volatilityの作法 その4

#概要

volatilityの作法、調べてみた。
winxpsp3のスナップショット、取ってみた。


#getsids


```
System (4): S-1-5-18 (Local System)
System (4): S-1-5-32-544 (Administrators)
System (4): S-1-1-0 (Everyone)
System (4): S-1-5-11 (Authenticated Users)
smss.exe (288): S-1-5-18 (Local System)
smss.exe (288): S-1-5-32-544 (Administrators)
smss.exe (288): S-1-1-0 (Everyone)
smss.exe (288): S-1-5-11 (Authenticated Users)
csrss.exe (388): S-1-5-18 (Local System)
csrss.exe (388): S-1-5-32-544 (Administrators)
csrss.exe (388): S-1-1-0 (Everyone)
csrss.exe (388): S-1-5-11 (Authenticated Users)
winlogon.exe (412): S-1-5-18 (Local System)
winlogon.exe (412): S-1-5-32-544 (Administrators)
winlogon.exe (412): S-1-1-0 (Everyone)
winlogon.exe (412): S-1-5-11 (Authenticated Users)
services.exe (516): S-1-5-18 (Local System)
services.exe (516): S-1-5-32-544 (Administrators)
services.exe (516): S-1-1-0 (Everyone)
services.exe (516): S-1-5-11 (Authenticated Users)
lsass.exe (528): S-1-5-18 (Local System)
lsass.exe (528): S-1-5-32-544 (Administrators)
lsass.exe (528): S-1-1-0 (Everyone)
lsass.exe (528): S-1-5-11 (Authenticated Users)
svchost.exe (676): S-1-5-18 (Local System)
svchost.exe (676): S-1-5-32-544 (Administrators)
svchost.exe (676): S-1-1-0 (Everyone)
svchost.exe (676): S-1-5-11 (Authenticated Users)
svchost.exe (736): S-1-5-20 (NT Authority)
svchost.exe (736): S-1-5-20 (NT Authority)
svchost.exe (736): S-1-1-0 (Everyone)
svchost.exe (736): S-1-5-32-545 (Users)
svchost.exe (736): S-1-5-6 (Service)
svchost.exe (736): S-1-5-11 (Authenticated Users)
svchost.exe (736): S-1-5-5-0-27913 (Logon Session)
svchost.exe (736): S-1-2-0 (Local (Users with the ability to log in locally))
svchost.exe (736): S-1-1-0 (Everyone)
svchost.exe (736): S-1-5-11 (Authenticated Users)
svchost.exe (736): S-1-2-0 (Local (Users with the ability to log in locally))
svchost.exe (736): S-1-5-32-545 (Users)
svchost.exe (800): S-1-5-18 (Local System)
svchost.exe (800): S-1-5-32-544 (Administrators)
svchost.exe (800): S-1-1-0 (Everyone)
svchost.exe (800): S-1-5-11 (Authenticated Users)
svchost.exe (844): S-1-5-20 (NT Authority)
svchost.exe (844): S-1-5-20 (NT Authority)
svchost.exe (844): S-1-1-0 (Everyone)
svchost.exe (844): S-1-5-32-545 (Users)
svchost.exe (844): S-1-5-6 (Service)
svchost.exe (844): S-1-5-11 (Authenticated Users)
svchost.exe (844): S-1-5-5-0-29844 (Logon Session)
svchost.exe (844): S-1-2-0 (Local (Users with the ability to log in locally))
svchost.exe (844): S-1-1-0 (Everyone)
svchost.exe (844): S-1-5-11 (Authenticated Users)
svchost.exe (844): S-1-2-0 (Local (Users with the ability to log in locally))
svchost.exe (844): S-1-5-32-545 (Users)
svchost.exe (876): S-1-5-19 (NT Authority)
svchost.exe (876): S-1-5-19 (NT Authority)
svchost.exe (876): S-1-1-0 (Everyone)
svchost.exe (876): S-1-5-32-545 (Users)
svchost.exe (876): S-1-5-6 (Service)
svchost.exe (876): S-1-5-11 (Authenticated Users)
svchost.exe (876): S-1-5-5-0-30538 (Logon Session)
svchost.exe (876): S-1-2-0 (Local (Users with the ability to log in locally))
svchost.exe (876): S-1-1-0 (Everyone)
svchost.exe (876): S-1-5-11 (Authenticated Users)
svchost.exe (876): S-1-2-0 (Local (Users with the ability to log in locally))
svchost.exe (876): S-1-5-32-545 (Users)
spoolsv.exe (1172): S-1-5-18 (Local System)
spoolsv.exe (1172): S-1-5-32-544 (Administrators)
spoolsv.exe (1172): S-1-1-0 (Everyone)
spoolsv.exe (1172): S-1-5-11 (Authenticated Users)
userinit.exe (1268): S-1-5-21-1957994488-2052111302-1078081533-1004 (testuser)
userinit.exe (1268): S-1-5-21-1957994488-2052111302-1078081533-513 (Domain Users)
userinit.exe (1268): S-1-1-0 (Everyone)
userinit.exe (1268): S-1-5-32-544 (Administrators)
userinit.exe (1268): S-1-5-32-545 (Users)
userinit.exe (1268): S-1-5-4 (Interactive)
userinit.exe (1268): S-1-5-11 (Authenticated Users)
userinit.exe (1268): S-1-5-5-0-33051 (Logon Session)
userinit.exe (1268): S-1-2-0 (Local (Users with the ability to log in locally))
explorer.exe (1284): S-1-5-21-1957994488-2052111302-1078081533-1004 (testuser)
explorer.exe (1284): S-1-5-21-1957994488-2052111302-1078081533-513 (Domain Users)
explorer.exe (1284): S-1-1-0 (Everyone)
explorer.exe (1284): S-1-5-32-544 (Administrators)
explorer.exe (1284): S-1-5-32-545 (Users)
explorer.exe (1284): S-1-5-4 (Interactive)
explorer.exe (1284): S-1-5-11 (Authenticated Users)
explorer.exe (1284): S-1-5-5-0-33051 (Logon Session)
explorer.exe (1284): S-1-2-0 (Local (Users with the ability to log in locally))
ctfmon.exe (1412): S-1-5-21-1957994488-2052111302-1078081533-1004 (testuser)
ctfmon.exe (1412): S-1-5-21-1957994488-2052111302-1078081533-513 (Domain Users)
ctfmon.exe (1412): S-1-1-0 (Everyone)
ctfmon.exe (1412): S-1-5-32-544 (Administrators)
ctfmon.exe (1412): S-1-5-32-545 (Users)
ctfmon.exe (1412): S-1-5-4 (Interactive)
ctfmon.exe (1412): S-1-5-11 (Authenticated Users)
ctfmon.exe (1412): S-1-5-5-0-33051 (Logon Session)
ctfmon.exe (1412): S-1-2-0 (Local (Users with the ability to log in locally))

```


#privs


```
Pid      Process          Value  Privilege                            Attributes               Description
-------- ---------------- ------ ------------------------------------ ------------------------ -----------
       4 System                7 SeTcbPrivilege                       Present,Enabled,Default  Act as part of the operating system
       4 System                2 SeCreateTokenPrivilege               Present                  Create a token object
       4 System                9 SeTakeOwnershipPrivilege             Present                  Take ownership of files/objects
       4 System               15 SeCreatePagefilePrivilege            Present,Enabled,Default  Create a pagefile
       4 System                4 SeLockMemoryPrivilege                Present,Enabled,Default  Lock pages in memory
       4 System                3 SeAssignPrimaryTokenPrivilege        Present                  Replace a process-level token
       4 System                5 SeIncreaseQuotaPrivilege             Present                  Increase quotas
       4 System               14 SeIncreaseBasePriorityPrivilege      Present,Enabled,Default  Increase scheduling priority
       4 System               16 SeCreatePermanentPrivilege           Present,Enabled,Default  Create permanent shared objects
       4 System               20 SeDebugPrivilege                     Present,Enabled,Default  Debug programs
       4 System               21 SeAuditPrivilege                     Present,Enabled,Default  Generate security audits
       4 System                8 SeSecurityPrivilege                  Present                  Manage auditing and security log
       4 System               22 SeSystemEnvironmentPrivilege         Present                  Edit firmware environment values
       4 System               23 SeChangeNotifyPrivilege              Present,Enabled,Default  Receive notifications of changes to files or directories
       4 System               17 SeBackupPrivilege                    Present                  Backup files and directories
       4 System               18 SeRestorePrivilege                   Present                  Restore files and directories
       4 System               19 SeShutdownPrivilege                  Present                  Shut down the system
       4 System               10 SeLoadDriverPrivilege                Present                  Load and unload device drivers
       4 System               13 SeProfileSingleProcessPrivilege      Present,Enabled,Default  Profile a single process
       4 System               12 SeSystemtimePrivilege                Present                  Change the system time
       4 System               25 SeUndockPrivilege                    Present                  Remove computer from docking station
       4 System               28 SeManageVolumePrivilege              Present                  Manage the files on a volume
       4 System               29 SeImpersonatePrivilege               Present,Enabled,Default  Impersonate a client after authentication
       4 System               30 SeCreateGlobalPrivilege              Present,Enabled,Default  Create global objects
     288 smss.exe              7 SeTcbPrivilege                       Present,Enabled,Default  Act as part of the operating system
     288 smss.exe              2 SeCreateTokenPrivilege               Present                  Create a token object
     288 smss.exe              9 SeTakeOwnershipPrivilege             Present                  Take ownership of files/objects
     288 smss.exe             15 SeCreatePagefilePrivilege            Present,Enabled,Default  Create a pagefile
     288 smss.exe              4 SeLockMemoryPrivilege                Present,Enabled,Default  Lock pages in memory
     288 smss.exe              3 SeAssignPrimaryTokenPrivilege        Present                  Replace a process-level token
     288 smss.exe              5 SeIncreaseQuotaPrivilege             Present                  Increase quotas
     288 smss.exe             14 SeIncreaseBasePriorityPrivilege      Present,Enabled,Default  Increase scheduling priority
     288 smss.exe             16 SeCreatePermanentPrivilege           Present,Enabled,Default  Create permanent shared objects
     288 smss.exe             20 SeDebugPrivilege                     Present,Enabled,Default  Debug programs
     288 smss.exe             21 SeAuditPrivilege                     Present,Enabled,Default  Generate security audits
     288 smss.exe              8 SeSecurityPrivilege                  Present                  Manage auditing and security log
     288 smss.exe             22 SeSystemEnvironmentPrivilege         Present                  Edit firmware environment values
     288 smss.exe             23 SeChangeNotifyPrivilege              Present,Enabled,Default  Receive notifications of changes to files or directories
     288 smss.exe             17 SeBackupPrivilege                    Present                  Backup files and directories
     288 smss.exe             18 SeRestorePrivilege                   Present                  Restore files and directories
     288 smss.exe             19 SeShutdownPrivilege                  Present                  Shut down the system
     288 smss.exe             10 SeLoadDriverPrivilege                Present                  Load and unload device drivers
     288 smss.exe             13 SeProfileSingleProcessPrivilege      Present,Enabled,Default  Profile a single process
     288 smss.exe             12 SeSystemtimePrivilege                Present                  Change the system time
     288 smss.exe             25 SeUndockPrivilege                    Present                  Remove computer from docking station
     288 smss.exe             28 SeManageVolumePrivilege              Present                  Manage the files on a volume
     288 smss.exe             29 SeImpersonatePrivilege               Present,Enabled,Default  Impersonate a client after authentication
     288 smss.exe             30 SeCreateGlobalPrivilege              Present,Enabled,Default  Create global objects
     388 csrss.exe             7 SeTcbPrivilege                       Present,Enabled,Default  Act as part of the operating system
     388 csrss.exe             2 SeCreateTokenPrivilege               Present                  Create a token object
     388 csrss.exe             9 SeTakeOwnershipPrivilege             Present                  Take ownership of files/objects
     388 csrss.exe            15 SeCreatePagefilePrivilege            Present,Enabled,Default  Create a pagefile
     388 csrss.exe             4 SeLockMemoryPrivilege                Present,Enabled,Default  Lock pages in memory
     388 csrss.exe             3 SeAssignPrimaryTokenPrivilege        Present                  Replace a process-level token
     388 csrss.exe             5 SeIncreaseQuotaPrivilege             Present                  Increase quotas
     388 csrss.exe            14 SeIncreaseBasePriorityPrivilege      Present,Enabled,Default  Increase scheduling priority
     388 csrss.exe            16 SeCreatePermanentPrivilege           Present,Enabled,Default  Create permanent shared objects
     388 csrss.exe            20 SeDebugPrivilege                     Present,Enabled,Default  Debug programs
     388 csrss.exe            21 SeAuditPrivilege                     Present,Enabled,Default  Generate security audits
     388 csrss.exe             8 SeSecurityPrivilege                  Present                  Manage auditing and security log
     388 csrss.exe            22 SeSystemEnvironmentPrivilege         Present                  Edit firmware environment values
     388 csrss.exe            23 SeChangeNotifyPrivilege              Present,Enabled,Default  Receive notifications of changes to files or directories
     388 csrss.exe            17 SeBackupPrivilege                    Present                  Backup files and directories
     388 csrss.exe            18 SeRestorePrivilege                   Present                  Restore files and directories
     388 csrss.exe            19 SeShutdownPrivilege                  Present                  Shut down the system
     388 csrss.exe            10 SeLoadDriverPrivilege                Present                  Load and unload device drivers
     388 csrss.exe            13 SeProfileSingleProcessPrivilege      Present,Enabled,Default  Profile a single process
     388 csrss.exe            12 SeSystemtimePrivilege                Present                  Change the system time
     388 csrss.exe            25 SeUndockPrivilege                    Present                  Remove computer from docking station
     388 csrss.exe            28 SeManageVolumePrivilege              Present                  Manage the files on a volume
     388 csrss.exe            29 SeImpersonatePrivilege               Present,Enabled,Default  Impersonate a client after authentication
     388 csrss.exe            30 SeCreateGlobalPrivilege              Present,Enabled,Default  Create global objects
     412 winlogon.exe          7 SeTcbPrivilege                       Present,Enabled,Default  Act as part of the operating system
     412 winlogon.exe          2 SeCreateTokenPrivilege               Present                  Create a token object
     412 winlogon.exe          9 SeTakeOwnershipPrivilege             Present                  Take ownership of files/objects
     412 winlogon.exe         15 SeCreatePagefilePrivilege            Present,Enabled,Default  Create a pagefile
     412 winlogon.exe          4 SeLockMemoryPrivilege                Present,Enabled,Default  Lock pages in memory
     412 winlogon.exe          3 SeAssignPrimaryTokenPrivilege        Present                  Replace a process-level token
     412 winlogon.exe          5 SeIncreaseQuotaPrivilege             Present                  Increase quotas
     412 winlogon.exe         14 SeIncreaseBasePriorityPrivilege      Present,Enabled,Default  Increase scheduling priority
     412 winlogon.exe         16 SeCreatePermanentPrivilege           Present,Enabled,Default  Create permanent shared objects
     412 winlogon.exe         20 SeDebugPrivilege                     Present,Enabled,Default  Debug programs
     412 winlogon.exe         21 SeAuditPrivilege                     Present,Enabled,Default  Generate security audits
     412 winlogon.exe          8 SeSecurityPrivilege                  Present                  Manage auditing and security log
     412 winlogon.exe         22 SeSystemEnvironmentPrivilege         Present                  Edit firmware environment values
     412 winlogon.exe         23 SeChangeNotifyPrivilege              Present,Enabled,Default  Receive notifications of changes to files or directories
     412 winlogon.exe         17 SeBackupPrivilege                    Present                  Backup files and directories
     412 winlogon.exe         18 SeRestorePrivilege                   Present                  Restore files and directories
     412 winlogon.exe         19 SeShutdownPrivilege                  Present                  Shut down the system
     412 winlogon.exe         10 SeLoadDriverPrivilege                Present,Enabled          Load and unload device drivers
     412 winlogon.exe         13 SeProfileSingleProcessPrivilege      Present,Enabled,Default  Profile a single process
     412 winlogon.exe         12 SeSystemtimePrivilege                Present                  Change the system time
     412 winlogon.exe         25 SeUndockPrivilege                    Present,Enabled          Remove computer from docking station
     412 winlogon.exe         28 SeManageVolumePrivilege              Present                  Manage the files on a volume
     412 winlogon.exe         29 SeImpersonatePrivilege               Present,Enabled,Default  Impersonate a client after authentication
     412 winlogon.exe         30 SeCreateGlobalPrivilege              Present,Enabled,Default  Create global objects
     516 services.exe          7 SeTcbPrivilege                       Present,Enabled,Default  Act as part of the operating system
     516 services.exe          2 SeCreateTokenPrivilege               Present                  Create a token object
     516 services.exe          9 SeTakeOwnershipPrivilege             Present                  Take ownership of files/objects
     516 services.exe         15 SeCreatePagefilePrivilege            Present,Enabled,Default  Create a pagefile
     516 services.exe          4 SeLockMemoryPrivilege                Present,Enabled,Default  Lock pages in memory
     516 services.exe          3 SeAssignPrimaryTokenPrivilege        Present                  Replace a process-level token
     516 services.exe          5 SeIncreaseQuotaPrivilege             Present                  Increase quotas
     516 services.exe         14 SeIncreaseBasePriorityPrivilege      Present,Enabled,Default  Increase scheduling priority
     516 services.exe         16 SeCreatePermanentPrivilege           Present,Enabled,Default  Create permanent shared objects
     516 services.exe         20 SeDebugPrivilege                     Present,Enabled,Default  Debug programs
     516 services.exe         21 SeAuditPrivilege                     Present,Enabled,Default  Generate security audits
     516 services.exe          8 SeSecurityPrivilege                  Present                  Manage auditing and security log
     516 services.exe         22 SeSystemEnvironmentPrivilege         Present                  Edit firmware environment values
     516 services.exe         23 SeChangeNotifyPrivilege              Present,Enabled,Default  Receive notifications of changes to files or directories
     516 services.exe         17 SeBackupPrivilege                    Present                  Backup files and directories
     516 services.exe         18 SeRestorePrivilege                   Present                  Restore files and directories
     516 services.exe         19 SeShutdownPrivilege                  Present                  Shut down the system
     516 services.exe         10 SeLoadDriverPrivilege                Present                  Load and unload device drivers
     516 services.exe         13 SeProfileSingleProcessPrivilege      Present,Enabled,Default  Profile a single process
     516 services.exe         12 SeSystemtimePrivilege                Present                  Change the system time
     516 services.exe         25 SeUndockPrivilege                    Present                  Remove computer from docking station
     516 services.exe         28 SeManageVolumePrivilege              Present                  Manage the files on a volume
     516 services.exe         29 SeImpersonatePrivilege               Present,Enabled,Default  Impersonate a client after authentication
     516 services.exe         30 SeCreateGlobalPrivilege              Present,Enabled,Default  Create global objects
     528 lsass.exe             7 SeTcbPrivilege                       Present,Enabled,Default  Act as part of the operating system
     528 lsass.exe             2 SeCreateTokenPrivilege               Present,Enabled          Create a token object
     528 lsass.exe             9 SeTakeOwnershipPrivilege             Present                  Take ownership of files/objects
     528 lsass.exe            15 SeCreatePagefilePrivilege            Present,Enabled,Default  Create a pagefile
     528 lsass.exe             4 SeLockMemoryPrivilege                Present,Enabled,Default  Lock pages in memory
     528 lsass.exe             3 SeAssignPrimaryTokenPrivilege        Present                  Replace a process-level token
     528 lsass.exe             5 SeIncreaseQuotaPrivilege             Present                  Increase quotas
     528 lsass.exe            14 SeIncreaseBasePriorityPrivilege      Present,Enabled,Default  Increase scheduling priority
     528 lsass.exe            16 SeCreatePermanentPrivilege           Present,Enabled,Default  Create permanent shared objects
     528 lsass.exe            20 SeDebugPrivilege                     Present,Enabled,Default  Debug programs
     528 lsass.exe            21 SeAuditPrivilege                     Present,Enabled,Default  Generate security audits
     528 lsass.exe             8 SeSecurityPrivilege                  Present                  Manage auditing and security log
     528 lsass.exe            22 SeSystemEnvironmentPrivilege         Present                  Edit firmware environment values
     528 lsass.exe            23 SeChangeNotifyPrivilege              Present,Enabled,Default  Receive notifications of changes to files or directories
     528 lsass.exe            17 SeBackupPrivilege                    Present                  Backup files and directories
     528 lsass.exe            18 SeRestorePrivilege                   Present                  Restore files and directories
     528 lsass.exe            19 SeShutdownPrivilege                  Present                  Shut down the system
     528 lsass.exe            10 SeLoadDriverPrivilege                Present,Enabled          Load and unload device drivers
     528 lsass.exe            13 SeProfileSingleProcessPrivilege      Present,Enabled,Default  Profile a single process
     528 lsass.exe            12 SeSystemtimePrivilege                Present                  Change the system time
     528 lsass.exe            25 SeUndockPrivilege                    Present,Enabled          Remove computer from docking station
     528 lsass.exe            28 SeManageVolumePrivilege              Present                  Manage the files on a volume
     528 lsass.exe            29 SeImpersonatePrivilege               Present,Enabled,Default  Impersonate a client after authentication
     528 lsass.exe            30 SeCreateGlobalPrivilege              Present,Enabled,Default  Create global objects
     676 svchost.exe           7 SeTcbPrivilege                       Present,Enabled,Default  Act as part of the operating system
     676 svchost.exe           2 SeCreateTokenPrivilege               Present                  Create a token object
     676 svchost.exe           9 SeTakeOwnershipPrivilege             Present                  Take ownership of files/objects
     676 svchost.exe          15 SeCreatePagefilePrivilege            Present,Enabled,Default  Create a pagefile
     676 svchost.exe           4 SeLockMemoryPrivilege                Present,Enabled,Default  Lock pages in memory
     676 svchost.exe           3 SeAssignPrimaryTokenPrivilege        Present                  Replace a process-level token
     676 svchost.exe           5 SeIncreaseQuotaPrivilege             Present                  Increase quotas
     676 svchost.exe          14 SeIncreaseBasePriorityPrivilege      Present,Enabled,Default  Increase scheduling priority
     676 svchost.exe          16 SeCreatePermanentPrivilege           Present,Enabled,Default  Create permanent shared objects
     676 svchost.exe          20 SeDebugPrivilege                     Present,Enabled,Default  Debug programs
     676 svchost.exe          21 SeAuditPrivilege                     Present,Enabled,Default  Generate security audits
     676 svchost.exe           8 SeSecurityPrivilege                  Present                  Manage auditing and security log
     676 svchost.exe          22 SeSystemEnvironmentPrivilege         Present                  Edit firmware environment values
     676 svchost.exe          23 SeChangeNotifyPrivilege              Present,Enabled,Default  Receive notifications of changes to files or directories
     676 svchost.exe          17 SeBackupPrivilege                    Present                  Backup files and directories
     676 svchost.exe          18 SeRestorePrivilege                   Present                  Restore files and directories
     676 svchost.exe          19 SeShutdownPrivilege                  Present                  Shut down the system
     676 svchost.exe          10 SeLoadDriverPrivilege                Present                  Load and unload device drivers
     676 svchost.exe          13 SeProfileSingleProcessPrivilege      Present,Enabled,Default  Profile a single process
     676 svchost.exe          12 SeSystemtimePrivilege                Present                  Change the system time
     676 svchost.exe          25 SeUndockPrivilege                    Present                  Remove computer from docking station
     676 svchost.exe          28 SeManageVolumePrivilege              Present                  Manage the files on a volume
     676 svchost.exe          29 SeImpersonatePrivilege               Present,Enabled,Default  Impersonate a client after authentication
     676 svchost.exe          30 SeCreateGlobalPrivilege              Present,Enabled,Default  Create global objects
     736 svchost.exe          21 SeAuditPrivilege                     Present                  Generate security audits
     736 svchost.exe           5 SeIncreaseQuotaPrivilege             Present                  Increase quotas
     736 svchost.exe           3 SeAssignPrimaryTokenPrivilege        Present                  Replace a process-level token
     736 svchost.exe          23 SeChangeNotifyPrivilege              Present,Enabled,Default  Receive notifications of changes to files or directories
     736 svchost.exe          19 SeShutdownPrivilege                  Present                  Shut down the system
     736 svchost.exe          25 SeUndockPrivilege                    Present                  Remove computer from docking station
     736 svchost.exe          30 SeCreateGlobalPrivilege              Present,Enabled,Default  Create global objects
     736 svchost.exe          29 SeImpersonatePrivilege               Present,Enabled,Default  Impersonate a client after authentication
     800 svchost.exe           7 SeTcbPrivilege                       Present,Enabled,Default  Act as part of the operating system
     800 svchost.exe           2 SeCreateTokenPrivilege               Present                  Create a token object
     800 svchost.exe           9 SeTakeOwnershipPrivilege             Present                  Take ownership of files/objects
     800 svchost.exe          15 SeCreatePagefilePrivilege            Present,Enabled,Default  Create a pagefile
     800 svchost.exe           4 SeLockMemoryPrivilege                Present,Enabled,Default  Lock pages in memory
     800 svchost.exe           3 SeAssignPrimaryTokenPrivilege        Present                  Replace a process-level token
     800 svchost.exe           5 SeIncreaseQuotaPrivilege             Present                  Increase quotas
     800 svchost.exe          14 SeIncreaseBasePriorityPrivilege      Present,Enabled,Default  Increase scheduling priority
     800 svchost.exe          16 SeCreatePermanentPrivilege           Present,Enabled,Default  Create permanent shared objects
     800 svchost.exe          20 SeDebugPrivilege                     Present,Enabled,Default  Debug programs
     800 svchost.exe          21 SeAuditPrivilege                     Present,Enabled,Default  Generate security audits
     800 svchost.exe           8 SeSecurityPrivilege                  Present                  Manage auditing and security log
     800 svchost.exe          22 SeSystemEnvironmentPrivilege         Present                  Edit firmware environment values
     800 svchost.exe          23 SeChangeNotifyPrivilege              Present,Enabled,Default  Receive notifications of changes to files or directories
     800 svchost.exe          17 SeBackupPrivilege                    Present                  Backup files and directories
     800 svchost.exe          18 SeRestorePrivilege                   Present                  Restore files and directories
     800 svchost.exe          19 SeShutdownPrivilege                  Present                  Shut down the system
     800 svchost.exe          10 SeLoadDriverPrivilege                Present,Enabled          Load and unload device drivers
     800 svchost.exe          13 SeProfileSingleProcessPrivilege      Present,Enabled,Default  Profile a single process
     800 svchost.exe          12 SeSystemtimePrivilege                Present,Enabled          Change the system time
     800 svchost.exe          25 SeUndockPrivilege                    Present,Enabled          Remove computer from docking station
     800 svchost.exe          28 SeManageVolumePrivilege              Present                  Manage the files on a volume
     800 svchost.exe          29 SeImpersonatePrivilege               Present,Enabled,Default  Impersonate a client after authentication
     800 svchost.exe          30 SeCreateGlobalPrivilege              Present,Enabled,Default  Create global objects
     844 svchost.exe          21 SeAuditPrivilege                     Present                  Generate security audits
     844 svchost.exe           5 SeIncreaseQuotaPrivilege             Present                  Increase quotas
     844 svchost.exe           3 SeAssignPrimaryTokenPrivilege        Present                  Replace a process-level token
     844 svchost.exe          23 SeChangeNotifyPrivilege              Present,Enabled,Default  Receive notifications of changes to files or directories
     844 svchost.exe          19 SeShutdownPrivilege                  Present                  Shut down the system
     844 svchost.exe          25 SeUndockPrivilege                    Present                  Remove computer from docking station
     844 svchost.exe          30 SeCreateGlobalPrivilege              Present,Enabled,Default  Create global objects
     844 svchost.exe          29 SeImpersonatePrivilege               Present,Enabled,Default  Impersonate a client after authentication
     876 svchost.exe          21 SeAuditPrivilege                     Present                  Generate security audits
     876 svchost.exe           5 SeIncreaseQuotaPrivilege             Present                  Increase quotas
     876 svchost.exe           3 SeAssignPrimaryTokenPrivilege        Present                  Replace a process-level token
     876 svchost.exe          23 SeChangeNotifyPrivilege              Present,Enabled,Default  Receive notifications of changes to files or directories
     876 svchost.exe          19 SeShutdownPrivilege                  Present                  Shut down the system
     876 svchost.exe          25 SeUndockPrivilege                    Present                  Remove computer from docking station
     876 svchost.exe          30 SeCreateGlobalPrivilege              Present,Enabled,Default  Create global objects
     876 svchost.exe          29 SeImpersonatePrivilege               Present,Enabled,Default  Impersonate a client after authentication
    1172 spoolsv.exe           7 SeTcbPrivilege                       Present,Enabled,Default  Act as part of the operating system
    1172 spoolsv.exe           2 SeCreateTokenPrivilege               Present                  Create a token object
    1172 spoolsv.exe           9 SeTakeOwnershipPrivilege             Present                  Take ownership of files/objects
    1172 spoolsv.exe          15 SeCreatePagefilePrivilege            Present,Enabled,Default  Create a pagefile
    1172 spoolsv.exe           4 SeLockMemoryPrivilege                Present,Enabled,Default  Lock pages in memory
    1172 spoolsv.exe           3 SeAssignPrimaryTokenPrivilege        Present                  Replace a process-level token
    1172 spoolsv.exe           5 SeIncreaseQuotaPrivilege             Present                  Increase quotas
    1172 spoolsv.exe          14 SeIncreaseBasePriorityPrivilege      Present,Enabled,Default  Increase scheduling priority
    1172 spoolsv.exe          16 SeCreatePermanentPrivilege           Present,Enabled,Default  Create permanent shared objects
    1172 spoolsv.exe          20 SeDebugPrivilege                     Present,Enabled,Default  Debug programs
    1172 spoolsv.exe          21 SeAuditPrivilege                     Present,Enabled,Default  Generate security audits
    1172 spoolsv.exe           8 SeSecurityPrivilege                  Present                  Manage auditing and security log
    1172 spoolsv.exe          22 SeSystemEnvironmentPrivilege         Present                  Edit firmware environment values
    1172 spoolsv.exe          23 SeChangeNotifyPrivilege              Present,Enabled,Default  Receive notifications of changes to files or directories
    1172 spoolsv.exe          17 SeBackupPrivilege                    Present                  Backup files and directories
    1172 spoolsv.exe          18 SeRestorePrivilege                   Present                  Restore files and directories
    1172 spoolsv.exe          19 SeShutdownPrivilege                  Present                  Shut down the system
    1172 spoolsv.exe          10 SeLoadDriverPrivilege                Present                  Load and unload device drivers
    1172 spoolsv.exe          13 SeProfileSingleProcessPrivilege      Present,Enabled,Default  Profile a single process
    1172 spoolsv.exe          12 SeSystemtimePrivilege                Present                  Change the system time
    1172 spoolsv.exe          25 SeUndockPrivilege                    Present                  Remove computer from docking station
    1172 spoolsv.exe          28 SeManageVolumePrivilege              Present                  Manage the files on a volume
    1172 spoolsv.exe          29 SeImpersonatePrivilege               Present,Enabled,Default  Impersonate a client after authentication
    1172 spoolsv.exe          30 SeCreateGlobalPrivilege              Present,Enabled,Default  Create global objects
    1268 userinit.exe         23 SeChangeNotifyPrivilege              Present,Enabled,Default  Receive notifications of changes to files or directories
    1268 userinit.exe          8 SeSecurityPrivilege                  Present                  Manage auditing and security log
    1268 userinit.exe         17 SeBackupPrivilege                    Present                  Backup files and directories
    1268 userinit.exe         18 SeRestorePrivilege                   Present                  Restore files and directories
    1268 userinit.exe         12 SeSystemtimePrivilege                Present                  Change the system time
    1268 userinit.exe         19 SeShutdownPrivilege                  Present                  Shut down the system
    1268 userinit.exe         24 SeRemoteShutdownPrivilege            Present                  Force shutdown from a remote system
    1268 userinit.exe          9 SeTakeOwnershipPrivilege             Present                  Take ownership of files/objects
    1268 userinit.exe         20 SeDebugPrivilege                     Present                  Debug programs
    1268 userinit.exe         22 SeSystemEnvironmentPrivilege         Present                  Edit firmware environment values
    1268 userinit.exe         11 SeSystemProfilePrivilege             Present                  Profile system performance
    1268 userinit.exe         13 SeProfileSingleProcessPrivilege      Present                  Profile a single process
    1268 userinit.exe         14 SeIncreaseBasePriorityPrivilege      Present                  Increase scheduling priority
    1268 userinit.exe         10 SeLoadDriverPrivilege                Present,Enabled          Load and unload device drivers
    1268 userinit.exe         15 SeCreatePagefilePrivilege            Present                  Create a pagefile
    1268 userinit.exe          5 SeIncreaseQuotaPrivilege             Present                  Increase quotas
    1268 userinit.exe         25 SeUndockPrivilege                    Present,Enabled          Remove computer from docking station
    1268 userinit.exe         28 SeManageVolumePrivilege              Present                  Manage the files on a volume
    1268 userinit.exe         30 SeCreateGlobalPrivilege              Present,Enabled,Default  Create global objects
    1268 userinit.exe         29 SeImpersonatePrivilege               Present,Enabled,Default  Impersonate a client after authentication
    1284 explorer.exe         23 SeChangeNotifyPrivilege              Present,Enabled,Default  Receive notifications of changes to files or directories
    1284 explorer.exe          8 SeSecurityPrivilege                  Present                  Manage auditing and security log
    1284 explorer.exe         17 SeBackupPrivilege                    Present                  Backup files and directories
    1284 explorer.exe         18 SeRestorePrivilege                   Present                  Restore files and directories
    1284 explorer.exe         12 SeSystemtimePrivilege                Present                  Change the system time
    1284 explorer.exe         19 SeShutdownPrivilege                  Present                  Shut down the system
    1284 explorer.exe         24 SeRemoteShutdownPrivilege            Present                  Force shutdown from a remote system
    1284 explorer.exe          9 SeTakeOwnershipPrivilege             Present                  Take ownership of files/objects
    1284 explorer.exe         20 SeDebugPrivilege                     Present                  Debug programs
    1284 explorer.exe         22 SeSystemEnvironmentPrivilege         Present                  Edit firmware environment values
    1284 explorer.exe         11 SeSystemProfilePrivilege             Present                  Profile system performance
    1284 explorer.exe         13 SeProfileSingleProcessPrivilege      Present                  Profile a single process
    1284 explorer.exe         14 SeIncreaseBasePriorityPrivilege      Present                  Increase scheduling priority
    1284 explorer.exe         10 SeLoadDriverPrivilege                Present,Enabled          Load and unload device drivers
    1284 explorer.exe         15 SeCreatePagefilePrivilege            Present                  Create a pagefile
    1284 explorer.exe          5 SeIncreaseQuotaPrivilege             Present                  Increase quotas
    1284 explorer.exe         25 SeUndockPrivilege                    Present,Enabled          Remove computer from docking station
    1284 explorer.exe         28 SeManageVolumePrivilege              Present                  Manage the files on a volume
    1284 explorer.exe         30 SeCreateGlobalPrivilege              Present,Enabled,Default  Create global objects
    1284 explorer.exe         29 SeImpersonatePrivilege               Present,Enabled,Default  Impersonate a client after authentication
    1412 ctfmon.exe           23 SeChangeNotifyPrivilege              Present,Enabled,Default  Receive notifications of changes to files or directories
    1412 ctfmon.exe            8 SeSecurityPrivilege                  Present                  Manage auditing and security log
    1412 ctfmon.exe           17 SeBackupPrivilege                    Present                  Backup files and directories
    1412 ctfmon.exe           18 SeRestorePrivilege                   Present                  Restore files and directories
    1412 ctfmon.exe           12 SeSystemtimePrivilege                Present                  Change the system time
    1412 ctfmon.exe           19 SeShutdownPrivilege                  Present                  Shut down the system
    1412 ctfmon.exe           24 SeRemoteShutdownPrivilege            Present                  Force shutdown from a remote system
    1412 ctfmon.exe            9 SeTakeOwnershipPrivilege             Present                  Take ownership of files/objects
    1412 ctfmon.exe           20 SeDebugPrivilege                     Present                  Debug programs
    1412 ctfmon.exe           22 SeSystemEnvironmentPrivilege         Present                  Edit firmware environment values
    1412 ctfmon.exe           11 SeSystemProfilePrivilege             Present                  Profile system performance
    1412 ctfmon.exe           13 SeProfileSingleProcessPrivilege      Present                  Profile a single process
    1412 ctfmon.exe           14 SeIncreaseBasePriorityPrivilege      Present                  Increase scheduling priority
    1412 ctfmon.exe           10 SeLoadDriverPrivilege                Present,Enabled          Load and unload device drivers
    1412 ctfmon.exe           15 SeCreatePagefilePrivilege            Present                  Create a pagefile
    1412 ctfmon.exe            5 SeIncreaseQuotaPrivilege             Present                  Increase quotas
    1412 ctfmon.exe           25 SeUndockPrivilege                    Present,Enabled          Remove computer from docking station
    1412 ctfmon.exe           28 SeManageVolumePrivilege              Present                  Manage the files on a volume
    1412 ctfmon.exe           30 SeCreateGlobalPrivilege              Present,Enabled,Default  Create global objects
    1412 ctfmon.exe           29 SeImpersonatePrivilege               Present,Enabled,Default  Impersonate a client after authentication

```

#envars


```
Pid      Process              Block      Variable                       Value
-------- -------------------- ---------- ------------------------------ -----
     288 smss.exe             0x00100000 CommonProgramFiles             
     288 smss.exe             0x00100000 Path                           C:\WINDOWS\System32
     288 smss.exe             0x00100000 ProgramFiles                   
     288 smss.exe             0x00100000 SystemDrive                    C:
     288 smss.exe             0x00100000 SystemRoot                     C:\WINDOWS
     388 csrss.exe            0x00100000 ComSpec                        C:\WINDOWS\system32\cmd.exe
     388 csrss.exe            0x00100000 FP_NO_HOST_CHECK               NO
     388 csrss.exe            0x00100000 NUMBER_OF_PROCESSORS           1
     388 csrss.exe            0x00100000 OS                             Windows_NT
     388 csrss.exe            0x00100000 Path                           C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
     388 csrss.exe            0x00100000 PATHEXT                        .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
     388 csrss.exe            0x00100000 PROCESSOR_ARCHITECTURE         x86
     388 csrss.exe            0x00100000 PROCESSOR_IDENTIFIER           x86 Family 6 Model 6 Stepping 3, GenuineIntel
     388 csrss.exe            0x00100000 PROCESSOR_LEVEL                6
     388 csrss.exe            0x00100000 PROCESSOR_REVISION             0603
     388 csrss.exe            0x00100000 SystemDrive                    C:
     388 csrss.exe            0x00100000 SystemRoot                     C:\WINDOWS
     388 csrss.exe            0x00100000 TEMP                           C:\WINDOWS\TEMP
     388 csrss.exe            0x00100000 TMP                            C:\WINDOWS\TEMP
     388 csrss.exe            0x00100000 windir                         C:\WINDOWS
     412 winlogon.exe         0x00010000 ALLUSERSPROFILE                C:\Documents and Settings\All Users
     412 winlogon.exe         0x00010000 APPDATA                        C:\Documents and Settings\testuser\Application Data
     412 winlogon.exe         0x00010000 CommonProgramFiles             C:\Program Files\Common Files
     412 winlogon.exe         0x00010000 COMPUTERNAME                   TESTUSER-D7P72A
     412 winlogon.exe         0x00010000 ComSpec                        C:\WINDOWS\system32\cmd.exe
     412 winlogon.exe         0x00010000 FP_NO_HOST_CHECK               NO
     412 winlogon.exe         0x00010000 LOGONSERVER                    \\TESTUSER-D7P72A
     412 winlogon.exe         0x00010000 NUMBER_OF_PROCESSORS           1
     412 winlogon.exe         0x00010000 OS                             Windows_NT
     412 winlogon.exe         0x00010000 Path                           C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
     412 winlogon.exe         0x00010000 PATHEXT                        .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
     412 winlogon.exe         0x00010000 PROCESSOR_ARCHITECTURE         x86
     412 winlogon.exe         0x00010000 PROCESSOR_IDENTIFIER           x86 Family 6 Model 6 Stepping 3, GenuineIntel
     412 winlogon.exe         0x00010000 PROCESSOR_LEVEL                6
     412 winlogon.exe         0x00010000 PROCESSOR_REVISION             0603
     412 winlogon.exe         0x00010000 ProgramFiles                   C:\Program Files
     412 winlogon.exe         0x00010000 SystemDrive                    C:
     412 winlogon.exe         0x00010000 SystemRoot                     C:\WINDOWS
     412 winlogon.exe         0x00010000 TEMP                           C:\WINDOWS\TEMP
     412 winlogon.exe         0x00010000 TMP                            C:\WINDOWS\TEMP
     412 winlogon.exe         0x00010000 USERPROFILE                    C:\Documents and Settings\testuser
     412 winlogon.exe         0x00010000 windir                         C:\WINDOWS
     516 services.exe         0x00010000 ALLUSERSPROFILE                C:\Documents and Settings\All Users
     516 services.exe         0x00010000 CommonProgramFiles             C:\Program Files\Common Files
     516 services.exe         0x00010000 COMPUTERNAME                   TESTUSER-D7P72A
     516 services.exe         0x00010000 ComSpec                        C:\WINDOWS\system32\cmd.exe
     516 services.exe         0x00010000 FP_NO_HOST_CHECK               NO
     516 services.exe         0x00010000 NUMBER_OF_PROCESSORS           1
     516 services.exe         0x00010000 OS                             Windows_NT
     516 services.exe         0x00010000 Path                           C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
     516 services.exe         0x00010000 PATHEXT                        .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
     516 services.exe         0x00010000 PROCESSOR_ARCHITECTURE         x86
     516 services.exe         0x00010000 PROCESSOR_IDENTIFIER           x86 Family 6 Model 6 Stepping 3, GenuineIntel
     516 services.exe         0x00010000 PROCESSOR_LEVEL                6
     516 services.exe         0x00010000 PROCESSOR_REVISION             0603
     516 services.exe         0x00010000 ProgramFiles                   C:\Program Files
     516 services.exe         0x00010000 SystemDrive                    C:
     516 services.exe         0x00010000 SystemRoot                     C:\WINDOWS
     516 services.exe         0x00010000 TEMP                           C:\WINDOWS\TEMP
     516 services.exe         0x00010000 TMP                            C:\WINDOWS\TEMP
     516 services.exe         0x00010000 USERPROFILE                    C:\Documents and Settings\LocalService
     516 services.exe         0x00010000 windir                         C:\WINDOWS
     528 lsass.exe            0x00010000 ALLUSERSPROFILE                C:\Documents and Settings\All Users
     528 lsass.exe            0x00010000 CommonProgramFiles             C:\Program Files\Common Files
     528 lsass.exe            0x00010000 COMPUTERNAME                   TESTUSER-D7P72A
     528 lsass.exe            0x00010000 ComSpec                        C:\WINDOWS\system32\cmd.exe
     528 lsass.exe            0x00010000 FP_NO_HOST_CHECK               NO
     528 lsass.exe            0x00010000 NUMBER_OF_PROCESSORS           1
     528 lsass.exe            0x00010000 OS                             Windows_NT
     528 lsass.exe            0x00010000 Path                           C:\WINDOWS\System32
     528 lsass.exe            0x00010000 PATHEXT                        .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
     528 lsass.exe            0x00010000 PROCESSOR_ARCHITECTURE         x86
     528 lsass.exe            0x00010000 PROCESSOR_IDENTIFIER           x86 Family 6 Model 6 Stepping 3, GenuineIntel
     528 lsass.exe            0x00010000 PROCESSOR_LEVEL                6
     528 lsass.exe            0x00010000 PROCESSOR_REVISION             0603
     528 lsass.exe            0x00010000 ProgramFiles                   C:\Program Files
     528 lsass.exe            0x00010000 SystemDrive                    C:
     528 lsass.exe            0x00010000 SystemRoot                     C:\WINDOWS
     528 lsass.exe            0x00010000 TEMP                           C:\WINDOWS\TEMP
     528 lsass.exe            0x00010000 TMP                            C:\WINDOWS\TEMP
     528 lsass.exe            0x00010000 USERPROFILE                    C:\WINDOWS\system32\config\systemprofile
     528 lsass.exe            0x00010000 windir                         C:\WINDOWS
     676 svchost.exe          0x00010000 ALLUSERSPROFILE                C:\Documents and Settings\All Users
     676 svchost.exe          0x00010000 CommonProgramFiles             C:\Program Files\Common Files
     676 svchost.exe          0x00010000 COMPUTERNAME                   TESTUSER-D7P72A
     676 svchost.exe          0x00010000 ComSpec                        C:\WINDOWS\system32\cmd.exe
     676 svchost.exe          0x00010000 FP_NO_HOST_CHECK               NO
     676 svchost.exe          0x00010000 NUMBER_OF_PROCESSORS           1
     676 svchost.exe          0x00010000 OS                             Windows_NT
     676 svchost.exe          0x00010000 Path                           C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
     676 svchost.exe          0x00010000 PATHEXT                        .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
     676 svchost.exe          0x00010000 PROCESSOR_ARCHITECTURE         x86
     676 svchost.exe          0x00010000 PROCESSOR_IDENTIFIER           x86 Family 6 Model 6 Stepping 3, GenuineIntel
     676 svchost.exe          0x00010000 PROCESSOR_LEVEL                6
     676 svchost.exe          0x00010000 PROCESSOR_REVISION             0603
     676 svchost.exe          0x00010000 ProgramFiles                   C:\Program Files
     676 svchost.exe          0x00010000 SystemDrive                    C:
     676 svchost.exe          0x00010000 SystemRoot                     C:\WINDOWS
     676 svchost.exe          0x00010000 TEMP                           C:\WINDOWS\TEMP
     676 svchost.exe          0x00010000 TMP                            C:\WINDOWS\TEMP
     676 svchost.exe          0x00010000 USERPROFILE                    C:\WINDOWS\system32\config\systemprofile
     676 svchost.exe          0x00010000 windir                         C:\WINDOWS
     736 svchost.exe          0x00010000 ALLUSERSPROFILE                C:\Documents and Settings\All Users
     736 svchost.exe          0x00010000 CommonProgramFiles             C:\Program Files\Common Files
     736 svchost.exe          0x00010000 COMPUTERNAME                   TESTUSER-D7P72A
     736 svchost.exe          0x00010000 ComSpec                        C:\WINDOWS\system32\cmd.exe
     736 svchost.exe          0x00010000 FP_NO_HOST_CHECK               NO
     736 svchost.exe          0x00010000 NUMBER_OF_PROCESSORS           1
     736 svchost.exe          0x00010000 OS                             Windows_NT
     736 svchost.exe          0x00010000 Path                           C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
     736 svchost.exe          0x00010000 PATHEXT                        .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
     736 svchost.exe          0x00010000 PROCESSOR_ARCHITECTURE         x86
     736 svchost.exe          0x00010000 PROCESSOR_IDENTIFIER           x86 Family 6 Model 6 Stepping 3, GenuineIntel
     736 svchost.exe          0x00010000 PROCESSOR_LEVEL                6
     736 svchost.exe          0x00010000 PROCESSOR_REVISION             0603
     736 svchost.exe          0x00010000 ProgramFiles                   C:\Program Files
     736 svchost.exe          0x00010000 SystemDrive                    C:
     736 svchost.exe          0x00010000 SystemRoot                     C:\WINDOWS
     736 svchost.exe          0x00010000 TEMP                           C:\DOCUME~1\NETWOR~1\LOCALS~1\Temp
     736 svchost.exe          0x00010000 TMP                            C:\DOCUME~1\NETWOR~1\LOCALS~1\Temp
     736 svchost.exe          0x00010000 USERDOMAIN                     NT AUTHORITY
     736 svchost.exe          0x00010000 USERNAME                       NETWORK SERVICE
     736 svchost.exe          0x00010000 USERPROFILE                    C:\Documents and Settings\NetworkService
     736 svchost.exe          0x00010000 windir                         C:\WINDOWS
     800 svchost.exe          0x00010000 ALLUSERSPROFILE                C:\Documents and Settings\All Users
     800 svchost.exe          0x00010000 CommonProgramFiles             C:\Program Files\Common Files
     800 svchost.exe          0x00010000 COMPUTERNAME                   TESTUSER-D7P72A
     800 svchost.exe          0x00010000 ComSpec                        C:\WINDOWS\system32\cmd.exe
     800 svchost.exe          0x00010000 FP_NO_HOST_CHECK               NO
     800 svchost.exe          0x00010000 NUMBER_OF_PROCESSORS           1
     800 svchost.exe          0x00010000 OS                             Windows_NT
     800 svchost.exe          0x00010000 Path                           C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
     800 svchost.exe          0x00010000 PATHEXT                        .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
     800 svchost.exe          0x00010000 PROCESSOR_ARCHITECTURE         x86
     800 svchost.exe          0x00010000 PROCESSOR_IDENTIFIER           x86 Family 6 Model 6 Stepping 3, GenuineIntel
     800 svchost.exe          0x00010000 PROCESSOR_LEVEL                6
     800 svchost.exe          0x00010000 PROCESSOR_REVISION             0603
     800 svchost.exe          0x00010000 ProgramFiles                   C:\Program Files
     800 svchost.exe          0x00010000 SystemDrive                    C:
     800 svchost.exe          0x00010000 SystemRoot                     C:\WINDOWS
     800 svchost.exe          0x00010000 TEMP                           C:\WINDOWS\TEMP
     800 svchost.exe          0x00010000 TMP                            C:\WINDOWS\TEMP
     800 svchost.exe          0x00010000 USERPROFILE                    C:\Documents and Settings\NetworkService
     800 svchost.exe          0x00010000 windir                         C:\WINDOWS
     844 svchost.exe          0x00010000 ALLUSERSPROFILE                C:\Documents and Settings\All Users
     844 svchost.exe          0x00010000 CommonProgramFiles             C:\Program Files\Common Files
     844 svchost.exe          0x00010000 COMPUTERNAME                   TESTUSER-D7P72A
     844 svchost.exe          0x00010000 ComSpec                        C:\WINDOWS\system32\cmd.exe
     844 svchost.exe          0x00010000 FP_NO_HOST_CHECK               NO
     844 svchost.exe          0x00010000 NUMBER_OF_PROCESSORS           1
     844 svchost.exe          0x00010000 OS                             Windows_NT
     844 svchost.exe          0x00010000 Path                           C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
     844 svchost.exe          0x00010000 PATHEXT                        .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
     844 svchost.exe          0x00010000 PROCESSOR_ARCHITECTURE         x86
     844 svchost.exe          0x00010000 PROCESSOR_IDENTIFIER           x86 Family 6 Model 6 Stepping 3, GenuineIntel
     844 svchost.exe          0x00010000 PROCESSOR_LEVEL                6
     844 svchost.exe          0x00010000 PROCESSOR_REVISION             0603
     844 svchost.exe          0x00010000 ProgramFiles                   C:\Program Files
     844 svchost.exe          0x00010000 SystemDrive                    C:
     844 svchost.exe          0x00010000 SystemRoot                     C:\WINDOWS
     844 svchost.exe          0x00010000 TEMP                           C:\DOCUME~1\NETWOR~1\LOCALS~1\Temp
     844 svchost.exe          0x00010000 TMP                            C:\DOCUME~1\NETWOR~1\LOCALS~1\Temp
     844 svchost.exe          0x00010000 USERDOMAIN                     NT AUTHORITY
     844 svchost.exe          0x00010000 USERNAME                       NETWORK SERVICE
     844 svchost.exe          0x00010000 USERPROFILE                    C:\Documents and Settings\NetworkService
     844 svchost.exe          0x00010000 windir                         C:\WINDOWS
     876 svchost.exe          0x00010000 ALLUSERSPROFILE                C:\Documents and Settings\All Users
     876 svchost.exe          0x00010000 CommonProgramFiles             C:\Program Files\Common Files
     876 svchost.exe          0x00010000 COMPUTERNAME                   TESTUSER-D7P72A
     876 svchost.exe          0x00010000 ComSpec                        C:\WINDOWS\system32\cmd.exe
     876 svchost.exe          0x00010000 FP_NO_HOST_CHECK               NO
     876 svchost.exe          0x00010000 NUMBER_OF_PROCESSORS           1
     876 svchost.exe          0x00010000 OS                             Windows_NT
     876 svchost.exe          0x00010000 Path                           C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
     876 svchost.exe          0x00010000 PATHEXT                        .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
     876 svchost.exe          0x00010000 PROCESSOR_ARCHITECTURE         x86
     876 svchost.exe          0x00010000 PROCESSOR_IDENTIFIER           x86 Family 6 Model 6 Stepping 3, GenuineIntel
     876 svchost.exe          0x00010000 PROCESSOR_LEVEL                6
     876 svchost.exe          0x00010000 PROCESSOR_REVISION             0603
     876 svchost.exe          0x00010000 ProgramFiles                   C:\Program Files
     876 svchost.exe          0x00010000 SystemDrive                    C:
     876 svchost.exe          0x00010000 SystemRoot                     C:\WINDOWS
     876 svchost.exe          0x00010000 TEMP                           C:\DOCUME~1\LOCALS~1\LOCALS~1\Temp
     876 svchost.exe          0x00010000 TMP                            C:\DOCUME~1\LOCALS~1\LOCALS~1\Temp
     876 svchost.exe          0x00010000 USERDOMAIN                     NT AUTHORITY
     876 svchost.exe          0x00010000 USERNAME                       LOCAL SERVICE
     876 svchost.exe          0x00010000 USERPROFILE                    C:\Documents and Settings\LocalService
     876 svchost.exe          0x00010000 windir                         C:\WINDOWS
    1172 spoolsv.exe          0x00010000 ALLUSERSPROFILE                C:\Documents and Settings\All Users
    1172 spoolsv.exe          0x00010000 CommonProgramFiles             C:\Program Files\Common Files
    1172 spoolsv.exe          0x00010000 COMPUTERNAME                   TESTUSER-D7P72A
    1172 spoolsv.exe          0x00010000 ComSpec                        C:\WINDOWS\system32\cmd.exe
    1172 spoolsv.exe          0x00010000 FP_NO_HOST_CHECK               NO
    1172 spoolsv.exe          0x00010000 NUMBER_OF_PROCESSORS           1
    1172 spoolsv.exe          0x00010000 OS                             Windows_NT
    1172 spoolsv.exe          0x00010000 Path                           C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
    1172 spoolsv.exe          0x00010000 PATHEXT                        .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
    1172 spoolsv.exe          0x00010000 PROCESSOR_ARCHITECTURE         x86
    1172 spoolsv.exe          0x00010000 PROCESSOR_IDENTIFIER           x86 Family 6 Model 6 Stepping 3, GenuineIntel
    1172 spoolsv.exe          0x00010000 PROCESSOR_LEVEL                6
    1172 spoolsv.exe          0x00010000 PROCESSOR_REVISION             0603
    1172 spoolsv.exe          0x00010000 ProgramFiles                   C:\Program Files
    1172 spoolsv.exe          0x00010000 SystemDrive                    C:
    1172 spoolsv.exe          0x00010000 SystemRoot                     C:\WINDOWS
    1172 spoolsv.exe          0x00010000 TEMP                           C:\WINDOWS\TEMP
    1172 spoolsv.exe          0x00010000 TMP                            C:\WINDOWS\TEMP
    1172 spoolsv.exe          0x00010000 USERPROFILE                    C:\Documents and Settings\LocalService
    1172 spoolsv.exe          0x00010000 windir                         C:\WINDOWS
    1268 userinit.exe         0x00010000 ALLUSERSPROFILE                C:\Documents and Settings\All Users
    1268 userinit.exe         0x00010000 APPDATA                        C:\Documents and Settings\testuser\Application Data
    1268 userinit.exe         0x00010000 CLIENTNAME                     Console
    1268 userinit.exe         0x00010000 CommonProgramFiles             C:\Program Files\Common Files
    1268 userinit.exe         0x00010000 COMPUTERNAME                   TESTUSER-D7P72A
    1268 userinit.exe         0x00010000 ComSpec                        C:\WINDOWS\system32\cmd.exe
    1268 userinit.exe         0x00010000 FP_NO_HOST_CHECK               NO
    1268 userinit.exe         0x00010000 HOMEDRIVE                      C:
    1268 userinit.exe         0x00010000 HOMEPATH                       \Documents and Settings\testuser
    1268 userinit.exe         0x00010000 LOGONSERVER                    \\TESTUSER-D7P72A
    1268 userinit.exe         0x00010000 NUMBER_OF_PROCESSORS           1
    1268 userinit.exe         0x00010000 OS                             Windows_NT
    1268 userinit.exe         0x00010000 Path                           C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
    1268 userinit.exe         0x00010000 PATHEXT                        .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
    1268 userinit.exe         0x00010000 PROCESSOR_ARCHITECTURE         x86
    1268 userinit.exe         0x00010000 PROCESSOR_IDENTIFIER           x86 Family 6 Model 6 Stepping 3, GenuineIntel
    1268 userinit.exe         0x00010000 PROCESSOR_LEVEL                6
    1268 userinit.exe         0x00010000 PROCESSOR_REVISION             0603
    1268 userinit.exe         0x00010000 ProgramFiles                   C:\Program Files
    1268 userinit.exe         0x00010000 SEE_MASK_NOZONECHECKS          1
    1268 userinit.exe         0x00010000 SESSIONNAME                    Console
    1268 userinit.exe         0x00010000 SystemDrive                    C:
    1268 userinit.exe         0x00010000 SystemRoot                     C:\WINDOWS
    1268 userinit.exe         0x00010000 TEMP                           C:\DOCUME~1\testuser\LOCALS~1\Temp
    1268 userinit.exe         0x00010000 TMP                            C:\DOCUME~1\testuser\LOCALS~1\Temp
    1268 userinit.exe         0x00010000 USERDOMAIN                     TESTUSER-D7P72A
    1268 userinit.exe         0x00010000 USERNAME                       testuser
    1268 userinit.exe         0x00010000 USERPROFILE                    C:\Documents and Settings\testuser
    1268 userinit.exe         0x00010000 windir                         C:\WINDOWS
    1284 explorer.exe         0x00010000 ALLUSERSPROFILE                C:\Documents and Settings\All Users
    1284 explorer.exe         0x00010000 APPDATA                        C:\Documents and Settings\testuser\Application Data
    1284 explorer.exe         0x00010000 CLIENTNAME                     Console
    1284 explorer.exe         0x00010000 CommonProgramFiles             C:\Program Files\Common Files
    1284 explorer.exe         0x00010000 COMPUTERNAME                   TESTUSER-D7P72A
    1284 explorer.exe         0x00010000 ComSpec                        C:\WINDOWS\system32\cmd.exe
    1284 explorer.exe         0x00010000 FP_NO_HOST_CHECK               NO
    1284 explorer.exe         0x00010000 HOMEDRIVE                      C:
    1284 explorer.exe         0x00010000 HOMEPATH                       \Documents and Settings\testuser
    1284 explorer.exe         0x00010000 LOGONSERVER                    \\TESTUSER-D7P72A
    1284 explorer.exe         0x00010000 NUMBER_OF_PROCESSORS           1
    1284 explorer.exe         0x00010000 OS                             Windows_NT
    1284 explorer.exe         0x00010000 Path                           C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
    1284 explorer.exe         0x00010000 PATHEXT                        .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
    1284 explorer.exe         0x00010000 PROCESSOR_ARCHITECTURE         x86
    1284 explorer.exe         0x00010000 PROCESSOR_IDENTIFIER           x86 Family 6 Model 6 Stepping 3, GenuineIntel
    1284 explorer.exe         0x00010000 PROCESSOR_LEVEL                6
    1284 explorer.exe         0x00010000 PROCESSOR_REVISION             0603
    1284 explorer.exe         0x00010000 ProgramFiles                   C:\Program Files
    1284 explorer.exe         0x00010000 SESSIONNAME                    Console
    1284 explorer.exe         0x00010000 SystemDrive                    C:
    1284 explorer.exe         0x00010000 SystemRoot                     C:\WINDOWS
    1284 explorer.exe         0x00010000 TEMP                           C:\DOCUME~1\testuser\LOCALS~1\Temp
    1284 explorer.exe         0x00010000 TMP                            C:\DOCUME~1\testuser\LOCALS~1\Temp
    1284 explorer.exe         0x00010000 USERDOMAIN                     TESTUSER-D7P72A
    1284 explorer.exe         0x00010000 USERNAME                       testuser
    1284 explorer.exe         0x00010000 USERPROFILE                    C:\Documents and Settings\testuser
    1284 explorer.exe         0x00010000 windir                         C:\WINDOWS
    1412 ctfmon.exe           0x00010000 ALLUSERSPROFILE                C:\Documents and Settings\All Users
    1412 ctfmon.exe           0x00010000 APPDATA                        C:\Documents and Settings\testuser\Application Data
    1412 ctfmon.exe           0x00010000 CLIENTNAME                     Console
    1412 ctfmon.exe           0x00010000 CommonProgramFiles             C:\Program Files\Common Files
    1412 ctfmon.exe           0x00010000 COMPUTERNAME                   TESTUSER-D7P72A
    1412 ctfmon.exe           0x00010000 ComSpec                        C:\WINDOWS\system32\cmd.exe
    1412 ctfmon.exe           0x00010000 FP_NO_HOST_CHECK               NO
    1412 ctfmon.exe           0x00010000 HOMEDRIVE                      C:
    1412 ctfmon.exe           0x00010000 HOMEPATH                       \Documents and Settings\testuser
    1412 ctfmon.exe           0x00010000 LOGONSERVER                    \\TESTUSER-D7P72A
    1412 ctfmon.exe           0x00010000 NUMBER_OF_PROCESSORS           1
    1412 ctfmon.exe           0x00010000 OS                             Windows_NT
    1412 ctfmon.exe           0x00010000 Path                           C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
    1412 ctfmon.exe           0x00010000 PATHEXT                        .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
    1412 ctfmon.exe           0x00010000 PROCESSOR_ARCHITECTURE         x86
    1412 ctfmon.exe           0x00010000 PROCESSOR_IDENTIFIER           x86 Family 6 Model 6 Stepping 3, GenuineIntel
    1412 ctfmon.exe           0x00010000 PROCESSOR_LEVEL                6
    1412 ctfmon.exe           0x00010000 PROCESSOR_REVISION             0603
    1412 ctfmon.exe           0x00010000 ProgramFiles                   C:\Program Files
    1412 ctfmon.exe           0x00010000 SESSIONNAME                    Console
    1412 ctfmon.exe           0x00010000 SystemDrive                    C:
    1412 ctfmon.exe           0x00010000 SystemRoot                     C:\WINDOWS
    1412 ctfmon.exe           0x00010000 TEMP                           C:\DOCUME~1\testuser\LOCALS~1\Temp
    1412 ctfmon.exe           0x00010000 TMP                            C:\DOCUME~1\testuser\LOCALS~1\Temp
    1412 ctfmon.exe           0x00010000 USERDOMAIN                     TESTUSER-D7P72A
    1412 ctfmon.exe           0x00010000 USERNAME                       testuser
    1412 ctfmon.exe           0x00010000 USERPROFILE                    C:\Documents and Settings\testuser
    1412 ctfmon.exe           0x00010000 windir                         C:\WINDOWS



```

以上。