mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-09-25 19:14:52 +02:00
windows testing data
This commit is contained in:
Abyss Watcher
@@ -0,0 +1,32 @@
|
||||
{
|
||||
"GENERIC": [
|
||||
"IRP_MJ_CREATE",
|
||||
"IRP_MJ_CREATE_NAMED_PIPE",
|
||||
"IRP_MJ_CLOSE",
|
||||
"IRP_MJ_READ",
|
||||
"IRP_MJ_WRITE",
|
||||
"IRP_MJ_QUERY_INFORMATION",
|
||||
"IRP_MJ_SET_INFORMATION",
|
||||
"IRP_MJ_QUERY_EA",
|
||||
"IRP_MJ_SET_EA",
|
||||
"IRP_MJ_FLUSH_BUFFERS",
|
||||
"IRP_MJ_QUERY_VOLUME_INFORMATION",
|
||||
"IRP_MJ_SET_VOLUME_INFORMATION",
|
||||
"IRP_MJ_DIRECTORY_CONTROL",
|
||||
"IRP_MJ_FILE_SYSTEM_CONTROL",
|
||||
"IRP_MJ_DEVICE_CONTROL",
|
||||
"IRP_MJ_INTERNAL_DEVICE_CONTROL",
|
||||
"IRP_MJ_SHUTDOWN",
|
||||
"IRP_MJ_LOCK_CONTROL",
|
||||
"IRP_MJ_CLEANUP",
|
||||
"IRP_MJ_CREATE_MAILSLOT",
|
||||
"IRP_MJ_QUERY_SECURITY",
|
||||
"IRP_MJ_SET_SECURITY",
|
||||
"IRP_MJ_POWER",
|
||||
"IRP_MJ_SYSTEM_CONTROL",
|
||||
"IRP_MJ_DEVICE_CHANGE",
|
||||
"IRP_MJ_QUERY_QUOTA",
|
||||
"IRP_MJ_SET_QUOTA",
|
||||
"IRP_MJ_PNP"
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,96 @@
|
||||
{
|
||||
"WINDOWS10_GENERIC": [
|
||||
{
|
||||
"Value": "0xf8043601f000",
|
||||
"Variable": "Kernel Base"
|
||||
},
|
||||
{
|
||||
"Value": "0x6d4000",
|
||||
"Variable": "DTB"
|
||||
},
|
||||
{
|
||||
"Value": "True",
|
||||
"Variable": "Is64Bit"
|
||||
},
|
||||
{
|
||||
"Value": "False",
|
||||
"Variable": "IsPAE"
|
||||
},
|
||||
{
|
||||
"Value": "0 WindowsIntel32e",
|
||||
"Variable": "layer_name"
|
||||
},
|
||||
{
|
||||
"Value": "1 WindowsCrashDump64Layer",
|
||||
"Variable": "memory_layer"
|
||||
},
|
||||
{
|
||||
"Value": "2 FileLayer",
|
||||
"Variable": "base_layer"
|
||||
},
|
||||
{
|
||||
"Value": "0xf80436c1fb20",
|
||||
"Variable": "KdDebuggerDataBlock"
|
||||
},
|
||||
{
|
||||
"Value": "19041.1.amd64fre.vb_release.1912",
|
||||
"Variable": "NTBuildLab"
|
||||
},
|
||||
{
|
||||
"Value": "0",
|
||||
"Variable": "CSDVersion"
|
||||
},
|
||||
{
|
||||
"Value": "0xf80436c2e420",
|
||||
"Variable": "KdVersionBlock"
|
||||
},
|
||||
{
|
||||
"Value": "15.19041",
|
||||
"Variable": "Major/Minor"
|
||||
},
|
||||
{
|
||||
"Value": "34404",
|
||||
"Variable": "MachineType"
|
||||
},
|
||||
{
|
||||
"Value": "1",
|
||||
"Variable": "KeNumberProcessors"
|
||||
},
|
||||
{
|
||||
"Value": "2025-03-06 17:59:20+00:00",
|
||||
"Variable": "SystemTime"
|
||||
},
|
||||
{
|
||||
"Value": "C:\\Windows",
|
||||
"Variable": "NtSystemRoot"
|
||||
},
|
||||
{
|
||||
"Value": "NtProductWinNt",
|
||||
"Variable": "NtProductType"
|
||||
},
|
||||
{
|
||||
"Value": "10",
|
||||
"Variable": "NtMajorVersion"
|
||||
},
|
||||
{
|
||||
"Value": "0",
|
||||
"Variable": "NtMinorVersion"
|
||||
},
|
||||
{
|
||||
"Value": "10",
|
||||
"Variable": "PE MajorOperatingSystemVersion"
|
||||
},
|
||||
{
|
||||
"Value": "0",
|
||||
"Variable": "PE MinorOperatingSystemVersion"
|
||||
},
|
||||
{
|
||||
"Value": "34404",
|
||||
"Variable": "PE Machine"
|
||||
},
|
||||
{
|
||||
"Value": "Tue Sep 26 06:53:33 2023",
|
||||
"Variable": "PE TimeDateStamp"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,375 @@
|
||||
{
|
||||
"WINDOWS10_GENERIC": {
|
||||
"Audit": "\\Device\\HarddiskVolume4\\Windows\\System32\\winlogon.exe",
|
||||
"Cmd": null,
|
||||
"CreateTime": "2025-03-06T17:49:34+00:00",
|
||||
"ExitTime": null,
|
||||
"Handles": null,
|
||||
"ImageFileName": "winlogon.exe",
|
||||
"Offset(V)": 145201769754752,
|
||||
"PID": 3616,
|
||||
"PPID": 3568,
|
||||
"Path": null,
|
||||
"SessionId": 2,
|
||||
"Threads": 3,
|
||||
"Wow64": false,
|
||||
"__children": [
|
||||
{
|
||||
"Audit": "\\Device\\HarddiskVolume4\\Windows\\System32\\userinit.exe",
|
||||
"Cmd": null,
|
||||
"CreateTime": "2025-03-06T17:50:15+00:00",
|
||||
"ExitTime": "2025-03-06T17:50:32+00:00",
|
||||
"Handles": null,
|
||||
"ImageFileName": "userinit.exe",
|
||||
"Offset(V)": 145201786712256,
|
||||
"PID": 4832,
|
||||
"PPID": 3616,
|
||||
"Path": null,
|
||||
"SessionId": 2,
|
||||
"Threads": 0,
|
||||
"Wow64": false,
|
||||
"__children": [
|
||||
{
|
||||
"Audit": "\\Device\\HarddiskVolume4\\Windows\\explorer.exe",
|
||||
"Cmd": "C:\\Windows\\Explorer.EXE",
|
||||
"CreateTime": "2025-03-06T17:50:17+00:00",
|
||||
"ExitTime": null,
|
||||
"Handles": null,
|
||||
"ImageFileName": "explorer.exe",
|
||||
"Offset(V)": 145201787191488,
|
||||
"PID": 4912,
|
||||
"PPID": 4832,
|
||||
"Path": "C:\\Windows\\Explorer.EXE",
|
||||
"SessionId": 2,
|
||||
"Threads": 57,
|
||||
"Wow64": false,
|
||||
"__children": [
|
||||
{
|
||||
"Audit": "\\Device\\HarddiskVolume4\\Windows\\System32\\SecurityHealthSystray.exe",
|
||||
"Cmd": "\"C:\\Windows\\System32\\SecurityHealthSystray.exe\" ",
|
||||
"CreateTime": "2025-03-06T17:51:05+00:00",
|
||||
"ExitTime": null,
|
||||
"Handles": null,
|
||||
"ImageFileName": "SecurityHealth",
|
||||
"Offset(V)": 145201826054336,
|
||||
"PID": 1860,
|
||||
"PPID": 4912,
|
||||
"Path": "C:\\Windows\\System32\\SecurityHealthSystray.exe",
|
||||
"SessionId": 2,
|
||||
"Threads": 2,
|
||||
"Wow64": false,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
||||
"Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --no-startup-window --win-session-start",
|
||||
"CreateTime": "2025-03-06T17:51:05+00:00",
|
||||
"ExitTime": null,
|
||||
"Handles": null,
|
||||
"ImageFileName": "msedge.exe",
|
||||
"Offset(V)": 145201826906304,
|
||||
"PID": 3952,
|
||||
"PPID": 4912,
|
||||
"Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
||||
"SessionId": 2,
|
||||
"Threads": 61,
|
||||
"Wow64": false,
|
||||
"__children": [
|
||||
{
|
||||
"Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
||||
"Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --time-ticks-at-unix-epoch=-1741283277737123 --launch-time-ticks=556708795 --always-read-main-dll --field-trial-handle=3928,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=3996 /prefetch:1",
|
||||
"CreateTime": "2025-03-06T17:57:14+00:00",
|
||||
"ExitTime": null,
|
||||
"Handles": null,
|
||||
"ImageFileName": "msedge.exe",
|
||||
"Offset(V)": 145201787768960,
|
||||
"PID": 5348,
|
||||
"PPID": 3952,
|
||||
"Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
||||
"SessionId": 2,
|
||||
"Threads": 19,
|
||||
"Wow64": false,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
||||
"Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --string-annotations --always-read-main-dll --field-trial-handle=6740,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:8",
|
||||
"CreateTime": "2025-03-06T17:57:52+00:00",
|
||||
"ExitTime": null,
|
||||
"Handles": null,
|
||||
"ImageFileName": "msedge.exe",
|
||||
"Offset(V)": 145201832050880,
|
||||
"PID": 3876,
|
||||
"PPID": 3952,
|
||||
"Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
||||
"SessionId": 2,
|
||||
"Threads": 8,
|
||||
"Wow64": false,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
||||
"Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=7016,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:8",
|
||||
"CreateTime": "2025-03-06T17:57:59+00:00",
|
||||
"ExitTime": null,
|
||||
"Handles": null,
|
||||
"ImageFileName": "msedge.exe",
|
||||
"Offset(V)": 145201827619008,
|
||||
"PID": 5604,
|
||||
"PPID": 3952,
|
||||
"Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
||||
"SessionId": 2,
|
||||
"Threads": 14,
|
||||
"Wow64": false,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
||||
"Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=5520,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:8",
|
||||
"CreateTime": "2025-03-06T17:57:16+00:00",
|
||||
"ExitTime": null,
|
||||
"Handles": null,
|
||||
"ImageFileName": "msedge.exe",
|
||||
"Offset(V)": 145201827774656,
|
||||
"PID": 1000,
|
||||
"PPID": 3952,
|
||||
"Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
||||
"SessionId": 2,
|
||||
"Threads": 9,
|
||||
"Wow64": false,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
||||
"Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --time-ticks-at-unix-epoch=-1741283277737123 --launch-time-ticks=596993509 --always-read-main-dll --field-trial-handle=6904,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:1",
|
||||
"CreateTime": "2025-03-06T17:57:54+00:00",
|
||||
"ExitTime": null,
|
||||
"Handles": null,
|
||||
"ImageFileName": "msedge.exe",
|
||||
"Offset(V)": 145201839592000,
|
||||
"PID": 7080,
|
||||
"PPID": 3952,
|
||||
"Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
||||
"SessionId": 2,
|
||||
"Threads": 15,
|
||||
"Wow64": false,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
||||
"Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --time-ticks-at-unix-epoch=-1741283277737123 --launch-time-ticks=625057436 --always-read-main-dll --field-trial-handle=5592,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:1",
|
||||
"CreateTime": "2025-03-06T17:58:23+00:00",
|
||||
"ExitTime": null,
|
||||
"Handles": null,
|
||||
"ImageFileName": "msedge.exe",
|
||||
"Offset(V)": 145201828201216,
|
||||
"PID": 5132,
|
||||
"PPID": 3952,
|
||||
"Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
||||
"SessionId": 2,
|
||||
"Threads": 17,
|
||||
"Wow64": false,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
||||
"Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --time-ticks-at-unix-epoch=-1741283277737123 --launch-time-ticks=625148972 --always-read-main-dll --field-trial-handle=7112,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:1",
|
||||
"CreateTime": "2025-03-06T17:58:23+00:00",
|
||||
"ExitTime": null,
|
||||
"Handles": null,
|
||||
"ImageFileName": "msedge.exe",
|
||||
"Offset(V)": 145201839919232,
|
||||
"PID": 5388,
|
||||
"PPID": 3952,
|
||||
"Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
||||
"SessionId": 2,
|
||||
"Threads": 15,
|
||||
"Wow64": false,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
||||
"Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=2180,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:3",
|
||||
"CreateTime": "2025-03-06T17:51:14+00:00",
|
||||
"ExitTime": null,
|
||||
"Handles": null,
|
||||
"ImageFileName": "msedge.exe",
|
||||
"Offset(V)": 145201835704512,
|
||||
"PID": 6448,
|
||||
"PPID": 3952,
|
||||
"Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
||||
"SessionId": 2,
|
||||
"Threads": 16,
|
||||
"Wow64": false,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
||||
"Cmd": null,
|
||||
"CreateTime": "2025-03-06T17:51:16+00:00",
|
||||
"ExitTime": null,
|
||||
"Handles": null,
|
||||
"ImageFileName": "msedge.exe",
|
||||
"Offset(V)": 145201668321408,
|
||||
"PID": 6672,
|
||||
"PPID": 3952,
|
||||
"Path": null,
|
||||
"SessionId": 2,
|
||||
"Threads": 9,
|
||||
"Wow64": false,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
||||
"Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=price_comparison_service.mojom.DataProcessor --lang=en-US --service-sandbox-type=entity_extraction --string-annotations --always-read-main-dll --field-trial-handle=6188,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:8",
|
||||
"CreateTime": "2025-03-06T17:58:44+00:00",
|
||||
"ExitTime": null,
|
||||
"Handles": null,
|
||||
"ImageFileName": "msedge.exe",
|
||||
"Offset(V)": 145201830273728,
|
||||
"PID": 6064,
|
||||
"PPID": 3952,
|
||||
"Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
||||
"SessionId": 2,
|
||||
"Threads": 9,
|
||||
"Wow64": false,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
||||
"Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2472,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:2",
|
||||
"CreateTime": "2025-03-06T17:51:14+00:00",
|
||||
"ExitTime": null,
|
||||
"Handles": null,
|
||||
"ImageFileName": "msedge.exe",
|
||||
"Offset(V)": 145201834049728,
|
||||
"PID": 6456,
|
||||
"PPID": 3952,
|
||||
"Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
||||
"SessionId": 2,
|
||||
"Threads": 15,
|
||||
"Wow64": false,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
||||
"Cmd": null,
|
||||
"CreateTime": "2025-03-06T17:51:11+00:00",
|
||||
"ExitTime": null,
|
||||
"Handles": null,
|
||||
"ImageFileName": "msedge.exe",
|
||||
"Offset(V)": 145201786340096,
|
||||
"PID": 6204,
|
||||
"PPID": 3952,
|
||||
"Path": null,
|
||||
"SessionId": 2,
|
||||
"Threads": 8,
|
||||
"Wow64": false,
|
||||
"__children": []
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"Audit": "\\Device\\HarddiskVolume4\\Users\\generic-user\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe",
|
||||
"Cmd": "\"C:\\Users\\generic-user\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe\" /background",
|
||||
"CreateTime": "2025-03-06T17:51:11+00:00",
|
||||
"ExitTime": null,
|
||||
"Handles": null,
|
||||
"ImageFileName": "OneDrive.exe",
|
||||
"Offset(V)": 145201834340544,
|
||||
"PID": 6160,
|
||||
"PPID": 4912,
|
||||
"Path": "C:\\Users\\generic-user\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe",
|
||||
"SessionId": 2,
|
||||
"Threads": 22,
|
||||
"Wow64": true,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Audit": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe",
|
||||
"Cmd": "\"C:\\Windows\\system32\\cmd.exe\" ",
|
||||
"CreateTime": "2025-03-06T17:51:44+00:00",
|
||||
"ExitTime": null,
|
||||
"Handles": null,
|
||||
"ImageFileName": "cmd.exe",
|
||||
"Offset(V)": 145201834332288,
|
||||
"PID": 784,
|
||||
"PPID": 4912,
|
||||
"Path": "C:\\Windows\\system32\\cmd.exe",
|
||||
"SessionId": 2,
|
||||
"Threads": 1,
|
||||
"Wow64": false,
|
||||
"__children": [
|
||||
{
|
||||
"Audit": "\\Device\\HarddiskVolume4\\Windows\\System32\\conhost.exe",
|
||||
"Cmd": null,
|
||||
"CreateTime": "2025-03-06T17:51:49+00:00",
|
||||
"ExitTime": null,
|
||||
"Handles": null,
|
||||
"ImageFileName": "conhost.exe",
|
||||
"Offset(V)": 145201834446976,
|
||||
"PID": 3896,
|
||||
"PPID": 784,
|
||||
"Path": null,
|
||||
"SessionId": 2,
|
||||
"Threads": 3,
|
||||
"Wow64": false,
|
||||
"__children": []
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"Audit": "\\Device\\HarddiskVolume4\\Windows\\System32\\notepad.exe",
|
||||
"Cmd": "\"C:\\Windows\\system32\\notepad.exe\" ",
|
||||
"CreateTime": "2025-03-06T17:52:33+00:00",
|
||||
"ExitTime": null,
|
||||
"Handles": null,
|
||||
"ImageFileName": "notepad.exe",
|
||||
"Offset(V)": 145201839497344,
|
||||
"PID": 2968,
|
||||
"PPID": 4912,
|
||||
"Path": "C:\\Windows\\system32\\notepad.exe",
|
||||
"SessionId": 2,
|
||||
"Threads": 4,
|
||||
"Wow64": false,
|
||||
"__children": []
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"Audit": "\\Device\\HarddiskVolume4\\Windows\\System32\\fontdrvhost.exe",
|
||||
"Cmd": null,
|
||||
"CreateTime": "2025-03-06T17:49:42+00:00",
|
||||
"ExitTime": null,
|
||||
"Handles": null,
|
||||
"ImageFileName": "fontdrvhost.ex",
|
||||
"Offset(V)": 145201770697088,
|
||||
"PID": 3812,
|
||||
"PPID": 3616,
|
||||
"Path": null,
|
||||
"SessionId": 2,
|
||||
"Threads": 5,
|
||||
"Wow64": false,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Audit": "\\Device\\HarddiskVolume4\\Windows\\System32\\dwm.exe",
|
||||
"Cmd": "\"dwm.exe\"",
|
||||
"CreateTime": "2025-03-06T17:49:42+00:00",
|
||||
"ExitTime": null,
|
||||
"Handles": null,
|
||||
"ImageFileName": "dwm.exe",
|
||||
"Offset(V)": 145201770352768,
|
||||
"PID": 3860,
|
||||
"PPID": 3616,
|
||||
"Path": "C:\\Windows\\system32\\dwm.exe",
|
||||
"SessionId": 2,
|
||||
"Threads": 16,
|
||||
"Wow64": false,
|
||||
"__children": []
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,100 @@
|
||||
{
|
||||
"WINDOWS10_GENERIC": [
|
||||
{
|
||||
"Offset": 213323072327680,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Offset": 213323069669376,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Offset": 213323011252224,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Offset": 213322964488192,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Offset": 213323011387392,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Offset": 213322962362368,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Offset": 213323041546240,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Offset": 213323013046272,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Offset": 213323061571584,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Offset": 213323079548928,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Offset": 213323067502592,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Offset": 213323081900032,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Offset": 213322954362880,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Offset": 213322954346496,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Offset": 213323014123520,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Offset": 213323067707392,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Offset": 213323070193664,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Offset": 213323078791168,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Offset": 213323069112320,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Offset": 213323047776256,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Offset": 213323013799936,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Offset": 213322954985472,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Offset": 213322954969088,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Offset": 213323048636416,
|
||||
"__children": []
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"WINDOWS10_GENERIC": [
|
||||
{
|
||||
"Data": "",
|
||||
"Hive Offset": 213322954346496,
|
||||
"Key": "[NONAME]",
|
||||
"Last Write Time": "2025-03-06T17:59:19+00:00",
|
||||
"Name": "A",
|
||||
"Type": "Key",
|
||||
"Volatile": false
|
||||
},
|
||||
{
|
||||
"Data": "",
|
||||
"Hive Offset": 213322954362880,
|
||||
"Key": "\\REGISTRY\\MACHINE\\SYSTEM",
|
||||
"Last Write Time": "2019-12-07T09:15:07+00:00",
|
||||
"Name": "ControlSet001",
|
||||
"Type": "Key",
|
||||
"Volatile": false
|
||||
},
|
||||
{
|
||||
"Data": "",
|
||||
"Hive Offset": 213322964488192,
|
||||
"Key": "\\SystemRoot\\System32\\Config\\SOFTWARE",
|
||||
"Last Write Time": "2025-03-06T17:38:01+00:00",
|
||||
"Name": "Classes",
|
||||
"Type": "Key",
|
||||
"Volatile": false
|
||||
},
|
||||
{
|
||||
"Data": "",
|
||||
"Hive Offset": 213323011252224,
|
||||
"Key": "\\SystemRoot\\System32\\Config\\SAM",
|
||||
"Last Write Time": "2025-01-31T13:01:49+00:00",
|
||||
"Name": "SAM",
|
||||
"Type": "Key",
|
||||
"Volatile": false,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Data": "",
|
||||
"Hive Offset": 213323048636416,
|
||||
"Key": "\\??\\C:\\Users\\generic-user\\ntuser.dat",
|
||||
"Last Write Time": "2025-03-06T17:50:04+00:00",
|
||||
"Name": "SOFTWARE",
|
||||
"Type": "Key",
|
||||
"Volatile": false,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Data": "",
|
||||
"Hive Offset": 213323047776256,
|
||||
"Key": "\\??\\C:\\Users\\generic-user\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat",
|
||||
"Last Write Time": "2025-03-05T18:36:09+00:00",
|
||||
"Name": ".eip",
|
||||
"Type": "Key",
|
||||
"Volatile": false,
|
||||
"__children": []
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,123 @@
|
||||
{
|
||||
"WINDOWS10_GENERIC": {
|
||||
"Count": null,
|
||||
"Focus Count": null,
|
||||
"Hive Name": "\\??\\C:\\Users\\generic-user\\ntuser.dat",
|
||||
"Hive Offset": 213323048636416,
|
||||
"ID": null,
|
||||
"Last Updated": null,
|
||||
"Last Write Time": "2025-03-06T17:57:09+00:00",
|
||||
"Name": null,
|
||||
"Path": "ntuser.dat\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count",
|
||||
"Raw Data": "",
|
||||
"Time Focused": null,
|
||||
"Type": "Key",
|
||||
"__children": [
|
||||
{
|
||||
"Count": 7,
|
||||
"Focus Count": 0,
|
||||
"Hive Name": "\\??\\C:\\Users\\generic-user\\ntuser.dat",
|
||||
"Hive Offset": 213323048636416,
|
||||
"ID": null,
|
||||
"Last Updated": "2025-03-05T18:34:13+00:00",
|
||||
"Last Write Time": "2025-03-06T17:57:09+00:00",
|
||||
"Name": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk",
|
||||
"Path": "ntuser.dat\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count",
|
||||
"Raw Data": "\"\n00 00 00 00 07 00 00 00 00 00 00 00 07 00 00 00 ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf ff ff ff ff 90 86 6b 31 ..............k1\nfd 8d db 01 00 00 00 00 ........ \"",
|
||||
"Time Focused": "0:00:00.507000",
|
||||
"Type": "Value",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Count": 1,
|
||||
"Focus Count": 0,
|
||||
"Hive Name": "\\??\\C:\\Users\\generic-user\\ntuser.dat",
|
||||
"Hive Offset": 213323048636416,
|
||||
"ID": null,
|
||||
"Last Updated": "2025-03-06T12:46:34+00:00",
|
||||
"Last Write Time": "2025-03-06T17:57:09+00:00",
|
||||
"Name": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Registry Editor.lnk",
|
||||
"Path": "ntuser.dat\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count",
|
||||
"Raw Data": "\"\n00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf ff ff ff ff f0 82 cf ca ................\n95 8e db 01 00 00 00 00 ........ \"",
|
||||
"Time Focused": "0:00:00.501000",
|
||||
"Type": "Value",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Count": 4,
|
||||
"Focus Count": 0,
|
||||
"Hive Name": "\\??\\C:\\Users\\generic-user\\ntuser.dat",
|
||||
"Hive Offset": 213323048636416,
|
||||
"ID": null,
|
||||
"Last Updated": "2025-03-06T17:36:33+00:00",
|
||||
"Last Write Time": "2025-03-06T17:57:09+00:00",
|
||||
"Name": "%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk",
|
||||
"Path": "ntuser.dat\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count",
|
||||
"Raw Data": "\"\n00 00 00 00 04 00 00 00 00 00 00 00 04 00 00 00 ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf ff ff ff ff 10 67 cf 4d .............g.M\nbe 8e db 01 00 00 00 00 ........ \"",
|
||||
"Time Focused": "0:00:00.504000",
|
||||
"Type": "Value",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Count": 1,
|
||||
"Focus Count": 0,
|
||||
"Hive Name": "\\??\\C:\\Users\\generic-user\\ntuser.dat",
|
||||
"Hive Offset": 213323048636416,
|
||||
"ID": null,
|
||||
"Last Updated": "2025-03-06T17:51:44+00:00",
|
||||
"Last Write Time": "2025-03-06T17:57:09+00:00",
|
||||
"Name": "%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk",
|
||||
"Path": "ntuser.dat\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count",
|
||||
"Raw Data": "\"\n00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf ff ff ff ff d0 99 66 6c ..............fl\nc0 8e db 01 00 00 00 00 ........ \"",
|
||||
"Time Focused": "0:00:00.501000",
|
||||
"Type": "Value",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Count": 1,
|
||||
"Focus Count": 0,
|
||||
"Hive Name": "\\??\\C:\\Users\\generic-user\\ntuser.dat",
|
||||
"Hive Offset": 213323048636416,
|
||||
"ID": null,
|
||||
"Last Updated": "2025-03-06T17:52:33+00:00",
|
||||
"Last Write Time": "2025-03-06T17:57:09+00:00",
|
||||
"Name": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk",
|
||||
"Path": "ntuser.dat\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count",
|
||||
"Raw Data": "\"\n00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf ff ff ff ff 00 62 ba 89 .............b..\nc0 8e db 01 00 00 00 00 ........ \"",
|
||||
"Time Focused": "0:00:00.501000",
|
||||
"Type": "Value",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Count": 2,
|
||||
"Focus Count": 0,
|
||||
"Hive Name": "\\??\\C:\\Users\\generic-user\\ntuser.dat",
|
||||
"Hive Offset": 213323048636416,
|
||||
"ID": null,
|
||||
"Last Updated": "2025-03-06T17:56:50+00:00",
|
||||
"Last Write Time": "2025-03-06T17:57:09+00:00",
|
||||
"Name": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk",
|
||||
"Path": "ntuser.dat\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count",
|
||||
"Raw Data": "\"\n00 00 00 00 02 00 00 00 00 00 00 00 02 00 00 00 ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf ff ff ff ff b0 24 49 23 .............$I#\nc1 8e db 01 00 00 00 00 ........ \"",
|
||||
"Time Focused": "0:00:00.502000",
|
||||
"Type": "Value",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Count": 1,
|
||||
"Focus Count": 0,
|
||||
"Hive Name": "\\??\\C:\\Users\\generic-user\\ntuser.dat",
|
||||
"Hive Offset": 213323048636416,
|
||||
"ID": null,
|
||||
"Last Updated": "2025-03-06T17:57:09+00:00",
|
||||
"Last Write Time": "2025-03-06T17:57:09+00:00",
|
||||
"Name": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Edge.lnk",
|
||||
"Path": "ntuser.dat\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count",
|
||||
"Raw Data": "\"\n00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf ff ff ff ff 60 3d 89 2e ............`=..\nc1 8e db 01 00 00 00 00 ........ \"",
|
||||
"Time Focused": "0:00:00.501000",
|
||||
"Type": "Value",
|
||||
"__children": []
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,36 @@
|
||||
{
|
||||
"WINDOWS10_GENERIC": [
|
||||
{
|
||||
"Create Time": "2025-03-06T17:48:02+00:00",
|
||||
"Process": "System",
|
||||
"Process ID": 4
|
||||
},
|
||||
{
|
||||
"Create Time": "2025-03-06T17:48:37+00:00",
|
||||
"Process": "lsass.exe",
|
||||
"Process ID": 696,
|
||||
"Session ID": 0,
|
||||
"Session Type": null,
|
||||
"User Name": "/SYSTEM",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Create Time": "2025-03-06T17:49:03+00:00",
|
||||
"Process": "MsMpEng.exe",
|
||||
"Process ID": 1956,
|
||||
"Session ID": 0,
|
||||
"Session Type": null,
|
||||
"User Name": "WORKGROUP/Windows-generic$",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Create Time": "2025-03-06T17:50:08+00:00",
|
||||
"Process": "rdpclip.exe",
|
||||
"Process ID": 4180,
|
||||
"Session ID": 2,
|
||||
"Session Type": null,
|
||||
"User Name": "Windows-generic/generic-user",
|
||||
"__children": []
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,41 @@
|
||||
{
|
||||
"WINDOWS10_GENERIC":
|
||||
[
|
||||
{
|
||||
"Exec Flag": null,
|
||||
"File Path": "C:\\Windows\\System32\\cmdl32.exe",
|
||||
"File Size": null,
|
||||
"Last Modified": "2019-12-07T09:09:07+00:00",
|
||||
"Last Update": null,
|
||||
"Order": 0,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Exec Flag": null,
|
||||
"File Path": "C:\\Windows\\System32\\cmdkey.exe",
|
||||
"File Size": null,
|
||||
"Last Modified": "2019-12-07T09:09:09+00:00",
|
||||
"Last Update": null,
|
||||
"Order": 1,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Exec Flag": null,
|
||||
"File Path": "C:\\Windows\\system32\\whoami.exe",
|
||||
"File Size": null,
|
||||
"Last Modified": "2019-12-07T09:09:51+00:00",
|
||||
"Last Update": null,
|
||||
"Order": 2,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"Exec Flag": null,
|
||||
"File Path": null,
|
||||
"File Size": null,
|
||||
"Last Modified": "2023-12-13T16:43:28+00:00",
|
||||
"Last Update": null,
|
||||
"Order": 3,
|
||||
"__children": []
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,684 @@
|
||||
{
|
||||
"WINDOWSXP_GENERIC": [
|
||||
{
|
||||
"DueTime": "0x00000001:0xb6912640",
|
||||
"Module": "ntoskrnl",
|
||||
"Offset": 2180960760,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 2152618407,
|
||||
"Signaled": "-",
|
||||
"Symbol": "ExpTimerDpcRoutine",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xe2e5d9fc",
|
||||
"Module": "ks",
|
||||
"Offset": 2181100944,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 4162614588,
|
||||
"Signaled": "-",
|
||||
"Symbol": null,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x80000001:0x838d66d0",
|
||||
"Module": "ntoskrnl",
|
||||
"Offset": 2180726816,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 2152618407,
|
||||
"Signaled": "-",
|
||||
"Symbol": "ExpTimerDpcRoutine",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xbe54efd0",
|
||||
"Module": "NDIS",
|
||||
"Offset": 2182586488,
|
||||
"Period(ms)": 60000,
|
||||
"Routine": 4164630316,
|
||||
"Signaled": "Yes",
|
||||
"Symbol": null,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x80000000:0x6d915dc0",
|
||||
"Module": "ntoskrnl",
|
||||
"Offset": 2182771520,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 2152618407,
|
||||
"Signaled": "-",
|
||||
"Symbol": "ExpTimerDpcRoutine",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xd5616870",
|
||||
"Module": "HTTP",
|
||||
"Offset": 4122586976,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 4122527634,
|
||||
"Signaled": "-",
|
||||
"Symbol": null,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xaa92535f",
|
||||
"Module": "USBPORT",
|
||||
"Offset": 2179614512,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 4163343596,
|
||||
"Signaled": "-",
|
||||
"Symbol": null,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x80000000:0x28ec7d80",
|
||||
"Module": "ntoskrnl",
|
||||
"Offset": 2167895896,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 2152618407,
|
||||
"Signaled": "-",
|
||||
"Symbol": "ExpTimerDpcRoutine",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xd5f1ddd0",
|
||||
"Module": "afd",
|
||||
"Offset": 4289149728,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 4146614848,
|
||||
"Signaled": "-",
|
||||
"Symbol": null,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xe64e9c50",
|
||||
"Module": "ntoskrnl",
|
||||
"Offset": 4289091536,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 2152618407,
|
||||
"Signaled": "-",
|
||||
"Symbol": "ExpTimerDpcRoutine",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000002:0x10691f50",
|
||||
"Module": "BATTC",
|
||||
"Offset": 2182647568,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 4170619626,
|
||||
"Signaled": "-",
|
||||
"Symbol": null,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000002:0x10691f50",
|
||||
"Module": "BATTC",
|
||||
"Offset": 2184852912,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 4170619626,
|
||||
"Signaled": "-",
|
||||
"Symbol": null,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xe650bd40",
|
||||
"Module": "ntoskrnl",
|
||||
"Offset": 4289091352,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 2152618407,
|
||||
"Signaled": "-",
|
||||
"Symbol": "ExpTimerDpcRoutine",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xaf39aa70",
|
||||
"Module": "watchdog",
|
||||
"Offset": 2182133296,
|
||||
"Period(ms)": 10000,
|
||||
"Routine": 4170290884,
|
||||
"Signaled": "Yes",
|
||||
"Symbol": "_imp__KdSave",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xaf39aa70",
|
||||
"Module": "watchdog",
|
||||
"Offset": 2181849992,
|
||||
"Period(ms)": 10000,
|
||||
"Routine": 4170290884,
|
||||
"Signaled": "Yes",
|
||||
"Symbol": "_imp__KdSave",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000008:0x61e17090",
|
||||
"Module": "ntoskrnl",
|
||||
"Offset": 2153125248,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 2152824977,
|
||||
"Signaled": "-",
|
||||
"Symbol": "ExpTimeRefreshDpcRoutine",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xa9537f40",
|
||||
"Module": "ntoskrnl",
|
||||
"Offset": 2153083360,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 2152814203,
|
||||
"Signaled": "-",
|
||||
"Symbol": "CmpLazyFlushDpcRoutine",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xc5addbe0",
|
||||
"Module": "TDI",
|
||||
"Offset": 4147138000,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 4169831408,
|
||||
"Signaled": "-",
|
||||
"Symbol": null,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xaadb3be0",
|
||||
"Module": "netbt",
|
||||
"Offset": 2182155920,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 4146697354,
|
||||
"Signaled": "-",
|
||||
"Symbol": null,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xaadb9040",
|
||||
"Module": "TDI",
|
||||
"Offset": 2182059040,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 4169831408,
|
||||
"Signaled": "-",
|
||||
"Symbol": null,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xa9537f40",
|
||||
"Module": "ntoskrnl",
|
||||
"Offset": 2153083360,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 2152814203,
|
||||
"Signaled": "-",
|
||||
"Symbol": "CmpLazyFlushDpcRoutine",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x80000000:0x19eae820",
|
||||
"Module": "ntoskrnl",
|
||||
"Offset": 2182169704,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 2152618407,
|
||||
"Signaled": "-",
|
||||
"Symbol": "ExpTimerDpcRoutine",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xaa9b2a20",
|
||||
"Module": "NDIS",
|
||||
"Offset": 2179568032,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 4164628447,
|
||||
"Signaled": "-",
|
||||
"Symbol": null,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000002:0x1a97a160",
|
||||
"Module": "Ntfs",
|
||||
"Offset": 4164841808,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 4164732734,
|
||||
"Signaled": "-",
|
||||
"Symbol": null,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x80000000:0x2c5fb7e0",
|
||||
"Module": "ntoskrnl",
|
||||
"Offset": 2180369200,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 2152618407,
|
||||
"Signaled": "-",
|
||||
"Symbol": "ExpTimerDpcRoutine",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000002:0x3dcf47a0",
|
||||
"Module": "afd",
|
||||
"Offset": 2183169664,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 4146614848,
|
||||
"Signaled": "-",
|
||||
"Symbol": null,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xc4906e60",
|
||||
"Module": "rdbss",
|
||||
"Offset": 4146422176,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 4146381701,
|
||||
"Signaled": "-",
|
||||
"Symbol": null,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xaa92535f",
|
||||
"Module": "USBPORT",
|
||||
"Offset": 2179614512,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 4163343596,
|
||||
"Signaled": "-",
|
||||
"Symbol": null,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xaa8619e0",
|
||||
"Module": "TDI",
|
||||
"Offset": 2182064136,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 4169831408,
|
||||
"Signaled": "-",
|
||||
"Symbol": null,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xc45ec240",
|
||||
"Module": "tcpip",
|
||||
"Offset": 4147157776,
|
||||
"Period(ms)": 100,
|
||||
"Routine": 4146861021,
|
||||
"Signaled": "Yes",
|
||||
"Symbol": null,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x80000000:0x35b72850",
|
||||
"Module": "ntoskrnl",
|
||||
"Offset": 2180437784,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 2152618407,
|
||||
"Signaled": "-",
|
||||
"Symbol": "ExpTimerDpcRoutine",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xaad6fab0",
|
||||
"Module": "NDIS",
|
||||
"Offset": 2181321392,
|
||||
"Period(ms)": 1000,
|
||||
"Routine": 4164630316,
|
||||
"Signaled": "Yes",
|
||||
"Symbol": null,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xaadb9040",
|
||||
"Module": "TDI",
|
||||
"Offset": 2182059040,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 4169831408,
|
||||
"Signaled": "-",
|
||||
"Symbol": null,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xa9537f40",
|
||||
"Module": "ntoskrnl",
|
||||
"Offset": 2153083360,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 2152814203,
|
||||
"Signaled": "-",
|
||||
"Symbol": "CmpLazyFlushDpcRoutine",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xe2e5ee70",
|
||||
"Module": "ipsec",
|
||||
"Offset": 4147285920,
|
||||
"Period(ms)": 60000,
|
||||
"Routine": 4147221715,
|
||||
"Signaled": "Yes",
|
||||
"Symbol": null,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xe2e5ee70",
|
||||
"Module": "ipsec",
|
||||
"Offset": 4147284744,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 4147221577,
|
||||
"Signaled": "-",
|
||||
"Symbol": null,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xe2e5d9fc",
|
||||
"Module": "ks",
|
||||
"Offset": 2181100944,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 4162614588,
|
||||
"Signaled": "-",
|
||||
"Symbol": null,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000098:0xa67683e0",
|
||||
"Module": "NDIS",
|
||||
"Offset": 2183038120,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 4164628447,
|
||||
"Signaled": "-",
|
||||
"Symbol": null,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xa6beb810",
|
||||
"Module": "ntoskrnl",
|
||||
"Offset": 2153086208,
|
||||
"Period(ms)": 1000,
|
||||
"Routine": 2152611575,
|
||||
"Signaled": "Yes",
|
||||
"Symbol": "IopTimerDispatch",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xe2f53650",
|
||||
"Module": "ipnat",
|
||||
"Offset": 4146164320,
|
||||
"Period(ms)": 60000,
|
||||
"Routine": 4146134936,
|
||||
"Signaled": "Yes",
|
||||
"Symbol": null,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x80000001:0x838d66d0",
|
||||
"Module": "ntoskrnl",
|
||||
"Offset": 2180726816,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 2152618407,
|
||||
"Signaled": "-",
|
||||
"Symbol": "ExpTimerDpcRoutine",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xa6c34da0",
|
||||
"Module": "ntoskrnl",
|
||||
"Offset": 2153118912,
|
||||
"Period(ms)": 1000,
|
||||
"Routine": 2152615232,
|
||||
"Signaled": "Yes",
|
||||
"Symbol": "PopScanIdleList",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000098:0xa67683e0",
|
||||
"Module": "NDIS",
|
||||
"Offset": 2183038120,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 4164628447,
|
||||
"Signaled": "-",
|
||||
"Symbol": null,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xa6d41cb0",
|
||||
"Module": "ntoskrnl",
|
||||
"Offset": 2153080200,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 2152616496,
|
||||
"Signaled": "-",
|
||||
"Symbol": "CcScanDpc",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x80000000:0x14500b10",
|
||||
"Module": "ntoskrnl",
|
||||
"Offset": 2182113448,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 2152618407,
|
||||
"Signaled": "-",
|
||||
"Symbol": "ExpTimerDpcRoutine",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xaba81b20",
|
||||
"Module": "NDIS",
|
||||
"Offset": 2182656416,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 4164628447,
|
||||
"Signaled": "-",
|
||||
"Symbol": null,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xab110bd0",
|
||||
"Module": "ntoskrnl",
|
||||
"Offset": 2181090272,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 2152754200,
|
||||
"Signaled": "-",
|
||||
"Symbol": "CcPfTraceTimerRoutine",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000098:0xa6ad86a0",
|
||||
"Module": "NDIS",
|
||||
"Offset": 2182615456,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 4164628447,
|
||||
"Signaled": "-",
|
||||
"Symbol": null,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xd56a01e0",
|
||||
"Module": "HTTP",
|
||||
"Offset": 4122576520,
|
||||
"Period(ms)": 60000,
|
||||
"Routine": 4122481076,
|
||||
"Signaled": "Yes",
|
||||
"Symbol": null,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xd56a7ca0",
|
||||
"Module": "HTTP",
|
||||
"Offset": 4122577120,
|
||||
"Period(ms)": 30000,
|
||||
"Routine": 4122510208,
|
||||
"Signaled": "Yes",
|
||||
"Symbol": null,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xd56a7ca0",
|
||||
"Module": "HTTP",
|
||||
"Offset": 4122586816,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 4122536296,
|
||||
"Signaled": "-",
|
||||
"Symbol": null,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x80000000:0x14500b10",
|
||||
"Module": "ntoskrnl",
|
||||
"Offset": 2182113448,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 2152618407,
|
||||
"Signaled": "-",
|
||||
"Symbol": "ExpTimerDpcRoutine",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000002:0x10691f50",
|
||||
"Module": "BATTC",
|
||||
"Offset": 2184852912,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 4170619626,
|
||||
"Signaled": "-",
|
||||
"Symbol": null,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000002:0x10691f50",
|
||||
"Module": "BATTC",
|
||||
"Offset": 2182647568,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 4170619626,
|
||||
"Signaled": "-",
|
||||
"Symbol": null,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xaa90b010",
|
||||
"Module": "sr",
|
||||
"Offset": 2184659528,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 4165384494,
|
||||
"Signaled": "-",
|
||||
"Symbol": null,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000131:0x3cf80b10",
|
||||
"Module": "NDIS",
|
||||
"Offset": 2181526704,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 4164628447,
|
||||
"Signaled": "-",
|
||||
"Symbol": null,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xaa9b2a20",
|
||||
"Module": "NDIS",
|
||||
"Offset": 2179568032,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 4164628447,
|
||||
"Signaled": "-",
|
||||
"Symbol": null,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xaa9cb150",
|
||||
"Module": "NDIS",
|
||||
"Offset": 2179569720,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 4164628447,
|
||||
"Signaled": "-",
|
||||
"Symbol": null,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xaa9e70c0",
|
||||
"Module": "ntoskrnl",
|
||||
"Offset": 2182248232,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 2152618407,
|
||||
"Signaled": "-",
|
||||
"Symbol": "ExpTimerDpcRoutine",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xd56bd340",
|
||||
"Module": "srv",
|
||||
"Offset": 4128143248,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 4128080773,
|
||||
"Signaled": "-",
|
||||
"Symbol": null,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xbae86a40",
|
||||
"Module": "ntoskrnl",
|
||||
"Offset": 2182222184,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 2152618407,
|
||||
"Signaled": "-",
|
||||
"Symbol": "ExpTimerDpcRoutine",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xacafcdd0",
|
||||
"Module": "Ntfs",
|
||||
"Offset": 4164841712,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 4164719155,
|
||||
"Signaled": "-",
|
||||
"Symbol": null,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xaa92535f",
|
||||
"Module": "USBPORT",
|
||||
"Offset": 2179614512,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 4163343596,
|
||||
"Signaled": "-",
|
||||
"Symbol": null,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xad54f9d0",
|
||||
"Module": "ntoskrnl",
|
||||
"Offset": 2153085904,
|
||||
"Period(ms)": 60000,
|
||||
"Routine": 2152638914,
|
||||
"Signaled": "Yes",
|
||||
"Symbol": "IopIrpStackProfilerTimer",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000008:0x73b44670",
|
||||
"Module": "ipsec",
|
||||
"Offset": 4147284848,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 4147221577,
|
||||
"Signaled": "-",
|
||||
"Symbol": null,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xaad6c270",
|
||||
"Module": "NDIS",
|
||||
"Offset": 2179663392,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 4164642677,
|
||||
"Signaled": "-",
|
||||
"Symbol": null,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000001:0xaad6fab0",
|
||||
"Module": "NDIS",
|
||||
"Offset": 2181321392,
|
||||
"Period(ms)": 1000,
|
||||
"Routine": 4164630316,
|
||||
"Signaled": "Yes",
|
||||
"Symbol": null,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"DueTime": "0x00000008:0x73bef8c0",
|
||||
"Module": "netbt",
|
||||
"Offset": 2182155520,
|
||||
"Period(ms)": 0,
|
||||
"Routine": 4146697354,
|
||||
"Signaled": "-",
|
||||
"Symbol": null,
|
||||
"__children": []
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,67 @@
|
||||
{
|
||||
"WINDOWS10_GENERIC": [
|
||||
{
|
||||
"EndAddress": 18446735295750344704,
|
||||
"Name": "hwpolicy.sys",
|
||||
"StartAddress": 18446735295750275072,
|
||||
"Time": "2025-03-06T17:47:55+00:00",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"EndAddress": 18446735295728652288,
|
||||
"Name": "WdBoot.sys",
|
||||
"StartAddress": 18446735295728582656,
|
||||
"Time": "2025-03-06T17:47:56+00:00",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"EndAddress": 18446735295786053632,
|
||||
"Name": "dam.sys",
|
||||
"StartAddress": 18446735295785926656,
|
||||
"Time": "2025-03-06T17:48:02+00:00",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"EndAddress": 18446735295788797952,
|
||||
"Name": "serial.sys",
|
||||
"StartAddress": 18446735295788679168,
|
||||
"Time": "2025-03-06T17:48:21+00:00",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"EndAddress": 18446735295788875776,
|
||||
"Name": "serenum.sys",
|
||||
"StartAddress": 18446735295788810240,
|
||||
"Time": "2025-03-06T17:48:21+00:00",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"EndAddress": 18446735295761932288,
|
||||
"Name": "dump_dumpfve.sys",
|
||||
"StartAddress": 18446735295761809408,
|
||||
"Time": "2025-03-06T17:48:27+00:00",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"EndAddress": 18446735295761629184,
|
||||
"Name": "dump_vmbkmcl.sys",
|
||||
"StartAddress": 18446735295761481728,
|
||||
"Time": "2025-03-06T17:48:27+00:00",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"EndAddress": 18446735295761481728,
|
||||
"Name": "dump_storvsc.sys",
|
||||
"StartAddress": 18446735295761416192,
|
||||
"Time": "2025-03-06T17:48:27+00:00",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"EndAddress": 18446735295761350656,
|
||||
"Name": "dump_storport.sys",
|
||||
"StartAddress": 18446735295761285120,
|
||||
"Time": "2025-03-06T17:48:27+00:00",
|
||||
"__children": []
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,94 @@
|
||||
{
|
||||
"WINDOWS10_GENERIC": [
|
||||
{
|
||||
"CommitCharge": 1,
|
||||
"End VPN": 2147381247,
|
||||
"File": null,
|
||||
"File output": "Disabled",
|
||||
"Offset": 18446607800399740208,
|
||||
"PID": 4,
|
||||
"Parent": 0,
|
||||
"PrivateMemory": 1,
|
||||
"Process": "System",
|
||||
"Protection": "PAGE_READONLY",
|
||||
"Start VPN": 2147377152,
|
||||
"Tag": "VadS",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"CommitCharge": 1,
|
||||
"End VPN": 2147356671,
|
||||
"File": null,
|
||||
"File output": "Disabled",
|
||||
"Offset": 18446607800399739968,
|
||||
"PID": 4,
|
||||
"Parent": 18446607800399740208,
|
||||
"PrivateMemory": 1,
|
||||
"Process": "System",
|
||||
"Protection": "PAGE_READONLY",
|
||||
"Start VPN": 2147352576,
|
||||
"Tag": "VadS",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"CommitCharge": 9,
|
||||
"End VPN": 2004303871,
|
||||
"File": "\\Windows\\SysWOW64\\ntdll.dll",
|
||||
"File output": "Disabled",
|
||||
"Offset": 18446607800410763840,
|
||||
"PID": 4,
|
||||
"Parent": 18446607800399739968,
|
||||
"PrivateMemory": 0,
|
||||
"Process": "System",
|
||||
"Protection": "PAGE_EXECUTE_WRITECOPY",
|
||||
"Start VPN": 2002583552,
|
||||
"Tag": "Vad ",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"CommitCharge": 9,
|
||||
"End VPN": 140703785033727,
|
||||
"File": "\\Windows\\System32\\vertdll.dll",
|
||||
"File output": "Disabled",
|
||||
"Offset": 18446607800410768000,
|
||||
"PID": 4,
|
||||
"Parent": 18446607800399740208,
|
||||
"PrivateMemory": 0,
|
||||
"Process": "System",
|
||||
"Protection": "PAGE_EXECUTE_WRITECOPY",
|
||||
"Start VPN": 140703784828928,
|
||||
"Tag": "Vad ",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"CommitCharge": 0,
|
||||
"End VPN": 2873390796799,
|
||||
"File": null,
|
||||
"File output": "Disabled",
|
||||
"Offset": 18446607800474375600,
|
||||
"PID": 4,
|
||||
"Parent": 18446607800410768000,
|
||||
"PrivateMemory": 0,
|
||||
"Process": "System",
|
||||
"Protection": "PAGE_READWRITE",
|
||||
"Start VPN": 2873390792704,
|
||||
"Tag": "Vad ",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"CommitCharge": 16,
|
||||
"End VPN": 140703787155455,
|
||||
"File": "\\Windows\\System32\\ntdll.dll",
|
||||
"File output": "Disabled",
|
||||
"Offset": 18446607800410767520,
|
||||
"PID": 4,
|
||||
"Parent": 18446607800410768000,
|
||||
"PrivateMemory": 0,
|
||||
"Process": "System",
|
||||
"Protection": "PAGE_EXECUTE_WRITECOPY",
|
||||
"Start VPN": 140703785091072,
|
||||
"Tag": "Vad ",
|
||||
"__children": []
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,76 @@
|
||||
{
|
||||
"WINDOWS10_GENERIC": [
|
||||
{
|
||||
"End": 2147381247,
|
||||
"Left": 145201666899008,
|
||||
"Offset": 145201666899248,
|
||||
"PID": 4,
|
||||
"Parent": 0,
|
||||
"Process": "System",
|
||||
"Right": 145201677927040,
|
||||
"Start": 2147377152,
|
||||
"Tag": "VadS",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"End": 2147356671,
|
||||
"Left": 145201677922880,
|
||||
"Offset": 145201666899008,
|
||||
"PID": 4,
|
||||
"Parent": 145201666899248,
|
||||
"Process": "System",
|
||||
"Right": 0,
|
||||
"Start": 2147352576,
|
||||
"Tag": "VadS",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"End": 2004303871,
|
||||
"Left": 0,
|
||||
"Offset": 145201677922880,
|
||||
"PID": 4,
|
||||
"Parent": 145201666899008,
|
||||
"Process": "System",
|
||||
"Right": 0,
|
||||
"Start": 2002583552,
|
||||
"Tag": "Vad ",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"End": 140703785033727,
|
||||
"Left": 145201741534640,
|
||||
"Offset": 145201677927040,
|
||||
"PID": 4,
|
||||
"Parent": 145201666899248,
|
||||
"Process": "System",
|
||||
"Right": 145201677926560,
|
||||
"Start": 140703784828928,
|
||||
"Tag": "Vad ",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"End": 2873390796799,
|
||||
"Left": 0,
|
||||
"Offset": 145201741534640,
|
||||
"PID": 4,
|
||||
"Parent": 145201677927040,
|
||||
"Process": "System",
|
||||
"Right": 0,
|
||||
"Start": 2873390792704,
|
||||
"Tag": "Vad ",
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"End": 140703787155455,
|
||||
"Left": 0,
|
||||
"Offset": 145201677926560,
|
||||
"PID": 4,
|
||||
"Parent": 145201677927040,
|
||||
"Process": "System",
|
||||
"Right": 0,
|
||||
"Start": 140703785091072,
|
||||
"Tag": "Vad ",
|
||||
"__children": []
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,82 @@
|
||||
{
|
||||
"WINDOWS10_GENERIC": [
|
||||
{
|
||||
"End offset": 17592186044416,
|
||||
"Region": "MiVaBootLoaded",
|
||||
"Start offset": 238594023227392,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"End offset": 549755813888,
|
||||
"Region": "MiVaDriverImages",
|
||||
"Start offset": 272678883688448,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"End offset": 549755813888,
|
||||
"Region": "MiVaHal",
|
||||
"Start offset": 258385232527360,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"End offset": 3848290697216,
|
||||
"Region": "MiVaNonPagedPool",
|
||||
"Start offset": 266081813921792,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"End offset": 2748779069440,
|
||||
"Region": "MiVaPagedPool",
|
||||
"Start offset": 278135644927560,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"End offset": 17592186044416,
|
||||
"Region": "MiVaPfnDatabase",
|
||||
"Start offset": 166026255794176,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"End offset": 17592186044416,
|
||||
"Region": "MiVaProcessSpace",
|
||||
"Start offset": 191315023233024,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"End offset": 549755813888,
|
||||
"Region": "MiVaSessionGlobalSpace",
|
||||
"Start offset": 186367220908032,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"End offset": 17592186044416,
|
||||
"Region": "MiVaSessionSpace",
|
||||
"Start offset": 213305255788544,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"End offset": 1099511627776,
|
||||
"Region": "MiVaSpecialPoolPaged",
|
||||
"Start offset": 261683767410688,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"End offset": 1099511627776,
|
||||
"Region": "MiVaSystemCache",
|
||||
"Start offset": 208907209277440,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"End offset": 549755813888,
|
||||
"Region": "MiVaSystemPtes",
|
||||
"Start offset": 274328151130112,
|
||||
"__children": []
|
||||
},
|
||||
{
|
||||
"End offset": 17592186044416,
|
||||
"Region": "MiVaUnused",
|
||||
"Start offset": 145135534866432,
|
||||
"__children": []
|
||||
}
|
||||
]
|
||||
}
|
||||
Reference in New Issue
Block a user