [rax], al +0x1ef80550037: add byte ptr [rax], al +0x1ef80550039: add byte ptr [rax], al +0x1ef8055003b: add byte ptr [rax], al +0x1ef8055003d: add byte ptr [rax], al +2688 MsMpEng.exe 0x1ef808a0000 0x1ef809acfff VadS PAGE_EXECUTE_READWRITE 269 1 Disabled N/A +56 57 53 55 41 54 41 55 48 83 ec 28 48 8b e9 48 VWSUATAUH..(H..H +8d b1 88 38 00 00 ff e2 48 83 c4 28 41 5d 41 5c ...8....H..(A]A\ +5d 5b 5f 5e c3 00 00 00 00 00 00 00 00 00 00 00 ][_^............ +00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ +0x1ef808a0000: push rsi +0x1ef808a0001: push rdi +0x1ef808a0002: push rbx +0x1ef808a0003: push rbp +0x1ef808a0004: push r12 +0x1ef808a0006: push r13 +0x1ef808a0008: sub rsp, 0x28 +0x1ef808a000c: mov rbp, rcx +0x1ef808a000f: lea rsi, [rcx + 0x3888] +0x1ef808a0016: jmp rdx +0x1ef808a0018: add rsp, 0x28 +0x1ef808a001c: pop r13 +0x1ef808a001e: pop r12 +0x1ef808a0020: pop rbp +0x1ef808a0021: pop rbx +0x1ef808a0022: pop rdi +0x1ef808a0023: pop rsi +0x1ef808a0024: ret +0x1ef808a0025: add byte ptr [rax], al +0x1ef808a0027: add byte ptr [rax], al +0x1ef808a0029: add byte ptr [rax], al +0x1ef808a002b: add byte ptr [rax], al +0x1ef808a002d: add byte ptr [rax], al +0x1ef808a002f: add byte ptr [rax], al +0x1ef808a0031: add byte ptr [rax], al +0x1ef808a0033: add byte ptr [rax], al +0x1ef808a0035: add byte ptr [rax], al +0x1ef808a0037: add byte ptr [rax], al +0x1ef808a0039: add byte ptr [rax], al +0x1ef808a003b: add byte ptr [rax], al +0x1ef808a003d: add byte ptr [rax], al +2688 MsMpEng.exe 0x1ef809b0000 0x1ef80abcfff VadS PAGE_EXECUTE_READWRITE 269 1 Disabled N/A +56 57 53 55 41 54 41 55 48 83 ec 28 48 8b e9 48 VWSUATAUH..(H..H +8d b1 88 38 00 00 ff e2 48 83 c4 28 41 5d 41 5c ...8....H..(A]A\ +5d 5b 5f 5e c3 00 00 00 00 00 00 00 00 00 00 00 ][_^............ +00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ +0x1ef809b0000: push rsi +0x1ef809b0001: push rdi +0x1ef809b0002: push rbx +0x1ef809b0003: push rbp +0x1ef809b0004: push r12 +0x1ef809b0006: push r13 +0x1ef809b0008: sub rsp, 0x28 +0x1ef809b000c: mov rbp, rcx +0x1ef809b000f: lea rsi, [rcx + 0x3888] +0x1ef809b0016: jmp rdx +0x1ef809b0018: add rsp, 0x28 +0x1ef809b001c: pop r13 +0x1ef809b001e: pop r12 +0x1ef809b0020: pop rbp +0x1ef809b0021: pop rbx +0x1ef809b0022: pop rdi +0x1ef809b0023: pop rsi +0x1ef809b0024: ret +0x1ef809b0025: add byte ptr [rax], al +0x1ef809b0027: add byte ptr [rax], al +0x1ef809b0029: add byte ptr [rax], al +0x1ef809b002b: add byte ptr [rax], al +0x1ef809b002d: add byte ptr [rax], al +0x1ef809b002f: add byte ptr [rax], al +0x1ef809b0031: add byte ptr [rax], al +0x1ef809b0033: add byte ptr [rax], al +0x1ef809b0035: add byte ptr [rax], al +0x1ef809b0037: add byte ptr [rax], al +0x1ef809b0039: add byte ptr [rax], al +0x1ef809b003b: add byte ptr [rax], al +0x1ef809b003d: add byte ptr [rax], al +2688 MsMpEng.exe 0x1ef80f60000 0x1ef8105ffff VadS PAGE_EXECUTE_READWRITE 256 1 Disabled N/A +20 00 00 00 e0 ff 0f 00 0c 00 00 00 01 00 07 00 ............... +00 42 00 30 00 70 00 60 00 50 00 c0 00 d0 00 00 .B.0.p.`.P...... +08 00 42 00 00 00 00 05 48 8b 45 20 48 89 c2 48 ..B.....H.E H..H +8b 45 18 48 8b 00 48 89 02 48 8b 45 20 81 00 b8 .E.H..H..H.E ... +0x1ef80f60000: and byte ptr [rax], al +0x1ef80f60002: add byte ptr [rax], al +0x1ef80f60004: loopne 0x1ef80f60005 +0x1ef80f60006: str word ptr [rax + rax] +0x1ef80f6000a: add byte ptr [rax], al +0x1ef80f6000c: add dword ptr [rax], eax +2688 MsMpEng.exe 0x1ef81a80000 0x1ef81b8cfff VadS PAGE_EXECUTE_READWRITE 269 1 Disabled N/A +56 57 53 55 41 54 41 55 48 83 ec 28 48 8b e9 48 VWSUATAUH..(H..H +8d b1 88 38 00 00 ff e2 48 83 c4 28 41 5d 41 5c ...8....H..(A]A\ +5d 5b 5f 5e c3 00 00 00 00 00 00 00 00 00 00 00 ][_^............ +00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ +0x1ef81a80000: push rsi +0x1ef81a80001: push rdi +0x1ef81a80002: push rbx +0x1ef81a80003: push rbp +0x1ef81a80004: push r12 +0x1ef81a80006: push r13 +0x1ef81a80008: sub rsp, 0x28 +0x1ef81a8000c: mov rbp, rcx +0x1ef81a8000f: lea rsi, [rcx + 0x3888] +0x1ef81a80016: jmp rdx +0x1ef81a80018: add rsp, 0x28 +0x1ef81a8001c: pop r13 +0x1ef81a8001e: pop r12 +0x1ef81a80020: pop rbp +0x1ef81a80021: pop rbx +0x1ef81a80022: pop rdi +0x1ef81a80023: pop rsi +0x1ef81a80024: ret +0x1ef81a80025: add byte ptr [rax], al +0x1ef81a80027: add byte ptr [rax], al +0x1ef81a80029: add byte ptr [rax], al +0x1ef81a8002b: add byte ptr [rax], al +0x1ef81a8002d: add byte ptr [rax], al +0x1ef81a8002f: add byte ptr [rax], al +0x1ef81a80031: add byte ptr [rax], al +0x1ef81a80033: add byte ptr [rax], al +0x1ef81a80035: add byte ptr [rax], al +0x1ef81a80037: add byte ptr [rax], al +0x1ef81a80039: add byte ptr [rax], al +0x1ef81a8003b: add byte ptr [rax], al +0x1ef81a8003d: add byte ptr [rax], al +2688 MsMpEng.exe 0x1ef81d60000 0x1ef81e6cfff VadS PAGE_EXECUTE_READWRITE 269 1 Disabled N/A +__ __ __ __ __ __ __ __ __ __ __ __ __ __ __ __ ................ +__ __ __ __ __ __ __ __ __ __ __ __ __ __ __ __ ................ +__ __ __ __ __ __ __ __ __ __ __ __ __ __ __ __ ................ +__ __ __ __ __ __ __ __ __ __ __ __ __ __ __ __ ................ +0x1ef81d60000: add byte ptr [rax], al +0x1ef81d60002: add byte ptr [rax], al +0x1ef81d60004: add byte ptr [rax], al +0x1ef81d60006: add byte ptr [rax], al +0x1ef81d60008: add byte ptr [rax], al +0x1ef81d6000a: add byte ptr [rax], al +0x1ef81d6000c: add byte ptr [rax], al +0x1ef81d6000e: add byte ptr [rax], al +0x1ef81d60010: add byte ptr [rax], al +0x1ef81d60012: add byte ptr [rax], al +0x1ef81d60014: add byte ptr [rax], al +0x1ef81d60016: add byte ptr [rax], al +0x1ef81d60018: add byte ptr [rax], al +0x1ef81d6001a: add byte ptr [rax], al +0x1ef81d6001c: add byte ptr [rax], al +0x1ef81d6001e: add byte ptr [rax], al +0x1ef81d60020: add byte ptr [rax], al +0x1ef81d60022: add byte ptr [rax], al +0x1ef81d60024: add byte ptr [rax], al +0x1ef81d60026: add byte ptr [rax], al +0x1ef81d60028: add byte ptr [rax], al +0x1ef81d6002a: add byte ptr [rax], al +0x1ef81d6002c: add byte ptr [rax], al +0x1ef81d6002e: add byte ptr [rax], al +0x1ef81d60030: add byte ptr [rax], al +0x1ef81d60032: add byte ptr [rax], al +0x1ef81d60034: add byte ptr [rax], al +0x1ef81d60036: add byte ptr [rax], al +0x1ef81d60038: add byte ptr [rax], al +0x1ef81d6003a: add byte ptr [rax], al +0x1ef81d6003c: add byte ptr [rax], al +0x1ef81d6003e: add byte ptr [rax], al +2688 MsMpEng.exe 0x1ef82040000 0x1ef8214cfff VadS PAGE_EXECUTE_READWRITE 269 1 Disabled N/A +56 57 53 55 41 54 41 55 48 83 ec 28 48 8b e9 48 VWSUATAUH..(H..H +8d b1 88 38 00 00 ff e2 48 83 c4 28 41 5d 41 5c ...8....H..(A]A\ +5d 5b 5f 5e c3 00 00 00 00 00 00 00 00 00 00 00 ][_^............ +00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ +0x1ef82040000: push rsi +0x1ef82040001: push rdi +0x1ef82040002: push rbx +0x1ef82040003: push rbp +0x1ef82040004: push r12 +0x1ef82040006: push r13 +0x1ef82040008: sub rsp, 0x28 +0x1ef8204000c: mov rbp, rcx +0x1ef8204000f: lea rsi, [rcx + 0x3888] +0x1ef82040016: jmp rdx +0x1ef82040018: add rsp, 0x28 +0x1ef8204001c: pop r13 +0x1ef8204001e: pop r12 +0x1ef82040020: pop rbp +0x1ef82040021: pop rbx +0x1ef82040022: pop rdi +0x1ef82040023: pop rsi +0x1ef82040024: ret +0x1ef82040025: add byte ptr [rax], al +0x1ef82040027: add byte ptr [rax], al +0x1ef82040029: add byte ptr [rax], al +0x1ef8204002b: add byte ptr [rax], al +0x1ef8204002d: add byte ptr [rax], al +0x1ef8204002f: add byte ptr [rax], al +0x1ef82040031: add byte ptr [rax], al +0x1ef82040033: add byte ptr [rax], al +0x1ef82040035: add byte ptr [rax], al +0x1ef82040037: add byte ptr [rax], al +0x1ef82040039: add byte ptr [rax], al +0x1ef8204003b: add byte ptr [rax], al +0x1ef8204003d: add byte ptr [rax], al +2688 MsMpEng.exe 0x1ef84720000 0x1ef8482cfff VadS PAGE_EXECUTE_READWRITE 269 1 Disabled N/A +56 57 53 55 41 54 41 55 48 83 ec 28 48 8b e9 48 VWSUATAUH..(H..H +8d b1 88 38 00 00 ff e2 48 83 c4 28 41 5d 41 5c ...8....H..(A]A\ +5d 5b 5f 5e c3 00 00 00 00 00 00 00 00 00 00 00 ][_^............ +00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ +0x1ef84720000: push rsi +0x1ef84720001: push rdi +0x1ef84720002: push rbx +0x1ef84720003: push rbp +0x1ef84720004: push r12 +0x1ef84720006: push r13 +0x1ef84720008: sub rsp, 0x28 +0x1ef8472000c: mov rbp, rcx +0x1ef8472000f: lea rsi, [rcx + 0x3888] +0x1ef84720016: jmp rdx +0x1ef84720018: add rsp, 0x28 +0x1ef8472001c: pop r13 +0x1ef8472001e: pop r12 +0x1ef84720020: pop rbp +0x1ef84720021: pop rbx +0x1ef84720022: pop rdi +0x1ef84720023: pop rsi +0x1ef84720024: ret +0x1ef84720025: add byte ptr [rax], al +0x1ef84720027: add byte ptr [rax], al +0x1ef84720029: add byte ptr [rax], al +0x1ef8472002b: add byte ptr [rax], al +0x1ef8472002d: add byte ptr [rax], al +0x1ef8472002f: add byte ptr [rax], al +0x1ef84720031: add byte ptr [rax], al +0x1ef84720033: add byte ptr [rax], al +0x1ef84720035: add byte ptr [rax], al +0x1ef84720037: add byte ptr [rax], al +0x1ef84720039: add byte ptr [rax], al +0x1ef8472003b: add byte ptr [rax], al +0x1ef8472003d: add byte ptr [rax], al +2688 MsMpEng.exe 0x1ef8f040000 0x1ef8f14cfff VadS PAGE_EXECUTE_READWRITE 269 1 Disabled N/A +56 57 53 55 41 54 41 55 48 83 ec 28 48 8b e9 48 VWSUATAUH..(H..H +8d b1 88 38 00 00 ff e2 48 83 c4 28 41 5d 41 5c ...8....H..(A]A\ +5d 5b 5f 5e c3 00 00 00 00 00 00 00 00 00 00 00 ][_^............ +00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ +0x1ef8f040000: push rsi +0x1ef8f040001: push rdi +0x1ef8f040002: push rbx +0x1ef8f040003: push rbp +0x1ef8f040004: push r12 +0x1ef8f040006: push r13 +0x1ef8f040008: sub rsp, 0x28 +0x1ef8f04000c: mov rbp, rcx +0x1ef8f04000f: lea rsi, [rcx + 0x3888] +0x1ef8f040016: jmp rdx +0x1ef8f040018: add rsp, 0x28 +0x1ef8f04001c: pop r13 +0x1ef8f04001e: pop r12 +0x1ef8f040020: pop rbp +0x1ef8f040021: pop rbx +0x1ef8f040022: pop rdi +0x1ef8f040023: pop rsi +0x1ef8f040024: ret +0x1ef8f040025: add byte ptr [rax], al +0x1ef8f040027: add byte ptr [rax], al +0x1ef8f040029: add byte ptr [rax], al +0x1ef8f04002b: add byte ptr [rax], al +0x1ef8f04002d: add byte ptr [rax], al +0x1ef8f04002f: add byte ptr [rax], al +0x1ef8f040031: add byte ptr [rax], al +0x1ef8f040033: add byte ptr [rax], al +0x1ef8f040035: add byte ptr [rax], al +0x1ef8f040037: add byte ptr [rax], al +0x1ef8f040039: add byte ptr [rax], al +0x1ef8f04003b: add byte ptr [rax], al +0x1ef8f04003d: add byte ptr [rax], al +2688 MsMpEng.exe 0x1ef90ae0000 0x1ef90cdffff VadS PAGE_EXECUTE_READWRITE 512 1 Disabled N/A +20 00 00 00 e0 ff 1f 00 0c 00 00 00 01 00 07 00 ............... +00 42 00 30 00 70 00 60 00 50 00 c0 00 d0 00 00 .B.0.p.`.P...... +0c 00 4e 00 0c 00 01 05 48 8b 55 28 48 8b 8d c0 ..N.....H.U(H... +00 00 00 48 8d 54 0a 10 48 89 d7 b9 08 00 1a 00 ...H.T..H....... +0x1ef90ae0000: and byte ptr [rax], al +0x1ef90ae0002: add byte ptr [rax], al +0x1ef90ae0004: loopne 0x1ef90ae0005 +5368 SearchUI.exe 0x249e6a40000 0x249e6a5ffff VadS PAGE_EXECUTE_READWRITE 2 1 Disabled N/A +__ __ __ __ __ __ __ __ __ __ __ __ __ __ __ __ ................ +__ __ __ __ __ __ __ __ __ __ __ __ __ __ __ __ ................ +__ __ __ __ __ __ __ __ __ __ __ __ __ __ __ __ ................ +__ __ __ __ __ __ __ __ __ __ __ __ __ __ __ __ ................ +0x249e6a40000: add byte ptr [rax], al +0x249e6a40002: add byte ptr [rax], al +0x249e6a40004: add byte ptr [rax], al +0x249e6a40006: add byte ptr [rax], al +0x249e6a40008: add byte ptr [rax], al +0x249e6a4000a: add byte ptr [rax], al +0x249e6a4000c: add byte ptr [rax], al +0x249e6a4000e: add byte ptr [rax], al +0x249e6a40010: add byte ptr [rax], al +0x249e6a40012: add byte ptr [rax], al +0x249e6a40014: add byte ptr [rax], al +0x249e6a40016: add byte ptr [rax], al +0x249e6a40018: add byte ptr [rax], al +0x249e6a4001a: add byte ptr [rax], al +0x249e6a4001c: add byte ptr [rax], al +0x249e6a4001e: add byte ptr [rax], al +0x249e6a40020: add byte ptr [rax], al +0x249e6a40022: add byte ptr [rax], al +0x249e6a40024: add byte ptr [rax], al +0x249e6a40026: add byte ptr [rax], al +0x249e6a40028: add byte ptr [rax], al +0x249e6a4002a: add byte ptr [rax], al +0x249e6a4002c: add byte ptr [rax], al +0x249e6a4002e: add byte ptr [rax], al +0x249e6a40030: add byte ptr [rax], al +0x249e6a40032: add byte ptr [rax], al +0x249e6a40034: add byte ptr [rax], al +0x249e6a40036: add byte ptr [rax], al +0x249e6a40038: add byte ptr [rax], al +0x249e6a4003a: add byte ptr [rax], al +0x249e6a4003c: add byte ptr [rax], al +0x249e6a4003e: add byte ptr [rax], al +4444 MOM.exe 0x23ac6580000 0x23ac658ffff VadS PAGE_EXECUTE_READWRITE 4 1 Disabled N/A +00 00 00 00 00 00 00 00 66 5c 96 0b 19 ad 00 01 ........f\...... +ee ff ee ff 02 00 00 00 20 01 58 c6 3a 02 00 00 ........ .X.:... +20 01 58 c6 3a 02 00 00 00 00 58 c6 3a 02 00 00 .X.:.....X.:... +00 00 58 c6 3a 02 00 00 0f 00 00 00 00 00 00 00 ..X.:........... +0x23ac6580000: add byte ptr [rax], al +0x23ac6580002: add byte ptr [rax], al +0x23ac6580004: add byte ptr [rax], al +0x23ac6580006: add byte ptr [rax], al +0x23ac6580008: pop sp +0x23ac658000a: xchg esi, eax +0x23ac658000b: or ebx, dword ptr [rcx] +0x23ac658000d: lodsd eax, dword ptr [rsi] +0x23ac658000e: add byte ptr [rcx], al +0x23ac6580010: out dx, al +880 CCC.exe 0x2bb040f0000 0x2bb040fffff VadS PAGE_EXECUTE_READWRITE 15 1 Disabled N/A +00 00 00 00 00 00 00 00 31 21 f8 3f 73 8e 00 01 ........1!.?s... +ee ff ee ff 02 00 00 00 20 01 0f 04 bb 02 00 00 ........ ....... +20 01 0f 04 bb 02 00 00 00 00 0f 04 bb 02 00 00 ............... +00 00 0f 04 bb 02 00 00 0f 00 00 00 00 00 00 00 ................ +0x2bb040f0000: add byte ptr [rax], al +0x2bb040f0002: add byte ptr [rax], al +0x2bb040f0004: add byte ptr [rax], al +0x2bb040f0006: add byte ptr [rax], al +0x2bb040f0008: xor dword ptr [rcx], esp +0x2bb040f000a: clc +7252 taskhostw.exe 0x7ff66cd00000 0x7ff66cd9ffff VadS PAGE_EXECUTE_READWRITE 2 1 Disabled N/A +d8 ff ff ff ff ff ff ff 08 00 00 00 00 00 00 00 ................ +01 00 00 00 00 00 00 00 00 02 0e 03 38 00 00 00 ............8... +68 41 d4 07 0c 00 00 00 b0 70 bc 7d f9 7f 00 00 hA.......p.}.... +00 10 53 7d f9 7f 00 00 e8 29 5e 7d f9 7f 00 00 ..S}.....)^}.... +0x7ff66cd00000: fdivr st(7) +7252 taskhostw.exe 0x7ff66ccf0000 0x7ff66ccfffff VadS PAGE_EXECUTE_READWRITE 1 1 Disabled N/A +00 00 00 00 00 00 00 00 78 0d 00 00 00 00 00 00 ........x....... +0c 00 00 00 49 c7 c2 00 00 00 00 48 b8 20 49 48 ....I......H. IH +7f f9 7f 00 00 ff e0 49 c7 c2 01 00 00 00 48 b8 .......I......H. +20 49 48 7f f9 7f 00 00 ff e0 49 c7 c2 02 00 00 IH.......I..... +0x7ff66ccf0000: add byte ptr [rax], al +0x7ff66ccf0002: add byte ptr [rax], al +0x7ff66ccf0004: add byte ptr [rax], al +0x7ff66ccf0006: add byte ptr [rax], al +0x7ff66ccf0008: js 0x7ff66ccf0017 +0x7ff66ccf000a: add byte ptr [rax], al +0x7ff66ccf000c: add byte ptr [rax], al +0x7ff66ccf000e: add byte ptr [rax], al +0x7ff66ccf0010: or al, 0 +0x7ff66ccf0012: add byte ptr [rax], al +0x7ff66ccf0014: mov r10, 0 +0x7ff66ccf001b: movabs rax, 0x7ff97f484920 +0x7ff66ccf0025: jmp rax +0x7ff66ccf0027: mov r10, 1 +0x7ff66ccf002e: movabs rax, 0x7ff97f484920 +0x7ff66ccf0038: jmp rax +6492 ngentask.exe 0x19e0000 0x19effff VadS PAGE_EXECUTE_READWRITE 1 1 Disabled N/A +61 ed 38 c7 7f 57 00 01 ee ff ee ff 02 00 00 00 a.8..W.......... +a4 00 9e 01 a4 00 9e 01 00 00 9e 01 00 00 9e 01 ................ +0f 00 00 00 98 04 9e 01 00 f0 9e 01 0e 00 00 00 ................ +01 00 00 00 00 00 00 00 f0 0f 9e 01 f0 0f 9e 01 ................ +0x19e0000: popal +0x19e0001: in eax, dx +0x19e0002: cmp bh, al +0x19e0004: jg 0x19e005d +0x19e0006: add byte ptr [ecx], al +0x19e0008: out dx, al +1336 ngentask.exe 0x21149e50000 0x21149e5ffff VadS PAGE_EXECUTE_READWRITE 2 1 Disabled N/A +00 00 00 00 00 00 00 00 83 97 31 0b 9b d6 00 01 ..........1..... +ee ff ee ff 02 00 00 00 20 01 e5 49 11 02 00 00 ........ ..I.... +20 01 e5 49 11 02 00 00 00 00 e5 49 11 02 00 00 ..I.......I.... +00 00 e5 49 11 02 00 00 0f 00 00 00 00 00 00 00 ...I............ +0x21149e50000: add byte ptr [rax], al +0x21149e50002: add byte ptr [rax], al +0x21149e50004: add byte ptr [rax], al +0x21149e50006: add byte ptr [rax], al +0x21149e50008: adc dword ptr [rdi - 0x2964f4cf], 0 +0x21149e5000f: add esi, ebp +1336 ngentask.exe 0x7ff5ffc50000 0x7ff5ffc5ffff VadS PAGE_EXECUTE_READWRITE 1 1 Disabled N/A +00 00 00 00 00 00 00 00 78 0d 00 00 00 00 00 00 ........x....... +0c 00 00 00 49 c7 c2 00 00 00 00 48 b8 20 49 48 ....I......H. IH +7f f9 7f 00 00 ff e0 49 c7 c2 01 00 00 00 48 b8 .......I......H. +20 49 48 7f f9 7f 00 00 ff e0 49 c7 c2 02 00 00 IH.......I..... +0x7ff5ffc50000: add byte ptr [rax], al +0x7ff5ffc50002: add byte ptr [rax], al +0x7ff5ffc50004: add byte ptr [rax], al +0x7ff5ffc50006: add byte ptr [rax], al +0x7ff5ffc50008: js 0x7ff5ffc50017 +0x7ff5ffc5000a: add byte ptr [rax], al +0x7ff5ffc5000c: add byte ptr [rax], al +0x7ff5ffc5000e: add byte ptr [rax], al +0x7ff5ffc50010: or al, 0 +0x7ff5ffc50012: add byte ptr [rax], al +0x7ff5ffc50014: mov r10, 0 +0x7ff5ffc5001b: movabs rax, 0x7ff97f484920 +0x7ff5ffc50025: jmp rax +0x7ff5ffc50027: mov r10, 1 +0x7ff5ffc5002e: movabs rax, 0x7ff97f484920 +0x7ff5ffc50038: jmp rax +1336 ngentask.exe 0x7ff5ffc60000 0x7ff5ffcfffff VadS PAGE_EXECUTE_READWRITE 2 1 Disabled N/A +d8 ff ff ff ff ff ff ff 08 00 00 00 00 00 00 00 ................ +01 00 00 00 00 00 00 00 00 02 0e 03 38 00 00 00 ............8... +68 41 d4 07 0c 00 00 00 b0 70 bc 7d f9 7f 00 00 hA.......p.}.... +00 10 53 7d f9 7f 00 00 e8 29 5e 7d f9 7f 00 00 ..S}.....)^}.... +0x7ff5ffc60000: fdivr st(7) diff --git a/Semaine_12/Jour_05/volatility/data/results/WinDump.mem_windows.netscan.log b/Semaine_12/Jour_05/volatility/data/results/WinDump.mem_windows.netscan.log new file mode 100644 index 0000000..5fa5ea2 --- /dev/null +++ b/Semaine_12/Jour_05/volatility/data/results/WinDump.mem_windows.netscan.log @@ -0,0 +1,178 @@ + Progress: 0.00 Scanning FileLayer using PageMapScanner Progress: 15.11 Scanning FileLayer using PageMapScanner Progress: 64.75 Scanning FileLayer using PageMapScanner Progress: 100.00 Stacking attempts finished Progress: 0.00 Scanning layer_name using PdbSignatureScanner Progress: 0.00 Scanning layer_name using PdbSignatureScanner Progress: 34.47 Scanning layer_name using PdbSignatureScanner Progress: 34.57 Scanning layer_name using PdbSignatureScanner Progress: 34.67 Scanning layer_name using PdbSignatureScanner Progress: 34.77 Scanning layer_name using PdbSignatureScanner Progress: 34.86 Scanning layer_name using PdbSignatureScanner Progress: 34.96 Scanning layer_name using PdbSignatureScanner Progress: 35.06 Scanning layer_name using PdbSignatureScanner Progress: 0.00 Scanning layer_name using PdbSignatureScanner Progress: 0.00 Scanning layer_name using PdbSignatureScanner Progress: 100.00 PDB scanning finished Volatility 3 Framework 2.28.0 + +Offset Proto LocalAddr LocalPort ForeignAddr ForeignPort State PID Owner Created + +0xd98df30584d0 UDPv4 192.168.2.169 64751 * 0 3400 svchost.exe 2018-06-21 06:00:33.000000 UTC +0xd98df30b21e0 UDPv6 fe80::9823:8c9:75b7:473b 64749 * 0 3400 svchost.exe 2018-06-21 06:00:33.000000 UTC +0xd98df33898e0 TCPv4 192.168.2.169 50803 198.142.175.46 80 CLOSED 5764 svchost.exe N/A +0xd98df33c2cc0 TCPv4 192.168.2.169 50781 198.142.175.14 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df3892950 UDPv4 0.0.0.0 0 * 0 880 CCC.exe 2018-06-21 06:38:50.000000 UTC +0xd98df3892950 UDPv6 :: 0 * 0 880 CCC.exe 2018-06-21 06:38:50.000000 UTC +0xd98df397d0a0 UDPv4 0.0.0.0 5353 * 0 1940 svchost.exe 2018-06-21 06:00:36.000000 UTC +0xd98df397d0a0 UDPv6 :: 5353 * 0 1940 svchost.exe 2018-06-21 06:00:36.000000 UTC +0xd98df3982840 TCPv4 192.168.2.169 50800 198.142.175.14 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df3b324d0 TCPv4 192.168.2.169 50780 198.142.175.46 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df3b3d5e0 TCPv4 192.168.2.169 50873 104.95.127.140 443 ESTABLISHED 5764 svchost.exe N/A +0xd98df3b8bcc0 TCPv4 192.168.2.169 50865 198.142.175.30 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df3c542d0 UDPv4 0.0.0.0 55125 * 0 2980 dasHost.exe 2018-06-21 06:00:31.000000 UTC +0xd98df3cbaab0 TCPv4 192.168.2.169 50820 67.27.57.254 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df3cf8010 TCPv4 192.168.2.169 50429 67.27.63.254 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df3d28d30 UDPv4 0.0.0.0 3702 * 0 3972 svchost.exe 2018-06-21 06:00:38.000000 UTC +0xd98df3d28d30 UDPv6 :: 3702 * 0 3972 svchost.exe 2018-06-21 06:00:38.000000 UTC +0xd98df3d3d010 UDPv4 0.0.0.0 3702 * 0 2980 dasHost.exe 2018-06-21 06:00:38.000000 UTC +0xd98df3d3d010 UDPv6 :: 3702 * 0 2980 dasHost.exe 2018-06-21 06:00:38.000000 UTC +0xd98df3d572c0 UDPv4 0.0.0.0 3702 * 0 3888 svchost.exe 2018-06-21 06:00:38.000000 UTC +0xd98df3d572c0 UDPv6 :: 3702 * 0 3888 svchost.exe 2018-06-21 06:00:38.000000 UTC +0xd98df3d8acc0 TCPv4 192.168.2.169 50815 67.27.59.254 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df3de7cc0 TCPv4 192.168.2.169 50812 198.142.175.14 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df3efb640 TCPv4 192.168.2.169 50777 198.142.175.14 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df40bd910 UDPv4 0.0.0.0 5355 * 0 1940 svchost.exe 2018-06-21 06:19:55.000000 UTC +0xd98df4187cc0 TCPv4 192.168.2.169 50792 198.142.175.14 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df42bd180 TCPv4 192.168.2.169 50867 198.142.175.30 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df42d8660 TCPv4 192.168.2.169 50793 198.142.175.46 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df43e2010 TCPv4 192.168.2.169 50689 198.142.175.14 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df46472e0 TCPv4 192.168.2.169 50779 198.142.175.14 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df46ccb50 TCPv4 192.168.2.169 50802 67.27.59.254 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df4831d90 UDPv4 127.0.0.1 64752 * 0 3400 svchost.exe 2018-06-21 06:00:33.000000 UTC +0xd98df4890400 TCPv4 192.168.2.169 50826 67.27.57.254 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df48f6820 TCPv4 192.168.2.169 50810 198.142.175.46 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df4b3ec40 UDPv4 0.0.0.0 3702 * 0 2980 dasHost.exe 2018-06-21 06:00:38.000000 UTC +0xd98df4b3ec40 UDPv6 :: 3702 * 0 2980 dasHost.exe 2018-06-21 06:00:38.000000 UTC +0xd98df4b8fcc0 TCPv4 192.168.2.169 50864 13.107.4.50 80 CLOSED 5764 svchost.exe N/A +0xd98df4c51ec0 TCPv4 0.0.0.0 135 0.0.0.0 0 LISTENING 920 svchost.exe 2018-06-08 00:12:25.000000 UTC +0xd98df4ecc410 TCPv4 0.0.0.0 49665 0.0.0.0 0 LISTENING 1260 svchost.exe 2018-06-08 00:12:27.000000 UTC +0xd98df4ff4750 TCPv4 192.168.2.169 50684 198.142.175.14 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df5034b90 TCPv4 192.168.2.169 139 0.0.0.0 0 LISTENING 4 System 2018-06-21 06:00:33.000000 UTC +0xd98df503c290 TCPv4 192.168.2.169 50860 111.221.29.254 443 CLOSED 2736 svchost.exe N/A +0xd98df507e450 UDPv4 0.0.0.0 3702 * 0 3972 svchost.exe 2018-06-21 06:00:38.000000 UTC +0xd98df5127a70 TCPv4 192.168.2.169 50654 67.27.59.254 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df5156010 UDPv4 0.0.0.0 56795 * 0 3888 svchost.exe 2018-06-08 00:12:44.000000 UTC +0xd98df5156010 UDPv6 :: 56795 * 0 3888 svchost.exe 2018-06-08 00:12:44.000000 UTC +0xd98df515b350 UDPv4 0.0.0.0 3702 * 0 3972 svchost.exe 2018-06-21 06:00:38.000000 UTC +0xd98df515b350 UDPv6 :: 3702 * 0 3972 svchost.exe 2018-06-21 06:00:38.000000 UTC +0xd98df5333260 UDPv4 192.168.2.169 1900 * 0 3400 svchost.exe 2018-06-21 06:00:33.000000 UTC +0xd98df53c4660 TCPv4 0.0.0.0 49667 0.0.0.0 0 LISTENING 2364 spoolsv.exe 2018-06-08 00:12:33.000000 UTC +0xd98df53c4660 TCPv6 :: 49667 :: 0 LISTENING 2364 spoolsv.exe 2018-06-08 00:12:33.000000 UTC +0xd98df5405cc0 TCPv4 192.168.2.169 50799 198.142.175.46 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df541dca0 UDPv6 ::1 64750 * 0 3400 svchost.exe 2018-06-21 06:00:33.000000 UTC +0xd98df5572610 UDPv4 0.0.0.0 5355 * 0 1940 svchost.exe 2018-06-21 06:19:55.000000 UTC +0xd98df5572610 UDPv6 :: 5355 * 0 1940 svchost.exe 2018-06-21 06:19:55.000000 UTC +0xd98df5588100 TCPv4 192.168.2.169 50817 198.142.175.46 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df55b2cc0 TCPv4 192.168.2.169 50804 198.142.175.46 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df5851ba0 UDPv4 0.0.0.0 0 * 0 1940 svchost.exe 2018-06-21 06:00:36.000000 UTC +0xd98df5851ba0 UDPv6 :: 0 * 0 1940 svchost.exe 2018-06-21 06:00:36.000000 UTC +0xd98df5856560 TCPv4 192.168.2.169 50675 8.253.176.103 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df59ae970 TCPv4 0.0.0.0 49665 0.0.0.0 0 LISTENING 1260 svchost.exe 2018-06-08 00:12:27.000000 UTC +0xd98df59ae970 TCPv6 :: 49665 :: 0 LISTENING 1260 svchost.exe 2018-06-08 00:12:27.000000 UTC +0xd98df59f9350 TCPv4 0.0.0.0 135 0.0.0.0 0 LISTENING 920 svchost.exe 2018-06-08 00:12:25.000000 UTC +0xd98df59f9350 TCPv6 :: 135 :: 0 LISTENING 920 svchost.exe 2018-06-08 00:12:25.000000 UTC +0xd98df5c07ce0 UDPv4 127.0.0.1 1900 * 0 3400 svchost.exe 2018-06-21 06:00:33.000000 UTC +0xd98df5d4a500 TCPv4 192.168.2.169 49923 52.230.7.59 443 ESTABLISHED 2720 svchost.exe N/A +0xd98df5d8a5b0 UDPv4 0.0.0.0 0 * 0 880 CCC.exe 2018-06-21 06:38:50.000000 UTC +0xd98df5da19d0 TCPv4 192.168.2.169 50783 198.142.175.14 80 CLOSED 5764 svchost.exe N/A +0xd98df5eb8830 TCPv4 192.168.2.169 50872 40.69.218.62 443 ESTABLISHED 5764 svchost.exe N/A +0xd98df5eecd30 UDPv4 0.0.0.0 54391 * 0 3972 svchost.exe 2018-06-21 06:00:38.000000 UTC +0xd98df6274400 UDPv4 0.0.0.0 0 * 0 880 CCC.exe 2018-06-21 06:38:49.000000 UTC +0xd98df6274400 UDPv6 :: 0 * 0 880 CCC.exe 2018-06-21 06:38:49.000000 UTC +0xd98df63a64f0 TCPv4 192.168.2.169 50796 198.142.175.14 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df63ab010 UDPv4 0.0.0.0 3702 * 0 3972 svchost.exe 2018-06-21 06:00:38.000000 UTC +0xd98df64134c0 TCPv4 192.168.2.169 50805 198.142.175.46 80 CLOSED 5764 svchost.exe N/A +0xd98df6447730 UDPv4 0.0.0.0 3702 * 0 3888 svchost.exe 2018-06-21 06:00:38.000000 UTC +0xd98df658eec0 TCPv4 0.0.0.0 49664 0.0.0.0 0 LISTENING 568 wininit.exe 2018-06-08 00:12:26.000000 UTC +0xd98df658eec0 TCPv6 :: 49664 :: 0 LISTENING 568 wininit.exe 2018-06-08 00:12:26.000000 UTC +0xd98df65ebd50 TCPv4 0.0.0.0 49664 0.0.0.0 0 LISTENING 568 wininit.exe 2018-06-08 00:12:26.000000 UTC +0xd98df65ff8b0 TCPv4 192.168.2.169 50339 67.27.59.254 80 CLOSED 5764 svchost.exe N/A +0xd98df67269d0 TCPv4 192.168.2.169 50798 67.27.59.254 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df68f5cb0 TCPv4 0.0.0.0 49666 0.0.0.0 0 LISTENING 1568 svchost.exe 2018-06-08 00:12:28.000000 UTC +0xd98df695aec0 TCPv4 0.0.0.0 49666 0.0.0.0 0 LISTENING 1568 svchost.exe 2018-06-08 00:12:28.000000 UTC +0xd98df695aec0 TCPv6 :: 49666 :: 0 LISTENING 1568 svchost.exe 2018-06-08 00:12:28.000000 UTC +0xd98df6a19cb0 UDPv4 0.0.0.0 3702 * 0 3888 svchost.exe 2018-06-21 06:00:38.000000 UTC +0xd98df6a19cb0 UDPv6 :: 3702 * 0 3888 svchost.exe 2018-06-21 06:00:38.000000 UTC +0xd98df6a29c70 TCPv4 0.0.0.0 49667 0.0.0.0 0 LISTENING 2364 spoolsv.exe 2018-06-08 00:12:33.000000 UTC +0xd98df6b1c500 TCPv4 192.168.2.169 50660 67.27.59.254 80 CLOSED 5764 svchost.exe N/A +0xd98df6b687a0 TCPv4 0.0.0.0 49669 0.0.0.0 0 LISTENING 716 services.exe 2018-06-08 00:12:37.000000 UTC +0xd98df6b687a0 TCPv6 :: 49669 :: 0 LISTENING 716 services.exe 2018-06-08 00:12:37.000000 UTC +0xd98df6bcf5b0 UDPv4 0.0.0.0 0 * 0 880 CCC.exe 2018-06-21 06:36:48.000000 UTC +0xd98df6cfa920 TCPv4 0.0.0.0 49668 0.0.0.0 0 LISTENING 744 lsass.exe 2018-06-08 00:12:35.000000 UTC +0xd98df6d98880 TCPv4 0.0.0.0 49668 0.0.0.0 0 LISTENING 744 lsass.exe 2018-06-08 00:12:35.000000 UTC +0xd98df6d98880 TCPv6 :: 49668 :: 0 LISTENING 744 lsass.exe 2018-06-08 00:12:35.000000 UTC +0xd98df6fba010 TCPv4 0.0.0.0 49669 0.0.0.0 0 LISTENING 716 services.exe 2018-06-08 00:12:37.000000 UTC +0xd98df6fdb2a0 UDPv4 127.0.0.1 49664 * 0 3288 svchost.exe 2018-06-08 00:12:37.000000 UTC +0xd98df7048570 TCPv4 0.0.0.0 445 0.0.0.0 0 LISTENING 4 System 2018-06-08 00:12:38.000000 UTC +0xd98df7048570 TCPv6 :: 445 :: 0 LISTENING 4 System 2018-06-08 00:12:38.000000 UTC +0xd98df70f2cc0 TCPv4 192.168.2.169 50698 8.247.57.254 80 CLOSED 5764 svchost.exe N/A +0xd98df7145a10 UDPv4 0.0.0.0 3702 * 0 2980 dasHost.exe 2018-06-21 06:00:38.000000 UTC +0xd98df71e37f0 TCPv4 192.168.2.169 50806 198.142.175.46 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df71e5a80 UDPv4 0.0.0.0 5050 * 0 4504 svchost.exe 2018-06-08 00:13:04.000000 UTC +0xd98df72a6230 UDPv4 0.0.0.0 0 * 0 880 CCC.exe 2018-06-21 06:36:48.000000 UTC +0xd98df72a6230 UDPv6 :: 0 * 0 880 CCC.exe 2018-06-21 06:36:48.000000 UTC +0xd98df72ae8b0 UDPv6 fe80::9823:8c9:75b7:473b 1900 * 0 3400 svchost.exe 2018-06-21 06:00:33.000000 UTC +0xd98df7316a40 TCPv4 0.0.0.0 5357 0.0.0.0 0 LISTENING 4 System 2018-06-08 00:12:44.000000 UTC +0xd98df7316a40 TCPv6 :: 5357 :: 0 LISTENING 4 System 2018-06-08 00:12:44.000000 UTC +0xd98df731ac70 UDPv4 0.0.0.0 3702 * 0 2980 dasHost.exe 2018-06-21 06:00:38.000000 UTC +0xd98df73220e0 UDPv4 0.0.0.0 5353 * 0 1940 svchost.exe 2018-06-21 06:00:36.000000 UTC +0xd98df7323ba0 UDPv4 0.0.0.0 56794 * 0 3888 svchost.exe 2018-06-08 00:12:44.000000 UTC +0xd98df738a480 UDPv4 0.0.0.0 0 * 0 4108 svchost.exe 2018-06-08 00:12:45.000000 UTC +0xd98df73bdd60 UDPv4 0.0.0.0 55126 * 0 2980 dasHost.exe 2018-06-21 06:00:31.000000 UTC +0xd98df73bdd60 UDPv6 :: 55126 * 0 2980 dasHost.exe 2018-06-21 06:00:31.000000 UTC +0xd98df73f2180 UDPv4 0.0.0.0 54392 * 0 3972 svchost.exe 2018-06-21 06:00:38.000000 UTC +0xd98df73f2180 UDPv6 :: 54392 * 0 3972 svchost.exe 2018-06-21 06:00:38.000000 UTC +0xd98df7406460 UDPv4 0.0.0.0 0 * 0 4108 svchost.exe 2018-06-08 00:12:45.000000 UTC +0xd98df7406460 UDPv6 :: 0 * 0 4108 svchost.exe 2018-06-08 00:12:45.000000 UTC +0xd98df7431cc0 TCPv4 192.168.2.169 50827 67.27.59.254 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df7442ad0 UDPv4 192.168.2.169 137 * 0 4 System 2018-06-21 06:00:33.000000 UTC +0xd98df74a4430 UDPv4 192.168.2.169 138 * 0 4 System 2018-06-21 06:00:33.000000 UTC +0xd98df74d41a0 TCPv4 192.168.2.169 50778 198.142.175.46 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df7506790 UDPv6 ::1 1900 * 0 3400 svchost.exe 2018-06-21 06:00:33.000000 UTC +0xd98df7579900 TCPv4 192.168.2.169 50824 198.142.175.14 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df75e7350 TCPv4 192.168.2.169 50795 198.142.175.46 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df790b870 TCPv4 192.168.2.169 50811 198.142.175.46 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df7918660 TCPv4 192.168.2.169 50797 198.142.175.46 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df793d450 UDPv4 0.0.0.0 3702 * 0 3888 svchost.exe 2018-06-21 06:00:38.000000 UTC +0xd98df7b35740 TCPv4 192.168.2.169 50816 198.142.175.46 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df7bfe0d0 TCPv4 192.168.2.169 50286 198.142.175.46 80 CLOSED 5764 svchost.exe N/A +0xd98df7c36460 TCPv4 192.168.2.169 50822 198.142.175.46 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df7d38640 TCPv4 192.168.2.169 50825 67.27.59.254 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df7edba20 TCPv4 192.168.2.169 50685 198.142.175.14 80 CLOSED 5764 svchost.exe N/A +0xd98df7fc0010 TCPv4 192.168.2.169 50427 67.27.63.254 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df81574a0 TCPv4 192.168.2.169 50789 198.142.175.46 80 CLOSED 5764 svchost.exe N/A +0xd98df818c260 TCPv4 192.168.2.169 50801 198.142.175.46 80 CLOSED 5764 svchost.exe N/A +0xd98df81ac4c0 TCPv4 192.168.2.169 50709 198.142.175.46 80 CLOSED 5764 svchost.exe N/A +0xd98df8260820 TCPv4 192.168.2.169 50310 13.107.21.200 443 CLOSED 5368 SearchUI.exe N/A +0xd98df8294b30 TCPv4 192.168.2.169 50776 198.142.175.46 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df834d010 TCPv4 192.168.2.169 50819 67.27.59.254 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df84fbaf0 TCPv4 192.168.2.169 50774 198.142.175.46 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df87841d0 UDPv4 0.0.0.0 56112 * 0 1940 svchost.exe 2018-06-21 06:47:03.000000 UTC +0xd98df87841d0 UDPv6 :: 56112 * 0 1940 svchost.exe 2018-06-21 06:47:03.000000 UTC +0xd98df8a54460 TCPv4 192.168.2.169 50687 198.142.175.14 80 CLOSED 5764 svchost.exe N/A +0xd98df8b07010 TCPv4 192.168.2.169 50309 13.107.21.200 443 CLOSED 5368 SearchUI.exe N/A +0xd98df8c21cc0 TCPv4 192.168.2.169 50447 8.253.176.103 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df8ed6cc0 TCPv4 192.168.2.169 50823 198.142.175.46 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df8f278f0 TCPv4 192.168.2.169 50662 67.27.59.254 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df9063630 TCPv4 192.168.2.169 50809 67.27.59.254 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df9091cc0 TCPv4 192.168.2.169 50821 67.27.59.254 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df90bdba0 UDPv4 0.0.0.0 0 * 0 4444 MOM.exe 2018-06-21 06:36:40.000000 UTC +0xd98df911f540 UDPv4 0.0.0.0 0 * 0 880 CCC.exe 2018-06-21 06:38:49.000000 UTC +0xd98df91a9b30 TCPv4 192.168.2.169 50259 13.107.4.50 80 CLOSED 5764 svchost.exe N/A +0xd98df933bcc0 TCPv4 192.168.2.169 50808 67.27.57.254 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df93ac010 TCPv4 192.168.2.169 50834 192.168.2.2 445 ESTABLISHED 4 System N/A +0xd98df951b160 TCPv4 192.168.2.169 50790 67.27.59.254 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df9579cc0 TCPv4 192.168.2.169 2869 192.168.2.1 40310 CLOSED 4 System N/A +0xd98df95e3cc0 TCPv4 192.168.2.169 50794 67.27.59.254 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df99a5350 TCPv4 192.168.2.169 50791 198.142.175.46 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df99f12b0 TCPv4 192.168.2.169 50818 198.142.175.14 80 ESTABLISHED 5764 svchost.exe N/A +0xd98df9cb1cc0 TCPv4 192.168.2.169 50836 104.74.31.166 443 CLOSED 5764 svchost.exe N/A +0xd98df9d32600 TCPv4 192.168.2.169 2869 192.168.2.1 43784 CLOSED 4 System N/A +0xd98dfa392350 TCPv4 192.168.2.169 50787 8.247.56.254 80 CLOSED 5764 svchost.exe N/A +0xd98dfa54b010 TCPv4 0.0.0.0 2869 0.0.0.0 0 LISTENING 4 System 2018-06-21 06:50:04.000000 UTC +0xd98dfa54b010 TCPv6 :: 2869 :: 0 LISTENING 4 System 2018-06-21 06:50:04.000000 UTC +0xd98dfa56b010 TCPv4 192.168.2.169 50814 67.27.57.254 80 ESTABLISHED 5764 svchost.exe N/A +0xd98dfa71acc0 TCPv4 192.168.2.169 50775 198.142.175.14 80 ESTABLISHED 5764 svchost.exe N/A +0xd98dfa7231a0 TCPv4 192.168.2.169 50782 198.142.175.46 80 ESTABLISHED 5764 svchost.exe N/A +0xd98dfa7de010 TCPv4 192.168.2.169 50813 67.27.59.254 80 ESTABLISHED 5764 svchost.exe N/A +0xd98dfae312e0 TCPv4 192.168.2.169 50691 8.247.57.254 80 ESTABLISHED 5764 svchost.exe N/A +0xd98dfaf59cc0 UDPv4 0.0.0.0 0 * 0 4444 MOM.exe 2018-06-21 06:36:40.000000 UTC +0xd98dfaf59cc0 UDPv6 :: 0 * 0 4444 MOM.exe 2018-06-21 06:36:40.000000 UTC +0xef80000584d0 UDPv4 192.168.2.169 64751 * 0 3400 svchost.exe 2018-06-21 06:00:33.000000 UTC +0xef80000b21e0 UDPv6 fe80::9823:8c9:75b7:473b 64749 * 0 3400 svchost.exe 2018-06-21 06:00:33.000000 UTC +0xf8021f484290 TCPv4 192.168.2.169 50860 111.221.29.254 443 CLOSED 2736 svchost.exe N/A diff --git a/Semaine_12/Jour_05/volatility/data/results/WinDump.mem_windows.pslist.log b/Semaine_12/Jour_05/volatility/data/results/WinDump.mem_windows.pslist.log new file mode 100644 index 0000000..fdbae43 --- /dev/null +++ b/Semaine_12/Jour_05/volatility/data/results/WinDump.mem_windows.pslist.log @@ -0,0 +1,143 @@ + Progress: 0.00 Scanning FileLayer using PageMapScanner Progress: 15.11 Scanning FileLayer using PageMapScanner Progress: 64.75 Scanning FileLayer using PageMapScanner Progress: 100.00 Stacking attempts finished Progress: 0.00 Scanning layer_name using PdbSignatureScanner Progress: 0.00 Scanning layer_name using PdbSignatureScanner Progress: 34.47 Scanning layer_name using PdbSignatureScanner Progress: 34.57 Scanning layer_name using PdbSignatureScanner Progress: 34.67 Scanning layer_name using PdbSignatureScanner Progress: 34.77 Scanning layer_name using PdbSignatureScanner Progress: 34.86 Scanning layer_name using PdbSignatureScanner Progress: 34.96 Scanning layer_name using PdbSignatureScanner Progress: 35.06 Scanning layer_name using PdbSignatureScanner Progress: 0.00 Scanning layer_name using PdbSignatureScanner Progress: 0.00 Scanning layer_name using PdbSignatureScanner Progress: 100.00 PDB scanning finished Volatility 3 Framework 2.28.0 + +PID PPID ImageFileName Offset(V) Threads Handles SessionId Wow64 CreateTime ExitTime File output + +4 0 System 0xd98df30c24c0 178 - N/A False 2018-06-08 00:11:39.000000 UTC N/A Disabled +356 4 smss.exe 0xd98df4e56600 3 - N/A False 2018-06-08 00:11:40.000000 UTC N/A Disabled +468 460 csrss.exe 0xd98df60ef080 12 - 0 False 2018-06-08 00:12:23.000000 UTC N/A Disabled +568 460 wininit.exe 0xd98df657c080 2 - 0 False 2018-06-08 00:12:24.000000 UTC N/A Disabled +716 568 services.exe 0xd98df65e0080 9 - 0 False 2018-06-08 00:12:24.000000 UTC N/A Disabled +744 568 lsass.exe 0xd98df65d7080 8 - 0 False 2018-06-08 00:12:25.000000 UTC N/A Disabled +844 716 svchost.exe 0xd98df665a600 2 - 0 False 2018-06-08 00:12:25.000000 UTC N/A Disabled +868 716 svchost.exe 0xd98df666c480 26 - 0 False 2018-06-08 00:12:25.000000 UTC N/A Disabled +920 716 svchost.exe 0xd98df6594600 12 - 0 False 2018-06-08 00:12:25.000000 UTC N/A Disabled +944 568 fontdrvhost.ex 0xd98df6590600 6 - 0 False 2018-06-08 00:12:25.000000 UTC N/A Disabled +72 716 svchost.exe 0xd98df658c600 6 - 0 False 2018-06-08 00:12:26.000000 UTC N/A Disabled +804 716 svchost.exe 0xd98df6729600 3 - 0 False 2018-06-08 00:12:26.000000 UTC N/A Disabled +1056 716 svchost.exe 0xd98df674c600 4 - 0 False 2018-06-08 00:12:26.000000 UTC N/A Disabled +1140 716 svchost.exe 0xd98df6774600 6 - 0 False 2018-06-08 00:12:26.000000 UTC N/A Disabled +1260 716 svchost.exe 0xd98df6781600 8 - 0 False 2018-06-08 00:12:26.000000 UTC N/A Disabled +1288 716 atiesrxx.exe 0xd98df67d5080 6 - 0 False 2018-06-08 00:12:27.000000 UTC N/A Disabled +1316 716 svchost.exe 0xd98df67cc600 5 - 0 False 2018-06-08 00:12:27.000000 UTC N/A Disabled +1368 716 svchost.exe 0xd98df67e0600 10 - 0 False 2018-06-08 00:12:27.000000 UTC N/A Disabled +1412 716 svchost.exe 0xd98df682f600 4 - 0 False 2018-06-08 00:12:27.000000 UTC N/A Disabled +1420 716 svchost.exe 0xd98df681b600 6 - 0 False 2018-06-08 00:12:27.000000 UTC N/A Disabled +1436 716 svchost.exe 0xd98df6838600 7 - 0 False 2018-06-08 00:12:27.000000 UTC N/A Disabled +1532 716 svchost.exe 0xd98df6867600 12 - 0 False 2018-06-08 00:12:27.000000 UTC N/A Disabled +1548 716 svchost.exe 0xd98df6887600 4 - 0 False 2018-06-08 00:12:27.000000 UTC N/A Disabled +1568 716 svchost.exe 0xd98df6894600 24 - 0 False 2018-06-08 00:12:27.000000 UTC N/A Disabled +1644 716 svchost.exe 0xd98df68bb600 5 - 0 False 2018-06-08 00:12:27.000000 UTC N/A Disabled +1652 716 svchost.exe 0xd98df68c9600 6 - 0 False 2018-06-08 00:12:27.000000 UTC N/A Disabled +1724 716 svchost.exe 0xd98df686a600 14 - 0 False 2018-06-08 00:12:27.000000 UTC N/A Disabled +1824 716 svchost.exe 0xd98df691a600 8 - 0 False 2018-06-08 00:12:28.000000 UTC N/A Disabled +1872 716 svchost.exe 0xd98df6949600 6 - 0 False 2018-06-08 00:12:28.000000 UTC N/A Disabled +1940 716 svchost.exe 0xd98df696a600 11 - 0 False 2018-06-08 00:12:29.000000 UTC N/A Disabled +1948 716 svchost.exe 0xd98df698e600 6 - 0 False 2018-06-08 00:12:29.000000 UTC N/A Disabled +2036 716 svchost.exe 0xd98df69b2600 5 - 0 False 2018-06-08 00:12:29.000000 UTC N/A Disabled +2068 716 svchost.exe 0xd98df6a2c380 15 - 0 False 2018-06-08 00:12:29.000000 UTC N/A Disabled +2260 716 svchost.exe 0xd98df6a94600 11 - 0 False 2018-06-08 00:12:31.000000 UTC N/A Disabled +2304 716 svchost.exe 0xd98df6aa1600 7 - 0 False 2018-06-08 00:12:32.000000 UTC N/A Disabled +2364 716 spoolsv.exe 0xd98df6abe600 14 - 0 False 2018-06-08 00:12:32.000000 UTC N/A Disabled +2424 716 svchost.exe 0xd98df6b08600 14 - 0 False 2018-06-08 00:12:33.000000 UTC N/A Disabled +2504 716 svchost.exe 0xd98df6b53600 6 - 0 False 2018-06-08 00:12:33.000000 UTC N/A Disabled +2656 716 svchost.exe 0xd98df6b61600 5 - 0 False 2018-06-08 00:12:34.000000 UTC N/A Disabled +2664 716 svchost.exe 0xd98df6b78600 11 - 0 False 2018-06-08 00:12:34.000000 UTC N/A Disabled +2672 716 SynTPEnhServic 0xd98df6bc7600 5 - 0 False 2018-06-08 00:12:34.000000 UTC N/A Disabled +2688 716 MsMpEng.exe 0xd98df6bd9600 34 - 0 False 2018-06-08 00:12:35.000000 UTC N/A Disabled +2696 716 svchost.exe 0xd98df6bdb600 3 - 0 False 2018-06-08 00:12:35.000000 UTC N/A Disabled +2704 716 svchost.exe 0xd98df6bed600 9 - 0 False 2018-06-08 00:12:35.000000 UTC N/A Disabled +2712 716 svchost.exe 0xd98df6bef600 6 - 0 False 2018-06-08 00:12:35.000000 UTC N/A Disabled +2720 716 svchost.exe 0xd98df6bf1600 8 - 0 False 2018-06-08 00:12:35.000000 UTC N/A Disabled +2736 716 svchost.exe 0xd98df6bf7600 14 - 0 False 2018-06-08 00:12:35.000000 UTC N/A Disabled +2748 716 svchost.exe 0xd98df6bfc600 15 - 0 False 2018-06-08 00:12:35.000000 UTC N/A Disabled +2756 716 svchost.exe 0xd98df6c01600 8 - 0 False 2018-06-08 00:12:35.000000 UTC N/A Disabled +2764 716 svchost.exe 0xd98df6c0a600 4 - 0 False 2018-06-08 00:12:35.000000 UTC N/A Disabled +2772 716 svchost.exe 0xd98df6c0c600 14 - 0 False 2018-06-08 00:12:35.000000 UTC N/A Disabled +2780 716 svchost.exe 0xd98df6c10600 9 - 0 False 2018-06-08 00:12:35.000000 UTC N/A Disabled +2792 716 svchost.exe 0xd98df6c12600 7 - 0 False 2018-06-08 00:12:35.000000 UTC N/A Disabled +2800 716 SecurityHealth 0xd98df6c114c0 6 - 0 False 2018-06-08 00:12:35.000000 UTC N/A Disabled +3052 4 MemCompression 0xd98df6d1e040 22 - N/A False 2018-06-08 00:12:35.000000 UTC N/A Disabled +2464 716 svchost.exe 0xd98df6d1d600 3 - 0 False 2018-06-08 00:12:35.000000 UTC N/A Disabled +2980 2656 dasHost.exe 0xd98df6d92600 7 - 0 False 2018-06-08 00:12:35.000000 UTC N/A Disabled +3188 716 svchost.exe 0xd98df6df8600 6 - 0 False 2018-06-08 00:12:35.000000 UTC N/A Disabled +3288 716 svchost.exe 0xd98df6dff600 9 - 0 False 2018-06-08 00:12:36.000000 UTC N/A Disabled +3400 716 svchost.exe 0xd98df6f24600 15 - 0 False 2018-06-08 00:12:36.000000 UTC N/A Disabled +3880 716 svchost.exe 0xd98df713d600 3 - 0 False 2018-06-08 00:12:39.000000 UTC N/A Disabled +3888 716 svchost.exe 0xd98df70de600 13 - 0 False 2018-06-08 00:12:39.000000 UTC N/A Disabled +3972 716 svchost.exe 0xd98df719b4c0 24 - 0 False 2018-06-08 00:12:40.000000 UTC N/A Disabled +2828 716 svchost.exe 0xd98df59cb600 5 - 0 False 2018-06-08 00:12:43.000000 UTC N/A Disabled +4108 716 svchost.exe 0xd98df73ac080 4 - 0 False 2018-06-08 00:12:43.000000 UTC N/A Disabled +4264 716 svchost.exe 0xd98df7406600 5 - 0 False 2018-06-08 00:12:45.000000 UTC N/A Disabled +4504 716 svchost.exe 0xd98df74fc080 22 - 0 False 2018-06-08 00:12:48.000000 UTC N/A Disabled +5020 716 NisSrv.exe 0xd98df337d600 7 - 0 False 2018-06-08 00:13:09.000000 UTC N/A Disabled +3448 716 svchost.exe 0xd98df5cf5600 8 - 0 False 2018-06-08 00:13:27.000000 UTC N/A Disabled +2988 716 svchost.exe 0xd98df5ce9600 41 - 0 False 2018-06-08 00:13:27.000000 UTC N/A Disabled +4660 716 svchost.exe 0xd98df3e5b600 8 - 0 False 2018-06-08 00:14:28.000000 UTC N/A Disabled +5648 716 svchost.exe 0xd98df5244600 3 - 0 False 2018-06-08 00:14:30.000000 UTC N/A Disabled +5932 5480 GoogleCrashHan 0xd98df53cd600 5 - 0 True 2018-06-08 00:14:30.000000 UTC N/A Disabled +5764 716 svchost.exe 0xd98df5caa080 19 - 0 False 2018-06-08 00:14:37.000000 UTC N/A Disabled +5940 5480 GoogleCrashHan 0xd98df5242600 4 - 0 False 2018-06-08 00:14:37.000000 UTC N/A Disabled +2872 716 svchost.exe 0xd98df5227600 6 - 0 False 2018-06-08 00:14:43.000000 UTC N/A Disabled +5380 716 SearchIndexer. 0xd98df5ca4600 36 - 0 False 2018-06-08 00:14:44.000000 UTC N/A Disabled +7324 716 svchost.exe 0xd98df759c600 3 - 0 False 2018-06-08 00:17:13.000000 UTC N/A Disabled +7812 716 svchost.exe 0xd98df3827080 12 - 0 False 2018-06-08 00:22:36.000000 UTC N/A Disabled +7944 716 svchost.exe 0xd98df5cee600 4 - 0 False 2018-06-08 00:22:37.000000 UTC N/A Disabled +6920 356 smss.exe 0xd98df7ba4080 0 - 2 False 2018-06-08 00:26:24.000000 UTC 2018-06-08 00:26:24.000000 UTC Disabled +9312 6920 csrss.exe 0xd98df3dd9080 14 - 2 False 2018-06-08 00:26:24.000000 UTC N/A Disabled +3376 6920 winlogon.exe 0xd98df3c4c600 6 - 2 False 2018-06-08 00:26:24.000000 UTC N/A Disabled +2932 3376 fontdrvhost.ex 0xd98df67a0080 5 - 2 False 2018-06-08 00:26:24.000000 UTC N/A Disabled +6976 3376 dwm.exe 0xd98df6263080 10 - 2 False 2018-06-08 00:26:24.000000 UTC N/A Disabled +9336 1288 atieclxx.exe 0xd98df3895080 9 - 2 False 2018-06-08 00:26:27.000000 UTC N/A Disabled +9932 1568 remsh.exe 0xd98df641d080 6 - 0 False 2018-06-21 06:00:29.000000 UTC N/A Disabled +9200 716 svchost.exe 0xd98df6426600 9 - 0 False 2018-06-21 06:00:30.000000 UTC N/A Disabled +2192 2672 SynTPEnh.exe 0xd98df8649340 10 - 2 False 2018-06-21 06:35:49.000000 UTC N/A Disabled +2388 2192 SynTPEnh.exe 0xd98df3af8080 0 - 2 False 2018-06-21 06:35:50.000000 UTC 2018-06-21 06:35:56.000000 UTC Disabled +3560 716 svchost.exe 0xd98df3d56600 10 - 2 False 2018-06-21 06:35:50.000000 UTC N/A Disabled +3752 1872 sihost.exe 0xd98df62f5600 21 - 2 False 2018-06-21 06:35:50.000000 UTC N/A Disabled +3540 716 svchost.exe 0xd98df42b0080 26 - 2 False 2018-06-21 06:35:50.000000 UTC N/A Disabled +7300 3376 userinit.exe 0xd98df69ad280 0 - 2 False 2018-06-21 06:35:52.000000 UTC 2018-06-21 06:36:20.000000 UTC Disabled +7048 1568 taskhostw.exe 0xd98df7e11080 19 - 2 False 2018-06-21 06:35:53.000000 UTC N/A Disabled +7688 7300 explorer.exe 0xd98df6b162c0 91 - 2 False 2018-06-21 06:35:53.000000 UTC N/A Disabled +7736 2388 SynTPHelper.ex 0xd98dfa4ee600 2 - 2 False 2018-06-21 06:35:55.000000 UTC N/A Disabled +5368 868 SearchUI.exe 0xd98df97b9600 31 - 2 False 2018-06-21 06:35:59.000000 UTC N/A Disabled +7004 868 ShellExperienc 0xd98df4229600 30 - 2 False 2018-06-21 06:35:59.000000 UTC N/A Disabled +7220 868 RuntimeBroker. 0xd98df86c7240 43 - 2 False 2018-06-21 06:36:00.000000 UTC N/A Disabled +9788 868 SkypeHost.exe 0xd98df8760080 11 - 2 False 2018-06-21 06:36:04.000000 UTC N/A Disabled +2820 7688 MSASCuiL.exe 0xd98df4b61080 3 - 2 False 2018-06-21 06:36:16.000000 UTC N/A Disabled +4444 10208 MOM.exe 0xd98df5f67080 19 - 2 False 2018-06-21 06:36:28.000000 UTC N/A Disabled +880 4444 CCC.exe 0xd98df8be8600 26 - 2 False 2018-06-21 06:36:42.000000 UTC N/A Disabled +7764 716 svchost.exe 0xd98df8f9c600 11 - 0 False 2018-06-21 06:36:45.000000 UTC N/A Disabled +5520 716 svchost.exe 0xd98df3984600 3 - 0 False 2018-06-21 06:36:48.000000 UTC N/A Disabled +7496 716 svchost.exe 0xd98df5c59200 8 - 2 False 2018-06-21 06:37:52.000000 UTC N/A Disabled +4428 3236 OneDrive.exe 0xd98df47fd400 12 - 2 True 2018-06-21 06:39:27.000000 UTC N/A Disabled +6624 1596 software_repor 0xd98df63582c0 11 - 2 False 2018-06-21 06:39:48.000000 UTC N/A Disabled +6620 6624 software_repor 0xd98df8800080 8 - 2 False 2018-06-21 06:39:48.000000 UTC N/A Disabled +6708 6624 software_repor 0xd98df9d45600 5 - 2 False 2018-06-21 06:39:49.000000 UTC N/A Disabled +6512 868 InstallAgent.e 0xd98dfa3dd600 12 - 2 False 2018-06-21 06:40:53.000000 UTC N/A Disabled +7876 868 InstallAgentUs 0xd98df9992600 12 - 2 False 2018-06-21 06:40:56.000000 UTC N/A Disabled +7380 716 svchost.exe 0xd98df9421080 8 - 0 False 2018-06-21 06:41:21.000000 UTC N/A Disabled +7252 1568 taskhostw.exe 0xd98df8584480 9 - 0 False 2018-06-21 06:43:12.000000 UTC N/A Disabled +1048 5468 mcbuilder.exe 0xd98df994a600 3 - 0 False 2018-06-21 06:43:17.000000 UTC N/A Disabled +3156 716 svchost.exe 0xd98df8791600 6 - 0 False 2018-06-21 06:43:18.000000 UTC N/A Disabled +9324 1048 conhost.exe 0xd98df99f7080 3 - 0 False 2018-06-21 06:43:19.000000 UTC N/A Disabled +6492 7252 ngentask.exe 0xd98df7bd0080 7 - 0 True 2018-06-21 06:43:20.000000 UTC N/A Disabled +1336 7252 ngentask.exe 0xd98df929e3c0 7 - 0 False 2018-06-21 06:43:20.000000 UTC N/A Disabled +8648 1336 conhost.exe 0xd98df958a600 6 - 0 False 2018-06-21 06:43:29.000000 UTC N/A Disabled +2120 6492 conhost.exe 0xd98df80ec080 5 - 0 False 2018-06-21 06:43:30.000000 UTC N/A Disabled +9756 1336 ngen.exe 0xd98df4652080 6 - 0 False 2018-06-21 06:43:32.000000 UTC N/A Disabled +5684 6492 ngen.exe 0xd98df41a8600 3 - 0 True 2018-06-21 06:42:33.000000 UTC N/A Disabled +428 716 svchost.exe 0xd98df8831080 5 - 0 False 2018-06-21 06:46:12.000000 UTC N/A Disabled +9888 716 svchost.exe 0xd98df64f3400 10 - 0 False 2018-06-21 06:46:12.000000 UTC N/A Disabled +4596 1824 audiodg.exe 0xd98df5f48600 6 - 0 False 2018-06-21 06:46:18.000000 UTC N/A Disabled +9660 716 svchost.exe 0xd98df95d32c0 34 - 0 False 2018-06-21 06:47:06.000000 UTC N/A Disabled +1168 5380 SearchProtocol 0xd98dfa893600 6 - 0 False 2018-06-21 06:47:33.000000 UTC N/A Disabled +8892 5352 osf64.exe 0xd98df480e080 30 - 2 False 2018-06-21 06:49:21.000000 UTC N/A Disabled +7080 868 WmiPrvSE.exe 0xd98df6361600 8 - 0 False 2018-06-21 06:49:23.000000 UTC N/A Disabled +3672 2664 CompatTelRunne 0xd98df3ab8600 6 - 0 False 2018-06-21 06:49:57.000000 UTC N/A Disabled +1612 3672 conhost.exe 0xd98df91ce080 3 - 0 False 2018-06-21 06:49:57.000000 UTC N/A Disabled +8704 716 svchost.exe 0xd98df5f05600 7 - 0 False 2018-06-21 06:50:05.000000 UTC N/A Disabled +7776 716 svchost.exe 0xd98df80cf2c0 4 - 0 False 2018-06-21 06:51:28.000000 UTC N/A Disabled +9628 7324 WUDFHost.exe 0xd98df5c58080 9 - 0 False 2018-06-21 06:51:30.000000 UTC N/A Disabled +9160 716 TrustedInstall 0xd98df503a080 8 - 0 False 2018-06-21 06:51:57.000000 UTC N/A Disabled +10084 868 SystemSettings 0xd98df7cbe380 51 - 2 False 2018-06-21 06:36:42.000000 UTC N/A Disabled +8084 868 smartscreen.ex 0xd98df9d4e600 10 - 2 False 2018-06-21 06:46:00.000000 UTC N/A Disabled diff --git a/Semaine_12/Jour_05/volatility/data/results/WinDump.mem_windows.psscan.log b/Semaine_12/Jour_05/volatility/data/results/WinDump.mem_windows.psscan.log new file mode 100644 index 0000000..75dfc74 --- /dev/null +++ b/Semaine_12/Jour_05/volatility/data/results/WinDump.mem_windows.psscan.log @@ -0,0 +1,164 @@ + Progress: 0.00 Scanning FileLayer using PageMapScanner Progress: 15.11 Scanning FileLayer using PageMapScanner Progress: 64.75 Scanning FileLayer using PageMapScanner Progress: 100.00 Stacking attempts finished Progress: 0.00 Scanning layer_name using PdbSignatureScanner Progress: 0.00 Scanning layer_name using PdbSignatureScanner Progress: 34.47 Scanning layer_name using PdbSignatureScanner Progress: 34.57 Scanning layer_name using PdbSignatureScanner Progress: 34.67 Scanning layer_name using PdbSignatureScanner Progress: 34.77 Scanning layer_name using PdbSignatureScanner Progress: 34.86 Scanning layer_name using PdbSignatureScanner Progress: 34.96 Scanning layer_name using PdbSignatureScanner Progress: 35.06 Scanning layer_name using PdbSignatureScanner Progress: 0.00 Scanning layer_name using PdbSignatureScanner Progress: 0.00 Scanning layer_name using PdbSignatureScanner Progress: 100.00 PDB scanning finished Volatility 3 Framework 2.28.0 + +PID PPID ImageFileName Offset(V) Threads Handles SessionId Wow64 CreateTime ExitTime File output + +4 0 System 0xd98df30c24c0 178 - N/A False 2018-06-08 00:11:39.000000 UTC N/A Disabled +5020 716 NisSrv.exe 0xd98df337d600 7 - 0 False 2018-06-08 00:13:09.000000 UTC N/A Disabled +7812 716 svchost.exe 0xd98df3827080 12 - 0 False 2018-06-08 00:22:36.000000 UTC N/A Disabled +9336 1288 atieclxx.exe 0xd98df3895080 9 - 2 False 2018-06-08 00:26:27.000000 UTC N/A Disabled +5520 716 svchost.exe 0xd98df3984600 3 - 0 False 2018-06-21 06:36:48.000000 UTC N/A Disabled +584 868 backgroundTask 0xd98df3a85600 0 - 2 False 2018-06-21 06:45:10.000000 UTC 2018-06-21 06:46:59.000000 UTC Disabled +3672 2664 CompatTelRunne 0xd98df3ab8600 6 - 0 False 2018-06-21 06:49:57.000000 UTC N/A Disabled +2388 2192 SynTPEnh.exe 0xd98df3af8080 0 - 2 False 2018-06-21 06:35:50.000000 UTC 2018-06-21 06:35:56.000000 UTC Disabled +5352 8264 OSForensics.ex 0xd98df3b97240 0 - 2 False 2018-06-21 06:49:20.000000 UTC 2018-06-21 06:49:21.000000 UTC Disabled +3376 6920 winlogon.exe 0xd98df3c4c600 6 - 2 False 2018-06-08 00:26:24.000000 UTC N/A Disabled +3560 716 svchost.exe 0xd98df3d56600 10 - 2 False 2018-06-21 06:35:50.000000 UTC N/A Disabled +5440 1568 MpCmdRun.exe 0xd98df3d9c600 0 - 0 False 2018-06-21 06:43:18.000000 UTC 2018-06-21 06:45:51.000000 UTC Disabled +9312 6920 csrss.exe 0xd98df3dd9080 14 - 2 False 2018-06-08 00:26:24.000000 UTC N/A Disabled +4660 716 svchost.exe 0xd98df3e5b600 8 - 0 False 2018-06-08 00:14:28.000000 UTC N/A Disabled +5684 6492 ngen.exe 0xd98df41a8600 3 - 0 True 2018-06-21 06:42:33.000000 UTC N/A Disabled +7004 868 ShellExperienc 0xd98df4229600 30 - 2 False 2018-06-21 06:35:59.000000 UTC N/A Disabled +3540 716 svchost.exe 0xd98df42b0080 26 - 2 False 2018-06-21 06:35:50.000000 UTC N/A Disabled +9756 1336 ngen.exe 0xd98df4652080 6 - 0 False 2018-06-21 06:43:32.000000 UTC N/A Disabled +4428 3236 OneDrive.exe 0xd98df47fd400 12 - 2 True 2018-06-21 06:39:27.000000 UTC N/A Disabled +8892 5352 osf64.exe 0xd98df480e080 30 - 2 False 2018-06-21 06:49:21.000000 UTC N/A Disabled +2820 7688 MSASCuiL.exe 0xd98df4b61080 3 - 2 False 2018-06-21 06:36:16.000000 UTC N/A Disabled +356 4 smss.exe 0xd98df4e56600 3 - N/A False 2018-06-08 00:11:40.000000 UTC N/A Disabled +5180 1596 chrome.exe 0xd98df4eb8200 0 - 2 False 2018-06-21 06:37:37.000000 UTC 2018-06-21 06:45:58.000000 UTC Disabled +9160 716 TrustedInstall 0xd98df503a080 8 - 0 False 2018-06-21 06:51:57.000000 UTC N/A Disabled +2872 716 svchost.exe 0xd98df5227600 6 - 0 False 2018-06-08 00:14:43.000000 UTC N/A Disabled +5940 5480 GoogleCrashHan 0xd98df5242600 4 - 0 False 2018-06-08 00:14:37.000000 UTC N/A Disabled +5648 716 svchost.exe 0xd98df5244600 3 - 0 False 2018-06-08 00:14:30.000000 UTC N/A Disabled +5932 5480 GoogleCrashHan 0xd98df53cd600 5 - 0 True 2018-06-08 00:14:30.000000 UTC N/A Disabled +2908 9756 mscorsvw.exe 0xd98df53e0600 0 - 0 False 2018-06-21 06:51:57.000000 UTC 2018-06-21 06:52:09.000000 UTC Disabled +2828 716 svchost.exe 0xd98df59cb600 5 - 0 False 2018-06-08 00:12:43.000000 UTC N/A Disabled +9628 7324 WUDFHost.exe 0xd98df5c58080 9 - 0 False 2018-06-21 06:51:30.000000 UTC N/A Disabled +7496 716 svchost.exe 0xd98df5c59200 8 - 2 False 2018-06-21 06:37:52.000000 UTC N/A Disabled +5380 716 SearchIndexer. 0xd98df5ca4600 36 - 0 False 2018-06-08 00:14:44.000000 UTC N/A Disabled +5764 716 svchost.exe 0xd98df5caa080 19 - 0 False 2018-06-08 00:14:37.000000 UTC N/A Disabled +2988 716 svchost.exe 0xd98df5ce9600 41 - 0 False 2018-06-08 00:13:27.000000 UTC N/A Disabled +7944 716 svchost.exe 0xd98df5cee600 4 - 0 False 2018-06-08 00:22:37.000000 UTC N/A Disabled +3448 716 svchost.exe 0xd98df5cf5600 8 - 0 False 2018-06-08 00:13:27.000000 UTC N/A Disabled +8704 716 svchost.exe 0xd98df5f05600 7 - 0 False 2018-06-21 06:50:05.000000 UTC N/A Disabled +4596 1824 audiodg.exe 0xd98df5f48600 6 - 0 False 2018-06-21 06:46:18.000000 UTC N/A Disabled +4444 10208 MOM.exe 0xd98df5f67080 19 - 2 False 2018-06-21 06:36:28.000000 UTC N/A Disabled +468 460 csrss.exe 0xd98df60ef080 12 - 0 False 2018-06-08 00:12:23.000000 UTC N/A Disabled +6976 3376 dwm.exe 0xd98df6263080 10 - 2 False 2018-06-08 00:26:24.000000 UTC N/A Disabled +3752 1872 sihost.exe 0xd98df62f5600 21 - 2 False 2018-06-21 06:35:50.000000 UTC N/A Disabled +6624 1596 software_repor 0xd98df63582c0 11 - 2 False 2018-06-21 06:39:48.000000 UTC N/A Disabled +7080 868 WmiPrvSE.exe 0xd98df6361600 8 - 0 False 2018-06-21 06:49:23.000000 UTC N/A Disabled +9932 1568 remsh.exe 0xd98df641d080 6 - 0 False 2018-06-21 06:00:29.000000 UTC N/A Disabled +9200 716 svchost.exe 0xd98df6426600 9 - 0 False 2018-06-21 06:00:30.000000 UTC N/A Disabled +6220 1568 UpdateAssistan 0xd98df6492600 0 - 2 False 2018-06-21 06:43:09.000000 UTC 2018-06-21 06:45:52.000000 UTC Disabled +9888 716 svchost.exe 0xd98df64f3400 10 - 0 False 2018-06-21 06:46:12.000000 UTC N/A Disabled +568 460 wininit.exe 0xd98df657c080 2 - 0 False 2018-06-08 00:12:24.000000 UTC N/A Disabled +72 716 svchost.exe 0xd98df658c600 6 - 0 False 2018-06-08 00:12:26.000000 UTC N/A Disabled +944 568 fontdrvhost.ex 0xd98df6590600 6 - 0 False 2018-06-08 00:12:25.000000 UTC N/A Disabled +920 716 svchost.exe 0xd98df6594600 12 - 0 False 2018-06-08 00:12:25.000000 UTC N/A Disabled +744 568 lsass.exe 0xd98df65d7080 8 - 0 False 2018-06-08 00:12:25.000000 UTC N/A Disabled +716 568 services.exe 0xd98df65e0080 9 - 0 False 2018-06-08 00:12:24.000000 UTC N/A Disabled +844 716 svchost.exe 0xd98df665a600 2 - 0 False 2018-06-08 00:12:25.000000 UTC N/A Disabled +868 716 svchost.exe 0xd98df666c480 26 - 0 False 2018-06-08 00:12:25.000000 UTC N/A Disabled +804 716 svchost.exe 0xd98df6729600 3 - 0 False 2018-06-08 00:12:26.000000 UTC N/A Disabled +1056 716 svchost.exe 0xd98df674c600 4 - 0 False 2018-06-08 00:12:26.000000 UTC N/A Disabled +1140 716 svchost.exe 0xd98df6774600 6 - 0 False 2018-06-08 00:12:26.000000 UTC N/A Disabled +1260 716 svchost.exe 0xd98df6781600 8 - 0 False 2018-06-08 00:12:26.000000 UTC N/A Disabled +2932 3376 fontdrvhost.ex 0xd98df67a0080 5 - 2 False 2018-06-08 00:26:24.000000 UTC N/A Disabled +1316 716 svchost.exe 0xd98df67cc600 5 - 0 False 2018-06-08 00:12:27.000000 UTC N/A Disabled +1288 716 atiesrxx.exe 0xd98df67d5080 6 - 0 False 2018-06-08 00:12:27.000000 UTC N/A Disabled +1368 716 svchost.exe 0xd98df67e0600 10 - 0 False 2018-06-08 00:12:27.000000 UTC N/A Disabled +1420 716 svchost.exe 0xd98df681b600 6 - 0 False 2018-06-08 00:12:27.000000 UTC N/A Disabled +1412 716 svchost.exe 0xd98df682f600 4 - 0 False 2018-06-08 00:12:27.000000 UTC N/A Disabled +1436 716 svchost.exe 0xd98df6838600 7 - 0 False 2018-06-08 00:12:27.000000 UTC N/A Disabled +1532 716 svchost.exe 0xd98df6867600 12 - 0 False 2018-06-08 00:12:27.000000 UTC N/A Disabled +1724 716 svchost.exe 0xd98df686a600 14 - 0 False 2018-06-08 00:12:27.000000 UTC N/A Disabled +1548 716 svchost.exe 0xd98df6887600 4 - 0 False 2018-06-08 00:12:27.000000 UTC N/A Disabled +1568 716 svchost.exe 0xd98df6894600 24 - 0 False 2018-06-08 00:12:27.000000 UTC N/A Disabled +1644 716 svchost.exe 0xd98df68bb600 5 - 0 False 2018-06-08 00:12:27.000000 UTC N/A Disabled +1652 716 svchost.exe 0xd98df68c9600 6 - 0 False 2018-06-08 00:12:27.000000 UTC N/A Disabled +1824 716 svchost.exe 0xd98df691a600 8 - 0 False 2018-06-08 00:12:28.000000 UTC N/A Disabled +1872 716 svchost.exe 0xd98df6949600 6 - 0 False 2018-06-08 00:12:28.000000 UTC N/A Disabled +1940 716 svchost.exe 0xd98df696a600 11 - 0 False 2018-06-08 00:12:29.000000 UTC N/A Disabled +1948 716 svchost.exe 0xd98df698e600 6 - 0 False 2018-06-08 00:12:29.000000 UTC N/A Disabled +7300 3376 userinit.exe 0xd98df69ad280 0 - 2 False 2018-06-21 06:35:52.000000 UTC 2018-06-21 06:36:20.000000 UTC Disabled +2036 716 svchost.exe 0xd98df69b2600 5 - 0 False 2018-06-08 00:12:29.000000 UTC N/A Disabled +2068 716 svchost.exe 0xd98df6a2c380 15 - 0 False 2018-06-08 00:12:29.000000 UTC N/A Disabled +2260 716 svchost.exe 0xd98df6a94600 11 - 0 False 2018-06-08 00:12:31.000000 UTC N/A Disabled +2304 716 svchost.exe 0xd98df6aa1600 7 - 0 False 2018-06-08 00:12:32.000000 UTC N/A Disabled +2364 716 spoolsv.exe 0xd98df6abe600 14 - 0 False 2018-06-08 00:12:32.000000 UTC N/A Disabled +2424 716 svchost.exe 0xd98df6b08600 14 - 0 False 2018-06-08 00:12:33.000000 UTC N/A Disabled +7688 7300 explorer.exe 0xd98df6b162c0 91 - 2 False 2018-06-21 06:35:53.000000 UTC N/A Disabled +2504 716 svchost.exe 0xd98df6b53600 6 - 0 False 2018-06-08 00:12:33.000000 UTC N/A Disabled +2656 716 svchost.exe 0xd98df6b61600 5 - 0 False 2018-06-08 00:12:34.000000 UTC N/A Disabled +2664 716 svchost.exe 0xd98df6b78600 11 - 0 False 2018-06-08 00:12:34.000000 UTC N/A Disabled +2672 716 SynTPEnhServic 0xd98df6bc7600 5 - 0 False 2018-06-08 00:12:34.000000 UTC N/A Disabled +2688 716 MsMpEng.exe 0xd98df6bd9600 34 - 0 False 2018-06-08 00:12:35.000000 UTC N/A Disabled +2696 716 svchost.exe 0xd98df6bdb600 3 - 0 False 2018-06-08 00:12:35.000000 UTC N/A Disabled +2704 716 svchost.exe 0xd98df6bed600 9 - 0 False 2018-06-08 00:12:35.000000 UTC N/A Disabled +2712 716 svchost.exe 0xd98df6bef600 6 - 0 False 2018-06-08 00:12:35.000000 UTC N/A Disabled +2720 716 svchost.exe 0xd98df6bf1600 8 - 0 False 2018-06-08 00:12:35.000000 UTC N/A Disabled +2736 716 svchost.exe 0xd98df6bf7600 14 - 0 False 2018-06-08 00:12:35.000000 UTC N/A Disabled +2748 716 svchost.exe 0xd98df6bfc600 15 - 0 False 2018-06-08 00:12:35.000000 UTC N/A Disabled +2756 716 svchost.exe 0xd98df6c01600 8 - 0 False 2018-06-08 00:12:35.000000 UTC N/A Disabled +2764 716 svchost.exe 0xd98df6c0a600 4 - 0 False 2018-06-08 00:12:35.000000 UTC N/A Disabled +2772 716 svchost.exe 0xd98df6c0c600 14 - 0 False 2018-06-08 00:12:35.000000 UTC N/A Disabled +2780 716 svchost.exe 0xd98df6c10600 9 - 0 False 2018-06-08 00:12:35.000000 UTC N/A Disabled +2800 716 SecurityHealth 0xd98df6c114c0 6 - 0 False 2018-06-08 00:12:35.000000 UTC N/A Disabled +2792 716 svchost.exe 0xd98df6c12600 7 - 0 False 2018-06-08 00:12:35.000000 UTC N/A Disabled +2464 716 svchost.exe 0xd98df6d1d600 3 - 0 False 2018-06-08 00:12:35.000000 UTC N/A Disabled +3052 4 MemCompression 0xd98df6d1e040 22 - N/A False 2018-06-08 00:12:35.000000 UTC N/A Disabled +2980 2656 dasHost.exe 0xd98df6d92600 7 - 0 False 2018-06-08 00:12:35.000000 UTC N/A Disabled +3188 716 svchost.exe 0xd98df6df8600 6 - 0 False 2018-06-08 00:12:35.000000 UTC N/A Disabled +3288 716 svchost.exe 0xd98df6dff600 9 - 0 False 2018-06-08 00:12:36.000000 UTC N/A Disabled +3400 716 svchost.exe 0xd98df6f24600 15 - 0 False 2018-06-08 00:12:36.000000 UTC N/A Disabled +3888 716 svchost.exe 0xd98df70de600 13 - 0 False 2018-06-08 00:12:39.000000 UTC N/A Disabled +3880 716 svchost.exe 0xd98df713d600 3 - 0 False 2018-06-08 00:12:39.000000 UTC N/A Disabled +3972 716 svchost.exe 0xd98df719b4c0 24 - 0 False 2018-06-08 00:12:40.000000 UTC N/A Disabled +4108 716 svchost.exe 0xd98df73ac080 4 - 0 False 2018-06-08 00:12:43.000000 UTC N/A Disabled +4264 716 svchost.exe 0xd98df7406600 5 - 0 False 2018-06-08 00:12:45.000000 UTC N/A Disabled +4504 716 svchost.exe 0xd98df74fc080 22 - 0 False 2018-06-08 00:12:48.000000 UTC N/A Disabled +7324 716 svchost.exe 0xd98df759c600 3 - 0 False 2018-06-08 00:17:13.000000 UTC N/A Disabled +6920 356 smss.exe 0xd98df7ba4080 0 - 2 False 2018-06-08 00:26:24.000000 UTC 2018-06-08 00:26:24.000000 UTC Disabled +6492 7252 ngentask.exe 0xd98df7bd0080 7 - 0 True 2018-06-21 06:43:20.000000 UTC N/A Disabled +10084 868 SystemSettings 0xd98df7cbe380 51 - 2 False 2018-06-21 06:36:42.000000 UTC N/A Disabled +7048 1568 taskhostw.exe 0xd98df7e11080 19 - 2 False 2018-06-21 06:35:53.000000 UTC N/A Disabled +7776 716 svchost.exe 0xd98df80cf2c0 4 - 0 False 2018-06-21 06:51:28.000000 UTC N/A Disabled +2120 6492 conhost.exe 0xd98df80ec080 5 - 0 False 2018-06-21 06:43:30.000000 UTC N/A Disabled +5696 9756 mscorsvw.exe 0xd98df8408600 0 - 0 False 2018-06-21 06:50:47.000000 UTC 2018-06-21 06:50:50.000000 UTC Disabled +7252 1568 taskhostw.exe 0xd98df8584480 9 - 0 False 2018-06-21 06:43:12.000000 UTC N/A Disabled +2192 2672 SynTPEnh.exe 0xd98df8649340 10 - 2 False 2018-06-21 06:35:49.000000 UTC N/A Disabled +7220 868 RuntimeBroker. 0xd98df86c7240 43 - 2 False 2018-06-21 06:36:00.000000 UTC N/A Disabled +9788 868 SkypeHost.exe 0xd98df8760080 11 - 2 False 2018-06-21 06:36:04.000000 UTC N/A Disabled +3156 716 svchost.exe 0xd98df8791600 6 - 0 False 2018-06-21 06:43:18.000000 UTC N/A Disabled +6620 6624 software_repor 0xd98df8800080 8 - 2 False 2018-06-21 06:39:48.000000 UTC N/A Disabled +428 716 svchost.exe 0xd98df8831080 5 - 0 False 2018-06-21 06:46:12.000000 UTC N/A Disabled +880 4444 CCC.exe 0xd98df8be8600 26 - 2 False 2018-06-21 06:36:42.000000 UTC N/A Disabled +10164 9756 mscorsvw.exe 0xd98df8d99480 0 - 0 False 2018-06-21 06:48:41.000000 UTC 2018-06-21 06:48:42.000000 UTC Disabled +3828 716 svchost.exe 0xd98df8dd2600 12 - 0 False 2018-06-21 06:51:27.000000 UTC N/A Disabled +7764 716 svchost.exe 0xd98df8f9c600 11 - 0 False 2018-06-21 06:36:45.000000 UTC N/A Disabled +4364 9756 mscorsvw.exe 0xd98df90d7200 0 - 0 False 2018-06-21 06:47:23.000000 UTC 2018-06-21 06:47:23.000000 UTC Disabled +1612 3672 conhost.exe 0xd98df91ce080 3 - 0 False 2018-06-21 06:49:57.000000 UTC N/A Disabled +1336 7252 ngentask.exe 0xd98df929e3c0 7 - 0 False 2018-06-21 06:43:20.000000 UTC N/A Disabled +7380 716 svchost.exe 0xd98df9421080 8 - 0 False 2018-06-21 06:41:21.000000 UTC N/A Disabled +8648 1336 conhost.exe 0xd98df958a600 6 - 0 False 2018-06-21 06:43:29.000000 UTC N/A Disabled +6120 1568 taskhostw.exe 0xd98df95cf600 8 - 2 False 2018-06-21 06:50:53.000000 UTC N/A Disabled +9660 716 svchost.exe 0xd98df95d32c0 34 - 0 False 2018-06-21 06:47:06.000000 UTC N/A Disabled +5368 868 SearchUI.exe 0xd98df97b9600 31 - 2 False 2018-06-21 06:35:59.000000 UTC N/A Disabled +8292 9756 mscorsvw.exe 0xd98df98ae080 0 - 0 False 2018-06-21 06:52:09.000000 UTC 2018-06-21 06:52:15.000000 UTC Disabled +1048 5468 mcbuilder.exe 0xd98df994a600 3 - 0 False 2018-06-21 06:43:17.000000 UTC N/A Disabled +7876 868 InstallAgentUs 0xd98df9992600 12 - 2 False 2018-06-21 06:40:56.000000 UTC N/A Disabled +9324 1048 conhost.exe 0xd98df99f7080 3 - 0 False 2018-06-21 06:43:19.000000 UTC N/A Disabled +7268 9756 mscorsvw.exe 0xd98df9a7a600 0 - 0 False 2018-06-21 06:46:55.000000 UTC 2018-06-21 06:46:57.000000 UTC Disabled +1980 1568 UpdateAssistan 0xd98df9a87600 0 - 2 False 2018-06-21 06:45:53.000000 UTC 2018-06-21 06:46:11.000000 UTC Disabled +6708 6624 software_repor 0xd98df9d45600 5 - 2 False 2018-06-21 06:39:49.000000 UTC N/A Disabled +8084 868 smartscreen.ex 0xd98df9d4e600 10 - 2 False 2018-06-21 06:46:00.000000 UTC N/A Disabled +2372 716 svchost.exe 0xd98dfa30a080 0 - 0 False 2018-06-21 06:43:20.000000 UTC 2018-06-21 06:48:21.000000 UTC Disabled +2628 9596 conhost.exe 0xd98dfa3a9600 0 - 0 False 2018-06-21 06:43:18.000000 UTC 2018-06-21 06:45:51.000000 UTC Disabled +6512 868 InstallAgent.e 0xd98dfa3dd600 12 - 2 False 2018-06-21 06:40:53.000000 UTC N/A Disabled +7736 2388 SynTPHelper.ex 0xd98dfa4ee600 2 - 2 False 2018-06-21 06:35:55.000000 UTC N/A Disabled +1168 5380 SearchProtocol 0xd98dfa893600 6 - 0 False 2018-06-21 06:47:33.000000 UTC N/A Disabled +4 0 System 0xef80000c24c0 178 - N/A False 2018-06-08 00:11:39.000000 UTC N/A Disabled +868 716 svchost.exe 0xf8021ee91480 26 - 0 False 2018-06-08 00:12:25.000000 UTC N/A Disabled +844 716 svchost.exe 0xf8021f3d9600 2 - 0 False 2018-06-08 00:12:25.000000 UTC N/A Disabled +3672 2664 CompatTelRunne 0xf8021f43d600 6 - 0 False 2018-06-21 06:49:57.000000 UTC N/A Disabled +7004 868 ShellExperienc 0xf8021f5fe600 30 - 2 False 2018-06-21 06:35:59.000000 UTC N/A Disabled diff --git a/Semaine_12/Jour_05/volatility/data/results/WinDump.mem_windows.pstree.log b/Semaine_12/Jour_05/volatility/data/results/WinDump.mem_windows.pstree.log new file mode 100644 index 0000000..086403b --- /dev/null +++ b/Semaine_12/Jour_05/volatility/data/results/WinDump.mem_windows.pstree.log @@ -0,0 +1,143 @@ + Progress: 0.00 Scanning FileLayer using PageMapScanner Progress: 15.11 Scanning FileLayer using PageMapScanner Progress: 64.75 Scanning FileLayer using PageMapScanner Progress: 100.00 Stacking attempts finished Progress: 0.00 Scanning layer_name using PdbSignatureScanner Progress: 0.00 Scanning layer_name using PdbSignatureScanner Progress: 34.47 Scanning layer_name using PdbSignatureScanner Progress: 34.57 Scanning layer_name using PdbSignatureScanner Progress: 34.67 Scanning layer_name using PdbSignatureScanner Progress: 34.77 Scanning layer_name using PdbSignatureScanner Progress: 34.86 Scanning layer_name using PdbSignatureScanner Progress: 34.96 Scanning layer_name using PdbSignatureScanner Progress: 35.06 Scanning layer_name using PdbSignatureScanner Progress: 0.00 Scanning layer_name using PdbSignatureScanner Progress: 0.00 Scanning layer_name using PdbSignatureScanner Progress: 100.00 PDB scanning finished Volatility 3 Framework 2.28.0 + +PID PPID ImageFileName Offset(V) Threads Handles SessionId Wow64 CreateTime ExitTime Audit Cmd Path + +4 0 System 0xd98df30c24c0 178 - N/A False 2018-06-08 00:11:39.000000 UTC N/A - - - +* 356 4 smss.exe 0xd98df4e56600 3 - N/A False 2018-06-08 00:11:40.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\smss.exe \SystemRoot\System32\smss.exe \SystemRoot\System32\smss.exe +** 6920 356 smss.exe 0xd98df7ba4080 0 - 2 False 2018-06-08 00:26:24.000000 UTC 2018-06-08 00:26:24.000000 UTC \Device\HarddiskVolume2\Windows\System32\smss.exe - - +*** 9312 6920 csrss.exe 0xd98df3dd9080 14 - 2 False 2018-06-08 00:26:24.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\csrss.exe %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 C:\WINDOWS\system32\csrss.exe +*** 3376 6920 winlogon.exe 0xd98df3c4c600 6 - 2 False 2018-06-08 00:26:24.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\winlogon.exe C:\WINDOWS\System32\WinLogon.exe -SpecialSession C:\WINDOWS\System32\WinLogon.exe +**** 6976 3376 dwm.exe 0xd98df6263080 10 - 2 False 2018-06-08 00:26:24.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\dwm.exe "dwm.exe" C:\WINDOWS\System32\dwm.exe +**** 7300 3376 userinit.exe 0xd98df69ad280 0 - 2 False 2018-06-21 06:35:52.000000 UTC 2018-06-21 06:36:20.000000 UTC \Device\HarddiskVolume2\Windows\System32\userinit.exe - - +***** 7688 7300 explorer.exe 0xd98df6b162c0 91 - 2 False 2018-06-21 06:35:53.000000 UTC N/A \Device\HarddiskVolume2\Windows\explorer.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\Explorer.EXE +****** 2820 7688 MSASCuiL.exe 0xd98df4b61080 3 - 2 False 2018-06-21 06:36:16.000000 UTC N/A \Device\HarddiskVolume2\Program Files\Windows Defender\MSASCuiL.exe "C:\Program Files\Windows Defender\MSASCuiL.exe" C:\Program Files\Windows Defender\MSASCuiL.exe +**** 2932 3376 fontdrvhost.ex 0xd98df67a0080 5 - 2 False 2018-06-08 00:26:24.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\fontdrvhost.exe "fontdrvhost.exe" C:\WINDOWS\System32\fontdrvhost.exe +* 3052 4 MemCompression 0xd98df6d1e040 22 - N/A False 2018-06-08 00:12:35.000000 UTC N/A MemCompression - - +468 460 csrss.exe 0xd98df60ef080 12 - 0 False 2018-06-08 00:12:23.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\csrss.exe %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 C:\WINDOWS\system32\csrss.exe +568 460 wininit.exe 0xd98df657c080 2 - 0 False 2018-06-08 00:12:24.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\wininit.exe wininit.exe C:\WINDOWS\system32\wininit.exe +* 744 568 lsass.exe 0xd98df65d7080 8 - 0 False 2018-06-08 00:12:25.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\lsass.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\lsass.exe +* 716 568 services.exe 0xd98df65e0080 9 - 0 False 2018-06-08 00:12:24.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\services.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\services.exe +** 8704 716 svchost.exe 0xd98df5f05600 7 - 0 False 2018-06-21 06:50:05.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe C:\WINDOWS\system32\svchost.exe -k netsvcs -s wlidsvc C:\WINDOWS\system32\svchost.exe +** 1548 716 svchost.exe 0xd98df6887600 4 - 0 False 2018-06-08 00:12:27.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k netsvcs -s SENS c:\windows\system32\svchost.exe +** 4108 716 svchost.exe 0xd98df73ac080 4 - 0 False 2018-06-08 00:12:43.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent c:\windows\system32\svchost.exe +** 5648 716 svchost.exe 0xd98df5244600 3 - 0 False 2018-06-08 00:14:30.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k netsvcs -s Appinfo c:\windows\system32\svchost.exe +** 2068 716 svchost.exe 0xd98df6a2c380 15 - 0 False 2018-06-08 00:12:29.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted C:\WINDOWS\system32\svchost.exe +** 1056 716 svchost.exe 0xd98df674c600 4 - 0 False 2018-06-08 00:12:26.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s TimeBrokerSvc c:\windows\system32\svchost.exe +** 1568 716 svchost.exe 0xd98df6894600 24 - 0 False 2018-06-08 00:12:27.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k netsvcs -s Schedule c:\windows\system32\svchost.exe +*** 7048 1568 taskhostw.exe 0xd98df7e11080 19 - 2 False 2018-06-21 06:35:53.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\taskhostw.exe taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E} c:\windows\system32\taskhostw.exe +*** 9932 1568 remsh.exe 0xd98df641d080 6 - 0 False 2018-06-21 06:00:29.000000 UTC N/A \Device\HarddiskVolume2\Program Files\rempl\remsh.exe "C:\Program Files\rempl\remsh.exe" C:\Program Files\rempl\remsh.exe +*** 7252 1568 taskhostw.exe 0xd98df8584480 9 - 0 False 2018-06-21 06:43:12.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\taskhostw.exe - - +**** 1336 7252 ngentask.exe 0xd98df929e3c0 7 - 0 False 2018-06-21 06:43:20.000000 UTC N/A \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\NGenTask.exe" /RuntimeWide /StopEvent:408 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\NGenTask.exe +***** 8648 1336 conhost.exe 0xd98df958a600 6 - 0 False 2018-06-21 06:43:29.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\conhost.exe \??\C:\WINDOWS\system32\conhost.exe 0x4 C:\WINDOWS\system32\conhost.exe +***** 9756 1336 ngen.exe 0xd98df4652080 6 - 0 False 2018-06-21 06:43:32.000000 UTC N/A \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" ExecuteQueuedItems /LegacyServiceBehavior C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe +**** 6492 7252 ngentask.exe 0xd98df7bd0080 7 - 0 True 2018-06-21 06:43:20.000000 UTC N/A \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\NGenTask.exe" /RuntimeWide /StopEvent:964 C:\Windows\Microsoft.NET\Framework\v4.0.30319\NGenTask.exe +***** 2120 6492 conhost.exe 0xd98df80ec080 5 - 0 False 2018-06-21 06:43:30.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\conhost.exe \??\C:\WINDOWS\system32\conhost.exe 0x4 C:\WINDOWS\system32\conhost.exe +***** 5684 6492 ngen.exe 0xd98df41a8600 3 - 0 True 2018-06-21 06:42:33.000000 UTC N/A \Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" ExecuteQueuedItems /LegacyServiceBehavior C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe +** 4660 716 svchost.exe 0xd98df3e5b600 8 - 0 False 2018-06-08 00:14:28.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k netsvcs -s TokenBroker c:\windows\system32\svchost.exe +** 72 716 svchost.exe 0xd98df658c600 6 - 0 False 2018-06-08 00:12:26.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k dcomlaunch -s LSM c:\windows\system32\svchost.exe +** 7764 716 svchost.exe 0xd98df8f9c600 11 - 0 False 2018-06-21 06:36:45.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe - - +** 3156 716 svchost.exe 0xd98df8791600 6 - 0 False 2018-06-21 06:43:18.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DsSvc c:\windows\system32\svchost.exe +** 2656 716 svchost.exe 0xd98df6b61600 5 - 0 False 2018-06-08 00:12:34.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService c:\windows\system32\svchost.exe +*** 2980 2656 dasHost.exe 0xd98df6d92600 7 - 0 False 2018-06-08 00:12:35.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\dasHost.exe dashost.exe {489d7f42-5ab9-4185-a877c8ae8fe6a753} C:\WINDOWS\system32\dashost.exe +** 7776 716 svchost.exe 0xd98df80cf2c0 4 - 0 False 2018-06-21 06:51:28.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe - - +** 2664 716 svchost.exe 0xd98df6b78600 11 - 0 False 2018-06-08 00:12:34.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s PcaSvc c:\windows\system32\svchost.exe +*** 3672 2664 CompatTelRunne 0xd98df3ab8600 6 - 0 False 2018-06-21 06:49:57.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\CompatTelRunner.exe C:\WINDOWS\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW C:\WINDOWS\system32\compattelrunner.exe +**** 1612 3672 conhost.exe 0xd98df91ce080 3 - 0 False 2018-06-21 06:49:57.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\conhost.exe \??\C:\WINDOWS\system32\conhost.exe 0x4 C:\WINDOWS\system32\conhost.exe +** 1644 716 svchost.exe 0xd98df68bb600 5 - 0 False 2018-06-08 00:12:27.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder c:\windows\system32\svchost.exe +** 2672 716 SynTPEnhServic 0xd98df6bc7600 5 - 0 False 2018-06-08 00:12:34.000000 UTC N/A \Device\HarddiskVolume2\Program Files\Synaptics\SynTP\SynTPEnhService.exe "C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe" C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe +*** 2192 2672 SynTPEnh.exe 0xd98df8649340 10 - 2 False 2018-06-21 06:35:49.000000 UTC N/A \Device\HarddiskVolume2\Program Files\Synaptics\SynTP\SynTPEnh.exe "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" C:\Program Files\Synaptics\SynTP\SynTPEnh.exe +**** 2388 2192 SynTPEnh.exe 0xd98df3af8080 0 - 2 False 2018-06-21 06:35:50.000000 UTC 2018-06-21 06:35:56.000000 UTC \Device\HarddiskVolume2\Program Files\Synaptics\SynTP\SynTPEnh.exe - - +***** 7736 2388 SynTPHelper.ex 0xd98dfa4ee600 2 - 2 False 2018-06-21 06:35:55.000000 UTC N/A \Device\HarddiskVolume2\Program Files\Synaptics\SynTP\SynTPHelper.exe "C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE" C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE +** 1140 716 svchost.exe 0xd98df6774600 6 - 0 False 2018-06-08 00:12:26.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s hidserv c:\windows\system32\svchost.exe +** 1652 716 svchost.exe 0xd98df68c9600 6 - 0 False 2018-06-08 00:12:27.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -s FontCache c:\windows\system32\svchost.exe +** 3188 716 svchost.exe 0xd98df6df8600 6 - 0 False 2018-06-08 00:12:35.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer c:\windows\system32\svchost.exe +** 2688 716 MsMpEng.exe 0xd98df6bd9600 34 - 0 False 2018-06-08 00:12:35.000000 UTC N/A \Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.16.17656.18052-0\MsMpEng.exe "C:\ProgramData\Microsoft\Windows Defender\platform\4.16.17656.18052-0\MsMpEng.exe" C:\ProgramData\Microsoft\Windows Defender\platform\4.16.17656.18052-0\MsMpEng.exe +** 5764 716 svchost.exe 0xd98df5caa080 19 - 0 False 2018-06-08 00:14:37.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k netsvcs -s DoSvc c:\windows\system32\svchost.exe +** 7812 716 svchost.exe 0xd98df3827080 12 - 0 False 2018-06-08 00:22:36.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k netsvcs -s lfsvc c:\windows\system32\svchost.exe +** 2696 716 svchost.exe 0xd98df6bdb600 3 - 0 False 2018-06-08 00:12:35.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks c:\windows\system32\svchost.exe +** 2704 716 svchost.exe 0xd98df6bed600 9 - 0 False 2018-06-08 00:12:35.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\WINDOWS\system32\svchost.exe +** 2712 716 svchost.exe 0xd98df6bef600 6 - 0 False 2018-06-08 00:12:35.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -s WinHttpAutoProxySvc c:\windows\system32\svchost.exe +** 7324 716 svchost.exe 0xd98df759c600 3 - 0 False 2018-06-08 00:17:13.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted C:\WINDOWS\system32\svchost.exe +*** 9628 7324 WUDFHost.exe 0xd98df5c58080 9 - 0 False 2018-06-21 06:51:30.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\WUDFHost.exe - - +** 2720 716 svchost.exe 0xd98df6bf1600 8 - 0 False 2018-06-08 00:12:35.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k netsvcs -s WpnService c:\windows\system32\svchost.exe +** 9888 716 svchost.exe 0xd98df64f3400 10 - 0 False 2018-06-21 06:46:12.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s wcncsvc c:\windows\system32\svchost.exe +** 4264 716 svchost.exe 0xd98df7406600 5 - 0 False 2018-06-08 00:12:45.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s HomeGroupProvider c:\windows\system32\svchost.exe +** 2736 716 svchost.exe 0xd98df6bf7600 14 - 0 False 2018-06-08 00:12:35.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe C:\WINDOWS\System32\svchost.exe -k utcsvc C:\WINDOWS\System32\svchost.exe +** 1724 716 svchost.exe 0xd98df686a600 14 - 0 False 2018-06-08 00:12:27.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -s netprofm c:\windows\system32\svchost.exe +** 2748 716 svchost.exe 0xd98df6bfc600 15 - 0 False 2018-06-08 00:12:35.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenonetwork -s DPS c:\windows\system32\svchost.exe +** 2756 716 svchost.exe 0xd98df6c01600 8 - 0 False 2018-06-08 00:12:35.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -s CryptSvc c:\windows\system32\svchost.exe +** 2764 716 svchost.exe 0xd98df6c0a600 4 - 0 False 2018-06-08 00:12:35.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k osrss -s osrss c:\windows\system32\svchost.exe +** 2260 716 svchost.exe 0xd98df6a94600 11 - 0 False 2018-06-08 00:12:31.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted C:\WINDOWS\system32\svchost.exe +** 2772 716 svchost.exe 0xd98df6c0c600 14 - 0 False 2018-06-08 00:12:35.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt c:\windows\system32\svchost.exe +** 7380 716 svchost.exe 0xd98df9421080 8 - 0 False 2018-06-21 06:41:21.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -s WdiSystemHost C:\WINDOWS\System32\svchost.exe +** 3288 716 svchost.exe 0xd98df6dff600 9 - 0 False 2018-06-08 00:12:36.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k netsvcs -s iphlpsvc c:\windows\system32\svchost.exe +** 2780 716 svchost.exe 0xd98df6c10600 9 - 0 False 2018-06-08 00:12:35.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc c:\windows\system32\svchost.exe +** 2792 716 svchost.exe 0xd98df6c12600 7 - 0 False 2018-06-08 00:12:35.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s SysMain c:\windows\system32\svchost.exe +** 1260 716 svchost.exe 0xd98df6781600 8 - 0 False 2018-06-08 00:12:26.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog c:\windows\system32\svchost.exe +** 2800 716 SecurityHealth 0xd98df6c114c0 6 - 0 False 2018-06-08 00:12:35.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\SecurityHealthService.exe C:\WINDOWS\system32\SecurityHealthService.exe C:\WINDOWS\system32\SecurityHealthService.exe +** 2304 716 svchost.exe 0xd98df6aa1600 7 - 0 False 2018-06-08 00:12:32.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection c:\windows\system32\svchost.exe +** 5380 716 SearchIndexer. 0xd98df5ca4600 36 - 0 False 2018-06-08 00:14:44.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\SearchIndexer.exe C:\WINDOWS\system32\SearchIndexer.exe /Embedding C:\WINDOWS\system32\SearchIndexer.exe +*** 1168 5380 SearchProtocol 0xd98dfa893600 6 - 0 False 2018-06-21 06:47:33.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\SearchProtocolHost.exe "C:\WINDOWS\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe6_ Global\UsGthrCtrlFltPipeMssGthrPipe6 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\WINDOWS\system32\SearchProtocolHost.exe +** 1288 716 atiesrxx.exe 0xd98df67d5080 6 - 0 False 2018-06-08 00:12:27.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\atiesrxx.exe C:\WINDOWS\system32\atiesrxx.exe C:\WINDOWS\system32\atiesrxx.exe +*** 9336 1288 atieclxx.exe 0xd98df3895080 9 - 2 False 2018-06-08 00:26:27.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\atieclxx.exe atieclxx C:\WINDOWS\system32\atieclxx.exe +** 7944 716 svchost.exe 0xd98df5cee600 4 - 0 False 2018-06-08 00:22:37.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s StorSvc c:\windows\system32\svchost.exe +** 2828 716 svchost.exe 0xd98df59cb600 5 - 0 False 2018-06-08 00:12:43.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k netsvcs -s Browser c:\windows\system32\svchost.exe +** 1824 716 svchost.exe 0xd98df691a600 8 - 0 False 2018-06-08 00:12:28.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted C:\WINDOWS\System32\svchost.exe +*** 4596 1824 audiodg.exe 0xd98df5f48600 6 - 0 False 2018-06-21 06:46:18.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\audiodg.exe C:\WINDOWS\system32\AUDIODG.EXE 0x3c4 C:\WINDOWS\system32\AUDIODG.EXE +** 804 716 svchost.exe 0xd98df6729600 3 - 0 False 2018-06-08 00:12:26.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService c:\windows\system32\svchost.exe +** 1316 716 svchost.exe 0xd98df67cc600 5 - 0 False 2018-06-08 00:12:27.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -s nsi c:\windows\system32\svchost.exe +** 3880 716 svchost.exe 0xd98df713d600 3 - 0 False 2018-06-08 00:12:39.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenonetwork -s NcdAutoSetup c:\windows\system32\svchost.exe +** 3888 716 svchost.exe 0xd98df70de600 13 - 0 False 2018-06-08 00:12:39.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s FDResPub c:\windows\system32\svchost.exe +** 2872 716 svchost.exe 0xd98df5227600 6 - 0 False 2018-06-08 00:14:43.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc c:\windows\system32\svchost.exe +** 2364 716 spoolsv.exe 0xd98df6abe600 14 - 0 False 2018-06-08 00:12:32.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\spoolsv.exe C:\WINDOWS\System32\spoolsv.exe C:\WINDOWS\System32\spoolsv.exe +** 3400 716 svchost.exe 0xd98df6f24600 15 - 0 False 2018-06-08 00:12:36.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV c:\windows\system32\svchost.exe +** 7496 716 svchost.exe 0xd98df5c59200 8 - 2 False 2018-06-21 06:37:52.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k unistacksvcgroup c:\windows\system32\svchost.exe +** 844 716 svchost.exe 0xd98df665a600 2 - 0 False 2018-06-08 00:12:25.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay c:\windows\system32\svchost.exe +** 1872 716 svchost.exe 0xd98df6949600 6 - 0 False 2018-06-08 00:12:28.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k netsvcs -s UserManager c:\windows\system32\svchost.exe +*** 3752 1872 sihost.exe 0xd98df62f5600 21 - 2 False 2018-06-21 06:35:50.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\sihost.exe sihost.exe c:\windows\system32\sihost.exe +** 1368 716 svchost.exe 0xd98df67e0600 10 - 0 False 2018-06-08 00:12:27.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp c:\windows\system32\svchost.exe +** 868 716 svchost.exe 0xd98df666c480 26 - 0 False 2018-06-08 00:12:25.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe C:\WINDOWS\system32\svchost.exe -k DcomLaunch C:\WINDOWS\system32\svchost.exe +*** 7876 868 InstallAgentUs 0xd98df9992600 12 - 2 False 2018-06-21 06:40:56.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\InstallAgentUserBroker.exe - - +*** 10084 868 SystemSettings 0xd98df7cbe380 51 - 2 False 2018-06-21 06:36:42.000000 UTC N/A � - - +*** 7004 868 ShellExperienc 0xd98df4229600 30 - 2 False 2018-06-21 06:35:59.000000 UTC N/A \Device\HarddiskVolume2\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe "C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe +*** 7080 868 WmiPrvSE.exe 0xd98df6361600 8 - 0 False 2018-06-21 06:49:23.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\wbem\WmiPrvSE.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\system32\wbem\wmiprvse.exe +*** 6512 868 InstallAgent.e 0xd98dfa3dd600 12 - 2 False 2018-06-21 06:40:53.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\InstallAgent.exe C:\Windows\System32\InstallAgent.exe -Embedding C:\Windows\System32\InstallAgent.exe +*** 7220 868 RuntimeBroker. 0xd98df86c7240 43 - 2 False 2018-06-21 06:36:00.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\RuntimeBroker.exe C:\Windows\System32\RuntimeBroker.exe -Embedding C:\Windows\System32\RuntimeBroker.exe +*** 8084 868 smartscreen.ex 0xd98df9d4e600 10 - 2 False 2018-06-21 06:46:00.000000 UTC N/A 怒�￿ C:\Windows\System32\smartscreen.exe -Embedding C:\Windows\System32\smartscreen.exe +*** 5368 868 SearchUI.exe 0xd98df97b9600 31 - 2 False 2018-06-21 06:35:59.000000 UTC N/A \Device\HarddiskVolume2\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe +*** 9788 868 SkypeHost.exe 0xd98df8760080 11 - 2 False 2018-06-21 06:36:04.000000 UTC N/A \Device\HarddiskVolume2\Program Files\WindowsApps\Microsoft.SkypeApp_12.1815.209.0_x64__kzf8qxf38zg5c\SkypeHost.exe "C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1815.209.0_x64__kzf8qxf38zg5c\SkypeHost.exe" -ServerName:SkypeHost.ServerServer C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1815.209.0_x64__kzf8qxf38zg5c\SkypeHost.exe +** 3448 716 svchost.exe 0xd98df5cf5600 8 - 0 False 2018-06-08 00:13:27.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -s LicenseManager c:\windows\system32\svchost.exe +** 2424 716 svchost.exe 0xd98df6b08600 14 - 0 False 2018-06-08 00:12:33.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenonetwork c:\windows\system32\svchost.exe +** 1412 716 svchost.exe 0xd98df682f600 4 - 0 False 2018-06-08 00:12:27.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k netsvcs -s Themes c:\windows\system32\svchost.exe +** 3972 716 svchost.exe 0xd98df719b4c0 24 - 0 False 2018-06-08 00:12:40.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe C:\WINDOWS\system32\svchost.exe -k LocalService C:\WINDOWS\system32\svchost.exe +** 1420 716 svchost.exe 0xd98df681b600 6 - 0 False 2018-06-08 00:12:27.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc c:\windows\system32\svchost.exe +** 5520 716 svchost.exe 0xd98df3984600 3 - 0 False 2018-06-21 06:36:48.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -s SstpSvc c:\windows\system32\svchost.exe +** 1940 716 svchost.exe 0xd98df696a600 11 - 0 False 2018-06-08 00:12:29.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -s Dnscache c:\windows\system32\svchost.exe +** 920 716 svchost.exe 0xd98df6594600 12 - 0 False 2018-06-08 00:12:25.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k rpcss c:\windows\system32\svchost.exe +** 4504 716 svchost.exe 0xd98df74fc080 22 - 0 False 2018-06-08 00:12:48.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -s CDPSvc c:\windows\system32\svchost.exe +** 1436 716 svchost.exe 0xd98df6838600 7 - 0 False 2018-06-08 00:12:27.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -s EventSystem c:\windows\system32\svchost.exe +** 1948 716 svchost.exe 0xd98df698e600 6 - 0 False 2018-06-08 00:12:29.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted C:\WINDOWS\System32\svchost.exe +** 5020 716 NisSrv.exe 0xd98df337d600 7 - 0 False 2018-06-08 00:13:09.000000 UTC N/A \Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.16.17656.18052-0\NisSrv.exe "C:\ProgramData\Microsoft\Windows Defender\platform\4.16.17656.18052-0\NisSrv.exe" C:\ProgramData\Microsoft\Windows Defender\platform\4.16.17656.18052-0\NisSrv.exe +** 2464 716 svchost.exe 0xd98df6d1d600 3 - 0 False 2018-06-08 00:12:35.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -s WdiServiceHost c:\windows\system32\svchost.exe +** 2988 716 svchost.exe 0xd98df5ce9600 41 - 0 False 2018-06-08 00:13:27.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k netsvcs c:\windows\system32\svchost.exe +** 428 716 svchost.exe 0xd98df8831080 5 - 0 False 2018-06-21 06:46:12.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe - - +** 9660 716 svchost.exe 0xd98df95d32c0 34 - 0 False 2018-06-21 06:47:06.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe C:\WINDOWS\system32\svchost.exe -k wsappx -s AppXSvc C:\WINDOWS\system32\svchost.exe +** 2504 716 svchost.exe 0xd98df6b53600 6 - 0 False 2018-06-08 00:12:33.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation c:\windows\system32\svchost.exe +** 9160 716 TrustedInstall 0xd98df503a080 8 - 0 False 2018-06-21 06:51:57.000000 UTC N/A 力�￿▰�￿￿￿￿￿솠▘솯▘ - - +** 3540 716 svchost.exe 0xd98df42b0080 26 - 2 False 2018-06-21 06:35:50.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k unistacksvcgroup -s WpnUserService c:\windows\system32\svchost.exe +** 3560 716 svchost.exe 0xd98df3d56600 10 - 2 False 2018-06-21 06:35:50.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc c:\windows\system32\svchost.exe +** 9200 716 svchost.exe 0xd98df6426600 9 - 0 False 2018-06-21 06:00:30.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -s lmhosts C:\WINDOWS\System32\svchost.exe +** 2036 716 svchost.exe 0xd98df69b2600 5 - 0 False 2018-06-08 00:12:29.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k appmodel -s StateRepository c:\windows\system32\svchost.exe +** 1532 716 svchost.exe 0xd98df6867600 12 - 0 False 2018-06-08 00:12:27.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -s NlaSvc c:\windows\system32\svchost.exe +* 944 568 fontdrvhost.ex 0xd98df6590600 6 - 0 False 2018-06-08 00:12:25.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\fontdrvhost.exe "fontdrvhost.exe" C:\WINDOWS\system32\fontdrvhost.exe +5932 5480 GoogleCrashHan 0xd98df53cd600 5 - 0 True 2018-06-08 00:14:30.000000 UTC N/A \Device\HarddiskVolume2\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler.exe "C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler.exe" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler.exe +5940 5480 GoogleCrashHan 0xd98df5242600 4 - 0 False 2018-06-08 00:14:37.000000 UTC N/A \Device\HarddiskVolume2\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler64.exe "C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler64.exe" C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler64.exe +4444 10208 MOM.exe 0xd98df5f67080 19 - 2 False 2018-06-21 06:36:28.000000 UTC N/A \Device\HarddiskVolume2\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM" PriorityLow C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe +* 880 4444 CCC.exe 0xd98df8be8600 26 - 2 False 2018-06-21 06:36:42.000000 UTC N/A \Device\HarddiskVolume2\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe" 0 C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe +4428 3236 OneDrive.exe 0xd98df47fd400 12 - 2 True 2018-06-21 06:39:27.000000 UTC N/A \Device\HarddiskVolume2\Users\passmark\AppData\Local\Microsoft\OneDrive\OneDrive.exe /updateInstalled /background C:\Users\passmark\AppData\Local\Microsoft\OneDrive\OneDrive.exe +6624 1596 software_repor 0xd98df63582c0 11 - 2 False 2018-06-21 06:39:48.000000 UTC N/A \Device\HarddiskVolume2\Users\passmark\AppData\Local\Google\Chrome\User Data\SwReporter\25.141.202\software_reporter_tool.exe "C:\Users\passmark\AppData\Local\Google\Chrome\User Data\SwReporter\25.141.202\software_reporter_tool.exe" --engine=2 --session-id=ZW5PrXGAp7Wy7c+zFw7c8g0zyjnOXmsyUp4U3EAA --registry-suffix=ESET --enable-crash-reporting C:\Users\passmark\AppData\Local\Google\Chrome\User Data\SwReporter\25.141.202\software_reporter_tool.exe +* 6620 6624 software_repor 0xd98df8800080 8 - 2 False 2018-06-21 06:39:48.000000 UTC N/A \Device\HarddiskVolume2\Users\passmark\AppData\Local\Google\Chrome\User Data\SwReporter\25.141.202\software_reporter_tool.exe "c:\users\passmark\appdata\local\google\chrome\user data\swreporter\25.141.202\software_reporter_tool.exe" --crash-handler "--database=c:\users\passmark\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=25.141.202 --initial-client-data=0x224,0x21c,0x228,0x220,0x22c,0x7ff7a0e19e10,0x7ff7a0e19e28,0x7ff7a0e19e40 c:\users\passmark\appdata\local\google\chrome\user data\swreporter\25.141.202\software_reporter_tool.exe +* 6708 6624 software_repor 0xd98df9d45600 5 - 2 False 2018-06-21 06:39:49.000000 UTC N/A \Device\HarddiskVolume2\Users\passmark\AppData\Local\Google\Chrome\User Data\SwReporter\25.141.202\software_reporter_tool.exe - - +1048 5468 mcbuilder.exe 0xd98df994a600 3 - 0 False 2018-06-21 06:43:17.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\mcbuilder.exe C:\WINDOWS\system32\mcbuilder.exe C:\WINDOWS\system32\mcbuilder.exe +* 9324 1048 conhost.exe 0xd98df99f7080 3 - 0 False 2018-06-21 06:43:19.000000 UTC N/A \Device\HarddiskVolume2\Windows\System32\conhost.exe - - +8892 5352 osf64.exe 0xd98df480e080 30 - 2 False 2018-06-21 06:49:21.000000 UTC N/A \Device\HarddiskVolume2\Program Files\OSForensics\osf64.exe "C:\Program Files\OSForensics\osf64.exe" C:\Program Files\OSForensics\osf64.exe diff --git a/Semaine_12/Jour_05/volatility/data/results/WinDump_dumpfiles_1168.log b/Semaine_12/Jour_05/volatility/data/results/WinDump_dumpfiles_1168.log new file mode 100644 index 0000000..c5688bd --- /dev/null +++ b/Semaine_12/Jour_05/volatility/data/results/WinDump_dumpfiles_1168.log @@ -0,0 +1,54 @@ +Volatility 3 Framework 2.28.0 + +Cache FileObject FileName Result + +DataSectionObject 0xd98df5160980 HarddiskVolume2e="Microsoft-Windows-ProfessionalNEdition" lan Error dumping file +DataSectionObject 0xd98df6a74a50 cversions.2.db file.0xd98df6a74a50.0xd98df6a76a60.DataSectionObject.cversions.2.db.dat +ImageSectionObject 0xd98df60bfae0 HarddiskVolume2l-TimeZones.Resources" version file.0xd98df60bfae0.0xd98df60be280.ImageSectionObject.HarddiskVolume2l-TimeZones.Resources" version.img +ImageSectionObject 0xd98df662e660 cryptdll.dll file.0xd98df662e660.0xd98df662fdb0.ImageSectionObject.cryptdll.dll.img +ImageSectionObject 0xd98df6ca13d0 mssprxy.dll file.0xd98df6ca13d0.0xd98df3e7a960.ImageSectionObject.mssprxy.dll.img +ImageSectionObject 0xd98df5093b60 SearchProtocolHost.exe file.0xd98df5093b60.0xd98df36c7270.ImageSectionObject.SearchProtocolHost.exe.img +ImageSectionObject 0xd98df3684ca0 msidle.dll file.0xd98df3684ca0.0xd98df510e8c0.ImageSectionObject.msidle.dll.img +ImageSectionObject 0xd98df72a0530 tquery.dll file.0xd98df72a0530.0xd98df3729010.ImageSectionObject.tquery.dll.img +ImageSectionObject 0xd98df4fa8800 edputil.dll file.0xd98df4fa8800.0xd98df64ad270.ImageSectionObject.edputil.dll.img +ImageSectionObject 0xd98df3c049d0 mssph.dll file.0xd98df3c049d0.0xd98df3eb2010.ImageSectionObject.mssph.dll.img +ImageSectionObject 0xd98df3128230 cldapi.dll file.0xd98df3128230.0xd98df62419b0.ImageSectionObject.cldapi.dll.img +ImageSectionObject 0xd98df6a81850 fltLib.dll file.0xd98df6a81850.0xd98df6a8d010.ImageSectionObject.fltLib.dll.img +ImageSectionObject 0xd98df68684b0 propsys.dll file.0xd98df68684b0.0xd98df6905670.ImageSectionObject.propsys.dll.img +ImageSectionObject 0xd98df68ae460 Windows.StateRepository.dll file.0xd98df68ae460.0xd98df68b54f0.ImageSectionObject.Windows.StateRepository.dll.img +ImageSectionObject 0xd98df69f8e90 StateRepository.Core.dll file.0xd98df69f8e90.0xd98df69fc130.ImageSectionObject.StateRepository.Core.dll.img +ImageSectionObject 0xd98df64019a0 linkinfo.dll file.0xd98df64019a0.0xd98df5de3010.ImageSectionObject.linkinfo.dll.img +ImageSectionObject 0xd98df66461d0 ntmarta.dll file.0xd98df66461d0.0xd98df665c910.ImageSectionObject.ntmarta.dll.img +ImageSectionObject 0xd98df6652080 authz.dll file.0xd98df6652080.0xd98df6634390.ImageSectionObject.authz.dll.img +ImageSectionObject 0xd98df60a4550 msvcp_win.dll file.0xd98df60a4550.0xd98df59f0350.ImageSectionObject.msvcp_win.dll.img +DataSectionObject 0xd98df606bbd0 kernel.appcore.dll Error dumping file +ImageSectionObject 0xd98df606bbd0 kernel.appcore.dll file.0xd98df606bbd0.0xd98df60927e0.ImageSectionObject.kernel.appcore.dll.img +ImageSectionObject 0xd98df6074960 powrprof.dll file.0xd98df6074960.0xd98df60a2690.ImageSectionObject.powrprof.dll.img +ImageSectionObject 0xd98df60a0ef0 KernelBase.dll file.0xd98df60a0ef0.0xd98df60ad3b0.ImageSectionObject.KernelBase.dll.img +ImageSectionObject 0xd98df60c8ef0 profapi.dll file.0xd98df60c8ef0.0xd98df60b9a90.ImageSectionObject.profapi.dll.img +ImageSectionObject 0xd98df6093080 windows.storage.dll file.0xd98df6093080.0xd98df60ad7b0.ImageSectionObject.windows.storage.dll.img +ImageSectionObject 0xd98df60a8ef0 bcryptprimitives.dll file.0xd98df60a8ef0.0xd98df609d4f0.ImageSectionObject.bcryptprimitives.dll.img +ImageSectionObject 0xd98df609f080 win32u.dll file.0xd98df609f080.0xd98df5124540.ImageSectionObject.win32u.dll.img +ImageSectionObject 0xd98df6093240 gdi32full.dll file.0xd98df6093240.0xd98df60ac970.ImageSectionObject.gdi32full.dll.img +ImageSectionObject 0xd98df606def0 shlwapi.dll file.0xd98df606def0.0xd98df606dc20.ImageSectionObject.shlwapi.dll.img +ImageSectionObject 0xd98df60adda0 user32.dll file.0xd98df60adda0.0xd98df5bde9d0.ImageSectionObject.user32.dll.img +ImageSectionObject 0xd98df60cbef0 msvcrt.dll file.0xd98df60cbef0.0xd98df60a4de0.ImageSectionObject.msvcrt.dll.img +ImageSectionObject 0xd98df60ad680 rpcrt4.dll file.0xd98df60ad680.0xd98df60ac010.ImageSectionObject.rpcrt4.dll.img +DataSectionObject 0xd98df60be080 kernel32.dll Error dumping file +ImageSectionObject 0xd98df60be080 kernel32.dll file.0xd98df60be080.0xd98df6090010.ImageSectionObject.kernel32.dll.img +ImageSectionObject 0xd98df60c9680 clbcatq.dll file.0xd98df60c9680.0xd98df60c7770.ImageSectionObject.clbcatq.dll.img +DataSectionObject 0xd98df6062500 ole32.dll Error dumping file +ImageSectionObject 0xd98df6062500 ole32.dll file.0xd98df6062500.0xd98df60bddb0.ImageSectionObject.ole32.dll.img +ImageSectionObject 0xd98df6006080 gdi32.dll file.0xd98df6006080.0xd98df606d9c0.ImageSectionObject.gdi32.dll.img +DataSectionObject 0xd98df606d080 shell32.dll Error dumping file +ImageSectionObject 0xd98df606d080 shell32.dll file.0xd98df606d080.0xd98df60399e0.ImageSectionObject.shell32.dll.img +ImageSectionObject 0xd98df6075220 combase.dll file.0xd98df6075220.0xd98df605a1e0.ImageSectionObject.combase.dll.img +ImageSectionObject 0xd98df6069ef0 sechost.dll file.0xd98df6069ef0.0xd98df605bb30.ImageSectionObject.sechost.dll.img +DataSectionObject 0xd98df4a96ef0 SHCore.dll Error dumping file +ImageSectionObject 0xd98df4a96ef0 SHCore.dll file.0xd98df4a96ef0.0xd98df606e9f0.ImageSectionObject.SHCore.dll.img +DataSectionObject 0xd98df6070ae0 oleaut32.dll Error dumping file +ImageSectionObject 0xd98df6070ae0 oleaut32.dll file.0xd98df6070ae0.0xd98df60706a0.ImageSectionObject.oleaut32.dll.img +ImageSectionObject 0xd98df6061d10 advapi32.dll file.0xd98df6061d10.0xd98df605ddb0.ImageSectionObject.advapi32.dll.img +DataSectionObject 0xd98df604c650 imm32.dll Error dumping file +ImageSectionObject 0xd98df604c650 imm32.dll file.0xd98df604c650.0xd98df6060010.ImageSectionObject.imm32.dll.img +ImageSectionObject 0xd98df4afdef0 ntdll.dll file.0xd98df4afdef0.0xd98df4e908b0.ImageSectionObject.ntdll.dll.img diff --git a/Semaine_12/Jour_05/volatility/data/results/WinDump_dumpfiles_6620.log b/Semaine_12/Jour_05/volatility/data/results/WinDump_dumpfiles_6620.log new file mode 100644 index 0000000..3eec681 --- /dev/null +++ b/Semaine_12/Jour_05/volatility/data/results/WinDump_dumpfiles_6620.log @@ -0,0 +1,57 @@ +Volatility 3 Framework 2.28.0 + +Cache FileObject FileName Result + +DataSectionObject 0xd98df8e397b0 software_reporter_tool-crashpad.log file.0xd98df8e397b0.0xd98df5fa4010.DataSectionObject.software_reporter_tool-crashpad.log.dat +SharedCacheMap 0xd98df8e397b0 software_reporter_tool-crashpad.log file.0xd98df8e397b0.0xd98df4509010.SharedCacheMap.software_reporter_tool-crashpad.log.vacb +DataSectionObject 0xd98df5160980 HarddiskVolume2e="Microsoft-Windows-ProfessionalNEdition" lan Error dumping file +ImageSectionObject 0xd98df60aa080 crypt32.dll Error dumping file +ImageSectionObject 0xd98df66312d0 IPHLPAPI.DLL file.0xd98df66312d0.0xd98df6633db0.ImageSectionObject.IPHLPAPI.DLL.img +ImageSectionObject 0xd98df752c740 winmm.dll file.0xd98df752c740.0xd98df6734430.ImageSectionObject.winmm.dll.img +DataSectionObject 0xd98df9f84ef0 software_reporter_tool.exe Error dumping file +ImageSectionObject 0xd98df9f84ef0 software_reporter_tool.exe file.0xd98df9f84ef0.0xd98df4ffb980.ImageSectionObject.software_reporter_tool.exe.img +ImageSectionObject 0xd98df3382420 wininet.dll file.0xd98df3382420.0xd98df33cf9b0.ImageSectionObject.wininet.dll.img +ImageSectionObject 0xd98df75409f0 winmmbase.dll file.0xd98df75409f0.0xd98df7297010.ImageSectionObject.winmmbase.dll.img +ImageSectionObject 0xd98df6bcc9f0 version.dll file.0xd98df6bcc9f0.0xd98df6bfb9b0.ImageSectionObject.version.dll.img +ImageSectionObject 0xd98df6ce8a90 winhttp.dll file.0xd98df6ce8a90.0xd98df6cf0d70.ImageSectionObject.winhttp.dll.img +DataSectionObject 0xd98df680a390 dwmapi.dll file.0xd98df680a390.0xd98df9bb29c0.DataSectionObject.dwmapi.dll.dat +ImageSectionObject 0xd98df680a390 dwmapi.dll file.0xd98df680a390.0xd98df680d9d0.ImageSectionObject.dwmapi.dll.img +ImageSectionObject 0xd98df5d6ca80 secur32.dll file.0xd98df5d6ca80.0xd98df6413db0.ImageSectionObject.secur32.dll.img +ImageSectionObject 0xd98df6682ef0 uxtheme.dll file.0xd98df6682ef0.0xd98df66f2b60.ImageSectionObject.uxtheme.dll.img +ImageSectionObject 0xd98df6074960 powrprof.dll file.0xd98df6074960.0xd98df60a2690.ImageSectionObject.powrprof.dll.img +ImageSectionObject 0xd98df59db170 sspicli.dll file.0xd98df59db170.0xd98df65a2db0.ImageSectionObject.sspicli.dll.img +ImageSectionObject 0xd98df511dc10 cryptbase.dll file.0xd98df511dc10.0xd98df511d3f0.ImageSectionObject.cryptbase.dll.img +ImageSectionObject 0xd98df60aa240 msasn1.dll file.0xd98df60aa240.0xd98df6093ac0.ImageSectionObject.msasn1.dll.img +DataSectionObject 0xd98df606bbd0 kernel.appcore.dll Error dumping file +ImageSectionObject 0xd98df606bbd0 kernel.appcore.dll file.0xd98df606bbd0.0xd98df60927e0.ImageSectionObject.kernel.appcore.dll.img +ImageSectionObject 0xd98df60c8ef0 profapi.dll file.0xd98df60c8ef0.0xd98df60b9a90.ImageSectionObject.profapi.dll.img +ImageSectionObject 0xd98df60a4550 msvcp_win.dll file.0xd98df60a4550.0xd98df59f0350.ImageSectionObject.msvcp_win.dll.img +ImageSectionObject 0xd98df60a0ef0 KernelBase.dll file.0xd98df60a0ef0.0xd98df60ad3b0.ImageSectionObject.KernelBase.dll.img +ImageSectionObject 0xd98df609f080 win32u.dll file.0xd98df609f080.0xd98df5124540.ImageSectionObject.win32u.dll.img +DataSectionObject 0xd98df60be080 kernel32.dll Error dumping file +ImageSectionObject 0xd98df60be080 kernel32.dll file.0xd98df60be080.0xd98df6090010.ImageSectionObject.kernel32.dll.img +ImageSectionObject 0xd98df60ad680 rpcrt4.dll file.0xd98df60ad680.0xd98df60ac010.ImageSectionObject.rpcrt4.dll.img +ImageSectionObject 0xd98df6093240 gdi32full.dll file.0xd98df6093240.0xd98df60ac970.ImageSectionObject.gdi32full.dll.img +ImageSectionObject 0xd98df60a8ef0 bcryptprimitives.dll file.0xd98df60a8ef0.0xd98df609d4f0.ImageSectionObject.bcryptprimitives.dll.img +ImageSectionObject 0xd98df6093080 windows.storage.dll file.0xd98df6093080.0xd98df60ad7b0.ImageSectionObject.windows.storage.dll.img +ImageSectionObject 0xd98df60bfae0 HarddiskVolume2l-TimeZones.Resources" version file.0xd98df60bfae0.0xd98df60be280.ImageSectionObject.HarddiskVolume2l-TimeZones.Resources" version.img +ImageSectionObject 0xd98df60adda0 user32.dll file.0xd98df60adda0.0xd98df5bde9d0.ImageSectionObject.user32.dll.img +ImageSectionObject 0xd98df60cbef0 msvcrt.dll file.0xd98df60cbef0.0xd98df60a4de0.ImageSectionObject.msvcrt.dll.img +DataSectionObject 0xd98df6062500 ole32.dll Error dumping file +ImageSectionObject 0xd98df6062500 ole32.dll file.0xd98df6062500.0xd98df60bddb0.ImageSectionObject.ole32.dll.img +ImageSectionObject 0xd98df6069ef0 sechost.dll file.0xd98df6069ef0.0xd98df605bb30.ImageSectionObject.sechost.dll.img +ImageSectionObject 0xd98df6006080 gdi32.dll file.0xd98df6006080.0xd98df606d9c0.ImageSectionObject.gdi32.dll.img +ImageSectionObject 0xd98df546cef0 psapi.dll file.0xd98df546cef0.0xd98df605b900.ImageSectionObject.psapi.dll.img +DataSectionObject 0xd98df606d080 shell32.dll Error dumping file +ImageSectionObject 0xd98df606d080 shell32.dll file.0xd98df606d080.0xd98df60399e0.ImageSectionObject.shell32.dll.img +ImageSectionObject 0xd98df606def0 shlwapi.dll file.0xd98df606def0.0xd98df606dc20.ImageSectionObject.shlwapi.dll.img +ImageSectionObject 0xd98df606d800 msctf.dll file.0xd98df606d800.0xd98df5195830.ImageSectionObject.msctf.dll.img +DataSectionObject 0xd98df4a96ef0 SHCore.dll Error dumping file +ImageSectionObject 0xd98df4a96ef0 SHCore.dll file.0xd98df4a96ef0.0xd98df606e9f0.ImageSectionObject.SHCore.dll.img +ImageSectionObject 0xd98df6061d10 advapi32.dll file.0xd98df6061d10.0xd98df605ddb0.ImageSectionObject.advapi32.dll.img +ImageSectionObject 0xd98df6075220 combase.dll file.0xd98df6075220.0xd98df605a1e0.ImageSectionObject.combase.dll.img +DataSectionObject 0xd98df604c650 imm32.dll Error dumping file +ImageSectionObject 0xd98df604c650 imm32.dll file.0xd98df604c650.0xd98df6060010.ImageSectionObject.imm32.dll.img +ImageSectionObject 0xd98df4afdef0 ntdll.dll file.0xd98df4afdef0.0xd98df4e908b0.ImageSectionObject.ntdll.dll.img +DataSectionObject 0xd98df6070ae0 oleaut32.dll Error dumping file +ImageSectionObject 0xd98df6070ae0 oleaut32.dll file.0xd98df6070ae0.0xd98df60706a0.ImageSectionObject.oleaut32.dll.img diff --git a/Semaine_12/Jour_05/volatility/data/results/WinDump_vadinfo_1168.log b/Semaine_12/Jour_05/volatility/data/results/WinDump_vadinfo_1168.log new file mode 100644 index 0000000..c924da3 --- /dev/null +++ b/Semaine_12/Jour_05/volatility/data/results/WinDump_vadinfo_1168.log @@ -0,0 +1,96 @@ +Volatility 3 Framework 2.28.0 + +PID Process Offset Start VPN End VPN Tag Protection CommitCharge PrivateMemory Parent File File output + +1168 SearchProtocol 0xffffd98dfa330570 0x7df5ff4f0000 0x7ff5ff4effff Vad PAGE_NOACCESS 15 0 0x0 N/A Error outputting file +1168 SearchProtocol 0xffffd98df4811c00 0x20a2fd70000 0x20a2fe6ffff VadS PAGE_READWRITE 132 1 0xffffd98dfa330570 N/A pid.1168.vad.0x20a2fd70000-0x20a2fe6ffff-1.dmp +1168 SearchProtocol 0xffffd98df4f9a8e0 0x20a2fcc0000 0x20a2fcd7fff Vad PAGE_READONLY 0 0 0xffffd98df4811c00 N/A pid.1168.vad.0x20a2fcc0000-0x20a2fcd7fff-1.dmp +1168 SearchProtocol 0xffffd98df7f356b0 0xdf8fb00000 0xdf8fb7ffff VadS PAGE_READWRITE 16 1 0xffffd98df4f9a8e0 N/A pid.1168.vad.0xdf8fb00000-0xdf8fb7ffff-1.dmp +1168 SearchProtocol 0xffffd98df943c360 0xdf8f800000 0xdf8f9fffff VadS PAGE_READWRITE 13 1 0xffffd98df7f356b0 N/A pid.1168.vad.0xdf8f800000-0xdf8f9fffff-1.dmp +1168 SearchProtocol 0xffffd98df8d377b0 0x7ffe1000 0x7ffeffff VadS PAGE_READONLY 2147483647 1 0xffffd98df943c360 N/A pid.1168.vad.0x7ffe1000-0x7ffeffff-1.dmp +1168 SearchProtocol 0xffffd98df39c52e0 0x7ffe0000 0x7ffe0fff VadS PAGE_READONLY 1 1 0xffffd98df8d377b0 N/A pid.1168.vad.0x7ffe0000-0x7ffe0fff-1.dmp +1168 SearchProtocol 0xffffd98df527c0f0 0xdf8f610000 0xdf8f68ffff VadS PAGE_READWRITE 22 1 0xffffd98df8d377b0 N/A pid.1168.vad.0xdf8f610000-0xdf8f68ffff-1.dmp +1168 SearchProtocol 0xffffd98df3881d70 0xdf8fa80000 0xdf8fafffff VadS PAGE_READWRITE 11 1 0xffffd98df943c360 N/A pid.1168.vad.0xdf8fa80000-0xdf8fafffff-1.dmp +1168 SearchProtocol 0xffffd98df919f150 0xdf8fc80000 0xdf8fcfffff VadS PAGE_READWRITE 11 1 0xffffd98df7f356b0 N/A pid.1168.vad.0xdf8fc80000-0xdf8fcfffff-1.dmp +1168 SearchProtocol 0xffffd98df646bca0 0xdf8fc00000 0xdf8fc7ffff VadS PAGE_READWRITE 11 1 0xffffd98df919f150 N/A pid.1168.vad.0xdf8fc00000-0xdf8fc7ffff-1.dmp +1168 SearchProtocol 0xffffd98df4fdb8b0 0xdf8fb80000 0xdf8fbfffff VadS PAGE_READWRITE 11 1 0xffffd98df646bca0 N/A pid.1168.vad.0xdf8fb80000-0xdf8fbfffff-1.dmp +1168 SearchProtocol 0xffffd98df9130c50 0x20a2fca0000 0x20a2fcaffff Vad PAGE_READWRITE 0 0 0xffffd98df919f150 N/A pid.1168.vad.0x20a2fca0000-0x20a2fcaffff-1.dmp +1168 SearchProtocol 0xffffd98df3a38650 0x20a2fcb0000 0x20a2fcb0fff VadS PAGE_READWRITE 1 1 0xffffd98df9130c50 N/A pid.1168.vad.0x20a2fcb0000-0x20a2fcb0fff-1.dmp +1168 SearchProtocol 0xffffd98df75e7300 0x20a2fd00000 0x20a2fd00fff VadS PAGE_READWRITE 1 1 0xffffd98df4f9a8e0 N/A pid.1168.vad.0x20a2fd00000-0x20a2fd00fff-1.dmp +1168 SearchProtocol 0xffffd98df5cc6230 0x20a2fcf0000 0x20a2fcf0fff Vad PAGE_READONLY 0 0 0xffffd98df75e7300 N/A pid.1168.vad.0x20a2fcf0000-0x20a2fcf0fff-1.dmp +1168 SearchProtocol 0xffffd98df39763e0 0x20a2fce0000 0x20a2fce3fff Vad PAGE_READONLY 0 0 0xffffd98df5cc6230 N/A pid.1168.vad.0x20a2fce0000-0x20a2fce3fff-1.dmp +1168 SearchProtocol 0xffffd98df739dad0 0x20a2fd30000 0x20a2fd49fff VadS PAGE_READWRITE 1 1 0xffffd98df75e7300 N/A pid.1168.vad.0x20a2fd30000-0x20a2fd49fff-1.dmp +1168 SearchProtocol 0xffffd98df94924c0 0x20a2fd10000 0x20a2fd29fff VadS PAGE_READWRITE 3 1 0xffffd98df739dad0 N/A pid.1168.vad.0x20a2fd10000-0x20a2fd29fff-1.dmp +1168 SearchProtocol 0xffffd98df3a6a900 0x20a2fd50000 0x20a2fd50fff VadS PAGE_READWRITE 1 1 0xffffd98df739dad0 N/A pid.1168.vad.0x20a2fd50000-0x20a2fd50fff-1.dmp +1168 SearchProtocol 0xffffd98df52291a0 0x20a2fd60000 0x20a2fd60fff VadS PAGE_READWRITE 1 1 0xffffd98df3a6a900 N/A pid.1168.vad.0x20a2fd60000-0x20a2fd60fff-1.dmp +1168 SearchProtocol 0xffffd98df93b9450 0x20a30980000 0x20a30980fff Vad PAGE_READWRITE 0 0 0xffffd98df4811c00 N/A pid.1168.vad.0x20a30980000-0x20a30980fff-1.dmp +1168 SearchProtocol 0xffffd98df70991b0 0x20a30040000 0x20a3004ffff VadS PAGE_READWRITE 15 1 0xffffd98df93b9450 N/A pid.1168.vad.0x20a30040000-0x20a3004ffff-1.dmp +1168 SearchProtocol 0xffffd98df4260730 0x20a30010000 0x20a30010fff Vad PAGE_READONLY 0 0 0xffffd98df70991b0 N/A pid.1168.vad.0x20a30010000-0x20a30010fff-1.dmp +1168 SearchProtocol 0xffffd98df8e701b0 0x20a2ff40000 0x20a2fffffff Vad PAGE_READONLY 0 0 0xffffd98df4260730 N/A pid.1168.vad.0x20a2ff40000-0x20a2fffffff-1.dmp +1168 SearchProtocol 0xffffd98df85a6a90 0x20a2fe70000 0x20a2ff34fff Vad PAGE_READONLY 0 0 0xffffd98df8e701b0 \Windows\System32\locale.nls pid.1168.vad.0x20a2fe70000-0x20a2ff34fff-1.dmp +1168 SearchProtocol 0xffffd98df5494a40 0x20a30000000 0x20a30000fff Vad PAGE_READONLY 0 0 0xffffd98df8e701b0 N/A pid.1168.vad.0x20a30000000-0x20a30000fff-1.dmp +1168 SearchProtocol 0xffffd98dfac491e0 0x20a30020000 0x20a30025fff Vad PAGE_READONLY 0 0 0xffffd98df4260730 \Windows\Registration\R00000000000d.clb pid.1168.vad.0x20a30020000-0x20a30025fff-1.dmp +1168 SearchProtocol 0xffffd98df8b86b60 0x20a30030000 0x20a3003ffff VadS PAGE_NOACCESS 1 1 0xffffd98dfac491e0 N/A pid.1168.vad.0x20a30030000-0x20a3003ffff-1.dmp +1168 SearchProtocol 0xffffd98df5343d50 0x20a30520000 0x20a3052ffff Vad PAGE_READWRITE 0 0 0xffffd98df70991b0 N/A pid.1168.vad.0x20a30520000-0x20a3052ffff-1.dmp +1168 SearchProtocol 0xffffd98df4bef5f0 0x20a30260000 0x20a303e0fff Vad PAGE_READONLY 0 0 0xffffd98df5343d50 N/A pid.1168.vad.0x20a30260000-0x20a303e0fff-1.dmp +1168 SearchProtocol 0xffffd98df70f1cc0 0x20a30050000 0x20a30257fff Vad PAGE_READONLY 0 0 0xffffd98df4bef5f0 N/A pid.1168.vad.0x20a30050000-0x20a30257fff-1.dmp +1168 SearchProtocol 0xffffd98df3ec8880 0x20a303f0000 0x20a3051dfff Vad PAGE_READONLY 0 0 0xffffd98df4bef5f0 \Windows\System32\en-US\KernelBase.dll.mui pid.1168.vad.0x20a303f0000-0x20a3051dfff-1.dmp +1168 SearchProtocol 0xffffd98df3e7f180 0x20a30540000 0x20a3063ffff VadS PAGE_READWRITE 1 1 0xffffd98df5343d50 N/A pid.1168.vad.0x20a30540000-0x20a3063ffff-1.dmp +1168 SearchProtocol 0xffffd98df70b62a0 0x20a30530000 0x20a3053ffff Vad PAGE_READWRITE 0 0 0xffffd98df3e7f180 N/A pid.1168.vad.0x20a30530000-0x20a3053ffff-1.dmp +1168 SearchProtocol 0xffffd98df7c7dc50 0x20a30640000 0x20a30976fff Vad PAGE_READONLY 0 0 0xffffd98df3e7f180 e="Microsoft-Windows-ProfessionalNEdition" lan pid.1168.vad.0x20a30640000-0x20a30976fff-1.dmp +1168 SearchProtocol 0xffffd98df3961de0 0x20a30ae0000 0x20a30ae3fff Vad PAGE_READONLY 0 0 0xffffd98df93b9450 \ProgramData\Microsoft\Windows\Caches\cversions.2.db pid.1168.vad.0x20a30ae0000-0x20a30ae3fff-1.dmp +1168 SearchProtocol 0xffffd98df3bd81e0 0x20a30a00000 0x20a30a03fff Vad PAGE_READONLY 0 0 0xffffd98df3961de0 \ProgramData\Microsoft\Windows\Caches\cversions.2.db pid.1168.vad.0x20a30a00000-0x20a30a03fff-1.dmp +1168 SearchProtocol 0xffffd98df73b8c50 0x20a309a0000 0x20a309a3fff Vad PAGE_READONLY 0 0 0xffffd98df3bd81e0 \ProgramData\Microsoft\Windows\Caches\cversions.2.db pid.1168.vad.0x20a309a0000-0x20a309a3fff-1.dmp +1168 SearchProtocol 0xffffd98df3a45710 0x20a30990000 0x20a30990fff Vad PAGE_READWRITE 0 0 0xffffd98df73b8c50 N/A pid.1168.vad.0x20a30990000-0x20a30990fff-1.dmp +1168 SearchProtocol 0xffffd98df8d4e450 0x20a309b0000 0x20a309f5fff Vad PAGE_READONLY 0 0 0xffffd98df73b8c50 \ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db pid.1168.vad.0x20a309b0000-0x20a309f5fff-1.dmp +1168 SearchProtocol 0xffffd98df637b1a0 0x20a30ab0000 0x20a30ac0fff Vad PAGE_READONLY 0 0 0xffffd98df3bd81e0 \Windows\System32\en-US\propsys.dll.mui pid.1168.vad.0x20a30ab0000-0x20a30ac0fff-1.dmp +1168 SearchProtocol 0xffffd98df6261a70 0x20a30a10000 0x20a30aa1fff Vad PAGE_READONLY 0 0 0xffffd98df637b1a0 \ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db pid.1168.vad.0x20a30a10000-0x20a30aa1fff-1.dmp +1168 SearchProtocol 0xffffd98df435b4a0 0x20a30ad0000 0x20a30ad8fff Vad PAGE_READONLY 0 0 0xffffd98df637b1a0 \Windows\System32\en-US\windows.storage.dll.mui pid.1168.vad.0x20a30ad0000-0x20a30ad8fff-1.dmp +1168 SearchProtocol 0xffffd98df41f3570 0x20a30b50000 0x20a30b54fff Vad PAGE_READONLY 0 0 0xffffd98df3961de0 \Windows\System32\winnlsres.dll pid.1168.vad.0x20a30b50000-0x20a30b54fff-1.dmp +1168 SearchProtocol 0xffffd98df8b6e800 0x20a30af0000 0x20a30b4ffff Vad PAGE_READONLY 0 0 0xffffd98df41f3570 \Windows\System32\en-US\shell32.dll.mui pid.1168.vad.0x20a30af0000-0x20a30b4ffff-1.dmp +1168 SearchProtocol 0xffffd98df7ec7710 0x20a30b60000 0x20a30b6ffff Vad PAGE_READONLY 0 0 0xffffd98df41f3570 \Windows\System32\en-US\winnlsres.dll.mui pid.1168.vad.0x20a30b60000-0x20a30b6ffff-1.dmp +1168 SearchProtocol 0xffffd98df7d43c50 0x20a30b70000 0x20a30c6ffff VadS PAGE_READWRITE 4 1 0xffffd98df7ec7710 N/A pid.1168.vad.0x20a30b70000-0x20a30c6ffff-1.dmp +1168 SearchProtocol 0xffffd98df3a52430 0x7ff9a6d50000 0x7ff9a6e45fff Vad PAGE_EXECUTE_WRITECOPY 5 0 0xffffd98dfa330570 l-TimeZones.Resources" version pid.1168.vad.0x7ff9a6d50000-0x7ff9a6e45fff-1.dmp +1168 SearchProtocol 0xffffd98dfaaa71b0 0x7ff9a5670000 0x7ff9a5683fff Vad PAGE_EXECUTE_WRITECOPY 4 0 0xffffd98df3a52430 \Windows\System32\cryptdll.dll pid.1168.vad.0x7ff9a5670000-0x7ff9a5683fff-1.dmp +1168 SearchProtocol 0xffffd98df746dcf0 0x7ff9a0320000 0x7ff9a0343fff Vad PAGE_EXECUTE_WRITECOPY 2 0 0xffffd98dfaaa71b0 \Windows\System32\mssprxy.dll pid.1168.vad.0x7ff9a0320000-0x7ff9a0343fff-1.dmp +1168 SearchProtocol 0xffffd98dfab4a510 0x7ff6e12b0000 0x7ff6e130dfff Vad PAGE_EXECUTE_WRITECOPY 4 0 0xffffd98df746dcf0 \Windows\System32\SearchProtocolHost.exe pid.1168.vad.0x7ff6e12b0000-0x7ff6e130dfff-1.dmp +1168 SearchProtocol 0xffffd98df3a8a3d0 0x7ff6e0a20000 0x7ff6e0a42fff Vad PAGE_READONLY 0 0 0xffffd98dfab4a510 N/A pid.1168.vad.0x7ff6e0a20000-0x7ff6e0a42fff-1.dmp +1168 SearchProtocol 0xffffd98df50d12c0 0x7ff6e0920000 0x7ff6e0a1ffff Vad PAGE_READONLY 0 0 0xffffd98df3a8a3d0 N/A pid.1168.vad.0x7ff6e0920000-0x7ff6e0a1ffff-1.dmp +1168 SearchProtocol 0xffffd98dfabb9a20 0x7ff997e20000 0x7ff997e26fff Vad PAGE_EXECUTE_WRITECOPY 2 0 0xffffd98dfab4a510 \Windows\System32\msidle.dll pid.1168.vad.0x7ff997e20000-0x7ff997e26fff-1.dmp +1168 SearchProtocol 0xffffd98df62527e0 0x7ff9911e0000 0x7ff99151efff Vad PAGE_EXECUTE_WRITECOPY 9 0 0xffffd98dfabb9a20 \Windows\System32\tquery.dll pid.1168.vad.0x7ff9911e0000-0x7ff99151efff-1.dmp +1168 SearchProtocol 0xffffd98dfa3cced0 0x7ff994650000 0x7ff994693fff Vad PAGE_EXECUTE_WRITECOPY 4 0 0xffffd98df62527e0 \Windows\System32\edputil.dll pid.1168.vad.0x7ff994650000-0x7ff994693fff-1.dmp +1168 SearchProtocol 0xffffd98df75a2c20 0x7ff99a460000 0x7ff99a48efff Vad PAGE_EXECUTE_WRITECOPY 5 0 0xffffd98dfabb9a20 \Windows\System32\mssph.dll pid.1168.vad.0x7ff99a460000-0x7ff99a48efff-1.dmp +1168 SearchProtocol 0xffffd98df5d34760 0x7ff99a440000 0x7ff99a451fff Vad PAGE_EXECUTE_WRITECOPY 2 0 0xffffd98df75a2c20 \Windows\System32\cldapi.dll pid.1168.vad.0x7ff99a440000-0x7ff99a451fff-1.dmp +1168 SearchProtocol 0xffffd98df3ada2f0 0x7ff99ff00000 0x7ff99ff09fff Vad PAGE_EXECUTE_WRITECOPY 2 0 0xffffd98df75a2c20 \Windows\System32\fltLib.dll pid.1168.vad.0x7ff99ff00000-0x7ff99ff09fff-1.dmp +1168 SearchProtocol 0xffffd98df7a969c0 0x7ff9a1bd0000 0x7ff9a1d65fff Vad PAGE_EXECUTE_WRITECOPY 5 0 0xffffd98df746dcf0 \Windows\System32\propsys.dll pid.1168.vad.0x7ff9a1bd0000-0x7ff9a1d65fff-1.dmp +1168 SearchProtocol 0xffffd98df89cbb60 0x7ff9a0d80000 0x7ff9a1285fff Vad PAGE_EXECUTE_WRITECOPY 9 0 0xffffd98df7a969c0 \Windows\System32\Windows.StateRepository.dll pid.1168.vad.0x7ff9a0d80000-0x7ff9a1285fff-1.dmp +1168 SearchProtocol 0xffffd98df9bbe9e0 0x7ff9a0cd0000 0x7ff9a0d73fff Vad PAGE_EXECUTE_WRITECOPY 4 0 0xffffd98df89cbb60 \Windows\System32\StateRepository.Core.dll pid.1168.vad.0x7ff9a0cd0000-0x7ff9a0d73fff-1.dmp +1168 SearchProtocol 0xffffd98df7ec77c0 0x7ff9a14e0000 0x7ff9a14effff Vad PAGE_EXECUTE_WRITECOPY 3 0 0xffffd98df89cbb60 \Windows\System32\linkinfo.dll pid.1168.vad.0x7ff9a14e0000-0x7ff9a14effff-1.dmp +1168 SearchProtocol 0xffffd98df7f82bb0 0x7ff9a4f70000 0x7ff9a4fa0fff Vad PAGE_EXECUTE_WRITECOPY 4 0 0xffffd98df7a969c0 \Windows\System32\ntmarta.dll pid.1168.vad.0x7ff9a4f70000-0x7ff9a4fa0fff-1.dmp +1168 SearchProtocol 0xffffd98df84c5470 0x7ff9a5030000 0x7ff9a5077fff Vad PAGE_EXECUTE_WRITECOPY 4 0 0xffffd98df7f82bb0 \Windows\System32\authz.dll pid.1168.vad.0x7ff9a5030000-0x7ff9a5077fff-1.dmp +1168 SearchProtocol 0xffffd98df3e57270 0x7ff9a6060000 0x7ff9a60f9fff Vad PAGE_EXECUTE_WRITECOPY 6 0 0xffffd98dfaaa71b0 \Windows\System32\msvcp_win.dll pid.1168.vad.0x7ff9a6060000-0x7ff9a60f9fff-1.dmp +1168 SearchProtocol 0xffffd98df91636c0 0x7ff9a5db0000 0x7ff9a5dc0fff Vad PAGE_EXECUTE_WRITECOPY 3 0 0xffffd98df3e57270 \Windows\System32\kernel.appcore.dll pid.1168.vad.0x7ff9a5db0000-0x7ff9a5dc0fff-1.dmp +1168 SearchProtocol 0xffffd98df6d08010 0x7ff9a5d60000 0x7ff9a5dabfff Vad PAGE_EXECUTE_WRITECOPY 3 0 0xffffd98df91636c0 \Windows\System32\powrprof.dll pid.1168.vad.0x7ff9a5d60000-0x7ff9a5dabfff-1.dmp +1168 SearchProtocol 0xffffd98df7e627a0 0x7ff9a5e10000 0x7ff9a6058fff Vad PAGE_EXECUTE_WRITECOPY 9 0 0xffffd98df91636c0 \Windows\System32\KernelBase.dll pid.1168.vad.0x7ff9a5e10000-0x7ff9a6058fff-1.dmp +1168 SearchProtocol 0xffffd98df42a0590 0x7ff9a5dd0000 0x7ff9a5de4fff Vad PAGE_EXECUTE_WRITECOPY 3 0 0xffffd98df7e627a0 \Windows\System32\profapi.dll pid.1168.vad.0x7ff9a5dd0000-0x7ff9a5de4fff-1.dmp +1168 SearchProtocol 0xffffd98df4ec3890 0x7ff9a64c0000 0x7ff9a6bb0fff Vad PAGE_EXECUTE_WRITECOPY 11 0 0xffffd98df3e57270 \Windows\System32\windows.storage.dll pid.1168.vad.0x7ff9a64c0000-0x7ff9a6bb0fff-1.dmp +1168 SearchProtocol 0xffffd98df8ed09d0 0x7ff9a6400000 0x7ff9a6469fff Vad PAGE_EXECUTE_WRITECOPY 2 0 0xffffd98df4ec3890 \Windows\System32\bcryptprimitives.dll pid.1168.vad.0x7ff9a6400000-0x7ff9a6469fff-1.dmp +1168 SearchProtocol 0xffffd98df4bf6de0 0x7ff9a6160000 0x7ff9a617dfff Vad PAGE_EXECUTE_WRITECOPY 2 0 0xffffd98df8ed09d0 \Windows\System32\win32u.dll pid.1168.vad.0x7ff9a6160000-0x7ff9a617dfff-1.dmp +1168 SearchProtocol 0xffffd98df3734db0 0x7ff9a6470000 0x7ff9a64b8fff Vad PAGE_EXECUTE_WRITECOPY 5 0 0xffffd98df8ed09d0 \Windows\System32\cfgmgr32.dll pid.1168.vad.0x7ff9a6470000-0x7ff9a64b8fff-1.dmp +1168 SearchProtocol 0xffffd98dfa64d430 0x7ff9a6bc0000 0x7ff9a6d46fff Vad PAGE_EXECUTE_WRITECOPY 8 0 0xffffd98df4ec3890 \Windows\System32\gdi32full.dll pid.1168.vad.0x7ff9a6bc0000-0x7ff9a6d46fff-1.dmp +1168 SearchProtocol 0xffffd98df52a96f0 0x7ff9a8f60000 0x7ff9a8fb0fff Vad PAGE_EXECUTE_WRITECOPY 4 0 0xffffd98df3a52430 \Windows\System32\shlwapi.dll pid.1168.vad.0x7ff9a8f60000-0x7ff9a8fb0fff-1.dmp +1168 SearchProtocol 0xffffd98df5cf1670 0x7ff9a7130000 0x7ff9a7279fff Vad PAGE_EXECUTE_WRITECOPY 6 0 0xffffd98df52a96f0 \Windows\System32\user32.dll pid.1168.vad.0x7ff9a7130000-0x7ff9a7279fff-1.dmp +1168 SearchProtocol 0xffffd98df92d9c70 0x7ff9a7090000 0x7ff9a712cfff Vad PAGE_EXECUTE_WRITECOPY 10 0 0xffffd98df5cf1670 \Windows\System32\msvcrt.dll pid.1168.vad.0x7ff9a7090000-0x7ff9a712cfff-1.dmp +1168 SearchProtocol 0xffffd98df687c1b0 0x7ff9a6e70000 0x7ff9a6f94fff Vad PAGE_EXECUTE_WRITECOPY 5 0 0xffffd98df92d9c70 \Windows\System32\rpcrt4.dll pid.1168.vad.0x7ff9a6e70000-0x7ff9a6f94fff-1.dmp +1168 SearchProtocol 0xffffd98df671e340 0x7ff9a78c0000 0x7ff9a796dfff Vad PAGE_EXECUTE_WRITECOPY 6 0 0xffffd98df5cf1670 \Windows\System32\kernel32.dll pid.1168.vad.0x7ff9a78c0000-0x7ff9a796dfff-1.dmp +1168 SearchProtocol 0xffffd98df676ed40 0x7ff9a73d0000 0x7ff9a746dfff Vad PAGE_EXECUTE_WRITECOPY 9 0 0xffffd98df671e340 \Windows\System32\clbcatq.dll pid.1168.vad.0x7ff9a73d0000-0x7ff9a746dfff-1.dmp +1168 SearchProtocol 0xffffd98df3bf2010 0x7ff9a7280000 0x7ff9a73c4fff Vad PAGE_EXECUTE_WRITECOPY 5 0 0xffffd98df676ed40 \Windows\System32\ole32.dll pid.1168.vad.0x7ff9a7280000-0x7ff9a73c4fff-1.dmp +1168 SearchProtocol 0xffffd98df83c51b0 0x7ff9a8dc0000 0x7ff9a8de6fff Vad PAGE_EXECUTE_WRITECOPY 4 0 0xffffd98df671e340 \Windows\System32\gdi32.dll pid.1168.vad.0x7ff9a8dc0000-0x7ff9a8de6fff-1.dmp +1168 SearchProtocol 0xffffd98df67aed50 0x7ff9a7970000 0x7ff9a8da7fff Vad PAGE_EXECUTE_WRITECOPY 15 0 0xffffd98df83c51b0 \Windows\System32\shell32.dll pid.1168.vad.0x7ff9a7970000-0x7ff9a8da7fff-1.dmp +1168 SearchProtocol 0xffffd98dfa7be810 0x7ff9a9130000 0x7ff9a9428fff Vad PAGE_EXECUTE_WRITECOPY 9 0 0xffffd98df52a96f0 \Windows\System32\combase.dll pid.1168.vad.0x7ff9a9130000-0x7ff9a9428fff-1.dmp +1168 SearchProtocol 0xffffd98df51c8b70 0x7ff9a9070000 0x7ff9a90c8fff Vad PAGE_EXECUTE_WRITECOPY 5 0 0xffffd98dfa7be810 \Windows\System32\sechost.dll pid.1168.vad.0x7ff9a9070000-0x7ff9a90c8fff-1.dmp +1168 SearchProtocol 0xffffd98df4847790 0x7ff9a8fc0000 0x7ff9a9069fff Vad PAGE_EXECUTE_WRITECOPY 5 0 0xffffd98df51c8b70 \Windows\System32\SHCore.dll pid.1168.vad.0x7ff9a8fc0000-0x7ff9a9069fff-1.dmp +1168 SearchProtocol 0xffffd98df53b4e90 0x7ff9a97c0000 0x7ff9a987ffff Vad PAGE_EXECUTE_WRITECOPY 6 0 0xffffd98dfa7be810 \Windows\System32\oleaut32.dll pid.1168.vad.0x7ff9a97c0000-0x7ff9a987ffff-1.dmp +1168 SearchProtocol 0xffffd98df390b600 0x7ff9a9600000 0x7ff9a96a0fff Vad PAGE_EXECUTE_WRITECOPY 8 0 0xffffd98df53b4e90 \Windows\System32\advapi32.dll pid.1168.vad.0x7ff9a9600000-0x7ff9a96a0fff-1.dmp +1168 SearchProtocol 0xffffd98df93fa1b0 0x7ff9a9430000 0x7ff9a945cfff Vad PAGE_EXECUTE_WRITECOPY 3 0 0xffffd98df390b600 \Windows\System32\imm32.dll pid.1168.vad.0x7ff9a9430000-0x7ff9a945cfff-1.dmp +1168 SearchProtocol 0xffffd98df7e91a10 0x7ff9a98f0000 0x7ff9a9acafff Vad PAGE_EXECUTE_WRITECOPY 13 0 0xffffd98df53b4e90 \Windows\System32\ntdll.dll pid.1168.vad.0x7ff9a98f0000-0x7ff9a9acafff-1.dmp diff --git a/Semaine_12/Jour_05/volatility/data/results/WinDump_vadinfo_6620.log b/Semaine_12/Jour_05/volatility/data/results/WinDump_vadinfo_6620.log new file mode 100644 index 0000000..d06a6d3 --- /dev/null +++ b/Semaine_12/Jour_05/volatility/data/results/WinDump_vadinfo_6620.log @@ -0,0 +1,84 @@ +Volatility 3 Framework 2.28.0 + +PID Process Offset Start VPN End VPN Tag Protection CommitCharge PrivateMemory Parent File File output + +6620 software_repor 0xffffd98df98be960 0x7df5ff6a0000 0x7ff5ff69ffff Vad PAGE_NOACCESS 53 0 0x0 N/A Error outputting file +6620 software_repor 0xffffd98df7487b90 0x270603c0000 0x270603c0fff VadS PAGE_READWRITE 1 1 0xffffd98df98be960 N/A pid.6620.vad.0x270603c0000-0x270603c0fff.dmp +6620 software_repor 0xffffd98df4bcbd50 0x27060250000 0x27060267fff Vad PAGE_READONLY 0 0 0xffffd98df7487b90 N/A pid.6620.vad.0x27060250000-0x27060267fff.dmp +6620 software_repor 0xffffd98df5850af0 0xa947000000 0xa9470fffff VadS PAGE_READWRITE 6 1 0xffffd98df4bcbd50 N/A pid.6620.vad.0xa947000000-0xa9470fffff.dmp +6620 software_repor 0xffffd98df91b04c0 0xa946a00000 0xa946bfffff VadS PAGE_READWRITE 17 1 0xffffd98df5850af0 N/A pid.6620.vad.0xa946a00000-0xa946bfffff.dmp +6620 software_repor 0xffffd98df4f25f00 0x7ffe1000 0x7ffeffff VadS PAGE_READONLY 2147483647 1 0xffffd98df91b04c0 N/A pid.6620.vad.0x7ffe1000-0x7ffeffff.dmp +6620 software_repor 0xffffd98df9afc3e0 0x7ffe0000 0x7ffe0fff VadS PAGE_READONLY 1 1 0xffffd98df4f25f00 N/A pid.6620.vad.0x7ffe0000-0x7ffe0fff.dmp +6620 software_repor 0xffffd98df6719db0 0xa946c00000 0xa946cfffff VadS PAGE_READWRITE 8 1 0xffffd98df91b04c0 N/A pid.6620.vad.0xa946c00000-0xa946cfffff.dmp +6620 software_repor 0xffffd98df3c14f00 0xa947300000 0xa9473fffff VadS PAGE_READWRITE 5 1 0xffffd98df5850af0 N/A pid.6620.vad.0xa947300000-0xa9473fffff.dmp +6620 software_repor 0xffffd98df4bd5b10 0xa947100000 0xa9471fffff VadS PAGE_READWRITE 4 1 0xffffd98df3c14f00 N/A pid.6620.vad.0xa947100000-0xa9471fffff.dmp +6620 software_repor 0xffffd98df792e6e0 0xa947200000 0xa9472fffff VadS PAGE_READWRITE 5 1 0xffffd98df4bd5b10 N/A pid.6620.vad.0xa947200000-0xa9472fffff.dmp +6620 software_repor 0xffffd98df53d9010 0x27060230000 0x2706023ffff Vad PAGE_READWRITE 0 0 0xffffd98df3c14f00 N/A pid.6620.vad.0x27060230000-0x2706023ffff.dmp +6620 software_repor 0xffffd98dfa1d79a0 0xa947500000 0xa9475fffff VadS PAGE_READWRITE 5 1 0xffffd98df53d9010 N/A pid.6620.vad.0xa947500000-0xa9475fffff.dmp +6620 software_repor 0xffffd98df71c81a0 0xa947400000 0xa9474fffff VadS PAGE_READWRITE 5 1 0xffffd98dfa1d79a0 N/A pid.6620.vad.0xa947400000-0xa9474fffff.dmp +6620 software_repor 0xffffd98df821b170 0xa947600000 0xa9476fffff VadS PAGE_READWRITE 6 1 0xffffd98dfa1d79a0 N/A pid.6620.vad.0xa947600000-0xa9476fffff.dmp +6620 software_repor 0xffffd98df7cbe130 0x27060240000 0x2706024ffff VadS PAGE_READWRITE 2 1 0xffffd98df53d9010 N/A pid.6620.vad.0x27060240000-0x2706024ffff.dmp +6620 software_repor 0xffffd98df68fda10 0x27060370000 0x27060389fff VadS PAGE_READWRITE 2 1 0xffffd98df4bcbd50 N/A pid.6620.vad.0x27060370000-0x27060389fff.dmp +6620 software_repor 0xffffd98df3e75a80 0x27060290000 0x27060290fff VadS PAGE_READWRITE 1 1 0xffffd98df68fda10 N/A pid.6620.vad.0x27060290000-0x27060290fff.dmp +6620 software_repor 0xffffd98df31031c0 0x27060270000 0x27060273fff Vad PAGE_READONLY 0 0 0xffffd98df3e75a80 N/A pid.6620.vad.0x27060270000-0x27060273fff.dmp +6620 software_repor 0xffffd98dfa3260b0 0x27060280000 0x27060281fff Vad PAGE_READONLY 0 0 0xffffd98df31031c0 N/A pid.6620.vad.0x27060280000-0x27060281fff.dmp +6620 software_repor 0xffffd98df6fc3590 0x270602a0000 0x27060364fff Vad PAGE_READONLY 0 0 0xffffd98df3e75a80 \Windows\System32\locale.nls pid.6620.vad.0x270602a0000-0x27060364fff.dmp +6620 software_repor 0xffffd98df641a4c0 0x270603b0000 0x270603b0fff VadS PAGE_READWRITE 1 1 0xffffd98df68fda10 N/A pid.6620.vad.0x270603b0000-0x270603b0fff.dmp +6620 software_repor 0xffffd98df46b0bb0 0x27060390000 0x270603a9fff VadS PAGE_READWRITE 1 1 0xffffd98df641a4c0 N/A pid.6620.vad.0x27060390000-0x270603a9fff.dmp +6620 software_repor 0xffffd98df3b3ced0 0x27060980000 0x27061d7ffff Vad PAGE_READONLY 0 0 0xffffd98df7487b90 N/A pid.6620.vad.0x27060980000-0x27061d7ffff.dmp +6620 software_repor 0xffffd98df3a9c280 0x27060480000 0x2706057ffff VadS PAGE_READWRITE 46 1 0xffffd98df3b3ced0 N/A pid.6620.vad.0x27060480000-0x2706057ffff.dmp +6620 software_repor 0xffffd98df3bd7780 0x270603f0000 0x270603f0fff Vad PAGE_READWRITE 0 0 0xffffd98df3a9c280 N/A pid.6620.vad.0x270603f0000-0x270603f0fff.dmp +6620 software_repor 0xffffd98dfa77fef0 0x270603d0000 0x270603e9fff VadS PAGE_READWRITE 2 1 0xffffd98df3bd7780 N/A pid.6620.vad.0x270603d0000-0x270603e9fff.dmp +6620 software_repor 0xffffd98df55873a0 0x27060420000 0x2706042ffff VadS PAGE_READWRITE 15 1 0xffffd98df3bd7780 N/A pid.6620.vad.0x27060420000-0x2706042ffff.dmp +6620 software_repor 0xffffd98df4f9b840 0x27060400000 0x27060403fff Vad PAGE_READONLY 0 0 0xffffd98df55873a0 N/A pid.6620.vad.0x27060400000-0x27060403fff.dmp +6620 software_repor 0xffffd98df82af240 0x27060760000 0x2706076ffff VadS PAGE_READWRITE 8 1 0xffffd98df3a9c280 N/A pid.6620.vad.0x27060760000-0x2706076ffff.dmp +6620 software_repor 0xffffd98df7a246d0 0x27060580000 0x27060700fff Vad PAGE_READONLY 0 0 0xffffd98df82af240 N/A pid.6620.vad.0x27060580000-0x27060700fff.dmp +6620 software_repor 0xffffd98df625a490 0x27060770000 0x27060977fff Vad PAGE_READONLY 0 0 0xffffd98df82af240 N/A pid.6620.vad.0x27060770000-0x27060977fff.dmp +6620 software_repor 0xffffd98df7959290 0x27061e80000 0x270621b6fff Vad PAGE_READONLY 0 0 0xffffd98df3b3ced0 e="Microsoft-Windows-ProfessionalNEdition" lan pid.6620.vad.0x27061e80000-0x270621b6fff.dmp +6620 software_repor 0xffffd98df759a4c0 0x27061d80000 0x27061e7ffff VadS PAGE_READWRITE 26 1 0xffffd98df7959290 N/A pid.6620.vad.0x27061d80000-0x27061e7ffff.dmp +6620 software_repor 0xffffd98df9ef31a0 0x27062250000 0x2706225ffff VadS PAGE_READWRITE 2 1 0xffffd98df7959290 N/A pid.6620.vad.0x27062250000-0x2706225ffff.dmp +6620 software_repor 0xffffd98df63bcf70 0x27062260000 0x27062312fff Vad PAGE_READONLY 0 0 0xffffd98df9ef31a0 N/A pid.6620.vad.0x27062260000-0x27062312fff.dmp +6620 software_repor 0xffffd98df6abbed0 0x7ff9a6180000 0x7ff9a6348fff Vad PAGE_EXECUTE_WRITECOPY 10 0 0xffffd98df98be960 \Windows\System32\crypt32.dll pid.6620.vad.0x7ff9a6180000-0x7ff9a6348fff.dmp +6620 software_repor 0xffffd98df36f0b10 0x7ff9a53b0000 0x7ff9a53e6fff Vad PAGE_EXECUTE_WRITECOPY 3 0 0xffffd98df6abbed0 \Windows\System32\IPHLPAPI.DLL pid.6620.vad.0x7ff9a53b0000-0x7ff9a53e6fff.dmp +6620 software_repor 0xffffd98dfa4f61f0 0x7ff997fc0000 0x7ff997fe2fff Vad PAGE_EXECUTE_WRITECOPY 4 0 0xffffd98df36f0b10 \Windows\System32\winmm.dll pid.6620.vad.0x7ff997fc0000-0x7ff997fe2fff.dmp +6620 software_repor 0xffffd98df816a4b0 0x7ff7a0b70000 0x7ff7a17d8fff Vad PAGE_EXECUTE_WRITECOPY 21 0 0xffffd98dfa4f61f0 \Users\passmark\AppData\Local\Google\Chrome\User Data\SwReporter\25.141.202\software_reporter_tool.exe pid.6620.vad.0x7ff7a0b70000-0x7ff7a17d8fff.dmp +6620 software_repor 0xffffd98df67faa60 0x7ff7a01b0000 0x7ff7a01d2fff Vad PAGE_READONLY 0 0 0xffffd98df816a4b0 N/A pid.6620.vad.0x7ff7a01b0000-0x7ff7a01d2fff.dmp +6620 software_repor 0xffffd98df6466010 0x7ff7a00b0000 0x7ff7a01affff Vad PAGE_READONLY 0 0 0xffffd98df67faa60 N/A pid.6620.vad.0x7ff7a00b0000-0x7ff7a01affff.dmp +6620 software_repor 0xffffd98df5cf94e0 0x7ff995fe0000 0x7ff99630dfff Vad PAGE_EXECUTE_WRITECOPY 7 0 0xffffd98df816a4b0 \Windows\System32\wininet.dll pid.6620.vad.0x7ff995fe0000-0x7ff99630dfff.dmp +6620 software_repor 0xffffd98df90c76f0 0x7ff9973a0000 0x7ff9973cafff Vad PAGE_EXECUTE_WRITECOPY 5 0 0xffffd98df5cf94e0 \Windows\System32\winmmbase.dll pid.6620.vad.0x7ff9973a0000-0x7ff9973cafff.dmp +6620 software_repor 0xffffd98df73e88e0 0x7ff99e220000 0x7ff99e229fff Vad PAGE_EXECUTE_WRITECOPY 2 0 0xffffd98dfa4f61f0 \Windows\System32\version.dll pid.6620.vad.0x7ff99e220000-0x7ff99e229fff.dmp +6620 software_repor 0xffffd98df3c59100 0x7ff99d7a0000 0x7ff99d875fff Vad PAGE_EXECUTE_WRITECOPY 4 0 0xffffd98df73e88e0 \Windows\System32\winhttp.dll pid.6620.vad.0x7ff99d7a0000-0x7ff99d875fff.dmp +6620 software_repor 0xffffd98df50425c0 0x7ff9a2ac0000 0x7ff9a2ae9fff Vad PAGE_EXECUTE_WRITECOPY 6 0 0xffffd98df73e88e0 \Windows\System32\dwmapi.dll pid.6620.vad.0x7ff9a2ac0000-0x7ff9a2ae9fff.dmp +6620 software_repor 0xffffd98df9c38250 0x7ff9a09f0000 0x7ff9a09fbfff Vad PAGE_EXECUTE_WRITECOPY 3 0 0xffffd98df50425c0 \Windows\System32\secur32.dll pid.6620.vad.0x7ff9a09f0000-0x7ff9a09fbfff.dmp +6620 software_repor 0xffffd98df63bb010 0x7ff9a47d0000 0x7ff9a4864fff Vad PAGE_EXECUTE_WRITECOPY 5 0 0xffffd98df50425c0 \Windows\System32\uxtheme.dll pid.6620.vad.0x7ff9a47d0000-0x7ff9a4864fff.dmp +6620 software_repor 0xffffd98df5ed7640 0x7ff9a5d60000 0x7ff9a5dabfff Vad PAGE_EXECUTE_WRITECOPY 3 0 0xffffd98df36f0b10 \Windows\System32\powrprof.dll pid.6620.vad.0x7ff9a5d60000-0x7ff9a5dabfff.dmp +6620 software_repor 0xffffd98dfb407340 0x7ff9a5c90000 0x7ff9a5cbffff Vad PAGE_EXECUTE_WRITECOPY 5 0 0xffffd98df5ed7640 \Windows\System32\sspicli.dll pid.6620.vad.0x7ff9a5c90000-0x7ff9a5cbffff.dmp +6620 software_repor 0xffffd98df5ee5540 0x7ff9a57d0000 0x7ff9a57dafff Vad PAGE_EXECUTE_WRITECOPY 3 0 0xffffd98dfb407340 \Windows\System32\cryptbase.dll pid.6620.vad.0x7ff9a57d0000-0x7ff9a57dafff.dmp +6620 software_repor 0xffffd98dfa36ec70 0x7ff9a5df0000 0x7ff9a5e00fff Vad PAGE_EXECUTE_WRITECOPY 2 0 0xffffd98df5ed7640 \Windows\System32\msasn1.dll pid.6620.vad.0x7ff9a5df0000-0x7ff9a5e00fff.dmp +6620 software_repor 0xffffd98df6387c80 0x7ff9a5db0000 0x7ff9a5dc0fff Vad PAGE_EXECUTE_WRITECOPY 3 0 0xffffd98dfa36ec70 \Windows\System32\kernel.appcore.dll pid.6620.vad.0x7ff9a5db0000-0x7ff9a5dc0fff.dmp +6620 software_repor 0xffffd98df9b2e490 0x7ff9a5dd0000 0x7ff9a5de4fff Vad PAGE_EXECUTE_WRITECOPY 3 0 0xffffd98df6387c80 \Windows\System32\profapi.dll pid.6620.vad.0x7ff9a5dd0000-0x7ff9a5de4fff.dmp +6620 software_repor 0xffffd98df73ba800 0x7ff9a6060000 0x7ff9a60f9fff Vad PAGE_EXECUTE_WRITECOPY 6 0 0xffffd98dfa36ec70 \Windows\System32\msvcp_win.dll pid.6620.vad.0x7ff9a6060000-0x7ff9a60f9fff.dmp +6620 software_repor 0xffffd98df8458e00 0x7ff9a5e10000 0x7ff9a6058fff Vad PAGE_EXECUTE_WRITECOPY 9 0 0xffffd98df73ba800 \Windows\System32\KernelBase.dll pid.6620.vad.0x7ff9a5e10000-0x7ff9a6058fff.dmp +6620 software_repor 0xffffd98df55f5d40 0x7ff9a6160000 0x7ff9a617dfff Vad PAGE_EXECUTE_WRITECOPY 2 0 0xffffd98df73ba800 \Windows\System32\win32u.dll pid.6620.vad.0x7ff9a6160000-0x7ff9a617dfff.dmp +6620 software_repor 0xffffd98df79750f0 0x7ff9a78c0000 0x7ff9a796dfff Vad PAGE_EXECUTE_WRITECOPY 6 0 0xffffd98df6abbed0 \Windows\System32\kernel32.dll pid.6620.vad.0x7ff9a78c0000-0x7ff9a796dfff.dmp +6620 software_repor 0xffffd98dfa1d72a0 0x7ff9a6e70000 0x7ff9a6f94fff Vad PAGE_EXECUTE_WRITECOPY 5 0 0xffffd98df79750f0 \Windows\System32\rpcrt4.dll pid.6620.vad.0x7ff9a6e70000-0x7ff9a6f94fff.dmp +6620 software_repor 0xffffd98df935f7d0 0x7ff9a6bc0000 0x7ff9a6d46fff Vad PAGE_EXECUTE_WRITECOPY 8 0 0xffffd98dfa1d72a0 \Windows\System32\gdi32full.dll pid.6620.vad.0x7ff9a6bc0000-0x7ff9a6d46fff.dmp +6620 software_repor 0xffffd98df38bef70 0x7ff9a6470000 0x7ff9a64b8fff Vad PAGE_EXECUTE_WRITECOPY 5 0 0xffffd98df935f7d0 \Windows\System32\cfgmgr32.dll pid.6620.vad.0x7ff9a6470000-0x7ff9a64b8fff.dmp +6620 software_repor 0xffffd98df39144c0 0x7ff9a6400000 0x7ff9a6469fff Vad PAGE_EXECUTE_WRITECOPY 2 0 0xffffd98df38bef70 \Windows\System32\bcryptprimitives.dll pid.6620.vad.0x7ff9a6400000-0x7ff9a6469fff.dmp +6620 software_repor 0xffffd98df5e8fa40 0x7ff9a64c0000 0x7ff9a6bb0fff Vad PAGE_EXECUTE_WRITECOPY 11 0 0xffffd98df38bef70 \Windows\System32\windows.storage.dll pid.6620.vad.0x7ff9a64c0000-0x7ff9a6bb0fff.dmp +6620 software_repor 0xffffd98df4ad97f0 0x7ff9a6d50000 0x7ff9a6e45fff Vad PAGE_EXECUTE_WRITECOPY 5 0 0xffffd98df935f7d0 l-TimeZones.Resources" version pid.6620.vad.0x7ff9a6d50000-0x7ff9a6e45fff.dmp +6620 software_repor 0xffffd98df36a3b00 0x7ff9a7130000 0x7ff9a7279fff Vad PAGE_EXECUTE_WRITECOPY 6 0 0xffffd98dfa1d72a0 \Windows\System32\user32.dll pid.6620.vad.0x7ff9a7130000-0x7ff9a7279fff.dmp +6620 software_repor 0xffffd98df529a0b0 0x7ff9a7090000 0x7ff9a712cfff Vad PAGE_EXECUTE_WRITECOPY 10 0 0xffffd98df36a3b00 \Windows\System32\msvcrt.dll pid.6620.vad.0x7ff9a7090000-0x7ff9a712cfff.dmp +6620 software_repor 0xffffd98df91412b0 0x7ff9a7280000 0x7ff9a73c4fff Vad PAGE_EXECUTE_WRITECOPY 5 0 0xffffd98df36a3b00 \Windows\System32\ole32.dll pid.6620.vad.0x7ff9a7280000-0x7ff9a73c4fff.dmp +6620 software_repor 0xffffd98df6264300 0x7ff9a9070000 0x7ff9a90c8fff Vad PAGE_EXECUTE_WRITECOPY 5 0 0xffffd98df79750f0 \Windows\System32\sechost.dll pid.6620.vad.0x7ff9a9070000-0x7ff9a90c8fff.dmp +6620 software_repor 0xffffd98df98031b0 0x7ff9a8dc0000 0x7ff9a8de6fff Vad PAGE_EXECUTE_WRITECOPY 4 0 0xffffd98df6264300 \Windows\System32\gdi32.dll pid.6620.vad.0x7ff9a8dc0000-0x7ff9a8de6fff.dmp +6620 software_repor 0xffffd98df3ca6d70 0x7ff9a8db0000 0x7ff9a8db7fff Vad PAGE_EXECUTE_WRITECOPY 2 0 0xffffd98df98031b0 \Windows\System32\psapi.dll pid.6620.vad.0x7ff9a8db0000-0x7ff9a8db7fff.dmp +6620 software_repor 0xffffd98dfa0636a0 0x7ff9a7970000 0x7ff9a8da7fff Vad PAGE_EXECUTE_WRITECOPY 15 0 0xffffd98df3ca6d70 \Windows\System32\shell32.dll pid.6620.vad.0x7ff9a7970000-0x7ff9a8da7fff.dmp +6620 software_repor 0xffffd98df719a780 0x7ff9a8f60000 0x7ff9a8fb0fff Vad PAGE_EXECUTE_WRITECOPY 4 0 0xffffd98df98031b0 \Windows\System32\shlwapi.dll pid.6620.vad.0x7ff9a8f60000-0x7ff9a8fb0fff.dmp +6620 software_repor 0xffffd98df6a81ed0 0x7ff9a8df0000 0x7ff9a8f55fff Vad PAGE_EXECUTE_WRITECOPY 6 0 0xffffd98df719a780 \Windows\System32\msctf.dll pid.6620.vad.0x7ff9a8df0000-0x7ff9a8f55fff.dmp +6620 software_repor 0xffffd98df3913b50 0x7ff9a8fc0000 0x7ff9a9069fff Vad PAGE_EXECUTE_WRITECOPY 5 0 0xffffd98df719a780 \Windows\System32\SHCore.dll pid.6620.vad.0x7ff9a8fc0000-0x7ff9a9069fff.dmp +6620 software_repor 0xffffd98df3ed39d0 0x7ff9a9600000 0x7ff9a96a0fff Vad PAGE_EXECUTE_WRITECOPY 8 0 0xffffd98df6264300 \Windows\System32\advapi32.dll pid.6620.vad.0x7ff9a9600000-0x7ff9a96a0fff.dmp +6620 software_repor 0xffffd98dfa09fe90 0x7ff9a9130000 0x7ff9a9428fff Vad PAGE_EXECUTE_WRITECOPY 9 0 0xffffd98df3ed39d0 \Windows\System32\combase.dll pid.6620.vad.0x7ff9a9130000-0x7ff9a9428fff.dmp +6620 software_repor 0xffffd98df31122d0 0x7ff9a9430000 0x7ff9a945cfff Vad PAGE_EXECUTE_WRITECOPY 3 0 0xffffd98dfa09fe90 \Windows\System32\imm32.dll pid.6620.vad.0x7ff9a9430000-0x7ff9a945cfff.dmp +6620 software_repor 0xffffd98df5d139b0 0x7ff9a98f0000 0x7ff9a9acafff Vad PAGE_EXECUTE_WRITECOPY 13 0 0xffffd98df3ed39d0 \Windows\System32\ntdll.dll pid.6620.vad.0x7ff9a98f0000-0x7ff9a9acafff.dmp +6620 software_repor 0xffffd98df90f6630 0x7ff9a97c0000 0x7ff9a987ffff Vad PAGE_EXECUTE_WRITECOPY 6 0 0xffffd98df5d139b0 \Windows\System32\oleaut32.dll pid.6620.vad.0x7ff9a97c0000-0x7ff9a987ffff.dmp diff --git a/Semaine_12/Jour_05/volatility/data/results/Windump_injected_DLL.log b/Semaine_12/Jour_05/volatility/data/results/Windump_injected_DLL.log new file mode 100644 index 0000000..aa03511 --- /dev/null +++ b/Semaine_12/Jour_05/volatility/data/results/Windump_injected_DLL.log @@ -0,0 +1,855 @@ +PID: 356 | Processus: smss.exe | InLoad: 0x7ff6abfc0000 | InMem: True | InInit: False | DLL: True +PID: 468 | Processus: csrss.exe | InLoad: 0x7ff655c90000 | InMem: True | InInit: False | DLL: True +PID: 568 | Processus: wininit.exe | InLoad: 0x7ff9a2ca0000 | InMem: False | InInit: False | DLL: False +PID: 568 | Processus: wininit.exe | InLoad: 0x7ff6fe140000 | InMem: True | InInit: False | DLL: True +PID: 568 | Processus: wininit.exe | InLoad: 0x7ff9a5850000 | InMem: False | InInit: False | DLL: False +PID: 716 | Processus: services.exe | InLoad: 0x1f55fde0000 | InMem: False | InInit: False | DLL: False +PID: 716 | Processus: services.exe | InLoad: 0x7ff7164d0000 | InMem: True | InInit: False | DLL: True +PID: 744 | Processus: lsass.exe | InLoad: 0x7ff628030000 | InMem: True | InInit: False | DLL: True +PID: 844 | Processus: svchost.exe | InLoad: 0x7ff9a6d50000 | InMem: False | InInit: False | DLL: False +PID: 844 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 844 | Processus: svchost.exe | InLoad: 0x7ff9a5e10000 | InMem: False | InInit: False | DLL: False +PID: 844 | Processus: svchost.exe | InLoad: 0x7ff9a4f40000 | InMem: False | InInit: False | DLL: False +PID: 844 | Processus: svchost.exe | InLoad: 0x7ff9a4f20000 | InMem: False | InInit: False | DLL: False +PID: 844 | Processus: svchost.exe | InLoad: 0x7ff9a5df0000 | InMem: False | InInit: False | DLL: False +PID: 844 | Processus: svchost.exe | InLoad: 0x7ff9a6180000 | InMem: False | InInit: False | DLL: False +PID: 844 | Processus: svchost.exe | InLoad: 0x7ff9a6100000 | InMem: False | InInit: False | DLL: False +PID: 844 | Processus: svchost.exe | InLoad: 0x7ff9a6400000 | InMem: False | InInit: False | DLL: False +PID: 844 | Processus: svchost.exe | InLoad: 0x7ff9a78c0000 | InMem: False | InInit: False | DLL: False +PID: 844 | Processus: svchost.exe | InLoad: 0x7ff9a6e70000 | InMem: False | InInit: False | DLL: False +PID: 844 | Processus: svchost.exe | InLoad: 0x7ff9a7090000 | InMem: False | InInit: False | DLL: False +PID: 844 | Processus: svchost.exe | InLoad: 0x7ff9a9130000 | InMem: False | InInit: False | DLL: False +PID: 844 | Processus: svchost.exe | InLoad: 0x7ff9a9070000 | InMem: False | InInit: False | DLL: False +PID: 844 | Processus: svchost.exe | InLoad: 0x7ff9a9600000 | InMem: False | InInit: False | DLL: False +PID: 868 | Processus: svchost.exe | InLoad: 0x1e9b6d00000 | InMem: False | InInit: False | DLL: False +PID: 868 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 920 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 944 | Processus: fontdrvhost.ex | InLoad: 0x1f150eb0000 | InMem: False | InInit: False | DLL: False +PID: 944 | Processus: fontdrvhost.ex | InLoad: 0x7ff643ff0000 | InMem: True | InInit: False | DLL: True +PID: 72 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 804 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 1056 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 1140 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 1260 | Processus: svchost.exe | InLoad: 0x175c02c0000 | InMem: False | InInit: False | DLL: False +PID: 1260 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 1288 | Processus: atiesrxx.exe | InLoad: 0x7ff68ebf0000 | InMem: True | InInit: False | DLL: True +PID: 1316 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 1368 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 1412 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 1420 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 1436 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 1532 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 1548 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 1568 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 1644 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 1652 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 1724 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 1824 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 1872 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 1940 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 1948 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 2036 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 2068 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 2260 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 2304 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 2364 | Processus: spoolsv.exe | InLoad: 0x7ff69b060000 | InMem: True | InInit: False | DLL: True +PID: 2424 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 2504 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 2656 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 2664 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 2672 | Processus: SynTPEnhServic | InLoad: 0x7ff668c90000 | InMem: True | InInit: False | DLL: True +PID: 2688 | Processus: MsMpEng.exe | InLoad: 0x7ff799490000 | InMem: True | InInit: False | DLL: True +PID: 2696 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 2704 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 2712 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 2720 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 2736 | Processus: svchost.exe | InLoad: 0x1b6207e0000 | InMem: False | InInit: False | DLL: False +PID: 2736 | Processus: svchost.exe | InLoad: 0x1b6207f0000 | InMem: False | InInit: False | DLL: False +PID: 2736 | Processus: svchost.exe | InLoad: 0x1b6209c0000 | InMem: False | InInit: False | DLL: False +PID: 2736 | Processus: svchost.exe | InLoad: 0x1b621200000 | InMem: False | InInit: False | DLL: False +PID: 2736 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 2748 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 2764 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 2764 | Processus: svchost.exe | InLoad: 0x7ff9a20b0000 | InMem: False | InInit: False | DLL: False +PID: 2772 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 2780 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 2792 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 2800 | Processus: SecurityHealth | InLoad: 0x7ff6ef1e0000 | InMem: True | InInit: False | DLL: True +PID: 2464 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 2980 | Processus: dasHost.exe | InLoad: 0x7ff64b2b0000 | InMem: True | InInit: False | DLL: True +PID: 3188 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 3288 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 3400 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 3880 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 3888 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 3972 | Processus: svchost.exe | InLoad: 0x1866e1e0000 | InMem: False | InInit: False | DLL: False +PID: 3972 | Processus: svchost.exe | InLoad: 0x1866e1f0000 | InMem: False | InInit: False | DLL: False +PID: 3972 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 2828 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 4108 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 4264 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 4504 | Processus: svchost.exe | InLoad: 0x21d69a00000 | InMem: False | InInit: False | DLL: False +PID: 4504 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 5020 | Processus: NisSrv.exe | InLoad: 0x7ff75f940000 | InMem: True | InInit: False | DLL: True +PID: 3448 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 2988 | Processus: svchost.exe | InLoad: 0x2598b400000 | InMem: False | InInit: False | DLL: False +PID: 2988 | Processus: svchost.exe | InLoad: 0x2598cd90000 | InMem: False | InInit: False | DLL: False +PID: 2988 | Processus: svchost.exe | InLoad: 0x2598d200000 | InMem: False | InInit: False | DLL: False +PID: 2988 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 2988 | Processus: svchost.exe | InLoad: 0x7ff97c800000 | InMem: False | InInit: False | DLL: False +PID: 2988 | Processus: svchost.exe | InLoad: 0x7ff97c790000 | InMem: False | InInit: False | DLL: False +PID: 2988 | Processus: svchost.exe | InLoad: 0x7ff97f190000 | InMem: False | InInit: False | DLL: False +PID: 2988 | Processus: svchost.exe | InLoad: 0x7ff97ed60000 | InMem: False | InInit: False | DLL: False +PID: 2988 | Processus: svchost.exe | InLoad: 0x7ff97ed10000 | InMem: False | InInit: False | DLL: False +PID: 2988 | Processus: svchost.exe | InLoad: 0x7ff9879d0000 | InMem: False | InInit: False | DLL: False +PID: 2988 | Processus: svchost.exe | InLoad: 0x7ff99b680000 | InMem: False | InInit: False | DLL: False +PID: 2988 | Processus: svchost.exe | InLoad: 0x7ff99baf0000 | InMem: False | InInit: False | DLL: False +PID: 2988 | Processus: svchost.exe | InLoad: 0x7ff99c880000 | InMem: False | InInit: False | DLL: False +PID: 2988 | Processus: svchost.exe | InLoad: 0x7ff99cbf0000 | InMem: False | InInit: False | DLL: False +PID: 2988 | Processus: svchost.exe | InLoad: 0x7ff99e560000 | InMem: False | InInit: False | DLL: False +PID: 2988 | Processus: svchost.exe | InLoad: 0x7ff99ff10000 | InMem: False | InInit: False | DLL: False +PID: 2988 | Processus: svchost.exe | InLoad: 0x7ff9a0010000 | InMem: False | InInit: False | DLL: False +PID: 2988 | Processus: svchost.exe | InLoad: 0x7ff9a0450000 | InMem: False | InInit: False | DLL: False +PID: 2988 | Processus: svchost.exe | InLoad: 0x7ff9a0cd0000 | InMem: False | InInit: False | DLL: False +PID: 2988 | Processus: svchost.exe | InLoad: 0x7ff9a0c70000 | InMem: False | InInit: False | DLL: False +PID: 2988 | Processus: svchost.exe | InLoad: 0x7ff9a1540000 | InMem: False | InInit: False | DLL: False +PID: 2988 | Processus: svchost.exe | InLoad: 0x7ff9a1a00000 | InMem: False | InInit: False | DLL: False +PID: 2988 | Processus: svchost.exe | InLoad: 0x7ff9a1f90000 | InMem: False | InInit: False | DLL: False +PID: 2988 | Processus: svchost.exe | InLoad: 0x7ff9a1f50000 | InMem: False | InInit: False | DLL: False +PID: 2988 | Processus: svchost.exe | InLoad: 0x7ff9a27f0000 | InMem: False | InInit: False | DLL: False +PID: 2988 | Processus: svchost.exe | InLoad: 0x7ff9a4c30000 | InMem: False | InInit: False | DLL: False +PID: 2988 | Processus: svchost.exe | InLoad: 0x7ff9a4c90000 | InMem: False | InInit: False | DLL: False +PID: 2988 | Processus: svchost.exe | InLoad: 0x7ff9a54a0000 | InMem: False | InInit: False | DLL: False +PID: 2988 | Processus: svchost.exe | InLoad: 0x7ff9a56c0000 | InMem: False | InInit: False | DLL: False +PID: 4660 | Processus: svchost.exe | InLoad: 0x1d49f110000 | InMem: False | InInit: False | DLL: False +PID: 4660 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 5648 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 5932 | Processus: GoogleCrashHan | InLoad: 0xed0000 | InMem: True | InInit: False | DLL: True +PID: 5764 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 5940 | Processus: GoogleCrashHan | InLoad: 0x7ff715ca0000 | InMem: True | InInit: False | DLL: True +PID: 2872 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 5380 | Processus: SearchIndexer. | InLoad: 0x2e9f2dd0000 | InMem: False | InInit: False | DLL: False +PID: 5380 | Processus: SearchIndexer. | InLoad: 0x2e9f44a0000 | InMem: False | InInit: False | DLL: False +PID: 5380 | Processus: SearchIndexer. | InLoad: 0x7ff6756e0000 | InMem: True | InInit: False | DLL: True +PID: 7324 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 7812 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 7944 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 9312 | Processus: csrss.exe | InLoad: 0x7ff655c90000 | InMem: True | InInit: False | DLL: True +PID: 3376 | Processus: winlogon.exe | InLoad: 0x7ff65ec50000 | InMem: True | InInit: False | DLL: True +PID: 2932 | Processus: fontdrvhost.ex | InLoad: 0x13882660000 | InMem: False | InInit: False | DLL: False +PID: 2932 | Processus: fontdrvhost.ex | InLoad: 0x138827b0000 | InMem: False | InInit: False | DLL: False +PID: 2932 | Processus: fontdrvhost.ex | InLoad: 0x7ff643ff0000 | InMem: True | InInit: False | DLL: True +PID: 6976 | Processus: dwm.exe | InLoad: 0x7ff6ddc80000 | InMem: True | InInit: False | DLL: True +PID: 9336 | Processus: atieclxx.exe | InLoad: 0x7ff7bbc30000 | InMem: True | InInit: False | DLL: True +PID: 9932 | Processus: remsh.exe | InLoad: 0x7ff736d40000 | InMem: True | InInit: False | DLL: True +PID: 9200 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x59c50000 | InMem: False | InInit: False | DLL: False +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff997fc0000 | InMem: True | InInit: False | DLL: True +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x140000000 | InMem: True | InInit: False | DLL: True +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9973a0000 | InMem: False | InInit: False | DLL: False +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff997600000 | InMem: False | InInit: False | DLL: False +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9998d0000 | InMem: True | InInit: False | DLL: True +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff99c880000 | InMem: False | InInit: False | DLL: False +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff99a350000 | InMem: False | InInit: False | DLL: False +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff99ca10000 | InMem: False | InInit: False | DLL: False +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9a6e70000 | InMem: True | InInit: False | DLL: True +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9a54a0000 | InMem: False | InInit: False | DLL: False +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9a1f90000 | InMem: False | InInit: False | DLL: False +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9a13c0000 | InMem: False | InInit: False | DLL: False +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9a0610000 | InMem: False | InInit: False | DLL: False +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9a1bd0000 | InMem: False | InInit: False | DLL: False +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9a1a80000 | InMem: False | InInit: False | DLL: False +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9a2160000 | InMem: False | InInit: False | DLL: False +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9a1fb0000 | InMem: False | InInit: False | DLL: False +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9a47d0000 | InMem: False | InInit: False | DLL: False +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9a3920000 | InMem: False | InInit: False | DLL: False +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9a49c0000 | InMem: False | InInit: False | DLL: False +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9a4f70000 | InMem: False | InInit: False | DLL: False +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9a6160000 | InMem: True | InInit: False | DLL: True +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9a5db0000 | InMem: False | InInit: False | DLL: False +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9a5c90000 | InMem: False | InInit: False | DLL: False +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9a5850000 | InMem: False | InInit: False | DLL: False +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9a57d0000 | InMem: False | InInit: False | DLL: False +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9a5c30000 | InMem: False | InInit: False | DLL: False +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9a5d60000 | InMem: False | InInit: False | DLL: False +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9a5dd0000 | InMem: False | InInit: False | DLL: False +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9a6060000 | InMem: False | InInit: False | DLL: False +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9a6bc0000 | InMem: False | InInit: False | DLL: False +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9a6470000 | InMem: False | InInit: False | DLL: False +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9a6400000 | InMem: False | InInit: False | DLL: False +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9a64c0000 | InMem: False | InInit: False | DLL: False +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9a6d50000 | InMem: False | InInit: False | DLL: False +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9a8dc0000 | InMem: False | InInit: False | DLL: False +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9a7130000 | InMem: True | InInit: False | DLL: True +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9a7280000 | InMem: False | InInit: False | DLL: False +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9a73d0000 | InMem: False | InInit: False | DLL: False +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9a8db0000 | InMem: True | InInit: False | DLL: True +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9a7970000 | InMem: False | InInit: False | DLL: False +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9a9430000 | InMem: True | InInit: False | DLL: True +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9a8fc0000 | InMem: False | InInit: False | DLL: False +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9a8f60000 | InMem: False | InInit: False | DLL: False +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9a8df0000 | InMem: False | InInit: False | DLL: False +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9a9130000 | InMem: False | InInit: False | DLL: False +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9a9070000 | InMem: False | InInit: False | DLL: False +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9a96b0000 | InMem: False | InInit: False | DLL: False +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9a9600000 | InMem: False | InInit: False | DLL: False +PID: 2192 | Processus: SynTPEnh.exe | InLoad: 0x7ff9a97c0000 | InMem: False | InInit: False | DLL: False +PID: 3560 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 3752 | Processus: sihost.exe | InLoad: 0x1a681500000 | InMem: False | InInit: False | DLL: False +PID: 3752 | Processus: sihost.exe | InLoad: 0x7ff703780000 | InMem: True | InInit: False | DLL: True +PID: 3540 | Processus: svchost.exe | InLoad: 0x22525320000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x22525310000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x22526ca0000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff99cdc0000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff998380000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff991c10000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff9908c0000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff9980d0000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff9974a0000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff998180000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff99b7e0000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff998b20000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff998430000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff998730000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff99aa30000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff999940000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff99b740000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff99bee0000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff99ca30000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff99c9d0000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff99cbf0000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff9a1a80000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff99eb00000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff9a0cd0000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff9a0ca0000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff9a0100000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff9a18b0000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff9a0d80000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff9a1940000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff9a2b60000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff9a2000000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff9a1ad0000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff9a25a0000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff9a2120000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff9a2800000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff9a4660000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff9a40e0000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff9a2ca0000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff9a44a0000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff9a47d0000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff9a5d60000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff9a57d0000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff9a53f0000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff9a5270000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff9a5170000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff9a53b0000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff9a5610000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff9a58f0000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff9a58b0000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff9a5850000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff9a5c30000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff9a5b70000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff9a5c90000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff9a5dd0000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff9a7020000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff9a78b0000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff9a8df0000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff9a7970000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff9a8f60000 | InMem: False | InInit: False | DLL: False +PID: 3540 | Processus: svchost.exe | InLoad: 0x7ff9a97c0000 | InMem: False | InInit: False | DLL: False +PID: 7048 | Processus: taskhostw.exe | InLoad: 0x7ff66cfb0000 | InMem: True | InInit: False | DLL: True +PID: 7688 | Processus: explorer.exe | InLoad: 0x1090000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0xdf0000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x2b30000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x4c40000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x4db0000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x5c60000 | InMem: True | InInit: False | DLL: True +PID: 7688 | Processus: explorer.exe | InLoad: 0x5d00000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0xa260000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0xb870000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0xb930000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff986600000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff7e7050000 | InMem: True | InInit: False | DLL: True +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff7bc630000 | InMem: True | InInit: False | DLL: True +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff9814f0000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff978590000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff988510000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff9890c0000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff98a0e0000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff98b090000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff991c10000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff992550000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff9927c0000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff993d20000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff9939a0000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff9950f0000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff996b60000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff996800000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff996bd0000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff996cb0000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff997130000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff997ff0000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff9984e0000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff9986c0000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff998a90000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff999050000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff998fb0000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff998f20000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff998ff0000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff9990d0000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff999090000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff9994e0000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff9998c0000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff9998d0000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff99a4b0000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff999f40000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff99a490000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff99c9d0000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff99d670000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff99daa0000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff99e560000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff99f0f0000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff99fc00000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff99f470000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff99fbb0000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff99fb30000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff99fd30000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff99fe70000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff99fe60000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff9a0380000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff9a04e0000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff9a06f0000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff9a0760000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff9a0930000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff9a09f0000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff9a19e0000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff9a1fc0000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff9a3750000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff9a4c90000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff9a4c30000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff9a4fb0000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff9a53f0000 | InMem: False | InInit: False | DLL: False +PID: 7688 | Processus: explorer.exe | InLoad: 0x7ff9a5610000 | InMem: False | InInit: False | DLL: False +PID: 7736 | Processus: SynTPHelper.ex | InLoad: 0x7ff7782e0000 | InMem: True | InInit: False | DLL: True +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x241dfba0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x249e5f80000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x249e5fe0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x249e6670000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x249e6610000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x249e6660000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x249e66d0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x249f7920000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x249f7d00000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a18b0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff999710000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9927c0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff98ed40000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff98c7b0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff77dcf0000 | InMem: True | InInit: False | DLL: True +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff982b50000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff98c340000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9872f0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff98cb00000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff98c940000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff98cce0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff98ec30000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9905b0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff98fcb0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff98fb60000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff991f30000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff990db0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9909e0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff991d20000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff992330000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9973a0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff994940000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9942e0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9939f0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9939a0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff994790000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff996800000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff995fe0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff995480000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff997030000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff996e70000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9970a0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff997fc0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff997600000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9973d0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff997f30000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff997e60000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff998890000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff998180000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9980d0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff998070000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff998120000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff998430000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9981e0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff998730000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff998f20000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff998c70000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9990d0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff99eb00000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff99bb50000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff99a310000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff99a1e0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff999b60000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff99a2f0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff99aa30000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff99a330000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff99b010000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff99d7a0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff99c9d0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff99c9c0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff99cbf0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff99daf0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff99d880000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff99e220000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a03d0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a0110000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff99f500000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff99f470000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a02a0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a0280000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a09a0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a0610000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a04e0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a06a0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a0930000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a0c00000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a0c60000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a53f0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a2b60000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a2160000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a1a80000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a1940000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a1bd0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a1f50000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a2800000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a2210000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a2ac0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a3780000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a3450000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a3320000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a3920000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a3af0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a4fb0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a49c0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a4660000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a44a0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a47d0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a4f70000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a4d20000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a5270000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a5230000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a53b0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a6e70000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a5c30000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a57b0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a5610000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a58b0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a57d0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a58f0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a5d60000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a5c90000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a5c60000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a5dd0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a5db0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a5df0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a6400000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a6160000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a6060000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a6100000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a6180000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a6bc0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a64c0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a6470000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a6d50000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a7090000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a7020000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a7280000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a7130000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a78b0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a9130000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a8df0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a8dc0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a7970000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a8fc0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a8f60000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a9070000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a97c0000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a9430000 | InMem: False | InInit: False | DLL: False +PID: 5368 | Processus: SearchUI.exe | InLoad: 0x7ff9a9600000 | InMem: False | InInit: False | DLL: False +PID: 7004 | Processus: ShellExperienc | InLoad: 0x2b82bfa0000 | InMem: False | InInit: False | DLL: False +PID: 7004 | Processus: ShellExperienc | InLoad: 0x2b82d0a0000 | InMem: False | InInit: False | DLL: False +PID: 7004 | Processus: ShellExperienc | InLoad: 0x2b82fd00000 | InMem: False | InInit: False | DLL: False +PID: 7004 | Processus: ShellExperienc | InLoad: 0x7ff7a3640000 | InMem: True | InInit: False | DLL: True +PID: 7004 | Processus: ShellExperienc | InLoad: 0x7ff985d20000 | InMem: False | InInit: False | DLL: False +PID: 7004 | Processus: ShellExperienc | InLoad: 0x7ff9a49c0000 | InMem: False | InInit: False | DLL: False +PID: 7220 | Processus: RuntimeBroker. | InLoad: 0x207a0600000 | InMem: False | InInit: False | DLL: False +PID: 7220 | Processus: RuntimeBroker. | InLoad: 0x207a0850000 | InMem: False | InInit: False | DLL: False +PID: 7220 | Processus: RuntimeBroker. | InLoad: 0x207a07f0000 | InMem: False | InInit: False | DLL: False +PID: 7220 | Processus: RuntimeBroker. | InLoad: 0x207a1250000 | InMem: False | InInit: False | DLL: False +PID: 7220 | Processus: RuntimeBroker. | InLoad: 0x7ff75a1d0000 | InMem: True | InInit: False | DLL: True +PID: 7220 | Processus: RuntimeBroker. | InLoad: 0x7ff7bc630000 | InMem: True | InInit: False | DLL: True +PID: 9788 | Processus: SkypeHost.exe | InLoad: 0x7ff998f20000 | InMem: False | InInit: False | DLL: False +PID: 9788 | Processus: SkypeHost.exe | InLoad: 0x7ff9942e0000 | InMem: False | InInit: False | DLL: False +PID: 9788 | Processus: SkypeHost.exe | InLoad: 0x7ff98eb70000 | InMem: False | InInit: False | DLL: False +PID: 9788 | Processus: SkypeHost.exe | InLoad: 0x7ff9971b0000 | InMem: False | InInit: False | DLL: False +PID: 9788 | Processus: SkypeHost.exe | InLoad: 0x7ff998380000 | InMem: False | InInit: False | DLL: False +PID: 9788 | Processus: SkypeHost.exe | InLoad: 0x7ff99aa30000 | InMem: False | InInit: False | DLL: False +PID: 9788 | Processus: SkypeHost.exe | InLoad: 0x7ff99a2f0000 | InMem: False | InInit: False | DLL: False +PID: 9788 | Processus: SkypeHost.exe | InLoad: 0x7ff999730000 | InMem: False | InInit: False | DLL: False +PID: 9788 | Processus: SkypeHost.exe | InLoad: 0x7ff99a600000 | InMem: False | InInit: False | DLL: False +PID: 9788 | Processus: SkypeHost.exe | InLoad: 0x7ff99b010000 | InMem: False | InInit: False | DLL: False +PID: 9788 | Processus: SkypeHost.exe | InLoad: 0x7ff99e980000 | InMem: False | InInit: False | DLL: False +PID: 9788 | Processus: SkypeHost.exe | InLoad: 0x7ff9a4660000 | InMem: False | InInit: False | DLL: False +PID: 9788 | Processus: SkypeHost.exe | InLoad: 0x7ff9a0510000 | InMem: False | InInit: False | DLL: False +PID: 9788 | Processus: SkypeHost.exe | InLoad: 0x7ff9a03d0000 | InMem: False | InInit: False | DLL: False +PID: 9788 | Processus: SkypeHost.exe | InLoad: 0x7ff9a1bd0000 | InMem: False | InInit: False | DLL: False +PID: 9788 | Processus: SkypeHost.exe | InLoad: 0x7ff9a06a0000 | InMem: False | InInit: False | DLL: False +PID: 9788 | Processus: SkypeHost.exe | InLoad: 0x7ff9a2b60000 | InMem: False | InInit: False | DLL: False +PID: 9788 | Processus: SkypeHost.exe | InLoad: 0x7ff9a57b0000 | InMem: False | InInit: False | DLL: False +PID: 9788 | Processus: SkypeHost.exe | InLoad: 0x7ff9a4c90000 | InMem: False | InInit: False | DLL: False +PID: 9788 | Processus: SkypeHost.exe | InLoad: 0x7ff9a4c30000 | InMem: False | InInit: False | DLL: False +PID: 9788 | Processus: SkypeHost.exe | InLoad: 0x7ff9a4fb0000 | InMem: False | InInit: False | DLL: False +PID: 9788 | Processus: SkypeHost.exe | InLoad: 0x7ff9a4f70000 | InMem: False | InInit: False | DLL: False +PID: 9788 | Processus: SkypeHost.exe | InLoad: 0x7ff9a53b0000 | InMem: False | InInit: False | DLL: False +PID: 9788 | Processus: SkypeHost.exe | InLoad: 0x7ff9a5d60000 | InMem: False | InInit: False | DLL: False +PID: 9788 | Processus: SkypeHost.exe | InLoad: 0x7ff9a5c30000 | InMem: False | InInit: False | DLL: False +PID: 9788 | Processus: SkypeHost.exe | InLoad: 0x7ff9a5c60000 | InMem: False | InInit: False | DLL: False +PID: 9788 | Processus: SkypeHost.exe | InLoad: 0x7ff9a5dd0000 | InMem: False | InInit: False | DLL: False +PID: 9788 | Processus: SkypeHost.exe | InLoad: 0x7ff9a5db0000 | InMem: False | InInit: False | DLL: False +PID: 9788 | Processus: SkypeHost.exe | InLoad: 0x7ff9a6160000 | InMem: False | InInit: False | DLL: False +PID: 9788 | Processus: SkypeHost.exe | InLoad: 0x7ff9a6180000 | InMem: False | InInit: False | DLL: False +PID: 9788 | Processus: SkypeHost.exe | InLoad: 0x7ff9a64c0000 | InMem: False | InInit: False | DLL: False +PID: 9788 | Processus: SkypeHost.exe | InLoad: 0x7ff9a6470000 | InMem: False | InInit: False | DLL: False +PID: 9788 | Processus: SkypeHost.exe | InLoad: 0x7ff9a6bc0000 | InMem: False | InInit: False | DLL: False +PID: 9788 | Processus: SkypeHost.exe | InLoad: 0x7ff9a7090000 | InMem: False | InInit: False | DLL: False +PID: 9788 | Processus: SkypeHost.exe | InLoad: 0x7ff9a7020000 | InMem: False | InInit: False | DLL: False +PID: 9788 | Processus: SkypeHost.exe | InLoad: 0x7ff9a7130000 | InMem: False | InInit: False | DLL: False +PID: 9788 | Processus: SkypeHost.exe | InLoad: 0x7ff9a9130000 | InMem: True | InInit: False | DLL: True +PID: 9788 | Processus: SkypeHost.exe | InLoad: 0x7ff9a8fc0000 | InMem: False | InInit: False | DLL: False +PID: 9788 | Processus: SkypeHost.exe | InLoad: 0x7ff9a8f60000 | InMem: False | InInit: False | DLL: False +PID: 9788 | Processus: SkypeHost.exe | InLoad: 0x7ff9a8dc0000 | InMem: False | InInit: False | DLL: False +PID: 9788 | Processus: SkypeHost.exe | InLoad: 0x7ff9a9070000 | InMem: False | InInit: False | DLL: False +PID: 9788 | Processus: SkypeHost.exe | InLoad: 0x7ff9a9430000 | InMem: False | InInit: False | DLL: False +PID: 4444 | Processus: MOM.exe | InLoad: 0x23ac4700000 | InMem: True | InInit: False | DLL: True +PID: 4444 | Processus: MOM.exe | InLoad: 0x7ff9a7130000 | InMem: False | InInit: False | DLL: False +PID: 880 | Processus: CCC.exe | InLoad: 0x2bb03cd0000 | InMem: True | InInit: False | DLL: True +PID: 7764 | Processus: svchost.exe | InLoad: 0x7ff9a5e10000 | InMem: False | InInit: False | DLL: False +PID: 7764 | Processus: svchost.exe | InLoad: 0x7ff998430000 | InMem: False | InInit: False | DLL: False +PID: 7764 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: False | InInit: False | DLL: False +PID: 7764 | Processus: svchost.exe | InLoad: 0x7ff990590000 | InMem: False | InInit: False | DLL: False +PID: 7764 | Processus: svchost.exe | InLoad: 0x7ff98ebb0000 | InMem: False | InInit: False | DLL: False +PID: 7764 | Processus: svchost.exe | InLoad: 0x7ff98ab50000 | InMem: False | InInit: False | DLL: False +PID: 7764 | Processus: svchost.exe | InLoad: 0x7ff9907c0000 | InMem: False | InInit: False | DLL: False +PID: 7764 | Processus: svchost.exe | InLoad: 0x7ff9a4c20000 | InMem: False | InInit: False | DLL: False +PID: 7764 | Processus: svchost.exe | InLoad: 0x7ff99e5f0000 | InMem: False | InInit: False | DLL: False +PID: 7764 | Processus: svchost.exe | InLoad: 0x7ff9988f0000 | InMem: False | InInit: False | DLL: False +PID: 7764 | Processus: svchost.exe | InLoad: 0x7ff9988d0000 | InMem: False | InInit: False | DLL: False +PID: 7764 | Processus: svchost.exe | InLoad: 0x7ff99e3b0000 | InMem: False | InInit: False | DLL: False +PID: 7764 | Processus: svchost.exe | InLoad: 0x7ff9a49c0000 | InMem: False | InInit: False | DLL: False +PID: 7764 | Processus: svchost.exe | InLoad: 0x7ff9a1ad0000 | InMem: False | InInit: False | DLL: False +PID: 7764 | Processus: svchost.exe | InLoad: 0x7ff9a5db0000 | InMem: False | InInit: False | DLL: False +PID: 7764 | Processus: svchost.exe | InLoad: 0x7ff9a4f20000 | InMem: False | InInit: False | DLL: False +PID: 7764 | Processus: svchost.exe | InLoad: 0x7ff9a53b0000 | InMem: False | InInit: False | DLL: False +PID: 7764 | Processus: svchost.exe | InLoad: 0x7ff9a5df0000 | InMem: False | InInit: False | DLL: False +PID: 7764 | Processus: svchost.exe | InLoad: 0x7ff9a5dd0000 | InMem: False | InInit: False | DLL: False +PID: 7764 | Processus: svchost.exe | InLoad: 0x7ff9a6d50000 | InMem: False | InInit: False | DLL: False +PID: 7764 | Processus: svchost.exe | InLoad: 0x7ff9a6400000 | InMem: False | InInit: False | DLL: False +PID: 7764 | Processus: svchost.exe | InLoad: 0x7ff9a6160000 | InMem: False | InInit: False | DLL: False +PID: 7764 | Processus: svchost.exe | InLoad: 0x7ff9a6060000 | InMem: False | InInit: False | DLL: False +PID: 7764 | Processus: svchost.exe | InLoad: 0x7ff9a6100000 | InMem: False | InInit: False | DLL: False +PID: 7764 | Processus: svchost.exe | InLoad: 0x7ff9a6180000 | InMem: False | InInit: False | DLL: False +PID: 7764 | Processus: svchost.exe | InLoad: 0x7ff9a6470000 | InMem: False | InInit: False | DLL: False +PID: 7764 | Processus: svchost.exe | InLoad: 0x7ff9a6bc0000 | InMem: False | InInit: False | DLL: False +PID: 7764 | Processus: svchost.exe | InLoad: 0x7ff9a78c0000 | InMem: False | InInit: False | DLL: False +PID: 7764 | Processus: svchost.exe | InLoad: 0x7ff9a7280000 | InMem: False | InInit: False | DLL: False +PID: 7764 | Processus: svchost.exe | InLoad: 0x7ff9a7090000 | InMem: False | InInit: False | DLL: False +PID: 7764 | Processus: svchost.exe | InLoad: 0x7ff9a6e70000 | InMem: False | InInit: False | DLL: False +PID: 7764 | Processus: svchost.exe | InLoad: 0x7ff9a7130000 | InMem: False | InInit: False | DLL: False +PID: 7764 | Processus: svchost.exe | InLoad: 0x7ff9a73d0000 | InMem: False | InInit: False | DLL: False +PID: 7764 | Processus: svchost.exe | InLoad: 0x7ff9a78b0000 | InMem: False | InInit: False | DLL: False +PID: 7764 | Processus: svchost.exe | InLoad: 0x7ff9a9130000 | InMem: False | InInit: False | DLL: False +PID: 7764 | Processus: svchost.exe | InLoad: 0x7ff9a9070000 | InMem: False | InInit: False | DLL: False +PID: 7764 | Processus: svchost.exe | InLoad: 0x7ff9a8dc0000 | InMem: False | InInit: False | DLL: False +PID: 7764 | Processus: svchost.exe | InLoad: 0x7ff9a97c0000 | InMem: False | InInit: False | DLL: False +PID: 7764 | Processus: svchost.exe | InLoad: 0x7ff9a9600000 | InMem: False | InInit: False | DLL: False +PID: 7764 | Processus: svchost.exe | InLoad: 0x7ff9a98f0000 | InMem: False | InInit: False | DLL: False +PID: 5520 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: False | InInit: False | DLL: False +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff99fcc0000 | InMem: True | InInit: False | DLL: True +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff994e70000 | InMem: True | InInit: False | DLL: True +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff989f10000 | InMem: False | InInit: False | DLL: False +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff989e50000 | InMem: False | InInit: False | DLL: False +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff98a260000 | InMem: False | InInit: False | DLL: False +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff991c10000 | InMem: False | InInit: False | DLL: False +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff998a20000 | InMem: False | InInit: False | DLL: False +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff998380000 | InMem: False | InInit: False | DLL: False +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff998430000 | InMem: False | InInit: False | DLL: False +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff99a760000 | InMem: False | InInit: False | DLL: False +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff99a310000 | InMem: False | InInit: False | DLL: False +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff998c10000 | InMem: False | InInit: False | DLL: False +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff99a740000 | InMem: False | InInit: False | DLL: False +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff99d7a0000 | InMem: False | InInit: False | DLL: False +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff99bb50000 | InMem: False | InInit: False | DLL: False +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff99fcb0000 | InMem: False | InInit: False | DLL: False +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff9a1940000 | InMem: False | InInit: False | DLL: False +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff9a0c80000 | InMem: False | InInit: False | DLL: False +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff9a18b0000 | InMem: False | InInit: False | DLL: False +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff9a2930000 | InMem: True | InInit: False | DLL: True +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff9a2000000 | InMem: False | InInit: False | DLL: False +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff9a1ad0000 | InMem: False | InInit: False | DLL: False +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff9a2910000 | InMem: True | InInit: False | DLL: True +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff9a2b60000 | InMem: False | InInit: True | DLL: False +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff9a3750000 | InMem: False | InInit: False | DLL: False +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff9a57b0000 | InMem: False | InInit: False | DLL: False +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff9a53b0000 | InMem: False | InInit: False | DLL: False +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff9a4f20000 | InMem: False | InInit: False | DLL: False +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff9a40e0000 | InMem: False | InInit: False | DLL: False +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff9a55a0000 | InMem: False | InInit: False | DLL: False +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff9a5590000 | InMem: False | InInit: False | DLL: False +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff9a5670000 | InMem: False | InInit: False | DLL: False +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff9a5c90000 | InMem: False | InInit: False | DLL: False +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff9a5c30000 | InMem: False | InInit: True | DLL: False +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff9a5d60000 | InMem: False | InInit: False | DLL: False +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff9a5dd0000 | InMem: False | InInit: False | DLL: False +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff9a5df0000 | InMem: False | InInit: False | DLL: False +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff9a6100000 | InMem: False | InInit: False | DLL: False +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff9a6180000 | InMem: False | InInit: False | DLL: False +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff9a6470000 | InMem: False | InInit: False | DLL: False +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff9a73d0000 | InMem: False | InInit: False | DLL: False +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff9a78b0000 | InMem: False | InInit: False | DLL: False +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff9a8fc0000 | InMem: True | InInit: False | DLL: True +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff9a97c0000 | InMem: True | InInit: False | DLL: True +PID: 7496 | Processus: svchost.exe | InLoad: 0x7ff9a9600000 | InMem: False | InInit: False | DLL: False +PID: 4428 | Processus: OneDrive.exe | InLoad: 0x5120000 | InMem: False | InInit: False | DLL: False +PID: 4428 | Processus: OneDrive.exe | InLoad: 0x40000 | InMem: True | InInit: False | DLL: True +PID: 4428 | Processus: OneDrive.exe | InLoad: 0x5d60000 | InMem: False | InInit: False | DLL: False +PID: 4428 | Processus: OneDrive.exe | InLoad: 0x6f050000 | InMem: False | InInit: False | DLL: False +PID: 4428 | Processus: OneDrive.exe | InLoad: 0x6ef10000 | InMem: False | InInit: False | DLL: False +PID: 4428 | Processus: OneDrive.exe | InLoad: 0x71f80000 | InMem: False | InInit: False | DLL: False +PID: 4428 | Processus: OneDrive.exe | InLoad: 0x72f90000 | InMem: False | InInit: False | DLL: False +PID: 4428 | Processus: OneDrive.exe | InLoad: 0x73330000 | InMem: False | InInit: False | DLL: False +PID: 6624 | Processus: software_repor | InLoad: 0x7ff7a0b70000 | InMem: True | InInit: False | DLL: True +PID: 6620 | Processus: software_repor | InLoad: 0x7ff7a0b70000 | InMem: True | InInit: False | DLL: True +PID: 6512 | Processus: InstallAgent.e | InLoad: 0x1fd6bc90000 | InMem: False | InInit: False | DLL: False +PID: 6512 | Processus: InstallAgent.e | InLoad: 0x7ff78a750000 | InMem: True | InInit: False | DLL: True +PID: 7876 | Processus: InstallAgentUs | InLoad: 0x7ff7e53d0000 | InMem: True | InInit: False | DLL: True +PID: 7380 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff9a0730000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff986c60000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff66cfb0000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff9842a0000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff99e220000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff9925d0000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff986d00000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff996d00000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff997ad0000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff99ca10000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff99bb50000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff99c880000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff99d7a0000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff99f740000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff99f400000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff99ef60000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff99fba0000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff9a6e70000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff9a5b90000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff9a2140000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff9a0c50000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff9a1bd0000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff9a49c0000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff9a25f0000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff9a2730000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff9a54a0000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff9a4f20000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff9a57b0000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff9a6060000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff9a5d60000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff9a5df0000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff9a5db0000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff9a5e10000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff9a6400000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff9a6160000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff9a6100000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff9a6180000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff9a6bc0000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff9a6470000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff9a6d50000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff9a9130000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff9a78c0000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff9a7130000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff9a7090000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff9a73d0000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff9a7280000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff9a8f60000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff9a8dc0000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff9a9070000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff9a8fc0000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff9a97c0000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff9a9430000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff9a9600000 | InMem: False | InInit: False | DLL: False +PID: 7252 | Processus: taskhostw.exe | InLoad: 0x7ff9a98f0000 | InMem: False | InInit: False | DLL: False +PID: 3156 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 6492 | Processus: ngentask.exe | InLoad: 0xa10000 | InMem: True | InInit: False | DLL: True +PID: 6492 | Processus: ngentask.exe | InLoad: 0x4000000 | InMem: False | InInit: False | DLL: False +PID: 8648 | Processus: conhost.exe | InLoad: 0x2ba76200000 | InMem: False | InInit: False | DLL: False +PID: 8648 | Processus: conhost.exe | InLoad: 0x7ff71acb0000 | InMem: True | InInit: False | DLL: True +PID: 2120 | Processus: conhost.exe | InLoad: 0x2e6a3ae0000 | InMem: False | InInit: False | DLL: False +PID: 2120 | Processus: conhost.exe | InLoad: 0x7ff71acb0000 | InMem: True | InInit: False | DLL: True +PID: 9756 | Processus: ngen.exe | InLoad: 0x7ff7206d0000 | InMem: True | InInit: False | DLL: True +PID: 5684 | Processus: ngen.exe | InLoad: 0x10c0000 | InMem: True | InInit: False | DLL: True +PID: 428 | Processus: svchost.exe | InLoad: 0x7ff9a6d50000 | InMem: False | InInit: False | DLL: False +PID: 428 | Processus: svchost.exe | InLoad: 0x7ff9a4f20000 | InMem: False | InInit: False | DLL: False +PID: 428 | Processus: svchost.exe | InLoad: 0x7ff9a2890000 | InMem: False | InInit: False | DLL: False +PID: 428 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: False | InInit: False | DLL: False +PID: 428 | Processus: svchost.exe | InLoad: 0x7ff99c880000 | InMem: False | InInit: False | DLL: False +PID: 428 | Processus: svchost.exe | InLoad: 0x7ff995230000 | InMem: False | InInit: False | DLL: False +PID: 428 | Processus: svchost.exe | InLoad: 0x7ff9a27f0000 | InMem: False | InInit: False | DLL: False +PID: 428 | Processus: svchost.exe | InLoad: 0x7ff9a4890000 | InMem: False | InInit: False | DLL: False +PID: 428 | Processus: svchost.exe | InLoad: 0x7ff9a2ca0000 | InMem: False | InInit: False | DLL: False +PID: 428 | Processus: svchost.exe | InLoad: 0x7ff9a5e10000 | InMem: False | InInit: False | DLL: False +PID: 428 | Processus: svchost.exe | InLoad: 0x7ff9a5db0000 | InMem: False | InInit: False | DLL: False +PID: 428 | Processus: svchost.exe | InLoad: 0x7ff9a5850000 | InMem: False | InInit: False | DLL: False +PID: 428 | Processus: svchost.exe | InLoad: 0x7ff9a5c90000 | InMem: False | InInit: False | DLL: False +PID: 428 | Processus: svchost.exe | InLoad: 0x7ff9a5df0000 | InMem: False | InInit: False | DLL: False +PID: 428 | Processus: svchost.exe | InLoad: 0x7ff9a6160000 | InMem: False | InInit: False | DLL: False +PID: 428 | Processus: svchost.exe | InLoad: 0x7ff9a6060000 | InMem: False | InInit: False | DLL: False +PID: 428 | Processus: svchost.exe | InLoad: 0x7ff9a6100000 | InMem: False | InInit: False | DLL: False +PID: 428 | Processus: svchost.exe | InLoad: 0x7ff9a6400000 | InMem: False | InInit: False | DLL: False +PID: 428 | Processus: svchost.exe | InLoad: 0x7ff9a6180000 | InMem: False | InInit: False | DLL: False +PID: 428 | Processus: svchost.exe | InLoad: 0x7ff9a6bc0000 | InMem: False | InInit: False | DLL: False +PID: 428 | Processus: svchost.exe | InLoad: 0x7ff9a78c0000 | InMem: False | InInit: False | DLL: False +PID: 428 | Processus: svchost.exe | InLoad: 0x7ff9a7090000 | InMem: False | InInit: False | DLL: False +PID: 428 | Processus: svchost.exe | InLoad: 0x7ff9a6e70000 | InMem: False | InInit: False | DLL: False +PID: 428 | Processus: svchost.exe | InLoad: 0x7ff9a7130000 | InMem: False | InInit: False | DLL: False +PID: 428 | Processus: svchost.exe | InLoad: 0x7ff9a9130000 | InMem: False | InInit: False | DLL: False +PID: 428 | Processus: svchost.exe | InLoad: 0x7ff9a9070000 | InMem: False | InInit: False | DLL: False +PID: 428 | Processus: svchost.exe | InLoad: 0x7ff9a8dc0000 | InMem: False | InInit: False | DLL: False +PID: 428 | Processus: svchost.exe | InLoad: 0x7ff9a97c0000 | InMem: False | InInit: False | DLL: False +PID: 428 | Processus: svchost.exe | InLoad: 0x7ff9a9600000 | InMem: False | InInit: False | DLL: False +PID: 428 | Processus: svchost.exe | InLoad: 0x7ff9a98f0000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff9a49c0000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff996c10000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff98b020000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff995fe0000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff99d7a0000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff99cbf0000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff99b740000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff998730000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff99bb50000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff99d630000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff99d640000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff9a1ad0000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff99d900000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff99ec50000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff9a25a0000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff9a21d0000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff9a2800000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff9a5c30000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff9a5610000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff9a5030000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff9a4f20000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff9a53b0000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff9a5b90000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff9a57d0000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff9a5c90000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff9a5d60000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff9a5df0000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff9a5dd0000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff9a6160000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff9a6060000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff9a6100000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff9a6180000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff9a64c0000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff9a6470000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff9a6bc0000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff9a7020000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff9a7280000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff9a7130000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff9a73d0000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff9a78b0000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff9a8fc0000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff9a8dc0000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff9a8f60000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff9a97c0000 | InMem: False | InInit: False | DLL: False +PID: 9888 | Processus: svchost.exe | InLoad: 0x7ff9a9600000 | InMem: False | InInit: False | DLL: False +PID: 4596 | Processus: audiodg.exe | InLoad: 0x7ff6aedc0000 | InMem: True | InInit: False | DLL: True +PID: 9660 | Processus: svchost.exe | InLoad: 0x20262ad0000 | InMem: False | InInit: False | DLL: False +PID: 9660 | Processus: svchost.exe | InLoad: 0x20262af0000 | InMem: False | InInit: False | DLL: False +PID: 9660 | Processus: svchost.exe | InLoad: 0x20263c00000 | InMem: False | InInit: False | DLL: False +PID: 9660 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True +PID: 1168 | Processus: SearchProtocol | InLoad: 0x7ff6e12b0000 | InMem: True | InInit: False | DLL: True +PID: 1168 | Processus: SearchProtocol | InLoad: 0x7ff9a14e0000 | InMem: False | InInit: False | DLL: False +PID: 8892 | Processus: osf64.exe | InLoad: 0x6bf0000 | InMem: False | InInit: False | DLL: False +PID: 8892 | Processus: osf64.exe | InLoad: 0x830000 | InMem: False | InInit: False | DLL: False +PID: 8892 | Processus: osf64.exe | InLoad: 0x5990000 | InMem: False | InInit: False | DLL: False +PID: 8892 | Processus: osf64.exe | InLoad: 0x59b0000 | InMem: False | InInit: False | DLL: False +PID: 8892 | Processus: osf64.exe | InLoad: 0x59a0000 | InMem: False | InInit: False | DLL: False +PID: 8892 | Processus: osf64.exe | InLoad: 0x5a30000 | InMem: False | InInit: False | DLL: False +PID: 8892 | Processus: osf64.exe | InLoad: 0xde40000 | InMem: False | InInit: False | DLL: False +PID: 8892 | Processus: osf64.exe | InLoad: 0xe780000 | InMem: False | InInit: False | DLL: False +PID: 8892 | Processus: osf64.exe | InLoad: 0xe7b0000 | InMem: False | InInit: False | DLL: False +PID: 8892 | Processus: osf64.exe | InLoad: 0xe820000 | InMem: False | InInit: False | DLL: False +PID: 8892 | Processus: osf64.exe | InLoad: 0xe800000 | InMem: False | InInit: False | DLL: False +PID: 8892 | Processus: osf64.exe | InLoad: 0xe830000 | InMem: False | InInit: False | DLL: False +PID: 8892 | Processus: osf64.exe | InLoad: 0xf170000 | InMem: False | InInit: False | DLL: False +PID: 8892 | Processus: osf64.exe | InLoad: 0x10b20000 | InMem: False | InInit: False | DLL: False +PID: 8892 | Processus: osf64.exe | InLoad: 0x10c80000 | InMem: False | InInit: False | DLL: False +PID: 8892 | Processus: osf64.exe | InLoad: 0x10d00000 | InMem: False | InInit: False | DLL: False +PID: 8892 | Processus: osf64.exe | InLoad: 0x10ce0000 | InMem: False | InInit: False | DLL: False +PID: 8892 | Processus: osf64.exe | InLoad: 0x10cb0000 | InMem: False | InInit: False | DLL: False +PID: 8892 | Processus: osf64.exe | InLoad: 0x10cf0000 | InMem: False | InInit: False | DLL: False +PID: 8892 | Processus: osf64.exe | InLoad: 0x127c0000 | InMem: False | InInit: False | DLL: False +PID: 8892 | Processus: osf64.exe | InLoad: 0x10d90000 | InMem: False | InInit: False | DLL: False +PID: 8892 | Processus: osf64.exe | InLoad: 0x127d0000 | InMem: False | InInit: False | DLL: False +PID: 8892 | Processus: osf64.exe | InLoad: 0x19860000 | InMem: False | InInit: False | DLL: False +PID: 8892 | Processus: osf64.exe | InLoad: 0x1c9e0000 | InMem: False | InInit: False | DLL: False +PID: 8892 | Processus: osf64.exe | InLoad: 0x140000000 | InMem: True | InInit: False | DLL: True +PID: 7080 | Processus: WmiPrvSE.exe | InLoad: 0x281889b0000 | InMem: False | InInit: False | DLL: False +PID: 7080 | Processus: WmiPrvSE.exe | InLoad: 0x28188cb0000 | InMem: False | InInit: False | DLL: False +PID: 7080 | Processus: WmiPrvSE.exe | InLoad: 0x7ff99dba0000 | InMem: True | InInit: False | DLL: True +PID: 7080 | Processus: WmiPrvSE.exe | InLoad: 0x7ff99b300000 | InMem: True | InInit: False | DLL: True +PID: 7080 | Processus: WmiPrvSE.exe | InLoad: 0x7ff786ce0000 | InMem: True | InInit: False | DLL: True +PID: 7080 | Processus: WmiPrvSE.exe | InLoad: 0x7ff9889c0000 | InMem: False | InInit: False | DLL: False +PID: 7080 | Processus: WmiPrvSE.exe | InLoad: 0x7ff99b850000 | InMem: False | InInit: False | DLL: False +PID: 7080 | Processus: WmiPrvSE.exe | InLoad: 0x7ff99b630000 | InMem: True | InInit: False | DLL: True +PID: 7080 | Processus: WmiPrvSE.exe | InLoad: 0x7ff99b880000 | InMem: False | InInit: False | DLL: False +PID: 7080 | Processus: WmiPrvSE.exe | InLoad: 0x7ff9a49c0000 | InMem: False | InInit: False | DLL: False +PID: 7080 | Processus: WmiPrvSE.exe | InLoad: 0x7ff9a29c0000 | InMem: False | InInit: False | DLL: False +PID: 7080 | Processus: WmiPrvSE.exe | InLoad: 0x7ff9a2ca0000 | InMem: False | InInit: False | DLL: False +PID: 7080 | Processus: WmiPrvSE.exe | InLoad: 0x7ff9a5c30000 | InMem: False | InInit: False | DLL: False +PID: 7080 | Processus: WmiPrvSE.exe | InLoad: 0x7ff9a5850000 | InMem: False | InInit: False | DLL: False +PID: 7080 | Processus: WmiPrvSE.exe | InLoad: 0x7ff9a5d60000 | InMem: False | InInit: False | DLL: False +PID: 7080 | Processus: WmiPrvSE.exe | InLoad: 0x7ff9a6400000 | InMem: False | InInit: True | DLL: False +PID: 7080 | Processus: WmiPrvSE.exe | InLoad: 0x7ff9a6160000 | InMem: False | InInit: False | DLL: False +PID: 7080 | Processus: WmiPrvSE.exe | InLoad: 0x7ff9a6060000 | InMem: False | InInit: False | DLL: False +PID: 7080 | Processus: WmiPrvSE.exe | InLoad: 0x7ff9a6bc0000 | InMem: False | InInit: False | DLL: False +PID: 7080 | Processus: WmiPrvSE.exe | InLoad: 0x7ff9a6470000 | InMem: False | InInit: False | DLL: False +PID: 7080 | Processus: WmiPrvSE.exe | InLoad: 0x7ff9a6e70000 | InMem: False | InInit: True | DLL: False +PID: 7080 | Processus: WmiPrvSE.exe | InLoad: 0x7ff9a73d0000 | InMem: False | InInit: False | DLL: False +PID: 7080 | Processus: WmiPrvSE.exe | InLoad: 0x7ff9a9070000 | InMem: False | InInit: False | DLL: False +PID: 7080 | Processus: WmiPrvSE.exe | InLoad: 0x7ff9a8dc0000 | InMem: False | InInit: False | DLL: False +PID: 7080 | Processus: WmiPrvSE.exe | InLoad: 0x7ff9a97c0000 | InMem: False | InInit: False | DLL: False +PID: 7080 | Processus: WmiPrvSE.exe | InLoad: 0x7ff9a9600000 | InMem: False | InInit: False | DLL: False +PID: 3672 | Processus: CompatTelRunne | InLoad: 0x172a1f00000 | InMem: False | InInit: False | DLL: False +PID: 3672 | Processus: CompatTelRunne | InLoad: 0x172a2030000 | InMem: False | InInit: False | DLL: False +PID: 3672 | Processus: CompatTelRunne | InLoad: 0x172a2060000 | InMem: False | InInit: False | DLL: False +PID: 3672 | Processus: CompatTelRunne | InLoad: 0x7ff69b410000 | InMem: True | InInit: False | DLL: True +PID: 1612 | Processus: conhost.exe | InLoad: 0x2131a670000 | InMem: False | InInit: False | DLL: False +PID: 1612 | Processus: conhost.exe | InLoad: 0x2131a680000 | InMem: False | InInit: False | DLL: False +PID: 1612 | Processus: conhost.exe | InLoad: 0x2131aea0000 | InMem: False | InInit: False | DLL: False +PID: 1612 | Processus: conhost.exe | InLoad: 0x7ff71acb0000 | InMem: True | InInit: False | DLL: True +PID: 8704 | Processus: svchost.exe | InLoad: 0x20ca6f90000 | InMem: False | InInit: False | DLL: False +PID: 8704 | Processus: svchost.exe | InLoad: 0x20ca70f0000 | InMem: False | InInit: False | DLL: False +PID: 8704 | Processus: svchost.exe | InLoad: 0x20ca77d0000 | InMem: False | InInit: False | DLL: False +PID: 8704 | Processus: svchost.exe | InLoad: 0x20ca77c0000 | InMem: False | InInit: False | DLL: False +PID: 8704 | Processus: svchost.exe | InLoad: 0x20ca7800000 | InMem: False | InInit: False | DLL: False +PID: 8704 | Processus: svchost.exe | InLoad: 0x20ca77e0000 | InMem: False | InInit: False | DLL: False +PID: 8704 | Processus: svchost.exe | InLoad: 0x20ca7810000 | InMem: False | InInit: False | DLL: False +PID: 8704 | Processus: svchost.exe | InLoad: 0x20ca7d40000 | InMem: False | InInit: False | DLL: False +PID: 8704 | Processus: svchost.exe | InLoad: 0x7ff791320000 | InMem: True | InInit: False | DLL: True diff --git a/Semaine_12/Jour_05/volatility/data/results/zeus.vmem_windows.info.log b/Semaine_12/Jour_05/volatility/data/results/zeus.vmem_windows.info.log new file mode 100644 index 0000000..f5c69df --- /dev/null +++ b/Semaine_12/Jour_05/volatility/data/results/zeus.vmem_windows.info.log @@ -0,0 +1,28 @@ +WARNING volatility3.framework.layers.vmware: No metadata file found alongside VMEM file. A VMSS or VMSN file may be required to correctly process a VMEM file. These should be placed in the same directory with the same file name, e.g. zeus.vmem and zeus.vmss. + Progress: 0.00 Scanning FileLayer using PageMapScanner Progress: 15.11 Scanning FileLayer using PageMapScanner Progress: 64.75 Scanning FileLayer using PageMapScanner Progress: 0.00 Scanning FileLayer using PageMapScanner Progress: 100.00 Stacking attempts finished Progress: 0.00 Scanning memory_layer using BytesScanner Progress: 0.00 Scanning layer_name using PdbSignatureScanner Progress: 0.00 Scanning layer_name using PdbSignatureScanner Progress: 52.54 Scanning layer_name using PdbSignatureScanner Progress: 100.00 PDB scanning finished Volatility 3 Framework 2.28.0 + +Variable Value + +Kernel Base 0x804d7000 +DTB 0x39000 +Symbols jar:file:/usr/local/lib/python3.10/site-packages/volatility3/symbols/windows.zip!windows/ntkrnlpa.pdb/BD8F451F3E754ED8A34B50560CEB08E3-1.json.xz +Is64Bit False +IsPAE False +layer_name 0 WindowsIntel +memory_layer 1 FileLayer +KdDebuggerDataBlock 0x80544ce0 +NTBuildLab 2600.xpsp_sp2_rtm.040803-2158 +CSDVersion 2 +KdVersionBlock 0x80544cb8 +Major/Minor 15.2600 +MachineType 332 +KeNumberProcessors 1 +SystemTime 2010-08-15 19:17:56+00:00 +NtSystemRoot C:\WINDOWS +NtProductType NtProductWinNt +NtMajorVersion 5 +NtMinorVersion 1 +PE MajorOperatingSystemVersion 5 +PE MinorOperatingSystemVersion 1 +PE Machine 332 +PE TimeDateStamp Wed Aug 4 05:58:36 2004 diff --git a/Semaine_12/Jour_05/volatility/data/results/zeus.vmem_windows.ldrmodules.log b/Semaine_12/Jour_05/volatility/data/results/zeus.vmem_windows.ldrmodules.log new file mode 100644 index 0000000..7d1849f --- /dev/null +++ b/Semaine_12/Jour_05/volatility/data/results/zeus.vmem_windows.ldrmodules.log @@ -0,0 +1,7 @@ +WARNING volatility3.framework.layers.vmware: No metadata file found alongside VMEM file. A VMSS or VMSN file may be required to correctly process a VMEM file. These should be placed in the same directory with the same file name, e.g. zeus.vmem and zeus.vmss. + Progress: 0.00 Scanning FileLayer using PageMapScanner Progress: 15.11 Scanning FileLayer using PageMapScanner Progress: 64.75 Scanning FileLayer using PageMapScanner Progress: 0.00 Scanning FileLayer using PageMapScanner Progress: 100.00 Stacking attempts finished Progress: 0.00 Scanning memory_layer using BytesScanner Progress: 0.00 Scanning layer_name using PdbSignatureScanner Progress: 0.00 Scanning layer_name using PdbSignatureScanner Progress: 52.54 Scanning layer_name using PdbSignatureScanner Progress: 100.00 PDB scanning finished /usr/local/lib/python3.10/site-packages/volatility3/framework/deprecation.py:28: FutureWarning: This API (volatility3.plugins.windows.malware.ldrmodules.LdrModules.run) will be removed in the first release after 2026-06-07. This plugin has been renamed, please call volatility3.plugins.windows.malware.ldrmodules.LdrModules rather than volatility3.plugins.windows.ldrmodules.LdrModules. + warnings.warn( +Volatility 3 Framework 2.28.0 + +Pid Process Base InLoad InInit InMem MappedPath + diff --git a/Semaine_12/Jour_05/volatility/data/results/zeus.vmem_windows.malfind.log b/Semaine_12/Jour_05/volatility/data/results/zeus.vmem_windows.malfind.log new file mode 100644 index 0000000..6903900 --- /dev/null +++ b/Semaine_12/Jour_05/volatility/data/results/zeus.vmem_windows.malfind.log @@ -0,0 +1,7 @@ +WARNING volatility3.framework.layers.vmware: No metadata file found alongside VMEM file. A VMSS or VMSN file may be required to correctly process a VMEM file. These should be placed in the same directory with the same file name, e.g. zeus.vmem and zeus.vmss. + Progress: 0.00 Scanning FileLayer using PageMapScanner Progress: 15.11 Scanning FileLayer using PageMapScanner Progress: 64.75 Scanning FileLayer using PageMapScanner Progress: 0.00 Scanning FileLayer using PageMapScanner Progress: 100.00 Stacking attempts finished Progress: 0.00 Scanning memory_layer using BytesScanner Progress: 0.00 Scanning layer_name using PdbSignatureScanner Progress: 0.00 Scanning layer_name using PdbSignatureScanner Progress: 52.54 Scanning layer_name using PdbSignatureScanner Progress: 100.00 PDB scanning finished /usr/local/lib/python3.10/site-packages/volatility3/framework/deprecation.py:28: FutureWarning: This API (volatility3.plugins.windows.malware.malfind.Malfind.run) will be removed in the first release after 2026-06-07. This plugin has been renamed, please call volatility3.plugins.windows.malware.malfind.Malfind rather than volatility3.plugins.windows.malfind.Malfind. + warnings.warn( +Volatility 3 Framework 2.28.0 + +PID Process Start VPN End VPN Tag Protection CommitCharge PrivateMemory File output Notes Hexdump Disasm + diff --git a/Semaine_12/Jour_05/volatility/data/results/zeus.vmem_windows.netscan.log b/Semaine_12/Jour_05/volatility/data/results/zeus.vmem_windows.netscan.log new file mode 100644 index 0000000..12336bb --- /dev/null +++ b/Semaine_12/Jour_05/volatility/data/results/zeus.vmem_windows.netscan.log @@ -0,0 +1,22 @@ +WARNING volatility3.framework.layers.vmware: No metadata file found alongside VMEM file. A VMSS or VMSN file may be required to correctly process a VMEM file. These should be placed in the same directory with the same file name, e.g. zeus.vmem and zeus.vmss. + Progress: 0.00 Scanning FileLayer using PageMapScanner Progress: 15.11 Scanning FileLayer using PageMapScanner Progress: 64.75 Scanning FileLayer using PageMapScanner Progress: 0.00 Scanning FileLayer using PageMapScanner Progress: 100.00 Stacking attempts finished Progress: 0.00 Scanning memory_layer using BytesScanner Progress: 0.00 Scanning layer_name using PdbSignatureScanner Progress: 0.00 Scanning layer_name using PdbSignatureScanner Progress: 52.54 Scanning layer_name using PdbSignatureScanner Progress: 100.00 PDB scanning finished Volatility 3 Framework 2.28.0 + +Offset Proto LocalAddr LocalPort ForeignAddr ForeignPort State PID Owner Created +Traceback (most recent call last): + File "/usr/local/bin/vol", line 8, in + sys.exit(main()) + File "/usr/local/lib/python3.10/site-packages/volatility3/cli/__init__.py", line 934, in main + CommandLine().run() + File "/usr/local/lib/python3.10/site-packages/volatility3/cli/__init__.py", line 522, in run + renderer.render(grid) + File "/usr/local/lib/python3.10/site-packages/volatility3/cli/text_renderer.py", line 329, in render + grid.populate(visitor, outfd) + File "/usr/local/lib/python3.10/site-packages/volatility3/framework/renderers/__init__.py", line 318, in populate + for level, item in self._generator: + File "/usr/local/lib/python3.10/site-packages/volatility3/framework/plugins/windows/netscan.py", line 390, in _generator + netscan_symbol_table = self.create_netscan_symbol_table( + File "/usr/local/lib/python3.10/site-packages/volatility3/framework/plugins/windows/netscan.py", line 347, in create_netscan_symbol_table + symbol_filename, class_types = cls.determine_tcpip_version( + File "/usr/local/lib/python3.10/site-packages/volatility3/framework/plugins/windows/netscan.py", line 318, in determine_tcpip_version + raise NotImplementedError( +NotImplementedError: This version of Windows is not supported: 5.1 15.2600! diff --git a/Semaine_12/Jour_05/volatility/data/results/zeus.vmem_windows.pslist.log b/Semaine_12/Jour_05/volatility/data/results/zeus.vmem_windows.pslist.log new file mode 100644 index 0000000..7bad340 --- /dev/null +++ b/Semaine_12/Jour_05/volatility/data/results/zeus.vmem_windows.pslist.log @@ -0,0 +1,5 @@ +WARNING volatility3.framework.layers.vmware: No metadata file found alongside VMEM file. A VMSS or VMSN file may be required to correctly process a VMEM file. These should be placed in the same directory with the same file name, e.g. zeus.vmem and zeus.vmss. + Progress: 0.00 Scanning FileLayer using PageMapScanner Progress: 15.11 Scanning FileLayer using PageMapScanner Progress: 64.75 Scanning FileLayer using PageMapScanner Progress: 0.00 Scanning FileLayer using PageMapScanner Progress: 100.00 Stacking attempts finished Progress: 0.00 Scanning memory_layer using BytesScanner Progress: 0.00 Scanning layer_name using PdbSignatureScanner Progress: 0.00 Scanning layer_name using PdbSignatureScanner Progress: 52.54 Scanning layer_name using PdbSignatureScanner Progress: 100.00 PDB scanning finished Volatility 3 Framework 2.28.0 + +PID PPID ImageFileName Offset(V) Threads Handles SessionId Wow64 CreateTime ExitTime File output + diff --git a/Semaine_12/Jour_05/volatility/data/results/zeus.vmem_windows.psscan.log b/Semaine_12/Jour_05/volatility/data/results/zeus.vmem_windows.psscan.log new file mode 100644 index 0000000..88ea6dc --- /dev/null +++ b/Semaine_12/Jour_05/volatility/data/results/zeus.vmem_windows.psscan.log @@ -0,0 +1,31 @@ +WARNING volatility3.framework.layers.vmware: No metadata file found alongside VMEM file. A VMSS or VMSN file may be required to correctly process a VMEM file. These should be placed in the same directory with the same file name, e.g. zeus.vmem and zeus.vmss. + Progress: 0.00 Scanning FileLayer using PageMapScanner Progress: 15.11 Scanning FileLayer using PageMapScanner Progress: 64.75 Scanning FileLayer using PageMapScanner Progress: 0.00 Scanning FileLayer using PageMapScanner Progress: 100.00 Stacking attempts finished Progress: 0.00 Scanning memory_layer using BytesScanner Progress: 0.00 Scanning layer_name using PdbSignatureScanner Progress: 0.00 Scanning layer_name using PdbSignatureScanner Progress: 52.54 Scanning layer_name using PdbSignatureScanner Progress: 100.00 PDB scanning finished Volatility 3 Framework 2.28.0 + +PID PPID ImageFileName Offset(V) Threads Handles SessionId Wow64 CreateTime ExitTime File output + +1732 1028 wuauclt.exe 0x10c3da0 7 - - False 2010-08-11 06:07:44.000000 UTC N/A Disabled +468 1028 wuauclt.exe 0x10f7588 4 - - False 2010-08-11 06:09:37.000000 UTC N/A Disabled +1028 676 svchost.exe 0x1122910 88 - - False 2010-08-11 06:06:24.000000 UTC N/A Disabled +856 676 svchost.exe 0x115b8d8 29 - - False 2010-08-11 06:06:24.000000 UTC N/A Disabled +4 0 System 0x1214660 58 - N/A False N/A N/A Disabled +1968 676 TPAutoConnSvc.e 0x211ab28 5 - - False 2010-08-11 06:06:39.000000 UTC N/A Disabled +1084 1968 TPAutoConnect.e 0x49c15f8 1 - - False 2010-08-11 06:06:52.000000 UTC N/A Disabled +1724 1708 explorer.exe 0x4a065d0 13 - - False 2010-08-11 06:09:29.000000 UTC N/A Disabled +452 1724 VMwareUser.exe 0x4b5a980 8 - - False 2010-08-11 06:09:32.000000 UTC N/A Disabled +432 1724 VMwareTray.exe 0x4be97e8 1 - - False 2010-08-11 06:09:31.000000 UTC N/A Disabled +888 1028 wscntfy.exe 0x4c2b310 1 - - False 2010-08-11 06:06:49.000000 UTC N/A Disabled +544 4 smss.exe 0x5471020 3 - N/A False 2010-08-11 06:06:21.000000 UTC N/A Disabled +216 676 alg.exe 0x5f027e0 8 - - False 2010-08-11 06:06:39.000000 UTC N/A Disabled +688 632 lsass.exe 0x5f47020 21 - - False 2010-08-11 06:06:24.000000 UTC N/A Disabled +676 632 services.exe 0x6015020 16 - - False 2010-08-11 06:06:24.000000 UTC N/A Disabled +1088 676 svchost.exe 0x61ef558 7 - - False 2010-08-11 06:06:25.000000 UTC N/A Disabled +124 1668 cmd.exe 0x6238020 0 - - False 2010-08-15 19:17:55.000000 UTC 2010-08-15 19:17:56.000000 UTC Disabled +844 676 vmacthlp.exe 0x6384230 1 - - False 2010-08-11 06:06:24.000000 UTC N/A Disabled +936 676 svchost.exe 0x63c5560 11 - - False 2010-08-11 06:06:24.000000 UTC N/A Disabled +1148 676 svchost.exe 0x6499b80 15 - - False 2010-08-11 06:06:26.000000 UTC N/A Disabled +1788 676 VMUpgradeHelper 0x655fc88 5 - - False 2010-08-11 06:06:38.000000 UTC N/A Disabled +632 544 winlogon.exe 0x66f0978 24 - - False 2010-08-11 06:06:23.000000 UTC N/A Disabled +608 544 csrss.exe 0x66f0da0 10 - - False 2010-08-11 06:06:23.000000 UTC N/A Disabled +1432 676 spoolsv.exe 0x6945da0 14 - - False 2010-08-11 06:06:26.000000 UTC N/A Disabled +1944 124 VMip.exe 0x69a7328 0 - - False 2010-08-15 19:17:55.000000 UTC 2010-08-15 19:17:56.000000 UTC Disabled +1668 676 vmtoolsd.exe 0x69d5b28 5 - - False 2010-08-11 06:06:35.000000 UTC N/A Disabled diff --git a/Semaine_12/Jour_05/volatility/data/results/zeus.vmem_windows.pstree.log b/Semaine_12/Jour_05/volatility/data/results/zeus.vmem_windows.pstree.log new file mode 100644 index 0000000..e6dff99 --- /dev/null +++ b/Semaine_12/Jour_05/volatility/data/results/zeus.vmem_windows.pstree.log @@ -0,0 +1,5 @@ +WARNING volatility3.framework.layers.vmware: No metadata file found alongside VMEM file. A VMSS or VMSN file may be required to correctly process a VMEM file. These should be placed in the same directory with the same file name, e.g. zeus.vmem and zeus.vmss. + Progress: 0.00 Scanning FileLayer using PageMapScanner Progress: 15.11 Scanning FileLayer using PageMapScanner Progress: 64.75 Scanning FileLayer using PageMapScanner Progress: 0.00 Scanning FileLayer using PageMapScanner Progress: 100.00 Stacking attempts finished Progress: 0.00 Scanning memory_layer using BytesScanner Progress: 0.00 Scanning layer_name using PdbSignatureScanner Progress: 0.00 Scanning layer_name using PdbSignatureScanner Progress: 52.54 Scanning layer_name using PdbSignatureScanner Progress: 100.00 PDB scanning finished Volatility 3 Framework 2.28.0 + +PID PPID ImageFileName Offset(V) Threads Handles SessionId Wow64 CreateTime ExitTime Audit Cmd Path + diff --git a/Semaine_12/Jour_05/volatility/docker-compose.yml b/Semaine_12/Jour_05/volatility/docker-compose.yml new file mode 100644 index 0000000..b37ac85 --- /dev/null +++ b/Semaine_12/Jour_05/volatility/docker-compose.yml @@ -0,0 +1,9 @@ +services: + volatility: + build: . + container_name: volatility_lab + stdin_open: true + tty: true + volumes: + - ./data:/data + working_dir: /data \ No newline at end of file