Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- 0: kd> !process ffffe705889765c0
- PROCESS ffffe705889765c0
- SessionId: 0 Cid: 1088 Peb: 2db1730000 ParentCid: 0300
- DirBase: 1004e5000 ObjectTable: ffffae851abbb1c0 HandleCount: 721.
- Image: MsMpEng.exe
- VadRoot ffffe7058a2355e0 Vads 487 Clone 0 Private 26686. Modified 16624. Locked 0.
- DeviceMap ffffae8512018b60
- Token ffffae851af189d0
- ElapsedTime 00:57:37.928
- UserTime 00:00:00.000
- KernelTime 00:00:00.109
- QuotaPoolUsage[PagedPool] 622144
- QuotaPoolUsage[NonPagedPool] 69560
- Working Set Sizes (now,min,max) (28495, 50, 345) (113980KB, 200KB, 1380KB)
- PeakWorkingSetSize 28515
- VirtualSize 2097616 Mb
- PeakVirtualSize 2097617 Mb
- PageFaultCount 71003
- MemoryPriority BACKGROUND
- BasePriority 8
- CommitCharge 29500
- ----------------------------------------------------------------------------------------------------------------
- 0: kd> !exts.token ffffae851af189d0
- _TOKEN 0xffffae851af189d0
- TS Session ID: 0
- User: S-1-5-18
- User Groups:
- 00 S-1-16-16384
- Attributes - GroupIntegrity GroupIntegrityEnabled
- 01 S-1-1-0
- Attributes - Mandatory Default Enabled
- 02 S-1-5-32-545
- Attributes - Mandatory Default Enabled
- 03 S-1-5-6
- Attributes - Mandatory Default Enabled
- 04 S-1-2-1
- Attributes - Mandatory Default Enabled
- 05 S-1-5-11
- Attributes - Mandatory Default Enabled
- 06 S-1-5-15
- Attributes - Mandatory Default Enabled
- 07 S-1-5-80-1913148863-3492339771-4165695881-2087618961-4109116736
- Attributes - Default Enabled Owner
- 08 S-1-5-5-0-155074
- Attributes - Mandatory Default Enabled Owner LogonId
- 09 S-1-2-0
- Attributes - Mandatory Default Enabled
- 10 S-1-5-32-544
- Attributes - Default Enabled Owner
- Primary Group: S-1-5-18
- Privs:
- 03 0x000000003 SeAssignPrimaryTokenPrivilege Attributes - Enabled
- 05 0x000000005 SeIncreaseQuotaPrivilege Attributes - Enabled
- 07 0x000000007 SeTcbPrivilege Attributes - Enabled Default
- 08 0x000000008 SeSecurityPrivilege Attributes - Enabled
- 09 0x000000009 SeTakeOwnershipPrivilege Attributes - Enabled
- 10 0x00000000a SeLoadDriverPrivilege Attributes - Enabled
- 14 0x00000000e SeIncreaseBasePriorityPrivilege Attributes - Enabled Default
- 17 0x000000011 SeBackupPrivilege Attributes - Enabled
- 18 0x000000012 SeRestorePrivilege Attributes - Enabled
- 19 0x000000013 SeShutdownPrivilege Attributes - Enabled
- 20 0x000000014 SeDebugPrivilege Attributes - Enabled Default
- 22 0x000000016 SeSystemEnvironmentPrivilege Attributes - Enabled
- 23 0x000000017 SeChangeNotifyPrivilege Attributes - Enabled Default
- 29 0x00000001d SeImpersonatePrivilege Attributes - Enabled Default
- Authentication ID: (0,3e7)
- Impersonation Level: Anonymous
- TokenType: Primary
- Source: Advapi TokenFlags: 0x2800 ( Token in use )
- Token ID: 26287 ParentToken ID: 0
- Modified ID: (0, 2ce0a)
- RestrictedSidCount: 0 RestrictedSids: 0x0000000000000000
- OriginatingLogonSession: 3e7
- PackageSid: (null)
- CapabilityCount: 0 Capabilities: 0x0000000000000000
- LowboxNumberEntry: 0x0000000000000000
- Security Attributes:
- Unable to get the offset of nt!_AUTHZBASEP_SECURITY_ATTRIBUTE.ListLink
- Process Token TrustLevelSid: (null)
- ------------------------------------------------------------------------------------------------------------------------------------------
- 0: kd> dt nt!_TOKEN ffffae851af189d0
- +0x000 TokenSource : _TOKEN_SOURCE
- +0x010 TokenId : _LUID
- +0x018 AuthenticationId : _LUID
- +0x020 ParentTokenId : _LUID
- +0x028 ExpirationTime : _LARGE_INTEGER 0x06207526`b64ceb90
- +0x030 TokenLock : 0xffffe705`889bb2e0 _ERESOURCE
- +0x038 ModifiedId : _LUID
- +0x040 Privileges : _SEP_TOKEN_PRIVILEGES
- +0x058 AuditPolicy : _SEP_AUDIT_POLICY
- +0x078 SessionId : 0
- +0x07c UserAndGroupCount : 0xc
- +0x080 RestrictedSidCount : 0
- +0x084 VariableLength : 0x19c
- +0x088 DynamicCharged : 0x1000
- +0x08c DynamicAvailable : 0
- +0x090 DefaultOwnerIndex : 0
- +0x098 UserAndGroups : 0xffffae85`1af18e60 _SID_AND_ATTRIBUTES
- +0x0a0 RestrictedSids : (null)
- +0x0a8 PrimaryGroup : 0xffffae85`1aac2800 Void
- +0x0b0 DynamicPart : 0xffffae85`1aac2800 -> 0x101
- +0x0b8 DefaultDacl : 0xffffae85`1aac280c _ACL
- +0x0c0 TokenType : 1 ( TokenPrimary )
- +0x0c4 ImpersonationLevel : 0 ( SecurityAnonymous )
- +0x0c8 TokenFlags : 0x2800
- +0x0cc TokenInUse : 0x1 ''
- +0x0d0 IntegrityLevelIndex : 1
- +0x0d4 MandatoryPolicy : 3
- +0x0d8 LogonSession : 0xffffae85`12014dc0 _SEP_LOGON_SESSION_REFERENCES
- +0x0e0 OriginatingLogonSession : _LUID
- +0x0e8 SidHash : _SID_AND_ATTRIBUTES_HASH
- +0x1f8 RestrictedSidHash : _SID_AND_ATTRIBUTES_HASH
- +0x308 pSecurityAttributes : 0xffffae85`1aeea300 _AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION
- +0x310 Package : (null)
- +0x318 Capabilities : (null)
- +0x320 CapabilityCount : 0
- +0x328 CapabilitiesHash : _SID_AND_ATTRIBUTES_HASH
- +0x438 LowboxNumberEntry : (null)
- +0x440 LowboxHandlesEntry : (null)
- +0x448 pClaimAttributes : (null)
- +0x450 TrustLevelSid : (null)
- +0x458 TrustLinkedToken : (null)
- +0x460 IntegrityLevelSidValue : (null)
- +0x468 TokenSidValues : (null)
- +0x470 IndexEntry : 0xffffae85`1ab49bd0 _SEP_LUID_TO_INDEX_MAP_ENTRY
- +0x478 DiagnosticInfo : (null)
- +0x480 BnoIsolationHandlesEntry : (null)
- +0x488 SessionObject : (null)
- +0x490 VariablePart : 0xffffae85`1af18f20
Advertisement
Add Comment
Please, Sign In to add comment
