__process__
category
__notification__
is_success
retval
time_low
time_high
module_path
command_line
is_64bit
modules
flags_value
flags_bitmask
C:\Windows\System32\lsass.exe
C:\Windows\system32\lsass.exe
filepath
C:\Windows\system32\lsass.exe
basename
lsass.exe
baseaddr
0xffe80000
imgsize
filepath
C:\Windows\SYSTEM32\ntdll.dll
basename
ntdll.dll
baseaddr
0x76d30000
imgsize
filepath
C:\Windows\system32\kernel32.dll
basename
kernel32.dll
baseaddr
0x76c10000
imgsize
filepath
C:\Windows\system32\KERNELBASE.dll
basename
KERNELBASE.dll
baseaddr
0x7fefd4f0000
imgsize
filepath
C:\Windows\system32\msvcrt.dll
basename
msvcrt.dll
baseaddr
0x7fefdaf0000
imgsize
filepath
C:\Windows\system32\RPCRT4.dll
basename
RPCRT4.dll
baseaddr
0x7fefdb90000
imgsize
filepath
C:\Windows\system32\SspiSrv.dll
basename
SspiSrv.dll
baseaddr
0x7fefcfe0000
imgsize
filepath
C:\Windows\system32\lsasrv.dll
basename
lsasrv.dll
baseaddr
0x7fefce70000
imgsize
filepath
C:\Windows\SYSTEM32\sechost.dll
basename
sechost.dll
baseaddr
0x7fefec50000
imgsize
filepath
C:\Windows\system32\SspiCli.dll
basename
SspiCli.dll
baseaddr
0x7fefcff0000
imgsize
filepath
C:\Windows\system32\ADVAPI32.dll
basename
ADVAPI32.dll
baseaddr
0x7fefeb10000
imgsize
filepath
C:\Windows\system32\USER32.dll
basename
USER32.dll
baseaddr
0x769b0000
imgsize
filepath
C:\Windows\system32\GDI32.dll
basename
GDI32.dll
baseaddr
0x7fefd870000
imgsize
filepath
C:\Windows\system32\LPK.dll
basename
LPK.dll
baseaddr
0x7fefd7b0000
imgsize
filepath
C:\Windows\system32\USP10.dll
basename
USP10.dll
baseaddr
0x7fefd6e0000
imgsize
filepath
C:\Windows\system32\SAMSRV.dll
basename
SAMSRV.dll
baseaddr
0x7fefcd90000
imgsize
filepath
C:\Windows\system32\cryptdll.dll
basename
cryptdll.dll
baseaddr
0x7fefcd60000
imgsize
filepath
C:\Windows\system32\MSASN1.dll
basename
MSASN1.dll
baseaddr
0x7fefd230000
imgsize
filepath
C:\Windows\system32\wevtapi.dll
basename
wevtapi.dll
baseaddr
0x7fefccf0000
imgsize
filepath
C:\Windows\system32\IMM32.DLL
basename
IMM32.DLL
baseaddr
0x7fefd5e0000
imgsize
filepath
C:\Windows\system32\MSCTF.dll
basename
MSCTF.dll
baseaddr
0x7fefee50000
imgsize
filepath
C:\Windows\system32\cngaudit.dll
basename
cngaudit.dll
baseaddr
0x7fefcc20000
imgsize
filepath
C:\Windows\system32\AUTHZ.dll
basename
AUTHZ.dll
baseaddr
0x7fefcbf0000
imgsize
filepath
C:\Windows\system32\ncrypt.dll
basename
ncrypt.dll
baseaddr
0x7fefcba0000
imgsize
filepath
C:\Windows\system32\bcrypt.dll
basename
bcrypt.dll
baseaddr
0x7fefcb70000
imgsize
filepath
C:\Windows\system32\msprivs.DLL
basename
msprivs.DLL
baseaddr
0x745b0000
imgsize
filepath
C:\Windows\system32\netjoin.dll
basename
netjoin.dll
baseaddr
0x7fefcb30000
imgsize
filepath
C:\Windows\system32\negoexts.DLL
basename
negoexts.DLL
baseaddr
0x7fefcb00000
imgsize
filepath
C:\Windows\system32\Secur32.dll
basename
Secur32.dll
baseaddr
0x7fefcce0000
imgsize
filepath
C:\Windows\system32\cryptbase.dll
basename
cryptbase.dll
baseaddr
0x7fefd080000
imgsize
filepath
C:\Windows\system32\kerberos.DLL
basename
kerberos.DLL
baseaddr
0x7fefca40000
imgsize
filepath
C:\Windows\system32\CRYPTSP.dll
basename
CRYPTSP.dll
baseaddr
0x7fefca20000
imgsize
filepath
C:\Windows\system32\WS2_32.dll
basename
WS2_32.dll
baseaddr
0x7fefd690000
imgsize
filepath
C:\Windows\system32\NSI.dll
basename
NSI.dll
baseaddr
0x7fefd7c0000
imgsize
filepath
C:\Windows\system32\mswsock.dll
basename
mswsock.dll
baseaddr
0x7fefc9c0000
imgsize
filepath
C:\Windows\System32\wship6.dll
basename
wship6.dll
baseaddr
0x7fefc9b0000
imgsize
filepath
C:\Windows\system32\msv1_0.DLL
basename
msv1_0.DLL
baseaddr
0x7fefc950000
imgsize
filepath
C:\Windows\system32\netlogon.DLL
basename
netlogon.DLL
baseaddr
0x7fefc8a0000
imgsize
filepath
C:\Windows\system32\DNSAPI.dll
basename
DNSAPI.dll
baseaddr
0x7fefc840000
imgsize
filepath
C:\Windows\system32\logoncli.dll
basename
logoncli.dll
baseaddr
0x7fefc810000
imgsize
filepath
C:\Windows\system32\schannel.DLL
basename
schannel.DLL
baseaddr
0x7fefc7b0000
imgsize
filepath
C:\Windows\system32\CRYPT32.dll
basename
CRYPT32.dll
baseaddr
0x7fefd240000
imgsize
filepath
C:\Windows\system32\wdigest.DLL
basename
wdigest.DLL
baseaddr
0x7fefc770000
imgsize
filepath
C:\Windows\system32\rsaenh.dll
basename
rsaenh.dll
baseaddr
0x7fefc720000
imgsize
filepath
C:\Windows\system32\tspkg.DLL
basename
tspkg.DLL
baseaddr
0x7fefc700000
imgsize
filepath
C:\Windows\system32\pku2u.DLL
basename
pku2u.DLL
baseaddr
0x7fefc6b0000
imgsize
filepath
C:\Windows\system32\bcryptprimitives.dll
basename
bcryptprimitives.dll
baseaddr
0x7fefc660000
imgsize
filepath
C:\Windows\system32\RpcRtRemote.dll
basename
RpcRtRemote.dll
baseaddr
0x7fefd170000
imgsize
filepath
C:\Windows\system32\efslsaext.dll
basename
efslsaext.dll
baseaddr
0x7fefc640000
imgsize
filepath
C:\Windows\system32\scecli.DLL
basename
scecli.DLL
baseaddr
0x7fefc600000
imgsize
filepath
C:\Windows\system32\credssp.dll
basename
credssp.dll
baseaddr
0x7fefc5f0000
imgsize
filepath
C:\Windows\system32\WINSTA.dll
basename
WINSTA.dll
baseaddr
0x7fefd130000
imgsize
filepath
C:\Windows\system32\IPHLPAPI.DLL
basename
IPHLPAPI.DLL
baseaddr
0x7fefaab0000
imgsize
filepath
C:\Windows\system32\WINNSI.DLL
basename
WINNSI.DLL
baseaddr
0x7fefaaa0000
imgsize
filepath
C:\Windows\system32\netutils.dll
basename
netutils.dll
baseaddr
0x7fefb260000
imgsize
filepath
C:\Windows\system32\USERENV.dll
basename
USERENV.dll
baseaddr
0x7fefc4e0000
imgsize
filepath
C:\Windows\system32\profapi.dll
basename
profapi.dll
baseaddr
0x7fefd190000
imgsize
filepath
C:\Windows\System32\wshtcpip.dll
basename
wshtcpip.dll
baseaddr
0x7fefc3c0000
imgsize
filepath
C:\tmpuvzci8\bin\monitor-x64.dll
basename
monitor-x64.dll
baseaddr
0x73970000
imgsize
category
crypto
is_success
retval
client_random
server_random
master_secret
flags_value
flags_bitmask
key expansion
6814ebb2002ec4ed9d37c5e12991d9b5ac52a4013fa0ca9600c3549ffedabe7f
6814ebbb85b3417fef8d59f573e82220804df1af868c5a9369b4ce60b7e2d4ff
2b51a7e75a9a63ad8c5345f1022a7490e538840d4caeeb20c6fd4664c7998eef183c714a4724e3d4713124f0baf4ea71
client finished
key expansion
6814ebb2c414ffd50b2bd8e852849e843fbaac704845217c8b99d3fa48b21165
6814ebbb85b3b862d5cf8d674568d03733e42d3b6e428bc071742a5f4b8cdb92
8e3b85074b3460adb20d24d0c06b6441a590eda91c42e296eaf8768e1531c9977f7633ae2ba2f5970bb042a47ad8be0b
client finished
server finished
server finished
key expansion
6814ebb31144d8148ff6b181853689f270502c5d4e4f5fe503492faf69c19ae0
117b396fcf5200425501888a57dcf381027979826243e80e444f574e47524400
1abeca4de86742f6d09a3915b8b995b7363a07c89d4a59e1d726324d76612142c87e2709ef9c9056882f397558262496
client finished
key expansion
6814ebb3de1e2b2e85aaac600bef74f79032021b52ee7f7c54a44166d252411c
e22ebce518c722c0e431a5a4d1f4cd940d097590c3708739444f574e47524400
4244a3b638d1ef79eba2dd4e5d1d902c4da7cb71e22cd94ccc9582404704ce3657484738e7c648c70ff48a46ee83ff34
client finished
server finished
server finished
key expansion
6814ec0a26aab98d6ec75dd8e61fa693ad21bc0987ca55f800a3b01b0627bd6c
6814ec13fec3359cdf76f450691cec0b30e030efb33510f6444f574e47524400
d334b84e3877d2566b9c702ccce87e1f34b1a7564eaf0981affe4e99d93c5d550a8d5be425292253aa387ca56c7cabb9
client finished
server finished
key expansion
6814ec0a8176d3f234f7fcba86fca0545e8817ebf33cd9fdef01333fd69e11eb
6814ec14b1d272c1c6dd1eb69ba2ee283f75333361289a95444f574e47524400
f01e9592202736139d183a6aa32fb810cf18195f1fca6fb19618d8338e668d782b3162422d805dc4a681ca607d9b86e4
client finished
server finished