Download as txt, pdf, or txt
Download as txt, pdf, or txt
You are on page 1of 18

Razer Cortex Diagnostics Report v2.0 Version: 9.15.19.

1412
Date: 2021/07/12 22:29:07

----------------------------------
01 - Operating System
----------------------------------

0101 - Operating System : Windows 8.1 Pro 64-bit (6.3, Build 9600)
(9600.winblue_ltsb.190606-0600)
0102 - Language : English (Regional Setting: English)
0103 - BIOS : InsydeH2O Version 05.05.01F.20
0104 - Processor : Intel(R) Pentium(R) CPU N3700 @ 1.60GHz (4 CPUs), ~1.6GHz
0105 - Memory : 8192MB RAM
0106 - Available OS Memory : 8040MB RAM
0107 - Page File : 2447MB used, 13785MB available
0108 - Windows Dir : C:\Windows
0109 - DirectX Version : DirectX 11
0110 - DX Setup Parameters : Not found
0111 - User DPI Setting : Using System DPI
0112 - System DPI Setting : 96 DPI (100 percent)
0113 - DWM DPI Scaling : Disabled
0114 - DxDiag Version : 6.03.9600.17415

----------------------------------
02 - Processor
----------------------------------

0201 - Caption : Intel(R) Pentium(R) CPU N3700 @ 1.60GHz x4 ~1601MHz


0202 - Current Clock Speed : 480MHz

----------------------------------
03 - Video Adapter
----------------------------------

0301 - Card Name : Intel(R) HD Graphics


0302 - Manufacturer : Intel Corporation
0303 - Chiptype : Intel(R) HD Graphics
0304 - DAC Type : Internal
0305 - Device Key : Enum\PCI\VEN_8086&DEV_22B1&SUBSYS_80C5103C&REV_21
0306 - Display Memory : 1920 MB
0307 - AdapterRAM : 1.00 GB
0308 - Current Mode : 1366 x 768 (32 bit) (60Hz)
0309 - Monitor Name : Generic PnP Monitor
0310 - Driver Name :
igdumdim64.dll,igd10iumd64.dll,igd10iumd64.dll,igdumdim32,igd10iumd32,igd10iumd32
0311 - Driver Version : 20.19.0015.4835
0312 - Driver Language : English
0313 - DDI Version : 11.1
0314 - Driver Model : WDDM 1.3
0315 - Driver Beta : False
0316 - Driver Debug : False
0317 - Driver Date : 10/20/2017 16:37:00
0318 - Driver Size : 39510208
0319 - VDD : n/a
0320 - Mini VDD : n/a
0321 - Mini VDD Date : n/a
0322 - Mini VDD Size : 0
0323 - Device Identifier : {D7B78E66-61F1-11CF-6F61-CAA09DC2D935}
0324 - Vendor ID : 0x8086
0325 - Device ID : 0x22B1
: 0x80C5103C
0327 - Revision ID : 0x0021
0328 - Driver Strong Name : oem36.inf:5f63e5342b637067:iCHVM_w81:20.19.15.4835:pci\
ven_8086&dev_22b1
0329 - Rank Of Driver : 00DA2001
0330 - Video Accel : ModeMPEG2_A ModeMPEG2_C ModeWMV9_C ModeVC1_C
0331 - Deinterlace Caps : {BF752EF6-8CC4-457A-BE1B-08BD1CAEEE9F}:
Format(In/Out)=(YUY2,YUY2) Frames(Prev/Fwd/Back)=(0,0,1) Caps=VideoProcess_YUV2RGB
VideoProcess_StretchX VideoProcess_StretchY VideoProcess_AlphaBlend
DeinterlaceTech_EdgeFiltering
{335AA36E-7884-43A4-9C91-7F87FAF3E37E}: Format(In/Out)=(YUY2,YUY2)
Frames(Prev/Fwd/Back)=(0,0,0) Caps=VideoProcess_YUV2RGB VideoProcess_StretchX
VideoProcess_StretchY VideoProcess_AlphaBlend DeinterlaceTech_BOBVerticalStretch
{5A54A0C9-C7EC-4BD9-8EDE-F3C75DC4393B}: Format(In/Out)=(YUY2,YUY2)
Frames(Prev/Fwd/Back)=(0,0,0) Caps=VideoProcess_YUV2RGB VideoProcess_StretchX
VideoProcess_StretchY VideoProcess_AlphaBlend
{BF752EF6-8CC4-457A-BE1B-08BD1CAEEE9F}: Format(In/Out)=(UYVY,YUY2)
Frames(Prev/Fwd/Back)=(0,0,1) Caps=VideoProcess_YUV2RGB VideoProcess_StretchX
VideoProcess_StretchY VideoProcess_AlphaBlend DeinterlaceTech_EdgeFiltering
{335AA36E-7884-43A4-9C91-7F87FAF3E37E}: Format(In/Out)=(UYVY,YUY2)
Frames(Prev/Fwd/Back)=(0,0,0) Caps=VideoProcess_YUV2RGB VideoProcess_StretchX
VideoProcess_StretchY VideoProcess_AlphaBlend DeinterlaceTech_BOBVerticalStretch
{5A54A0C9-C7EC-4BD9-8EDE-F3C75DC4393B}: Format(In/Out)=(UYVY,YUY2)
Frames(Prev/Fwd/Back)=(0,0,0) Caps=VideoProcess_YUV2RGB VideoProcess_StretchX
VideoProcess_StretchY VideoProcess_AlphaBlend
{BF752EF6-8CC4-457A-BE1B-08BD1CAEEE9F}: Format(In/Out)=(YV12,YUY2)
Frames(Prev/Fwd/Back)=(0,0,1) Caps=VideoProcess_YUV2RGB VideoProcess_StretchX
VideoProcess_StretchY VideoProcess_AlphaBlend DeinterlaceTech_EdgeFiltering
{335AA36E-7884-43A4-9C91-7F87FAF3E37E}: Format(In/Out)=(YV12,YUY2)
Frames(Prev/Fwd/Back)=(0,0,0) Caps=VideoProcess_YUV2RGB VideoProcess_StretchX
VideoProcess_StretchY VideoProcess_AlphaBlend DeinterlaceTech_BOBVerticalStretch
{5A54A0C9-C7EC-4BD9-8EDE-F3C75DC4393B}: Format(In/Out)=(YV12,YUY2)
Frames(Prev/Fwd/Back)=(0,0,0) Caps=VideoProcess_YUV2RGB VideoProcess_StretchX
VideoProcess_StretchY VideoProcess_AlphaBlend
{BF752EF6-8CC4-457A-BE1B-08BD1CAEEE9F}: Format(In/Out)=(NV12,YUY2)
Frames(Prev/Fwd/Back)=(0,0,1) Caps=VideoProcess_YUV2RGB VideoProcess_StretchX
VideoProcess_StretchY VideoProcess_AlphaBlend DeinterlaceTech_EdgeFiltering
{335AA36E-7884-43A4-9C91-7F87FAF3E37E}: Format(In/Out)=(NV12,YUY2)
Frames(Prev/Fwd/Back)=(0,0,0) Caps=VideoProcess_YUV2RGB VideoProcess_StretchX
VideoProcess_StretchY VideoProcess_AlphaBlend DeinterlaceTech_BOBVerticalStretch
{5A54A0C9-C7EC-4BD9-8EDE-F3C75DC4393B}: Format(In/Out)=(NV12,YUY2)
Frames(Prev/Fwd/Back)=(0,0,0) Caps=VideoProcess_YUV2RGB VideoProcess_StretchX
VideoProcess_StretchY VideoProcess_AlphaBlend
{BF752EF6-8CC4-457A-BE1B-08BD1CAEEE9F}: Format(In/Out)=(IMC1,YUY2)
Frames(Prev/Fwd/Back)=(0,0,1) Caps=VideoProcess_YUV2RGB VideoProcess_StretchX
VideoProcess_StretchY VideoProcess_AlphaBlend DeinterlaceTech_EdgeFiltering
{335AA36E-7884-43A4-9C91-7F87FAF3E37E}: Format(In/Out)=(IMC1,YUY2)
Frames(Prev/Fwd/Back)=(0,0,0) Caps=VideoProcess_YUV2RGB VideoProcess_StretchX
VideoProcess_StretchY VideoProcess_AlphaBlend DeinterlaceTech_BOBVerticalStretch
{5A54A0C9-C7EC-4BD9-8EDE-F3C75DC4393B}: Format(In/Out)=(IMC1,YUY2)
Frames(Prev/Fwd/Back)=(0,0,0) Caps=VideoProcess_YUV2RGB VideoProcess_StretchX
VideoProcess_StretchY VideoProcess_AlphaBlend
{BF752EF6-8CC4-457A-BE1B-08BD1CAEEE9F}: Format(In/Out)=(IMC2,YUY2)
Frames(Prev/Fwd/Back)=(0,0,1) Caps=VideoProcess_YUV2RGB VideoProcess_StretchX
VideoProcess_StretchY VideoProcess_AlphaBlend DeinterlaceTech_EdgeFiltering
{335AA36E-7884-43A4-9C91-7F87FAF3E37E}: Format(In/Out)=(IMC2,YUY2)
Frames(Prev/Fwd/Back)=(0,0,0) Caps=VideoProcess_YUV2RGB VideoProcess_StretchX
VideoProcess_StretchY VideoProcess_AlphaBlend DeinterlaceTech_BOBVerticalStretch
{5A54A0C9-C7EC-4BD9-8EDE-F3C75DC4393B}: Format(In/Out)=(IMC2,YUY2)
Frames(Prev/Fwd/Back)=(0,0,0) Caps=VideoProcess_YUV2RGB VideoProcess_StretchX
VideoProcess_StretchY VideoProcess_AlphaBlend
{BF752EF6-8CC4-457A-BE1B-08BD1CAEEE9F}: Format(In/Out)=(IMC3,YUY2)
Frames(Prev/Fwd/Back)=(0,0,1) Caps=VideoProcess_YUV2RGB VideoProcess_StretchX
VideoProcess_StretchY VideoProcess_AlphaBlend DeinterlaceTech_EdgeFiltering
{335AA36E-7884-43A4-9C91-7F87FAF3E37E}: Format(In/Out)=(IMC3,YUY2)
Frames(Prev/Fwd/Back)=(0,0,0) Caps=VideoProcess_YUV2RGB VideoProcess_StretchX
VideoProcess_StretchY VideoProcess_AlphaBlend DeinterlaceTech_BOBVerticalStretch
{5A54A0C9-C7EC-4BD9-8EDE-F3C75DC4393B}: Format(In/Out)=(IMC3,YUY2)
Frames(Prev/Fwd/Back)=(0,0,0) Caps=VideoProcess_YUV2RGB VideoProcess_StretchX
VideoProcess_StretchY VideoProcess_AlphaBlend
{BF752EF6-8CC4-457A-BE1B-08BD1CAEEE9F}: Format(In/Out)=(IMC4,YUY2)
Frames(Prev/Fwd/Back)=(0,0,1) Caps=VideoProcess_YUV2RGB VideoProcess_StretchX
VideoProcess_StretchY VideoProcess_AlphaBlend DeinterlaceTech_EdgeFiltering
{335AA36E-7884-43A4-9C91-7F87FAF3E37E}: Format(In/Out)=(IMC4,YUY2)
Frames(Prev/Fwd/Back)=(0,0,0) Caps=VideoProcess_YUV2RGB VideoProcess_StretchX
VideoProcess_StretchY VideoProcess_AlphaBlend DeinterlaceTech_BOBVerticalStretch
{5A54A0C9-C7EC-4BD9-8EDE-F3C75DC4393B}: Format(In/Out)=(IMC4,YUY2)
Frames(Prev/Fwd/Back)=(0,0,0) Caps=VideoProcess_YUV2RGB VideoProcess_StretchX
VideoProcess_StretchY VideoProcess_AlphaBlend
0332 - D3D9 Overlay : Supported
0333 - DXVA-HD : Supported
0334 - DDraw Status : Enabled
0335 - D3D Status : Enabled
0336 - AGP Status : Enabled
0337 - Notes : No problems found.

0338 - OpenGL : 6.3.9600.17415 (winblue_r4.141028-1500)

----------------------------------
04 - Memory
----------------------------------
0401 - Total Memory : 7.872 GB
0402 - Free Memory : 5.341 GB
0403 - Total Pagefile : 15.872 GB
0404 - Free Pagefile : 13.468 GB

0405 - Bank Label : BANK 0


0406 - Speed : 1600 MHz
0407 - Total Width : 8 Bits
0408 - Capacity : 8.00 GB

----------------------------------
05 - Network
----------------------------------

0501 - Description : Realtek RTL8723BE 802.11 b/g/n Wi-Fi Adapter

----------------------------------
06 - Motherboard
----------------------------------

0601 - Model : 80C5


0602 - Manufacturer : HP

----------------------------------
07 - Sound Device
----------------------------------

0701 - Description : Speaker/HP (Realtek High Definition Audio)


0702 - Default Sound Playback : True
0703 - Default Voice Playback : True
0704 - Hardware ID : HDAUDIO\FUNC_01&VEN_10EC&DEV_0282&SUBSYS_103C80C5&REV_1000
0705 - Manufacturer ID : 1
0706 - Product ID : 100
0707 - Type : WDM
0708 - Driver Name : RTKVHD64.sys
0709 - Driver Version : 6.00.0001.7572
0710 - Driver attributes : Final Retail
0711 - Date and Size : 7/30/2015 09:32:52
0713 - Driver Provider : Realtek Semiconductor Corp.
0714 - Min/Max Sample Rate : N/A, N/A
0715 - Static/Strm HW Mix Bufs : N/A, N/A
0716 - Static/Strm HW 3D Bufs : N/A, N/A
0717 - HW Memory : N/A
0718 - Voice Management : False
0719 - EAX(tm) 2.0 Listen/Src : False, False
0720 - I3DL2(tm) Listen/Src : False, False
0721 - Notes : No problems found.

----------------------------------
08 - Harddisk
----------------------------------

0801 - Model : TOSHIBA MQ01ABF050


0802 - Media Type : Fixed hard disk media
0803 - Size : 465.777 GB
0804 - Interface Type : Serial ATA

0807 - Caption : C:\


0808 - Capacity : 243.817 GB
0809 - Free Space : 173.303 GB
0810 - Drive Type : 3-Fixed
0811 - File System : NTFS

0807 - Caption : E:\


0808 - Capacity : 221.633 GB
0809 - Free Space : 71.647 GB
0810 - Drive Type : 3-Fixed
0811 - File System : NTFS

----------------------------------
09 - Process
----------------------------------

0901 - 0000
[System Process]
0901 - 0004
System
0901 - 01f4
smss.exe
0901 - 02bc
csrss.exe
0901 - 02f8
wininit.exe
high C:\Windows\System32\wininit.exe
0901 - 0308 csrss.exe
0901 - 0334 winlogon.exe
high C:\Windows\System32\winlogon.exe
0901 - 0360 services.exe
0901 - 0368 lsass.exe
normal C:\Windows\System32\lsass.exe
0901 - 03b0 svchost.exe
normal C:\Windows\System32\svchost.exe
0901 - 03e0 svchost.exe
normal C:\Windows\System32\svchost.exe
0901 - 0190 svchost.exe
normal C:\Windows\System32\svchost.exe
0901 - 021c wsc_proxy.exe
normal C:\Program Files\AVAST Software\Avast\wsc_proxy.exe
0901 - 02c4 dwm.exe
high C:\Windows\System32\dwm.exe
0901 - 02a0 svchost.exe
normal C:\Windows\System32\svchost.exe
0901 - 03fc svchost.exe
normal C:\Windows\System32\svchost.exe
0901 - 0410 igfxCUIService.exe
normal C:\Windows\System32\igfxCUIService.exe
0901 - 0434 svchost.exe
normal C:\Windows\System32\svchost.exe
0901 - 049c RtkAudioService64.exe
normal C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
0901 - 04b4 WTabletServicePro.exe
normal C:\Program Files\Tablet\Wacom\WTabletServicePro.exe
0901 - 04c0 RAVBg64.exe
normal C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
0901 - 05b8 WacomHost.exe
normal C:\Program Files\Tablet\Wacom\WacomHost.exe
0901 - 05c0 svchost.exe
normal C:\Windows\System32\svchost.exe
0901 - 05e4 explorer.exe
normal C:\Windows\explorer.exe
0901 - 0628 igfxEM.exe
normal C:\Windows\System32\igfxEM.exe
0901 - 0630 igfxHK.exe
normal C:\Windows\System32\igfxHK.exe
0901 - 0638 igfxTray.exe
normal C:\Windows\System32\igfxTray.exe
0901 - 06b0 AvastSvc.exe
normal C:\Program Files\AVAST Software\Avast\AvastSvc.exe
0901 - 06d0 Wacom_TouchUser.exe
above normal C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe
0901 - 0514 aswToolsSvc.exe
normal C:\Program Files\AVAST Software\Avast\aswToolsSvc.exe
0901 - 0894 spoolsv.exe
normal C:\Windows\System32\spoolsv.exe
0901 - 08ac svchost.exe
normal C:\Windows\System32\svchost.exe
0901 - 08e0 taskhostex.exe
normal C:\Windows\System32\taskhostex.exe
0901 - 09c4 armsvc.exe
normal C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
0901 - 0a10 avp.exe
normal C:\Program Files (x86)\Kaspersky Lab\Kaspersky Free 21.3\avp.exe
0901 - 0ab0 svchost.exe
normal C:\Windows\System32\svchost.exe
0901 - 0afc dasHost.exe
normal C:\Windows\System32\dasHost.exe
0901 - 0b08 MBAMIService.exe
normal C:\ProgramData\MB3Install\MBAMIService.exe
0901 - 0b50 GROOVE.EXE
normal C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
0901 - 0bac SMSvcHost.exe
normal C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
0901 - 0c08 OSE.EXE
normal C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\
OSE.EXE
0901 - 0c4c OSPPSVC.EXE
normal C:\Program Files\Common Files\microsoft shared\
OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
0901 - 0ccc aswEngSrv.exe
normal C:\Program Files\AVAST Software\Avast\aswEngSrv.exe
0901 - 0d00 perfhost.exe
normal C:\Windows\SysWOW64\perfhost.exe
0901 - 0d78 GameManagerService.exe
normal C:\Program Files (x86)\Razer\Razer Services\GMS\GameManagerService.exe
0901 - 1028 RazerCentralService.exe
normal C:\Program Files (x86)\Razer\Razer Services\Razer Central\
RazerCentralService.exe
0901 - 10d0 RzKLService.exe
normal C:\Program Files (x86)\Razer\Razer Cortex\RzKLService.exe
0901 - 1100 VpnSvc.exe
normal C:\Program Files\AVAST Software\SecureLine VPN\VpnSvc.exe
0901 - 11d4 svchost.exe
normal C:\Windows\System32\svchost.exe
0901 - 11e8 svchost.exe
normal C:\Windows\System32\svchost.exe
0901 - 1280 SearchIndexer.exe
normal C:\Windows\System32\SearchIndexer.exe
0901 - 10ec aswidsagent.exe
normal C:\Program Files\AVAST Software\Avast\aswidsagent.exe
0901 - 122c svchost.exe
normal C:\Windows\System32\svchost.exe
0901 - 148c Wacom_Tablet.exe
above normal C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe
0901 - 151c unsecapp.exe
normal C:\Windows\System32\wbem\unsecapp.exe
0901 - 17d4 avpui.exe
normal C:\Program Files (x86)\Kaspersky Lab\Kaspersky Free 21.3\avpui.exe
0901 - 1660 AvastUI.exe
normal C:\Program Files\AVAST Software\Avast\AvastUI.exe
0901 - 1648 EpicUpdate.exe
normal C:\Users\Ramesh\AppData\Local\Epic Privacy Browser\Installer\
EpicUpdate.exe
0901 - 0738 GoogleCrashHandler.exe
idle C:\Program Files (x86)\Google\Update\1.3.36.82\GoogleCrashHandler.exe
0901 - 08a4 GoogleCrashHandler64.exe
idle C:\Program Files (x86)\Google\Update\1.3.36.82\
GoogleCrashHandler64.exe
0901 - 1570 WmiPrvSE.exe
normal C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
0901 - 13c8 AvastUI.exe
above normal C:\Program Files\AVAST Software\Avast\AvastUI.exe
0901 - 070c AvastUI.exe
normal C:\Program Files\AVAST Software\Avast\AvastUI.exe
0901 - 0f7c taskhost.exe
below normal C:\Windows\System32\taskhost.exe
0901 - 1868 RazerCortex.exe
normal C:\Program Files (x86)\Razer\Razer Cortex\RazerCortex.exe
0901 - 0bb4 CefSharp.BrowserSubprocess.exe
normal C:\Program Files (x86)\Razer\Razer Cortex\Cef\
CefSharp.BrowserSubprocess.exe
0901 - 19d0 WmiPrvSE.exe
normal C:\Windows\System32\wbem\WmiPrvSE.exe
0901 - 1560 Razer Central.exe
normal C:\Program Files (x86)\Razer\Razer Services\Razer Central\Razer
Central.exe
0901 - 1ba0 CefSharp.BrowserSubprocess.exe
normal C:\Program Files (x86)\Razer\Razer Services\Razer Central\
CefSharp.BrowserSubprocess.exe
0901 - 0d84 CefSharp.BrowserSubprocess.exe
normal C:\Program Files (x86)\Razer\Razer Services\Razer Central\
CefSharp.BrowserSubprocess.exe
0901 - 18a8 PMRunner32.exe
normal C:\Program Files (x86)\Razer\Razer Cortex\PMRunner32.exe
0901 - 07e0 PMRunner64.exe
normal C:\Program Files (x86)\Razer\Razer Cortex\x64\PMRunner64.exe
0901 - 1bd0 taskeng.exe
below normal C:\Windows\System32\taskeng.exe
0901 - 10fc FPSRunner32.exe
normal C:\Program Files (x86)\Razer\Razer Cortex\FPSRunner32.exe
0901 - 1304 FPSRunner64.exe
normal C:\Program Files (x86)\Razer\Razer Cortex\x64\FPSRunner64.exe

----------------------------------
10 - Service
----------------------------------

1001 - Adobe Acrobat Update Service - ["C:\Program Files (x86)\Common Files\Adobe\


ARM\1.0\armsvc.exe"]
1001 - Application Information - [C:\Windows\system32\svchost.exe -k netsvcs]
1001 - aswbIDSAgent - ["C:\Program Files\AVAST Software\Avast\aswidsagent.exe"]
1001 - Windows Audio Endpoint Builder - [C:\Windows\System32\svchost.exe -k
LocalSystemNetworkRestricted]
1001 - Windows Audio - [C:\Windows\System32\svchost.exe -k
LocalServiceNetworkRestricted]
1001 - Avast Antivirus - ["C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
/runassvc]
1001 - Avast Tools - ["C:\Program Files\AVAST Software\Avast\aswToolsSvc.exe"
/runassvc]
1001 - AvastWscReporter - ["C:\Program Files\AVAST Software\Avast\wsc_proxy.exe"
/runassvc /rpcserver]
1001 - Kaspersky Anti-Virus Service 21.3 - ["C:\Program Files (x86)\Kaspersky Lab\
Kaspersky Free 21.3\avp.exe" -r]
1001 - Base Filtering Engine - [C:\Windows\system32\svchost.exe -k
LocalServiceNoNetwork]
1001 - Background Intelligent Transfer Service - [C:\Windows\System32\svchost.exe -
k netsvcs]
1001 - Background Tasks Infrastructure Service - [C:\Windows\system32\svchost.exe -
k DcomLaunch]
1001 - Computer Browser - [C:\Windows\System32\svchost.exe -k netsvcs]
1001 - Cryptographic Services - [C:\Windows\system32\svchost.exe -k NetworkService]
1001 - DCOM Server Process Launcher - [C:\Windows\system32\svchost.exe -k
DcomLaunch]
1001 - Device Association Service - [C:\Windows\system32\svchost.exe -k
LocalSystemNetworkRestricted]
1001 - DHCP Client - [C:\Windows\system32\svchost.exe -k
LocalServiceNetworkRestricted]
1001 - Diagnostics Tracking Service - [C:\Windows\System32\svchost.exe -k utcsvc]
1001 - DNS Client - [C:\Windows\system32\svchost.exe -k NetworkService]
1001 - Diagnostic Policy Service - [C:\Windows\System32\svchost.exe -k
LocalServiceNoNetwork]
1001 - Device Setup Manager - [C:\Windows\system32\svchost.exe -k netsvcs]
1001 - Encrypting File System (EFS) - [C:\Windows\System32\lsass.exe]
1001 - Windows Event Log - [C:\Windows\System32\svchost.exe -k
LocalServiceNetworkRestricted]
1001 - COM+ Event System - [C:\Windows\system32\svchost.exe -k LocalService]
1001 - Function Discovery Provider Host - [C:\Windows\system32\svchost.exe -k
LocalService]
1001 - Function Discovery Resource Publication - [C:\Windows\system32\svchost.exe -
k LocalServiceAndNoImpersonation]
1001 - Windows Font Cache Service - [C:\Windows\system32\svchost.exe -k
LocalService]
1001 - HomeGroup Provider - [C:\Windows\System32\svchost.exe -k
LocalServiceNetworkRestricted]
1001 - Intel(R) HD Graphics Control Panel Service - [C:\Windows\system32\
igfxCUIService.exe]
1001 - IKE and AuthIP IPsec Keying Modules - [C:\Windows\system32\svchost.exe -k
netsvcs]
1001 - IP Helper - [C:\Windows\System32\svchost.exe -k NetSvcs]
1001 - Server - [C:\Windows\system32\svchost.exe -k netsvcs]
1001 - Workstation - [C:\Windows\System32\svchost.exe -k NetworkService]
1001 - TCP/IP NetBIOS Helper - [C:\Windows\system32\svchost.exe -k
LocalServiceNetworkRestricted]
1001 - Local Session Manager - [C:\Windows\system32\svchost.exe -k DcomLaunch]
1001 - Malwarebytes IService - [C:\ProgramData\MB3Install\MBAMIService.exe]
1001 - Microsoft SharePoint Workspace Audit Service - ["C:\Program Files (x86)\
Microsoft Office\Office14\GROOVE.EXE" /auditservice]
1001 - Windows Firewall - [C:\Windows\system32\svchost.exe -k
LocalServiceNoNetwork]
1001 - Network Connection Broker - [C:\Windows\System32\svchost.exe -k
LocalSystemNetworkRestricted]
1001 - Network Connections - [C:\Windows\System32\svchost.exe -k
LocalSystemNetworkRestricted]
1001 - Network List Service - [C:\Windows\System32\svchost.exe -k LocalService]
1001 - Net.Tcp Port Sharing Service - [C:\Windows\Microsoft.NET\Framework64\
v4.0.30319\SMSvcHost.exe]
1001 - Network Location Awareness - [C:\Windows\System32\svchost.exe -k
NetworkService]
1001 - Network Store Interface Service - [C:\Windows\system32\svchost.exe -k
LocalService]
1001 - Office Source Engine - ["C:\Program Files (x86)\Common Files\Microsoft
Shared\Source Engine\OSE.EXE"]
1001 - Office Software Protection Platform - ["C:\Program Files\Common Files\
Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"]
1001 - Program Compatibility Assistant Service - [C:\Windows\system32\svchost.exe -
k LocalSystemNetworkRestricted]
1001 - Performance Counter DLL Host - [C:\Windows\SysWow64\perfhost.exe]
1001 - Plug and Play - [C:\Windows\system32\svchost.exe -k DcomLaunch]
1001 - IPsec Policy Agent - [C:\Windows\system32\svchost.exe -k
NetworkServiceNetworkRestricted]
1001 - Power - [C:\Windows\system32\svchost.exe -k DcomLaunch]
1001 - User Profile Service - [C:\Windows\system32\svchost.exe -k netsvcs]
1001 - Razer Game Manager - ["C:\Program Files (x86)\Razer\Razer Services\GMS\
GameManagerService.exe"]
1001 - RPC Endpoint Mapper - [C:\Windows\system32\svchost.exe -k RPCSS]
1001 - Remote Procedure Call (RPC) - [C:\Windows\system32\svchost.exe -k rpcss]
1001 - Realtek Audio Service - ["C:\Program Files\Realtek\Audio\HDA\
RtkAudioService64.exe"]
1001 - Razer Central Service - ["C:\Program Files (x86)\Razer\Razer Services\Razer
Central\RazerCentralService.exe"]
1001 - RzKLService - ["C:\Program Files (x86)\Razer\Razer Cortex\RzKLService.exe"]
1001 - Security Accounts Manager - [C:\Windows\system32\lsass.exe]
1001 - Task Scheduler - [C:\Windows\system32\svchost.exe -k netsvcs]
1001 - Avast SecureLine VPN - ["C:\Program Files\Avast Software\SecureLine VPN\
VpnSvc.exe"]
1001 - System Event Notification Service - [C:\Windows\system32\svchost.exe -k
netsvcs]
1001 - Shell Hardware Detection - [C:\Windows\System32\svchost.exe -k netsvcs]
1001 - Print Spooler - [C:\Windows\System32\spoolsv.exe]
1001 - SSDP Discovery - [C:\Windows\system32\svchost.exe -k
LocalServiceAndNoImpersonation]
1001 - Windows Image Acquisition (WIA) - [C:\Windows\system32\svchost.exe -k
imgsvc]
1001 - Superfetch - [C:\Windows\system32\svchost.exe -k
LocalSystemNetworkRestricted]
1001 - System Events Broker - [C:\Windows\system32\svchost.exe -k DcomLaunch]
1001 - Themes - [C:\Windows\System32\svchost.exe -k netsvcs]
1001 - Time Broker - [C:\Windows\system32\svchost.exe -k
LocalServiceAndNoImpersonation]
1001 - Distributed Link Tracking Client - [C:\Windows\System32\svchost.exe -k
LocalSystemNetworkRestricted]
1001 - Windows Connection Manager - [C:\Windows\system32\svchost.exe -k
LocalServiceNetworkRestricted]
1001 - Diagnostic Service Host - [C:\Windows\System32\svchost.exe -k LocalService]
1001 - Diagnostic System Host - [C:\Windows\System32\svchost.exe -k
LocalSystemNetworkRestricted]
1001 - Still Image Acquisition Events - [C:\Windows\system32\svchost.exe -k
LocalSystemNetworkRestricted]
1001 - WinHTTP Web Proxy Auto-Discovery Service - [C:\Windows\system32\svchost.exe
-k LocalService]
1001 - Windows Management Instrumentation - [C:\Windows\system32\svchost.exe -k
netsvcs]
1001 - WLAN AutoConfig - [C:\Windows\system32\svchost.exe -k
LocalSystemNetworkRestricted]
1001 - Work Folders - [C:\Windows\System32\svchost.exe -k LocalService]
1001 - Security Center - [C:\Windows\System32\svchost.exe -k
LocalServiceNetworkRestricted]
1001 - Windows Search - [C:\Windows\system32\SearchIndexer.exe /Embedding]
1001 - Wacom Professional Service - ["C:\Program Files\Tablet\Wacom\
WTabletServicePro.exe"]

----------------------------------
12 - Event Log
----------------------------------

1201 - Time : 7/12/2021 22:10:33


1202 - Source : WTabletServicePro

1201 - Time : 7/12/2021 22:10:26


1202 - Source : WTabletServicePro

1201 - Time : 7/12/2021 22:07:50


1202 - Source : MBAMIService
1201 - Time : 7/12/2021 22:07:50
1202 - Source : MBAMIService

1201 - Time : 7/12/2021 22:27:07


1202 - Source : Schannel
1203 - Description : Special privileges assigned to new logon.

Subject:
Security ID: S-1-5-18
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3E7

Privileges: SeAssignPrimaryTokenPrivilege
SeTcbPrivilege
SeSecurityPrivilege
SeTakeOwnershipPrivilege
SeLoadDriverPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeDebugPrivilege
SeAuditPrivilege
SeSystemEnvironmentPrivilege
SeImpersonatePrivilege

1201 - Time : 7/12/2021 22:27:06


1202 - Source : Schannel
1203 - Description : An account was successfully logged on.

Subject:
Security ID: S-1-5-18
Account Name: DOCKFIRST$
Account Domain: WORKGROUP
Logon ID: 0x3E7

Logon Type: 5

Impersonation Level: Impersonation

New Logon:
Security ID: S-1-5-18
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3E7
Logon GUID: {00000000-0000-0000-0000-000000000000}

Process Information:
Process ID: 0x39c
Process Name: C:\Windows\System32\services.exe

Network Information:
Workstation Name: -
Source Network Address: -
Source Port: -

Detailed Authentication Information:


Logon Process: Advapi
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0

This event is generated when a logon session is created. It is generated on the


computer that was accessed.

The subject fields indicate the account on the local system which requested the
logon. This is most commonly a service such as the Server service, or a local
process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common
types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e.
the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation
name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon
session can impersonate.

The authentication information fields provide detailed information about this


specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event
with a KDC event.
- Transited services indicate which intermediate services have participated
in this logon request.
- Package name indicates which sub-protocol was used among the NTLM
protocols.
- Key length indicates the length of the generated session key. This will be
0 if no session key was requested.

1201 - Time : 7/12/2021 22:27:03


1202 - Source : Schannel
1203 - Description : Special privileges assigned to new logon.

Subject:
Security ID: S-1-5-18
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3E7

Privileges: SeAssignPrimaryTokenPrivilege
SeTcbPrivilege
SeSecurityPrivilege
SeTakeOwnershipPrivilege
SeLoadDriverPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeDebugPrivilege
SeAuditPrivilege
SeSystemEnvironmentPrivilege
SeImpersonatePrivilege

1201 - Time : 7/12/2021 22:27:03


1202 - Source : Schannel
1203 - Description : An account was successfully logged on.
Subject:
Security ID: S-1-5-18
Account Name: DOCKFIRST$
Account Domain: WORKGROUP
Logon ID: 0x3E7

Logon Type: 5

Impersonation Level: Impersonation

New Logon:
Security ID: S-1-5-18
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3E7
Logon GUID: {00000000-0000-0000-0000-000000000000}

Process Information:
Process ID: 0x39c
Process Name: C:\Windows\System32\services.exe

Network Information:
Workstation Name: -
Source Network Address: -
Source Port: -

Detailed Authentication Information:


Logon Process: Advapi
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0

This event is generated when a logon session is created. It is generated on the


computer that was accessed.

The subject fields indicate the account on the local system which requested the
logon. This is most commonly a service such as the Server service, or a local
process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common
types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e.
the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation
name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon
session can impersonate.

The authentication information fields provide detailed information about this


specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event
with a KDC event.
- Transited services indicate which intermediate services have participated
in this logon request.
- Package name indicates which sub-protocol was used among the NTLM
protocols.
- Key length indicates the length of the generated session key. This will be
0 if no session key was requested.

1201 - Time : 7/12/2021 22:09:58


1202 - Source : Service Control Manager
1203 - Description : An account was successfully logged on.

Subject:
Security ID: S-1-5-18
Account Name: DOCKFIRST$
Account Domain: WORKGROUP
Logon ID: 0x3E7

Logon Type: 5

Impersonation Level: Impersonation

New Logon:
Security ID: S-1-5-19
Account Name: LOCAL SERVICE
Account Domain: NT AUTHORITY
Logon ID: 0x3E5
Logon GUID: {00000000-0000-0000-0000-000000000000}

Process Information:
Process ID: 0x39c
Process Name: C:\Windows\System32\services.exe

Network Information:
Workstation Name: -
Source Network Address: -
Source Port: -

Detailed Authentication Information:


Logon Process: Advapi
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0

This event is generated when a logon session is created. It is generated on the


computer that was accessed.

The subject fields indicate the account on the local system which requested the
logon. This is most commonly a service such as the Server service, or a local
process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common
types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e.
the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation
name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon
session can impersonate.
The authentication information fields provide detailed information about this
specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event
with a KDC event.
- Transited services indicate which intermediate services have participated
in this logon request.
- Package name indicates which sub-protocol was used among the NTLM
protocols.
- Key length indicates the length of the generated session key. This will be
0 if no session key was requested.

1201 - Time : 7/12/2021 22:09:53


1202 - Source : DCOM
1203 - Description : Special privileges assigned to new logon.

Subject:
Security ID: S-1-5-90-1
Account Name: DWM-1
Account Domain: Window Manager
Logon ID: 0x13150

Privileges: SeAssignPrimaryTokenPrivilege
SeAuditPrivilege

1201 - Time : 7/12/2021 22:08:51


1202 - Source : Service Control Manager
1203 - Description : Special privileges assigned to new logon.

Subject:
Security ID: S-1-5-90-1
Account Name: DWM-1
Account Domain: Window Manager
Logon ID: 0x13132

Privileges: SeAssignPrimaryTokenPrivilege
SeAuditPrivilege
SeImpersonatePrivilege

1201 - Time : 7/12/2021 22:08:49


1202 - Source : Service Control Manager
1203 - Description : An account was successfully logged on.

Subject:
Security ID: S-1-5-18
Account Name: DOCKFIRST$
Account Domain: WORKGROUP
Logon ID: 0x3E7

Logon Type: 2

Impersonation Level: Impersonation

New Logon:
Security ID: S-1-5-90-1
Account Name: DWM-1
Account Domain: Window Manager
Logon ID: 0x13150
Logon GUID: {00000000-0000-0000-0000-000000000000}
Process Information:
Process ID: 0x370
Process Name: C:\Windows\System32\winlogon.exe

Network Information:
Workstation Name: -
Source Network Address: -
Source Port: -

Detailed Authentication Information:


Logon Process: Advapi
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0

This event is generated when a logon session is created. It is generated on the


computer that was accessed.

The subject fields indicate the account on the local system which requested the
logon. This is most commonly a service such as the Server service, or a local
process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common
types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e.
the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation
name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon
session can impersonate.

The authentication information fields provide detailed information about this


specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event
with a KDC event.
- Transited services indicate which intermediate services have participated
in this logon request.
- Package name indicates which sub-protocol was used among the NTLM
protocols.
- Key length indicates the length of the generated session key. This will be
0 if no session key was requested.

1201 - Time : 7/12/2021 22:07:21


1202 - Source : Microsoft-Windows-WLAN-AutoConfig
1203 - Description : An account was successfully logged on.

Subject:
Security ID: S-1-5-18
Account Name: DOCKFIRST$
Account Domain: WORKGROUP
Logon ID: 0x3E7

Logon Type: 2
Impersonation Level: Impersonation

New Logon:
Security ID: S-1-5-90-1
Account Name: DWM-1
Account Domain: Window Manager
Logon ID: 0x13132
Logon GUID: {00000000-0000-0000-0000-000000000000}

Process Information:
Process ID: 0x370
Process Name: C:\Windows\System32\winlogon.exe

Network Information:
Workstation Name: -
Source Network Address: -
Source Port: -

Detailed Authentication Information:


Logon Process: Advapi
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0

This event is generated when a logon session is created. It is generated on the


computer that was accessed.

The subject fields indicate the account on the local system which requested the
logon. This is most commonly a service such as the Server service, or a local
process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common
types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e.
the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation
name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon
session can impersonate.

The authentication information fields provide detailed information about this


specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event
with a KDC event.
- Transited services indicate which intermediate services have participated
in this logon request.
- Package name indicates which sub-protocol was used among the NTLM
protocols.
- Key length indicates the length of the generated session key. This will be
0 if no session key was requested.

1201 - Time : 7/12/2021 22:06:59


1202 - Source : EventLog
1203 - Description : An account was successfully logged on.
Subject:
Security ID: S-1-5-18
Account Name: DOCKFIRST$
Account Domain: WORKGROUP
Logon ID: 0x3E7

Logon Type: 7

Impersonation Level: Impersonation

New Logon:
Security ID: S-1-5-21-373589487-3119867508-454492495-1001
Account Name: Ramesh
Account Domain: DockFirst
Logon ID: 0x3CAFB0B9
Logon GUID: {00000000-0000-0000-0000-000000000000}

Process Information:
Process ID: 0x360
Process Name: C:\Windows\System32\winlogon.exe

Network Information:
Workstation Name: DOCKFIRST
Source Network Address: 127.0.0.1
Source Port: 0

Detailed Authentication Information:


Logon Process: User32
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0

This event is generated when a logon session is created. It is generated on the


computer that was accessed.

The subject fields indicate the account on the local system which requested the
logon. This is most commonly a service such as the Server service, or a local
process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common
types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e.
the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation
name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon
session can impersonate.

The authentication information fields provide detailed information about this


specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event
with a KDC event.
- Transited services indicate which intermediate services have participated
in this logon request.
- Package name indicates which sub-protocol was used among the NTLM
protocols.
- Key length indicates the length of the generated session key. This will be
0 if no session key was requested.

----------------------------------

End of file - 43882 Bytes.

You might also like